Amazon Practice Questions, Discussions & Exam Topics by our Authors
A developer is making changes to a custom application that uses AWS Elastic Beanstalk.
Which solutions will update the Elastic Beanstalk environment with the new app...
Let's go through the options and analyze each based on key factors for AWS Elastic Beanstalk deployment.
A) Package the application code into a zip file. Use the AWS Management Console to upload the .zip file and deploy the packaged application.
- Analysis: This method works by using the AWS Management Console to upload the new application version as a .zip file and deploy it. This is a straightforward option and is often used in cases where a manual deployment is required via the console. It directly updates the environment by deploying the new application.
- Why it's accepted: The AWS Management Console provides a graphical interface that makes it easy for developers to deploy updates to the Elastic Beanstalk environment.
- Limitations: Suitable for smaller, manual deployments but may not be ideal for automating the deployment process, as it requires manual interaction.
B) Package the application code into a .tar file. Use the AWS Management Console to create a new application version from the .tar file. Update the environment by using the AWS CLI.
- Analysis: This involves creating a new application version in the Management Console using the .tar file, then updating the environment via the AWS CLI. The AWS Management Console can be used to create a new version, and the AWS CLI is used for the update.
- Why it's rejected: Although it is possible to update the environment via the AWS CLI after creating the application version, this method is not as straightforward as it introduces an additional step where both the console and CLI are used together, potentially complicating the deployment process.
C) Package the application code into a .tar file. Use the AWS Management Console to upload the .tar file and deploy the packaged application.
- Analysis: This method involves using the AWS Management Console to upload the .tar file directly. The application version is then deployed through the console.
- Why it's accep...
Author: Henry · Last updated Jul 14, 2026
A developer needs to write an AWS CloudFormation template on a local machine and deploy a CloudFormation stack to AWS.
...
To deploy an AWS CloudFormation stack, the developer must interact with AWS services through a tool like the AWS CLI (Command Line Interface). Let's review the options:
A) Install the AWS CLI. Configure the AWS CLI by using an IAM user name and password.
- Analysis: The AWS CLI cannot be configured directly with just an IAM user name and password. AWS CLI requires credentials in the form of access keys, which consist of an access key ID and secret access key, not just a username and password.
- Why it's rejected: This configuration method will not work because the AWS CLI needs access keys to authenticate the requests, and IAM credentials require a pair of access key and secret key, not a username and password.
B) Install the AWS CLI. Configure the AWS CLI by using an SSH key.
- Analysis: SSH keys are used for secure communication with EC2 instances or other SSH-enabled services but are not suitable for authenticating AWS CLI requests.
- Why it's rejected: The AWS CLI cannot use SSH keys for authentication. It specifically requires AWS access keys for interactions with AWS services.
C) Install the AWS CLI. Configure the AWS CLI by using an IAM user access key and secret key.
- Analysis: This is the correct method. When using the AWS ...
Author: RadiantPhoenixX · Last updated Jul 14, 2026
A developer is updating an Amazon API Gateway REST API to have a mock endpoint. The developer wants to update the integration request mapping template so the endpoint will respond to mock integration requests with specific...
To achieve the desired behavior of responding to mock integration requests with specific HTTP status codes based on conditions, we need to modify the Integration Response configuration in API Gateway and set up Mapping Templates appropriately.
Key points for selecting the solution:
- Mock integration in API Gateway allows you to simulate an HTTP response without invoking any backend services.
- Integration Request Mapping Templates are used to map the incoming request data to a format that the backend understands (though, in a mock scenario, this is typically not needed because no backend is invoked).
- Integration Response Mapping Templates are used to format the mock response that API Gateway sends back to the client.
The solution to route the mock integration to return specific status codes based on conditions should be within the Integration Response section, which allows you to set HTTP status codes based on certain conditions, such as request parameters or headers.
Let's analyze the options:
Option A: Use a mock integration with a response status code mapping in the Integration Response. This would involve setting the conditions for the status codes in the mapping template, such as returning `200 OK` for a successful request, or `400` for a bad request, based on the conditions.
- Explanation: This is the correct approach because the mock integration response can be configured to return specific status codes based on conditions. The integration response mapping template allows you to map conditions (like request parameters) to specific status codes and response bodies.
- Scenario: This approach is ideal when you want to simulate different scenarios like success, failure, or any specific condition-driven responses in a mock API.
Option B: Set up an HTTP proxy integration and use a condition in the request mapping te...
Author: Rahul · Last updated Jul 14, 2026
A developer must cache dependent artifacts from Maven Central, a public package repository, as part of an application=E2=80=99s build pipeline. The build pipeline has an AWS CodeArtifact repository where artifacts of the build are published. The developer ne...
To determine the best solution for caching dependent artifacts from Maven Central and minimizing changes to the build pipeline, let's analyze each option carefully.
Option A: Modify the existing CodeArtifact repository to associate an upstream repository with the public package repository.
- Advantages:
- Minimal changes to the build pipeline, since the CodeArtifact repository can be directly configured to pull from the public package repository (Maven Central).
- Associating an upstream repository (like Maven Central) means CodeArtifact will fetch dependencies from the public repository when not found in the local repository, effectively caching them.
- Disadvantages:
- This approach requires modifying the existing repository's configuration but does not require any new repositories or major changes to the build pipeline.
Option B: Create a new CodeArtifact repository that has an external connection to the public package repository.
- Advantages:
- By creating a new repository with an external connection to Maven Central, you can isolate public artifact fetching from the existing CodeArtifact repositories, which may be useful for organizing builds.
- Disadvantages:
- Additional changes to the build pipeline would be required to point to the new repository, which is not ideal since the requirement specifies "minimum changes." You’d also have to update repository configuration in the pipeline to ensure the correct repository is used.
Option C: Create a new CodeArtifact domain that contains a new repository that h...
Author: Jack · Last updated Jul 14, 2026
A developer is creating an AWS Step Functions state machine to handle an order processing workflow. When the state machine receives an order, the state machine pauses until the order has been confirmed. A record that is added to an Amazon DynamoDB table by another service confirm...
In this scenario, the developer is building a workflow where the state machine pauses until the order is confirmed by the addition of a record in a DynamoDB table. Below is a breakdown of the options:
Option A:
- This option uses the GetItem state in Step Functions to periodically check if the record exists in DynamoDB, with a 5-minute delay if the record doesn't exist.
- Why it’s rejected: This approach introduces unnecessary delays (i.e., a 5-minute wait) and does not scale efficiently. The constant polling can also increase the cost and reduce the overall efficiency of the workflow.
Option B:
- This option uses an AWS Lambda function subscribed to the DynamoDB stream. The Lambda function triggers when a new record is added, and upon receiving the record, it uses the redrive execution command to resume the paused state machine.
- Why it’s selected: This is a good approach since it relies on a stream, which is event-driven, ensuring that the state machine proceeds exactly when the record is added. Lambda functions can process records asynchronously and handle the workflow efficiently without introducing delays or additional polling.
- Why other options are rejected: This solution is event-driven and doesn't require constant polling, making it cost-effective and responsive.
Option C:
- This option subscribes an AWS Lambda function to the DynamoDB s...
Author: Lucas Carter · Last updated Jul 14, 2026
A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when...
In this scenario, the goal is to allow only authenticated users to download documents from a private S3 bucket for a limited time of 15 minutes. Let’s analyze the options:
Option A:
- Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
- Why it’s rejected: This option requires duplicating documents into another S3 bucket and implementing a lifecycle policy to delete them after 15 minutes. This is an inefficient approach as it involves unnecessary duplication and does not align with the requirement of limiting access for a specific time period. The lifecycle policy would not control access, only deletion.
Option B:
- Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
- Why it’s selected: This is the most appropriate solution. A presigned URL grants time-limited access to a specific object in an S3 bucket, allowing authenticated users to download the document for a specified duration (15 minutes in this case). The URL is valid only for the time defined in the expiration parameter and provides secure access without needing to change any S3 bucket policies or configurations. It perfectly meets the need for time-limited access to private S3 objects.
Option C:
- Use server-side encryption with AWS KMS managed ke...
Author: Nathan · Last updated Jul 14, 2026
A company is developing a set of AWS Lambda functions to process data. The Lambda functions need to use a common third-party library as a dependency. The library is frequently updated with new features and bug fixes. The company wants to ensure that the Lambda functions always use ...
In this scenario, the company needs to manage a third-party library dependency for multiple Lambda functions, ensuring they always use the latest version of the library in an efficient way. Let’s evaluate each option:
Option A: Store the dependency and the function code in an Amazon S3 bucket.
- Why it’s rejected: Storing the dependency in an S3 bucket requires the Lambda functions to manually download and include the library each time they are invoked. While S3 is reliable for storage, it would require additional logic and potentially cause latency when accessing the latest version of the library. The process of retrieving the dependency from S3 during each invocation adds unnecessary complexity and does not ensure that the Lambda functions always use the latest version automatically.
Option B: Create a Lambda layer that includes the library. Attach the layer to each Lambda function.
- Why it’s selected: This is the most operationally efficient solution. Lambda layers are designed specifically for sharing common code or dependencies across multiple Lambda functions. Once a Lambda layer is created with the latest version of the library, it can be easily updated (for example, by re-deploying the layer with the new version). Each Lambda function can reference the layer, ensuring that all functions are using the latest version without any additional manual steps. Lambda layers are a native and optimized way to handle dependencies across Lambda functions, ensuring minimal overhead and maximum reuse.
Option C: Install the dependency in an Amazon Elastic File System (Amazon EFS) file system. Attach the file system to each Lambda...
Author: RadiantPhoenixX · Last updated Jul 14, 2026
A company hosts applications on premises. The on-premises servers generate audit logs that are available through an HTTP endpoint.
The company needs an automated solution to regularly ingest and store large volumes of audit data from the on-premises servers. The company also needs to...
In this scenario, the company needs an automated and efficient way to regularly ingest large volumes of audit data from on-premises servers, store the data, and perform queries. Let’s evaluate each option:
Option A: Export the audit logs. Upload the logs to Amazon S3. Import the logs to an Amazon RDS DB instance.
- Why it’s rejected: While storing logs in Amazon S3 is efficient for large volumes of data, importing the logs into an Amazon RDS database adds unnecessary complexity. RDS is a relational database service and may not be the best fit for efficiently querying large volumes of raw log data. Additionally, the process of importing logs into RDS requires manual intervention or custom automation, which may not be as operationally efficient as other solutions. Also, RDS incurs additional costs for database provisioning and scaling.
Option B: Create an AWS Lambda function to call the HTTP endpoint to fetch audit logs. Configure an Amazon EventBridge scheduled rule to invoke the Lambda function. Configure the Lambda function to push the logs to AWS CloudTrail Lake.
- Why it’s rejected: While AWS Lambda and EventBridge are good for automation, AWS CloudTrail Lake is primarily used for logging and auditing AWS service activity, not for ingesting and querying general application logs. This solution might not align with the specific use case of storing large volumes of audit logs from on-premises servers, and it would also require significant customization to handle the logs appropriately.
Option C: Use AWS DataSync to transfer audit logs to an Amazon S3 bucket. Load the logs into an Amazon S3 bucket. Use Amazon Athena to query the bucket.
- Why it’s selected: This is the most operationally efficient solution. AWS DataSync is designed to automate the transfer of large volumes o...
Author: Jack · Last updated Jul 14, 2026
A developer is building an application that includes an AWS Lambda function that is written in .NET Core. The Lambda function=E2=80=99s code needs to interact with Amazon DynamoDB tables and Amazon S3 buckets. The developer must minimize the Lambda ...
To meet the requirements of minimizing Lambda function deployment time and invocation duration while ensuring that it interacts with Amazon DynamoDB tables and Amazon S3 buckets, we need to analyze each option in terms of performance, cost, and suitability for .NET Core Lambda functions.
Option A: Increase the Lambda function’s memory
- Reasoning: Increasing memory in a Lambda function can speed up its execution by giving it more CPU power (since CPU is tied to memory in AWS Lambda). However, this does not directly address the problem of minimizing the deployment time or invocation duration with respect to the inclusion of the AWS SDK for .NET, which is the main issue in the given scenario. Increasing memory could improve execution speed, but it doesn't solve the problem of large SDK packages or slow download times.
- Rejected: This option doesn't directly minimize deployment time or the need for specific SDK modules required to interact with DynamoDB and S3.
Option B: Include the entire AWS SDK for .NET in the Lambda function’s deployment package
- Reasoning: This approach would involve bundling the entire AWS SDK for .NET into the Lambda deployment package. While this guarantees that the function has all the necessary modules to interact with AWS services, it significantly increases the size of the deployment package, which leads to longer deployment times and slower invocations (as it would take more time to load the entire SDK at runtime).
- Rejected: This option is inefficient because it increases both the deployment size and the Lambda startup time, which goes against the goal of minimizing both.
Option C: Include onl...
Author: Olivia · Last updated Jul 14, 2026
A development team has an Amazon API Gateway REST API that is backed by an AWS Lambda function.
Users have reported performance issues for the Lambda function. The development team identified the source of the issues as a cold start of the Lambda function. The development t...
To reduce the time needed for the Lambda function to initialize and address the cold start issue, we need to understand how cold starts occur and how to mitigate them effectively. Cold starts happen when a Lambda function is invoked for the first time or after it has been idle for a while, which causes the Lambda runtime to initialize the function, including loading dependencies and setting up the execution environment.
Option A: Change the Lambda concurrency to reserved concurrency
- Reasoning: Reserved concurrency guarantees a specific number of function instances, but it does not directly address cold starts. It ensures that a fixed number of Lambda instances are always available, but if a cold start happens, it still occurs within those instances. This setting would be useful in preventing the Lambda function from running out of available instances under high load, but it doesn't impact the time it takes for the Lambda to initialize when it's first invoked.
- Rejected: This option doesn't reduce cold start times, as it doesn't affect function initialization or reduce latency during the cold start process.
Option B: Increase the timeout of the Lambda function
- Reasoning: Increasing the timeout allows the Lambda function to run for a longer period before timing out. While this might help if the Lambda function is running into timeouts during long executions, it does nothing to reduce the time spent on initialization (cold starts). Increasing the timeout can give the function more time to execute, but it does not address the root cause of cold start delays.
- Rejected: This option is irrelevant to cold start performance since it does not speed up initialization or reduce the ...
Author: Chloe · Last updated Jul 14, 2026
A video streaming company has a pipe in Amazon EventBridge Pipes that uses an Amazon Simple Queue Service (Amazon SQS) queue as an event source. The pipe publishes all source events to a target EventBridge event bus. Before events are published, the pipe uses an AWS Lambda function to retrieve the stream status of each event from a database and adds the stream status to each source e...
In this scenario, the goal is to ensure that the pipe in Amazon EventBridge Pipes only publishes events to the event bus when the video stream status is "ready." Let's analyze each option:
Option A: Add a filter step to the pipe that will match on a stream status of ready
- Reasoning: A filter step within the EventBridge Pipe can be used to filter events based on specific criteria, such as the stream status being "ready." The filter would evaluate each event before passing it to the target EventBridge event bus. This approach is a direct and efficient way to ensure that only events with a stream status of "ready" are published.
- Selected: This option is the most appropriate because it directly filters the events in the pipe based on the stream status, before publishing to the target event bus.
Option B: Update the Lambda function to return only video streams that have a status of ready
- Reasoning: The Lambda function could be updated to return only events with a "ready" status, thereby ensuring that only such events are passed forward. However, this approach requires modifying the Lambda function logic and may be less flexible than the filter approach in the pipe, especially if you later want to add additional filtering logic or modify the stream status criteria. Additionally, you would still need to handle event routing based on stream status at the source.
- Rejected: This option is less efficient and requires more changes to the Lambda function. The filter in the pipe is a cleaner solution.
Option C: Include a filter for a status of ready in a...
Author: Maya2022 · Last updated Jul 14, 2026
A developer needs to build a workflow to handle messages that are sent to an Amazon Simple Queue Service (Amazon SQS) queue. When a message reaches the queue, the workflow must implement a delay before invoking an AWS Lambda function to pro...
To build a workflow where a delay occurs before an AWS Lambda function processes messages from an Amazon SQS queue, we need to focus on solutions that are both efficient and easy to manage. Let's analyze each option:
Option A: Create an AWS Step Functions state machine to process the SQS queue. Use a Wait state to delay the Lambda function's processing for the required number of seconds after message delivery to the SQS queue. Use Amazon EventBridge to invoke the state machine every 5 minutes.
- Reasoning: This solution involves setting up an AWS Step Functions state machine and using a Wait state to delay processing. While this approach is flexible and provides good control over workflows, it introduces additional complexity by requiring the use of Step Functions and EventBridge. EventBridge triggers the state machine periodically, adding more overhead and operational cost.
- Rejected: This is overly complex for the requirement of simply delaying Lambda invocation. It introduces unnecessary components (Step Functions, EventBridge) for what could be handled by simpler configurations.
Option B: Configure the Lambda function to poll the SQS queue. Update the Lambda code to republish each message with a custom attribute that contains a future time when the message should be fully processed. Update the Lambda code to fully process messages when the custom attribute's future time has passed.
- Reasoning: This solution involves custom logic in the Lambda function itself, where the Lambda would republish the message with a custom attribute to control processing delay. This introduces additional complexity by requiring the Lambda function to manage timing, message republishing, and conditionally processing based on the custom attribute. It also increases the chances of errors or inefficiencies due to the complexity of managing custom message attributes and republishing.
- Rejected: This option is inefficient, as it involves extra work and custom code to manage the delay logic. It's more prone to failure due ...
Author: Kai99 · Last updated Jul 14, 2026
A company is building an application to accept data from customers. The data must be encrypted at rest and in transit.
The application uses an Amazon API Gateway API that resolves to AWS Lambda functions. The Lambda functions store the data in an Amazon Aurora MySQL DB cluster. The application worked properly during testing.
A developer configured an Amazon CloudFront distribution with field-level encryption that uses an AWS Key Management Service (AWS KMS) key. After the configuration of the distribution, the application behaved unexpectedly. All th...
To address the issue where the data in the database is being stored as ciphertext due to CloudFront's field-level encryption, we need to focus on ensuring the data is decrypted before it reaches the Lambda function for storage in the database. Let's evaluate each option:
Option A: Change the CloudFront Viewer protocol policy from "HTTP and HTTPS" to "HTTPS only."
- Reasoning: The CloudFront Viewer protocol policy governs how CloudFront communicates with clients, specifying whether it supports both HTTP and HTTPS or only HTTPS. This setting does not affect how data is encrypted or decrypted during the communication between CloudFront and the backend Lambda function. It also does not impact how the data is processed by the Lambda function or stored in the database.
- Rejected: This option does not address the problem of the data being stored as ciphertext in the database. Changing the protocol policy does not solve the encryption/decryption issue.
Option B: Add a Lambda function that uses the KMS key to decrypt the data fields before saving the data to the database.
- Reasoning: This is a good solution. Since the CloudFront field-level encryption uses a KMS key to encrypt the data before it is sent to the Lambda function, the Lambda function will need to decrypt the data using the same KMS key before saving it to the Aurora MySQL DB. This ensures that the data is decrypted before storage and prevents the ciphertext from being saved in the database.
- Selected: This solution directly addresses the issue of ciphertext being stored in the database. It ensures proper decryption of the data before it is saved, which is exac...
Author: IronLion88 · Last updated Jul 14, 2026
A company offers a business-to-business software service that runs on dedicated infrastructure deployed in each customer=E2=80=99s AWS account. Before a feature release, the company needs to run integration tests on real AWS test infrastructure. The test infrastructure consists of Amazon EC2 instances and an Amazon RDS database.
A developer must set up a continuous delivery process that will provision the test infr...
Evaluation of Options
A) Use AWS CodeDeploy with AWS CloudFormation StackSets to deploy the infrastructure. Use Amazon CodeGuru to run the tests.
- AWS CloudFormation StackSets: This option can deploy infrastructure across multiple AWS accounts, which is a suitable choice for provisioning infrastructure in different environments.
- AWS CodeDeploy: Primarily designed for deploying applications across EC2 instances, it’s more suitable for managing code deployment, not specifically for running integration tests.
- Amazon CodeGuru: It is a tool for code review and analysis to improve code quality, not specifically designed for running integration tests.
Reason for rejection: CodeDeploy and CodeGuru are not suited for running integration tests on infrastructure and do not align well with the task of testing features after provisioning.
B) Use AWS CodePipeline with AWS CloudFormation StackSets to deploy the infrastructure. Use AWS CodeBuild to run the tests.
- AWS CodePipeline: A fully managed continuous delivery service that helps automate the release process. It integrates well with other AWS services, including CodeBuild.
- AWS CloudFormation StackSets: Can deploy infrastructure in multiple AWS accounts. This matches the requirement for provisioning infrastructure in different AWS environments.
- AWS CodeBuild: A service that can compile code, run tests, and produce artifacts. It is well-suited for running integration tests.
Reason for selection: CodePipeline automates the entire process from deploying infrastructure using CloudFormation StackSets to running integration tests with CodeBuild. This solution minimizes administrative overhead and aligns well with the requirements of continuous deli...
Author: Alexander · Last updated Jul 14, 2026
A developer is creating an application that uses an AWS Lambda function to transform and load data from an Amazon S3 bucket. When the developer tests the application, the developer finds that some invocations of the Lambda function are slower than others.
The developer needs to update the Lambda function to have predictable invocation durations that run with low latency. Any initialization activities, such as loading libra...
Evaluation of Options
A) Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.
- Amazon EventBridge Scheduler: It is used to run scheduled tasks and does not directly impact the duration or latency of Lambda invocations. Scheduling tasks doesn't address the issue of variability in invocation times or the initialization behavior of the Lambda function.
Reason for rejection: This option doesn’t relate to optimizing Lambda function execution times or controlling initialization overhead. It's better suited for managing scheduled events rather than optimizing performance.
B) Configure provisioned concurrency for the Lambda function to have the necessary number of execution environments.
- Provisioned Concurrency: Provisioned concurrency ensures that a specified number of execution environments are pre-warmed and ready to handle invocations immediately. This eliminates cold starts by ensuring that the Lambda function is always prepared to run, which directly addresses variability in invocation times and initialization delays. This is critical for achieving predictable, low-latency invocation times.
Reason for selection: This is the most suitable solution to ensure predictable invocation times with low latency, as it ensures Lambda functions are always pre-warmed and ready for fast execution, avoiding initialization delays during function invocation.
C) Use the $LATEST version of the Lambda function.
- $LATEST version: This is the default version for Lambda functions during development, but using it doesn't inherently impact latency or initialization times. It does not guarantee pre-warming of Lambda functions or any improvement in invocation speed.
Reason for rejection: While using the latest versi...
Author: NebulaEagle11 · Last updated Jul 14, 2026
A developer created an AWS Lambda function named ProcessMessages. The Lambda function is invoked asynchronously when a message is published to an Amazon Simple Notification Service (Amazon SNS) topic named InputTopic. The developer uses a second SNS topic named ErrorTopic to handle alerts of failures for other services.
The developer wants to receive not...
Evaluation of Options
A) Configure a subscription for the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the ProcessMessages Lambda function as the endpoint.
- Subscription and Filter Policy: You can configure an SNS subscription to another SNS topic (like `ErrorTopic`) and filter specific messages. However, SNS does not provide an automatic mechanism to filter failure events related to the Lambda function directly. It cannot filter Lambda function failures by default.
Reason for rejection: This approach doesn't work for capturing the failure events of the Lambda function, because SNS can't directly determine if the Lambda function failed or succeeded just by subscribing to the ErrorTopic with a filter policy.
B) Configure a failure destination for the ProcessMessages Lambda function. Specify the Amazon Resource Name (ARN) of the ErrorTopic SNS topic as the destination ARN.
- Failure Destination: When Lambda functions fail asynchronously, you can configure a failure destination to automatically forward failed events to another service, such as another SNS topic, SQS queue, or Lambda function.
- Error Handling: This setup allows failed Lambda executions to trigger notifications to `ErrorTopic` without additional configuration. This is a built-in feature of Lambda's asynchronous invocation model.
Reason for selection: This option meets the requirement because it enables you to send notifications directly to the `ErrorTopic` SNS topic when the Lambda function fails to process a message, using Lambda’s built-in failure destination configuration.
C) Configure a trigger for the ProcessMessages Lambda function. Specify the ErrorTopic SNS topic as the trigger topic. Configure a filter policy on the topic for failures.
- Trigger ...
Author: Aarav · Last updated Jul 14, 2026
A company has an Amazon DynamoDB table that contains records of users that have signed up for a trial of the company=E2=80=99s product. The company is using a spreadsheet to track data about the product trial. The company needs to ensure the spreadsheet is automatically updated with t...
Evaluation of Options
A) Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to old image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
- DynamoDB Accelerator (DAX): DAX is a caching service that improves read performance for DynamoDB, but it doesn't have native support for event-driven updates such as triggering updates when items in DynamoDB change. It's more about speeding up read operations rather than responding to changes in data.
- Old Image: The "old image" view type would show the data as it was before an update, which may not be ideal for tracking current states of records such as trial statuses.
Reason for rejection: DAX isn't designed to handle event-driven use cases like updating a spreadsheet automatically. Additionally, subscribing Lambda to DAX is not a valid architecture for monitoring and responding to DynamoDB changes.
B) Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to new image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
- DAX and New Image: While setting the view type to "new image" could give you the current state of items, as mentioned earlier, DAX doesn't work in an event-driven manner. It's more of a caching solution and cannot provide direct integration with event streams to update a spreadsheet.
Reason for rejection: DAX still isn't suited for the task of monitoring changes in DynamoDB and automatically updating the spreadsheet. Lambda needs to be triggered by events, not by cached data from DAX.
C) Enable a DynamoDB stream for the table. Set the view type to new image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
- DynamoDB Streams: DynamoDB Streams c...
Author: Liam · Last updated Jul 14, 2026
A developer is launching a global application that delivers content to multiple countries. The developer needs to serve specific content based on the country of each user and each user=E2=80=99s primary language. The developer must ensur...
Let's break down the options and consider the key factors: content delivery, low latency, country/language-specific content, and reliability.
Option A: Create an Amazon API Gateway REST API. Create an AWS Global Accelerator standard accelerator to resolve requests to the API. Configure endpoint groups on the accelerator. Attach listeners for each country and language.
- Advantages: AWS Global Accelerator is designed to improve the availability and performance of applications globally. It directs traffic to the closest AWS region, improving latency. The API Gateway helps with managing REST APIs effectively, while Global Accelerator can route requests based on geographic locations.
- Limitations: While Global Accelerator improves latency, configuring listeners for both country and language-specific content could be complex and may not perfectly fit the developer's need for content targeting based on country and language.
- Best Use Case: If there is a need to serve APIs globally with high availability and routing traffic efficiently across AWS regions.
Option B: Store the content in a centralized Amazon S3 bucket. Enable S3 Transfer Acceleration on the bucket. Create an Amazon Route 53 hosted zone that includes the endpoint for the S3 bucket. Create records in Route 53 that use geoproximity and geolocation routing policies.
- Advantages: Storing content in S3 is reliable and scalable. S3 Transfer Acceleration speeds up content delivery by routing through AWS edge locations. Geoproximity and geolocation routing in Route 53 help direct users to the nearest AWS region based on location.
- Limitations: While geolocation routing works for country-based content, it doesn't consider user language preferences as directly as needed. Additionally, this solution may have complexity with routing content at a detailed level of language (Accept-Language header).
- Best Use Case: For serving static content that can be geographically and language-targeted without much dynamic processing.
Option C: Create...
Author: Ethan · Last updated Jul 14, 2026
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company=E2=80=99s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notificatio...
Let’s analyze the options step-by-step based on the key requirements:
1. Notify the security team 90 days before a certificate expires.
2. The company uses AWS Certificate Manager (ACM) for managing SSL certificates.
3. The security team is notified via an SNS topic with an email address as a subscriber.
4. The company has already configured Amazon SQS and SNS for notification delivery.
Option A: Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rules target.
- Advantages: Amazon EventBridge provides an event-driven mechanism to respond to specific events, including certificate expiration. ACM can emit events like "Certificate Approaching Expiration" that EventBridge can capture. This rule can directly notify via SNS when the certificate approaches expiration.
- Limitations: This solution is highly aligned with the use case. However, it doesn’t explicitly mention the 90-day lead time, so EventBridge would need the correct configuration of thresholds for certificate expiration events.
- Best Use Case: This is an ideal option for handling certificate expiration notifications. EventBridge can provide targeted event handling, and SNS can notify the security team easily.
Option B: Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
- Advantages: Lambda is a flexible, serverless compute service that could be used to automate the search for expiring certificates and post them to SQS. This can be tailored for a custom solution if needed.
- Limitations: This approach introduces more complexity because the Lambda function would need to query ACM periodically, handle filtering for certificates expiring within 90 days, and then post messages to SQS. It also doesn’t directly integrate with SNS, which would require additional steps to notify the security team.
- Best Use Case: Useful for custom use cases but overcomplicates the process of notifying based on certificate expiration events. Not the most efficient option.
Option C: Create an AWS Step Function...
Author: RadiantJaguar56 · Last updated Jul 14, 2026
A developer has an AWS Lambda function that needs to access an Amazon DynamoDB table named DailyOrders. The Lambda function must be able to perform read operations on the table. The Lambda function must not be able to perform write operations on the table.
The developer needs to create an ...
To meet the requirements of allowing the Lambda function to perform read operations (like `GetItem`, `Query`, and `Scan`) on an Amazon DynamoDB table named `DailyOrders` while denying write operations (like `PutItem`, `UpdateItem`, and `DeleteItem`), we need to create an IAM policy with permissions for the specific read actions and explicitly deny the write actions.
Let's evaluate each potential policy statement:
Option A:
```json
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:Query",
"dynamodb:Scan"
],
"Resource": "arn:aws:dynamodb:<region>:<account-id>:table/DailyOrders"
}
```
- Explanation: This policy allows the Lambda function to perform read operations (`GetItem`, `Query`, and `Scan`) on the `DailyOrders` table. The `Resource` specifies the exact table, ensuring that the Lambda function only has access to that table.
- Reason for selection: This policy meets the requirement for allowing only read operations on the `DailyOrders` table. Since no write actions are included, the Lambda function cannot perform any write operations.
Option B:
```json
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem"
],
"Resource": "arn:aws:dynamodb:<region>:<account-id>:table/DailyOrders"
}
```
- Explanation: This policy allows write operations (`PutItem`, `UpdateItem`, and `DeleteItem`) on the `DailyOrders` table. However, the requirement is that the Lambda function should not be able to perform write operations.
- Rejection reason: This policy explicitly allows write operations, which contradicts the requirement of restricting the Lambda function to only read operations.
...
Author: Ava · Last updated Jul 14, 2026
A developer is working on a new authorization mechanism for an application. The developer must create an Amazon API Gateway API and must test JSON Web Token (JWT) authorization on the API.
The developer must use the built-in authorizer and must avoid managing the code with custom logic. The developer needs t...
Let's break down the requirements and analyze the options.
Key Requirements:
- Use API Gateway: The solution involves creating an API using Amazon API Gateway.
- JWT Authorization: The developer must test JWT authorization, using the built-in JWT authorizer (not a custom Lambda authorizer).
- No Custom Logic: The solution should avoid managing custom logic, meaning the built-in JWT authorizer should be used.
- Define a Route for Testing: The API should have an `/auth` route to test the authorizer configuration.
Analysis of Options:
Option A: Create a WebSocket API and the /auth route. Configure and attach the JWT authorizer to the API. Deploy the API.
- Explanation: A WebSocket API is designed for long-lived, two-way communication between the client and the server, primarily used for use cases such as real-time applications.
- Why it’s not suitable: JWT authorization is typically used for HTTP-based APIs, not WebSocket APIs. While you could configure JWT authorization on a WebSocket API, this is not the correct scenario for testing JWT-based authorization for general APIs.
- Best Use Case: WebSocket APIs are better suited for real-time communication (e.g., chat applications), not for testing simple authorization like JWT.
Option B: Create a WebSocket API and the /auth route. Create and configure an AWS Lambda authorizer. Attach the Lambda authorizer to the API. Deploy the API.
- Explanation: This option uses a Lambda authorizer (custom logic) instead of the built-in JWT authorizer, which goes against the requirement to avoid managing custom logic.
- Why it’s not suitable: Since the goal is to avoid managing custom code, this solution doesn’t meet the requirement to use a built-in JWT authorizer.
- Best Use Case: Suitable if you want a more flexible or custom authentication mechanism t...
Author: Ava · Last updated Jul 14, 2026
A company is creating a new application that gives users the ability to upload and share short video files. The average size of the video files is 10 MB. After a user uploads a file, a message needs to be placed into an Amazon Simple Queue Service (Amazon SQS) queue so the file can be processed. The ...
Analysis of Requirements:
1. Users need to upload and share short video files: The files are 10 MB in size, so the solution must handle moderate file sizes efficiently.
2. Message needs to be placed in SQS queue: After a file is uploaded, a message with the file location must be placed into SQS for further processing.
3. Files need to be accessible for processing within 5 minutes: The solution should ensure that files are readily available for processing soon after they are uploaded.
4. Cost-effectiveness: The solution should minimize costs while meeting the above requirements.
Evaluation of Options:
Option A: Write the files to Amazon S3 Glacier Deep Archive. Add the S3 location of the files to the SQS queue.
- Explanation: Amazon S3 Glacier Deep Archive is a storage class designed for long-term archiving of data that is rarely accessed. Retrieval from Glacier Deep Archive can take several hours to a day, which makes it unsuitable for files that need to be processed within 5 minutes.
- Why it's not suitable: The retrieval time for Glacier Deep Archive is not in line with the requirement of accessing files within 5 minutes, making this option slow and unsuitable for the use case.
- Best Use Case: Long-term archival of rarely accessed data, not for time-sensitive processing.
Option B: Write the files to Amazon S3 Standard. Add the S3 location of the files to the SQS queue.
- Explanation: Amazon S3 Standard is a storage class designed for frequent access and provides low-latency, high-throughput access to data. S3 objects stored in the Standard class are readily available and can be accessed almost immediately.
- Why it’s suitable: Files stored in S3 Standard can be processed quickly and are accessible within the required 5-minute timeframe. The S3 location can be added to the SQS message, allowing the file to be processed efficiently.
- Best Use Case: Storing frequently accessed data that needs to...
Author: Ravi Patel · Last updated Jul 14, 2026
A developer is updating the code for an AWS Lambda function to add new capabilities. The Lambda function has version aliases for production and development environments that run separate versions of the function. The developer needs to configure a staging environment for the Lambda function to...
To meet the requirement of configuring a staging environment for the AWS Lambda function to handle invocations to both the development version and the production version, let's analyze each option.
A) Create a weighted alias that references the production version of the function and the updated version of the function.
- Explanation:
- This is a standard AWS approach for managing versions of Lambda functions, allowing you to create an alias that can route traffic to different Lambda versions based on a weighted distribution.
- This solution would allow you to route traffic between different Lambda versions (e.g., production and updated versions) to achieve the staging environment.
- Why selected: Weighted aliases are great for canary releases, blue-green deployments, and testing versions in parallel. In this case, you can split traffic between the production and the updated version of the Lambda function, helping test the new version while maintaining the old one as fallback.
B) Add a Network Load Balancer. Add the production version of the function and updated version of the function as targets.
- Explanation:
- A Network Load Balancer (NLB) is typically used for managing traffic to EC2 instances, containers, or IP addresses. Lambda functions are invoked via the AWS Lambda API, not over the network in the traditional sense.
- Why rejected: Lambda functions...
Author: NebulaEagle11 · Last updated Jul 14, 2026
A developer has implemented an AWS Lambda function that inserts new customers into an Amazon RDS database. The function is expected to run hundreds of times each hour. The function and RDS database are in the same VPC. The function is configured to use 512 MB of RAM and is based on the following pseudo code:
After successfully testing the f...
Author: Kunal · Last updated Jul 14, 2026
A developer is troubleshooting the permissions of an application that needs to make changes to an Amazon RDS database. The developer has access to the IAM role that the application is using....
To troubleshoot the permissions of an IAM role associated with an application that interacts with an Amazon RDS database, let's evaluate each option:
A) aws sts assume-role
- Explanation:
- The `aws sts assume-role` command allows the user or application to assume an IAM role and obtain temporary security credentials for that role. This would be useful if the developer wants to test the permissions granted by the IAM role directly by assuming it and then performing operations.
- Why selected: This command would allow the developer to simulate the permissions of the application’s IAM role. By assuming the role, the developer can test whether the role has the required permissions to interact with RDS (or any other services), which is essential in troubleshooting the permissions.
B) aws iam attach-role-policy
- Explanation:
- This command is used to attach an IAM policy to an IAM role. While it is useful for modifying permissions, it is not meant for testing or troubleshooting permissions. It is a configuration action, not a diagnostic action.
- Why rejected: This option is not for testing the permissions of the existing role. It would only be useful if the developer needs to attach additional policies to t...
Author: Sophia · Last updated Jul 14, 2026
A gaming company has deployed a web portal on AWS Elastic Beanstalk. The company sometimes needs to deploy new versions three or four times in a day. The company needs to deploy new features for all users as quickly as possible. The solution must ...
To meet the requirements of deploying new features quickly with minimal performance impact and maximum availability, let's analyze each option:
A) Use a rolling deployment policy to deploy to Amazon EC2 instances.
- Explanation:
- A rolling deployment updates a few instances at a time, gradually replacing the old version of the application with the new one. This approach minimizes the number of instances that are unavailable during the deployment.
- Why rejected: Although this option provides a balance between availability and deployment speed, it may still result in some performance degradation during the deployment process, as a portion of instances will be unavailable at any given time. It is not the fastest approach for continuous deployment of new features multiple times a day.
B) Use an immutable deployment policy to deploy to Amazon EC2 instances.
- Explanation:
- An immutable deployment creates a new environment with the new version of the application and switches traffic to the new environment once it is fully deployed. The old environment remains running until the new one is fully functional and serving traffic.
- Why selected: Immutable deployments ensure zero-downtime deployments, as there is no risk of affecting already running instances during the update process. This approach ensures high availability and can be useful for fast feature rollouts with minimal risk. While the deployment is slower than all-at-onc...
Author: Vivaan · Last updated Jul 14, 2026
An AWS Lambda function generates a 3 MB JSON file and then uploads it to an Amazon S3 bucket daily. The file contains sensitive information, so the developer must ensure that it is encrypted before uploading to the bucket.
Which of the following mo...
To ensure that the 3 MB JSON file generated by the AWS Lambda function is encrypted before uploading it to the S3 bucket, let's evaluate the options provided:
A) Use the default AWS Key Management Service (AWS KMS) key for Amazon S3 in the Lambda function code.
- Explanation:
- By default, Amazon S3 uses an AWS-managed KMS key for encrypting objects (SSE-S3). If you specify this in the Lambda function code, it will automatically use the default KMS key for encryption.
- Why rejected: This option does not provide flexibility if the developer wants to control the encryption process directly or use a specific key. While it ensures encryption, the developer may need more control over key management and encryption behavior, which isn't provided by the default key.
B) Use the S3 managed key and call the GenerateDataKey API to encrypt the file.
- Explanation:
- S3 Managed Keys (SSE-S3) are automatically managed by Amazon S3 and don’t require the developer to call the `GenerateDataKey` API. The `GenerateDataKey` API is used for more granular control over encryption and is typically needed when using AWS KMS customer-managed keys (SSE-KMS), not S3 managed keys.
- Why rejected: This approach doesn't require the `GenerateDataKey` API because S3 managed keys automatically handle encryption for you. The `GenerateDataKey` API is unnecessary for this case.
C) Use the GenerateDataKey API, then use that data key to encrypt the file in the Lambda function code.
- Explanation:
- The `GenerateData...
Author: Max · Last updated Jul 14, 2026
A company is building a social media application. A developer is modifying an AWS Lambda function that updates a database with data that tracks each user's online activity. A web application server uses the AWS SDK to invoke the Lambda function.
The developer has tested the new Lambda code and is ready to deploy the code into production. However, the d...
To address the developer's requirement of allowing only a small percentage of invocations to invoke the new Lambda code, we need to carefully analyze each option based on the use case, AWS architecture, and functionality:
A) Configure a Lambda version that has a specific weight value for the updated Lambda function.
- Analysis: This approach is the simplest solution. AWS Lambda supports versioning, and once you publish a new version of the Lambda function, you can associate a weight value with the version to control the traffic distribution. This weight determines the percentage of invocations that go to the new version versus the old version. By setting a specific weight value (e.g., 10%), only 10% of invocations would trigger the updated Lambda code.
- Reason for selection: This solution is directly designed for traffic splitting between Lambda versions and is easy to configure. It also eliminates the need for extra infrastructure (like load balancers), making it a streamlined choice for this use case.
B) Create an alias for the Lambda function. Configure a specific weight value for the updated version.
- Analysis: Similar to option A, but using an alias. An alias acts as a pointer to a specific version of a Lambda function. You can configure an alias with a weight value, which can route a certain percentage of invocations to a particular version of the Lambda function.
- Reason for rejection: This option is still a viable solution, as it allows traffic distribution, but it adds an extra layer (the alias) on top of versioning, which may not be necessary for this straightforward scenario. It adds complexity without providing additional value in this case. Option A provides the same functionality in a simpler manner.
C) Create an Application Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda ...
Author: Maya · Last updated Jul 14, 2026
An Amazon Data Firehose delivery stream is receiving customer data that contains personally identifiable information. A developer needs to remove pattern-based customer identifiers from the data and store the modif...
Let's analyze each option based on the use case, cost-effectiveness, ease of implementation, and performance:
A) Implement Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream.
- Analysis: This option leverages Firehose's native data transformation feature using AWS Lambda, which allows you to process and modify data as it flows through the delivery stream. The Lambda function can be written to remove the customer identifiers from the data and directly pass the transformed data to an Amazon S3 bucket.
- Reason for selection: This is the most efficient and straightforward solution. AWS Lambda is built for such lightweight transformations and is easily integrated with Amazon Kinesis Firehose. This solution is cost-effective and highly scalable, as Lambda functions can handle a large number of data transformations without significant overhead.
B) Launch an Amazon EC2 instance. Set the EC2 instance as the destination of the delivery stream. Run an application on the EC2 instance to remove the customer identifiers. Store the transformed data in an Amazon S3 bucket.
- Analysis: This option involves using an EC2 instance to act as the destination for the Firehose delivery stream. You would need to configure and maintain the EC2 instance, including deploying an application to handle the data transformation and then forward it to an S3 bucket.
- Reason for rejection: While this solution can work, it is less efficient and more complex than option A. Running and maintaining an EC2 instance introduces operational overhead, and the solution lacks the scalability and seamless integration that Lambda offers. It also adds cost for the EC2 instance, which could be avoided by using Lambda.
C) Create an Amazon OpenSearch Service instance. Set the OpenSearch Service instance as the destination of the delivery stream. Use search and replace to remove the customer identifiers. Export the data to an Amazon S3 bucket.
- Analysis: Amazon OpenSearch Service (formerly Elasticsearch) is designed for searc...
Author: Aria · Last updated Jul 14, 2026
A developer is building a three-tier web application that should be able to handle a minimum of 5000 requests per minute. Requirements state that the web tier should be completely stateless while the application maintains session state...
Let’s evaluate each option based on factors such as performance, scalability, latency, and simplicity, in line with the requirements of handling a minimum of 5000 requests per minute while keeping latency as low as possible.
A) Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.
- Analysis: Amazon RDS (Relational Database Service) is a fully managed database service. While RDS is highly available and can scale to handle large amounts of data, databases like RDS typically introduce higher latency for session management due to disk I/O operations and the overhead of relational database management.
- Reason for rejection: Storing session data in RDS would lead to higher latency compared to other solutions like in-memory caching, and it is not the most efficient way to store session data. RDS is optimized for transactional data, not for frequent, low-latency operations required for session management.
B) Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.
- Analysis: A shared file system, such as Amazon EFS (Elastic File System), could be used to store session data, allowing multiple EC2 instances to access the same files. However, file-based storage typically has higher latency compared to in-memory data stores. Using a file system for session data would introduce potential bottlenecks as the application scales, especially when handling many requests concurrently.
- Reason for rejection: File systems are not optimized for high-performance, low-latency access that is needed for session storage in high-traffic web applications. The shared file system would likely introduce significant overhead and would not meet the low-latency requirement as efficiently as other options.
C) Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for ses...
Author: Kunal · Last updated Jul 14, 2026
A developer has deployed an AWS Lambda function that is subscribed to an Amazon Simple Notification Service (Amazon SNS) topic. The developer must implement a solution to add a record of each Lambda function invocation to ...
Let's evaluate each option based on the developer's requirement of adding a record of each Lambda function invocation to an SQS queue:
A) Configure the SQS queue as a dead-letter queue for the Lambda function.
- Analysis: A dead-letter queue (DLQ) is used to store failed invocations of a Lambda function that could not be processed successfully. It is primarily intended to hold failed events, not to log every invocation. The goal here is to record every invocation, not just the failed ones.
- Reason for rejection: DLQs are not designed for tracking successful invocations, so this does not meet the requirement of recording all Lambda function invocations.
B) Create code that uses the AWS SDK to call the SQS SendMessage operation to add the invocation details to the SQS queue. Add the code to the end of the Lambda function.
- Analysis: This option involves adding custom code to the Lambda function to send a message to the SQS queue every time the Lambda is invoked. The AWS SDK can be used within the Lambda function to interact with SQS and send invocation details.
- Reason for selection: This is a flexible and straightforward solution. The Lambda function will explicitly send a record to the SQS queue after it processes the SNS event. It ensures that every invocation is logged in the SQS queue, which is the desired outcome. The main downside would be the slight additional processing involved in sending a message to SQS within the Lambda function, but it meets the requirement perfectly.
C) Add two asynchronous invocation destinations to the Lambda function: one destination for successful invocations and one destination for failed invocations. Configure the SQS queue as the destination for each type. Create an Amazon CloudWatch alarm based on the DestinationDeliveryFailures metric to catch any message that cannot be delivered.
- Analysis: Lambda's invocation destinations are useful for capturing t...
Author: Lucas Carter · Last updated Jul 14, 2026
An AWS Lambda function that handles application requests uses the default Lambda logging mechanism to log the timestamp, processing time, and status of requests.
A developer needs to create Amazon CloudWatch metrics based on the logs. The developer needs...
To meet the requirement of creating custom CloudWatch metrics based on logs, the solution must extract data from Lambda logs and write it to a custom CloudWatch metrics namespace. Let’s analyze each option based on this.
A) Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
- Analysis: CloudWatch Logs Insights is a powerful query tool used to analyze and visualize log data. However, it is not used directly to create metrics; instead, it is typically used for querying and analyzing logs. The embedded metric format (EMF) is a specific format that allows logs to be converted into CloudWatch metrics, but CloudWatch Logs Insights does not directly handle EMF-based metrics creation.
- Reason for rejection: CloudWatch Logs Insights allows for querying and analyzing logs, but it doesn't directly produce custom metrics from logs in the format required. It’s more suited for searching and visualizing logs rather than writing metrics into a custom namespace.
B) Use Amazon CloudWatch RUM to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
- Analysis: Amazon CloudWatch RUM (Real User Monitoring) is designed to collect and analyze data from user interactions with web applications to understand user performance and behavior. RUM is not meant to handle Lambda logs or generate custom metrics from log data.
- Reason for rejection: CloudWatch RUM is designed for user-facing web applications and is not relevant for processing Lambda function logs or generating custom metrics based on them. Therefore, it does not meet the need for creating metrics from Lambda logs.
C) Use Amazon CloudWatch Logs Insights to ge...
Author: Mia · Last updated Jul 14, 2026
A developer needs to configure an AWS Lambda function to make HTTP POST requests to an internal application. The application is in the same AWS account that hosts the function. The internal application runs on Amazon E...
To determine the best solution for configuring an AWS Lambda function to make HTTP POST requests to an internal application running on EC2 instances within a private subnet, we need to consider various network configurations. The goal is to allow the Lambda function, which is outside the private subnet, to access resources within that private subnet securely.
Let’s evaluate each option:
A) Configure a VPC endpoint to connect to the private subnet. Attach the endpoint to the Lambda function.
- Analysis: A VPC endpoint is used to provide private connectivity to AWS services like S3 or DynamoDB without routing traffic through the internet. However, it cannot directly access EC2 instances in a private subnet unless the application is a supported AWS service.
- Why rejected: The internal application on EC2 instances is not a service like S3 or DynamoDB. Therefore, a VPC endpoint will not work in this case.
B) Attach the Lambda function to the VPC and to the private subnet.
- Analysis: This is a common approach. Lambda functions can be configured to run inside a VPC by attaching them to specific subnets. In this case, the private subnet where the EC2 application resides would be selected. Once configured, Lambda can access resources in the private subnet, including the EC2 instances.
- Why selected: Lambda will gain access to the internal EC2 instances via the VPC’s private IP addresses. The Lambda function will be able to make HTTP POST requests to the EC2 application on the private subnet, provided that the necessary security groups ...
Author: Mia · Last updated Jul 14, 2026
Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon Dy...
To grant the minimum privileges to two containerized microservices running on Amazon ECS, where one interacts with an Amazon RDS Aurora database and the other interacts with an Amazon DynamoDB table, we need to focus on the principle of least privilege and ensure that each microservice has only the permissions required for its specific task.
Let’s evaluate each option:
A) Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
- Analysis: ECS_ENABLE_TASK_IAM_ROLE set to false means that the EC2 instance itself will not be able to assume IAM roles for the ECS tasks. This approach requires that IAM roles are assigned to individual ECS tasks. While the individual IAM roles for the tasks can be scoped with read-only access for each microservice, the overall security and functionality are compromised because the EC2 instance is not allowed to assume roles for the tasks. This configuration is non-optimal for ECS workloads.
- Why rejected: Setting ECS_ENABLE_TASK_IAM_ROLE to false undermines the goal of assigning roles to tasks and properly handling IAM roles at the task level.
B) Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
- Analysis: In this case, the EC2 instance role will be given broad access to both the Aurora database and DynamoDB. This would grant unnecessary permissions to the EC2 instance, violating the principle of least privilege since the EC2 instance does not need direct access to either the Aurora database or DynamoDB.
- Why rejected: The instance profile role should not be granted permissions to access both resources. The goal is to grant permissions to the ECS tasks, not to the EC2 instance.
C) Set ECS_ENABLE_TASK_IAM_R...
Author: NebulaEagle11 · Last updated Jul 14, 2026
A developer is writing a mobile application that allows users to view images from an S3 bucket. The users must be able to log in with their Amazon login, as well as supported social med...
The goal here is to enable users to log in with their Amazon login and supported social media accounts while allowing them to view images from an S3 bucket. The best solution will be one that facilitates social login integration and ensures secure access to the S3 resources without hardcoding sensitive credentials in the application.
A) Use Amazon Cognito with web identity federation.
- Analysis: Amazon Cognito with web identity federation allows users to authenticate using their existing social media accounts (such as Facebook, Google, and Amazon) or through Amazon login. Cognito supports integrating multiple identity providers (IdPs) and federates the authentication process. After authentication, it can grant access to AWS resources (like S3) using the roles and permissions that are assigned in Cognito. This is a secure, managed way to handle authentication and access control without requiring you to manage user credentials or sensitive access keys.
- Why selected: This option is ideal because it allows the developer to implement social logins easily and securely with integration to Cognito, which can be used to manage authentication and access to S3 resources. Cognito takes care of federating logins from multiple providers and integrates seamlessly with AWS resources such as S3.
B) Use Amazon Cognito with SAML-based identity federation.
- Analysis: SAML-based identity federation allows the integration of an enterprise's identity provider (IdP), typically used in business or enterprise environments. This would be appropriate for enterprise applications where the user base is part of an existing corporate directory (like Active Directory). However, this doesn't cater to social logins (e.g., Facebook, Google), which is one of the requirements in the scenario.
- Why rejected: SAML is more commonly used for enterprise use cases and does not support social media logins, which is part of the requirement. Therefore, this solution...
Author: Nia · Last updated Jul 14, 2026
An application that is running on Amazon EC2 instances stores data in an Amazon S3 bucket. All the data must be encrypted in transit.
How can a ...
To ensure that all traffic to an Amazon S3 bucket is encrypted in transit, it’s important to configure the application or S3 settings in such a way that communication is securely encrypted over HTTPS. Let's evaluate each option based on this requirement:
A) Install certificates on the EC2 instances.
- Analysis: Installing certificates on EC2 instances is useful when enabling SSL/TLS for secure communication between the EC2 instance and other services (e.g., to encrypt outbound traffic from the EC2 instance itself). However, this does not specifically address ensuring encryption for traffic to an S3 bucket.
- Why rejected: While SSL/TLS certificates on EC2 instances ensure encrypted communication for outbound requests, they don't guarantee that traffic to S3 is encrypted. Additionally, S3 automatically supports HTTPS (SSL/TLS), so installing certificates on EC2 instances isn't necessary for this specific requirement.
B) Create a private VPC endpoint.
- Analysis: A VPC endpoint for S3 enables private connectivity between Amazon EC2 instances and S3 without routing traffic over the public internet. While this improves security and reduces the attack surface by keeping traffic within the AWS network, it doesn’t necessarily ensure that the traffic is encrypted in transit. VPC endpoints can use encryption, but encryption in transit (HTTPS) for all traffic needs to be enforced separately.
- Why rejected: While a VPC endpoint is beneficial for controlling the path of traffic, it does not directly enforce encryption in transit (HTTPS) for the communication between the EC2 instance and S3. Encryption needs to be explicitly required in the communication protocol.
C...
Author: ThunderBear · Last updated Jul 14, 2026
A company is hosting an Amazon AP! Gateway REST API that calls a single AWS Lambda function. The function is infrequently invoked by multiple clients at the same time.
The code performance is optimal, but the company wants to optimize the...
To optimize the startup time of an AWS Lambda function, the best option is to focus on reducing cold starts. Cold starts happen when a Lambda function is invoked for the first time after a period of inactivity, or when AWS needs to initialize a new instance of the function to handle the request.
Let's break down each option and reason the best choice:
A) Enable API Gateway caching for the REST API
Explanation: API Gateway caching improves performance by caching the responses of API calls at the API Gateway level. This reduces the number of calls to the backend Lambda function, but it does not affect Lambda function cold start times. API Gateway caching doesn't optimize the initialization of the Lambda function itself; it just improves response times for repeated requests with identical inputs.
Why rejected: Caching in API Gateway doesn't solve the Lambda cold start problem. It's useful when the same request is repeatedly made, but not for optimizing the startup time of Lambda itself.
B) Configure provisioned concurrency for the Lambda function
Explanation: Provisioned concurrency allows you to pre-warm a set number of Lambda function instances, ensuring that they are always initialized and ready to handle requests. This removes the cold start latency as the function is already running, significantly reducing initialization time.
Why selected: Provisioned concurrency directly addresses the cold start issue by ensuring that Lamb...
Author: John · Last updated Jul 14, 2026
A developer is building a three-tier application with an Application Load Balancer (ALB), Amazon EC2 instances, and Amazon RDS. There is an alias record in Amazon Route 53 that points to the ALB. When the developer tries to access the ALB from a laptop, the request...
To verify that the request is reaching the AWS network and diagnose the potential issue of the request timing out when accessing the Application Load Balancer (ALB), the developer needs to understand where the problem is occurring in the network flow.
Let’s evaluate each option:
A) VPC Flow Logs
Explanation: VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your Virtual Private Cloud (VPC). These logs provide data about incoming and outgoing traffic to EC2 instances, Load Balancers, and other resources. If the ALB is in the VPC, VPC Flow Logs will show whether the traffic is arriving at the ALB and whether the response is leaving the VPC.
Why selected: VPC Flow Logs are the most relevant in this scenario as they will help you verify whether the request is reaching the ALB and whether any issues (such as misconfigurations or blocked traffic) are occurring at the network level. It can confirm if the request is entering the AWS network, making it the best option for troubleshooting timeouts.
B) Amazon Route 53 logs
Explanation: Route 53 logs would provide information about DNS query requests and responses, showing whether the alias record correctly resolves to the ALB's IP address. However, Route 53 logs will not provide details about whether the actual request reaches the ALB or the backend EC2 instances, especially in case of network-related issues after DNS resolution.
Why rejected: While Route 53 logs help verify DNS resolution, they do not provide information on whether the request actually reaches the AWS network or if the traffic is gett...
Author: Emma Brown · Last updated Jul 14, 2026
A developer has an application that uses AWS Security Token Service (AWS STS). The application calls the STS AssumeRole API operation to provide trusted users with temporary security credentials. The application calls AWS STS at the service's default endpoint: https://sts.amazonaws.com.
The application is deployed in an Asia Pacific AWS Region. The applicatio...
In this scenario, the developer is facing intermittent latency issues when the application calls the AWS Security Token Service (STS) at the default endpoint: https://sts.amazonaws.com. The default endpoint for AWS STS is the global endpoint, which can sometimes result in higher latency, especially if the application is deployed in a specific AWS Region, like one in the Asia Pacific.
Let’s evaluate the options:
A) Update the application to use the GetSessionToken API operation
Explanation: The `GetSessionToken` API operation is used to obtain temporary security credentials based on existing credentials. This is typically used for session token-based authentication but does not directly address the latency issues caused by using a global STS endpoint.
Why rejected: While `GetSessionToken` is a valid API operation for obtaining temporary credentials, it does not resolve the latency problem caused by using the global STS endpoint. The issue is related to the location of the STS endpoint rather than the type of STS operation used.
B) Update the application to use the AssumeRoleWithSAML API operation
Explanation: The `AssumeRoleWithSAML` operation is used for federating users from an external identity provider (via SAML) to AWS roles. While it can be useful for identity federation, this is not related to resolving latency issues for an application calling the regular `AssumeRole` API operation.
Why rejected: The issue here is not related to identity federation or the specific type of AssumeRole API call being used. It’s about reducing latency by choosing a geographically closer endpoint for STS. Therefore, switching to `AssumeRoleWithSAML` does not address the core problem.
C) Update the application to...
Author: Evelyn · Last updated Jul 14, 2026
A company is launching a photo sharing application on AWS. Users use the application to upload images to an Amazon S3 bucket. When users upload images, an AWS Lambda function creates thumbnail versions of the images and stores the thumbnail versions in another S3 bucket.
During development, a developer notices that the Lambda function takes more than 2 minutes to co...
The problem here is that the Lambda function is taking longer than expected to process images and generate thumbnails, with the target processing time being under 30 seconds. To address this, we need to focus on optimizing the performance of the Lambda function, specifically reducing the time it takes to process each image.
Let’s break down each option and assess its suitability for addressing the issue:
A) Increase the virtual CPUs (vCPUs) for the Lambda function to use 10 vCPUs
Explanation: AWS Lambda does not provide direct control over the number of virtual CPUs (vCPUs) allocated to the function. The processing power in Lambda is directly tied to the amount of memory allocated. Increasing memory will effectively increase the CPU resources, but there is no specific control to allocate 10 vCPUs as Lambda does not allow users to adjust the number of vCPUs independently.
Why rejected: You cannot directly set the number of vCPUs in AWS Lambda. This option is not feasible.
B) Change Lambda function instance type to use m6a.4xlarge
Explanation: AWS Lambda does not allow you to select specific instance types (like EC2 instances). You can only specify the amount of memory to allocate to a Lambda function, which indirectly affects the CPU power. Lambda functions are abstracted from underlying EC2 instance types, so you cannot choose specific instance types like m6a.4xlarge for Lambda.
Why rejected: The instance type selection (e.g., m6a.4xlarge) is only applicable to EC2 instances, not Lambda functions. This option is not applicable.
C) Configure the Lambda function to increase the amount of memory
Explanation: In AWS Lambda, the amount of memory you allocate to a function directly affects its CPU ...
Author: Ella · Last updated Jul 14, 2026
A developer is building an application that will process messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The application needs to process the messages in an Amazon Elastic Container Service (Amazon ECS) tas...
To process messages from an Amazon SQS queue in the most cost-effective way in an Amazon ECS task, it’s essential to consider factors like how efficiently messages are retrieved, the cost of polling, and overall service performance. Let's evaluate each option:
A) Use long polling to query the queue for new messages.
- Explanation: Long polling reduces the number of empty responses returned when there are no messages in the queue, by waiting for messages to arrive instead of immediately returning when the queue is empty. This reduces the number of requests made to the queue, which lowers costs. Long polling is more cost-effective than short polling because it avoids the additional cost of continuous empty requests.
- Reasoning for selection: Long polling is more cost-effective because it minimizes unnecessary requests to SQS, as it only makes a request when there are messages to process. This directly impacts the cost by reducing the total number of requests.
B) Use short polling to query the queue for new messages.
- Explanation: Short polling checks the queue for messages but immediately returns an empty response if there are no messages, which can result in a higher number of requests if the queue is empty often. This incurs more costs due to frequent requests.
- Reasoning for rejection: Short polling increases the number of requests made to SQS, as it does not wait for messages to appear. This leads to higher costs compared to long polling.
C) Use message batching to retrieve messages from the queue.
- Explanation: Message batching allows multiple messages to be retrieved in a single request, reducing the number of requests and thus the cost. This is very cost-effective when processing multiple messages at once because the cost is incurred for the request, not for each individual message.
- Reasoning for ...
Author: Mia · Last updated Jul 14, 2026
A developer is writing an application in AWS Lambda. To simplify testing and deployments, the developer needs the database connection string to be easily changed ...
To meet the requirement of easily changing the database connection string without modifying the AWS Lambda code, we need to focus on how to store the connection string in a way that is secure, flexible, and external to the Lambda function itself. Let's evaluate each option:
A) Store the connection string as a secret in AWS Secrets Manager.
- Explanation: AWS Secrets Manager is specifically designed to store sensitive information such as database credentials, API keys, and other secrets. It provides secure access to secrets, and you can easily retrieve them from Lambda functions using the AWS SDK. Additionally, Secrets Manager allows for dynamic rotation of secrets, making it easier to update the connection string without changing the Lambda code.
- Reasoning for selection: Secrets Manager is the most appropriate service for securely storing sensitive configuration details like a database connection string. It allows you to update the connection string without needing to modify the Lambda code itself. Additionally, it integrates well with AWS Lambda and can securely store secrets without exposing them in the code.
B) Store the connection string in an IAM user account.
- Explanation: IAM (Identity and Access Management) is used for managing users, roles, and permissions. Storing a database connection string in an IAM user account is not a typical or recommended use of IAM. While IAM is designed to control access, it is not meant to store application-specific secrets such as database connection strings.
- Reasoning for rejection: IAM is intended for identity management and permissions, not for storing sensitive information like database credentials. This would complicate access management and add unnece...
Author: Manish · Last updated Jul 14, 2026
A developer is building an ecommerce application that uses multiple AWS Lambda functions. Each function performs a specific step in a customer order workflow, such as order processing and inventory management.
The developer must ensure that the Lambda func...
To ensure that the AWS Lambda functions run in a specific order with the least operational overhead, the developer should select a solution that simplifies orchestration and minimizes manual handling. Let's evaluate the options:
A) Configure an Amazon Simple Queue Service (Amazon SQS) queue to contain messages about each step a function must perform. Configure the Lambda functions to run sequentially based on the order of messages in the SQS queue.
- Explanation: Using SQS to process messages in order ensures that Lambda functions are triggered sequentially as messages are dequeued. However, this method requires extra configuration to ensure that each Lambda function processes messages in the correct order, handles potential retries, and scales properly. Additionally, it adds complexity in managing the queue and ensuring that Lambda invocations align with the workflow.
- Reasoning for rejection: While SQS can help manage message order, it introduces more operational overhead by requiring the developer to handle retries, errors, and message sequencing explicitly. This method may not be as efficient as other options in terms of simplifying the orchestration of Lambda functions.
B) Configure an Amazon Simple Notification Service (Amazon SNS) topic to contain notifications about each step a function must perform. Subscribe the Lambda functions to the SNS topic. Use subscription filters based on the step each function must perform.
- Explanation: SNS is useful for broadcasting notifications to multiple subscribers, but it does not guarantee the order of delivery to Lambda functions. SNS typically sends messages to all subscribers asynchronously, meaning there’s no inherent control over the sequence of function execution.
- Reasoning for rejection: SNS doesn’t inherently ensure sequential execution. It is better suited for broadcasting notifications to multiple systems but does not solve the problem of ordering Lambda functions in a precise sequence.
C) Confi...
Author: SilverBear · Last updated Jul 14, 2026
A developer is building an image-processing application that includes an AWS Lambda function. The Lambda function moves images from one AWS service to another AWS service for image processing. For images that are larger than 2 MB, the Lambda function returns the following error: =E2=80=9CTask timed out after 3.01 seconds.=E2=...
To address the error that occurs when processing images larger than 2 MB in the AWS Lambda function, the developer needs to resolve the issue related to the Lambda function's ability to handle larger files within the time constraints. Let's analyze each option:
A) Increase the Lambda function's timeout value.
- Explanation: Lambda functions have a configurable timeout, which can be set up to a maximum of 15 minutes. If the Lambda function is timing out because it is taking too long to process large images, increasing the timeout could help provide enough time for processing. This would allow the function to finish the task without encountering a timeout error.
- Reasoning for selection: Since the error message indicates that the function is timing out after 3.01 seconds, increasing the timeout value would give the function more time to complete the processing for large images. This solution is effective without needing to modify the Lambda function code and resolves the immediate issue of the timeout.
B) Configure the Lambda function to not move images that are larger than 2 MB.
- Explanation: This solution would involve modifying the Lambda function's behavior to skip images larger than 2 MB. However, the requirement specifies resolving the error without modifying the Lambda function code, so this option is not viable.
- Reasoning for rejection: Since the developer needs to resolve the error without changing the Lambda function code, this option is not applicable as it would involve code changes to exclude larger images from processing.
C) Request a concurrency quota increase...
Author: Lucas · Last updated Jul 14, 2026
A developer has an application container, an AWS Lambda function, and an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function uses the SQS queue as an event source. The Lambda function makes a call to a third-party machine learning API when the function is invoked. The response from the third-party API can take up to 60 seconds to return.
The Lambda function's timeout value is currently 65 seconds. The developer has notic...
The developer is encountering duplicate message processing in the Lambda function, which is triggered by an Amazon SQS queue. This issue occurs when the Lambda function takes too long to process a message and another Lambda function instance is triggered before the first one finishes processing, resulting in the same message being processed again. The developer needs to ensure that the Lambda function doesn't process duplicate messages by adjusting configurations related to message visibility and Lambda processing.
Let’s break down each option:
A) Configure the Lambda function with a larger amount of memory.
- Explanation: Increasing the memory allocation for the Lambda function can impact its CPU resources, which may help the function process tasks more quickly, but it doesn’t directly address the issue of duplicate message processing. The problem arises from the Lambda function taking too long to process a message, leading to a second invocation before the first is complete.
- Reasoning for rejection: While increasing memory can improve performance, it won't prevent the Lambda function from being triggered again before the first one finishes. The core issue is related to timeouts and message visibility, not memory capacity.
B) Configure an increase in the Lambda function's timeout value.
- Explanation: Increasing the timeout value would allow the Lambda function more time to complete the API call. However, this doesn’t address the root cause of the duplicate message processing. Even with a longer timeout, there is still a risk that SQS will trigger a new Lambda instance if the first invocation takes too long.
- Reasoning for rejection: Increasing the timeout might prevent some timeouts, but it doesn't prevent the issue of the SQS message being made available to another Lambda instance while the first one is still processing. It doesn’t address the core issue of duplicate message processing.
C) Configure the SQS queue's delivery delay value to be...
Author: Sam · Last updated Jul 14, 2026
A team deploys an AWS CloudFormation template to update a stack that already included an Amazon DynamoDB table. However, before the deployment of the update, the team changed the name of the DynamoDB table on the template by mistake. The Dele...
When deploying an AWS CloudFormation template to update an existing stack, CloudFormation will compare the template to the current state of the stack to determine what changes need to be made. If there is a change to a resource name (in this case, the name of the DynamoDB table), CloudFormation will consider it as a modification that might require the resource to be recreated or deleted and replaced, depending on how the resource is handled in the stack.
Let's analyze each option based on the default behavior of CloudFormation and the scenario provided:
A) CloudFormation will create a new table and will delete the existing table.
- Explanation: When CloudFormation detects a name change for a resource, it assumes the resource has been replaced, and typically, CloudFormation will delete the old resource and create a new one. However, this would only happen if the `DeletionPolicy` was set to allow deletion (such as `Delete`), or if it is the default behavior. In this case, with the default `DeletionPolicy` (which is `Retain` for DynamoDB tables), the existing table should not be deleted.
- Reasoning for rejection: The default `DeletionPolicy` would prevent the deletion of the table, so CloudFormation will not delete the table. This option does not align with the expected behavior of CloudFormation when the `DeletionPolicy` is set to `Retain`.
B) CloudFormation will create a new table and will keep the existing table.
- Explanation: Since the team mistakenly changed the DynamoDB table's name in the template, CloudFormation will treat the change as a new resource (a new table with the new name). CloudFormation will attempt to create the new table based on the template's instructions, but because the existing table is still retained (as per the default `DeletionPolicy`), it will not be deleted.
- Reasoning for selection: CloudFormation will recognize that the table n...
Author: Kai · Last updated Jul 14, 2026
A developer is creating a stock trading application. The developer needs a solution to send text messages to application users to confirmation when a trade has been completed.
The solution must deliver messages in the order a user makes sto...
To meet the requirements of delivering trade confirmation messages in the correct order and avoiding duplicates, let's analyze each of the options:
Option A: Configure the application to publish messages to an Amazon Data Firehose delivery stream
- Issue with this option: While Amazon Kinesis Data Firehose is excellent for streaming data to destinations like Amazon S3, Redshift, or Elasticsearch, it is not optimized for sending direct messages to mobile phone numbers. Moreover, it does not guarantee message ordering or deduplication when messages are delivered to an endpoint.
- Conclusion: This option is not suitable because it does not guarantee message ordering or deduplication, and its delivery method is not optimized for sending SMS directly to users.
Option B: Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue
- Why this could work: Amazon SQS FIFO queues ensure message ordering and can prevent duplicates through the use of deduplication IDs. FIFO queues are designed to deliver messages in the exact order they are received and can be used to manage and maintain the order of trade confirmation messages.
- Issue with this option: However, SQS is a queueing system, and while it guarantees ordering, it is not directly designed to send messages to mobile phone numbers. An extra step would be required (e.g., pulling messages from the queue and sending them via another service like SNS).
- Conclusion: This option is partially suitable for ensuring ordered delivery, but it introduces unnecessary complexity in terms of integration with mobile phone messaging.
Option C: Configure a pipe in Amazon EventBridge Pi...
Author: Max · Last updated Jul 14, 2026
A developer is deploying a new Node.js AWS Lambda function that is not connected to a VPC. The Lambda function needs to connect to and query an Amazon Aurora database that is not publicly accessible. The developer is expecting unpredictable surge...
To allow the Lambda function to access the Amazon Aurora database, the key considerations include the Lambda function needing access to the database, which is not publicly accessible, and the need to handle unpredictable surges in traffic. Let's analyze each option:
Option A: Configure the Lambda function to use an Amazon RDS Proxy
- Why this works: An Amazon RDS Proxy is designed to manage connections between Lambda functions and RDS (including Aurora) databases. It helps handle unpredictable surges in database traffic by pooling and reusing database connections, improving scalability and performance. It also allows Lambda functions to connect to an Aurora database that is in a VPC without needing to manage individual database connections directly.
- Conclusion: This option solves both the access and scalability problem effectively by using a managed service that handles the Lambda-to-database connections and can scale based on demand.
Option B: Configure a NAT gateway. Attach the NAT gateway to the Lambda function
- Why this doesn't work: A NAT gateway allows instances in a private subnet to access the internet, but it does not solve the issue of connecting to a database within a VPC. Lambda functions need to be connected to a VPC to interact with the database, and simply attaching a NAT gateway would not allow the Lambda function to access resources inside the VPC, including the private Aurora database.
- Conclusion: This option is not suitable because a NAT gateway only provides outbound internet access, not access to a VPC database.
Option C: Enable public access on the Aurora database. Configure...
Author: Nia · Last updated Jul 14, 2026
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company=E2=80=99s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notificatio...
Let's evaluate each of the given options for notifying the security team 90 days before an imported SSL certificate expires:
Option A: Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule's target.
- Why this works: Amazon EventBridge supports event patterns for various AWS services, including ACM. ACM can send an event when a certificate is approaching expiration (e.g., 90 days before expiration). EventBridge can then be configured to trigger notifications via SNS to the security team. This solution provides direct integration for monitoring the expiration of certificates and can automatically trigger notifications without needing complex custom code.
- Conclusion: This is a very efficient and appropriate solution because it directly uses AWS EventBridge to monitor certificate expiration events, with SNS handling the notification, which is exactly what is required.
Option B: Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
- Why this doesn't work as well: While Lambda can be programmed to search for certificates expiring within 90 days, this solution requires a custom function that needs to be triggered periodically (e.g., via CloudWatch Events). It introduces complexity since you would have to manage the logic for checking certificate expiration and triggering the notifications. It also requires maintaining the Lambda code and managing SQS interactions.
- Conclusion: This solution is functional but more complex than needed. It requires manual implementation and management of logic to periodically check for expiring certificates.
Option C: Create an AWS Step Functions workflow that is invoked by each certificate's expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
- Why ...
Author: NightmareDragon2025 · Last updated Jul 14, 2026
A developer is using AWS CodeDeploy to launch an application onto Amazon EC2 instances. The application deployment fails during testing. The developer notices an IAM_ROLE_PERMISSIONS error co...
To resolve the IAM_ROLE_PERMISSIONS error during a CodeDeploy deployment, the issue is related to permissions that the CodeDeploy service role or EC2 instances need to carry out the deployment.
Option A: Ensure that the deployment group is using the correct role name for the CodeDeploy service role
- Why this may work: If the wrong service role is associated with the deployment group, it could result in permission errors like IAM_ROLE_PERMISSIONS. This option suggests verifying that the correct service role is associated with the deployment group.
- Conclusion: This is a good first step to ensure that the correct IAM role is being used for deployment. However, there may be other causes for the permission error, so it is more of a diagnostic step rather than a complete solution.
Option B: Attach the AWSCodeDeployRoleECS policy to the CodeDeploy service role
- Why this doesn't work: The AWSCodeDeployRoleECS policy is specific to deployments for Amazon ECS (Elastic Container Service), not for EC2-based deployments. If the application is being deployed to EC2 instances, this policy would be irrelevant and would not address the IAM_ROLE_PERMISSIONS error in this context.
- Conclusion: This option is not suitable because it applies to ECS deployments, not EC2 instances.
Option C: Attach the AWSCodeDeployRole policy to the CodeDeploy service role
- Why this works: The AWSCodeDeployRole policy grants the necessary permissions to the CodeDeplo...
