AWS Certified Developer - Associate (DVA-C02)

Correct answer: C. Use the ChangeMessageVisibility action to extend a message's visibility timeout

ChangeMessageVisibility extends a message's visibility timeout while a consumer is still processing it, preventing other consumers from picking up the same in-flight message. Exam cue: when processing time may exceed the visibility timeout, call ChangeMessageVisibility, not DelaySeconds or WaitTimeSeconds, which do not extend an in-flight message's timeout.

Correct answer: D. Correct the policy of the IAM user to allow the kms:GenerateDataKey action

Uploading to a bucket with default SSE-KMS encryption requires the caller to have kms:GenerateDataKey permission on the KMS key, in addition to s3:PutObject. Exam cue: access denied on PutObject against an SSE-KMS bucket almost always means the missing KMS permission; there is no s3:Encrypt action, and ACLs never grant KMS access.

Correct answer: C. Set up the application to use an alias that points to the current version. Deploy the new version of the code and configure the alias to send 10% of the users to this new version. If the deployment goes wrong, reset the alias to point all traffic to the current version

A Lambda alias with weighted routing can send a small percentage of traffic, such as 10%, to the new version while the rest goes to the stable version. Because callers use the alias ARN, repointing the alias back to the stable version gives an instant, low-downtime rollback. Option A sends all traffic to the new version, defeating the canary requirement.

Correct answer: D. Develop an AWS Lambda authorizer that references the authentication data in the DynamoDB table

A Lambda authorizer runs custom code that reads the client ID and user ID headers and validates them against the DynamoDB table before API Gateway forwards the request. Cognito only works with tokens Cognito itself issues, and models or integration settings cannot perform authentication against a proprietary data store.

Correct answer: C. Use long polling

Long polling makes SQS wait, up to 20 seconds, until a message arrives, eliminating most empty ReceiveMessage responses that still count as billable API requests. Exam cue: low-traffic queues, frequent empty responses, and rising SQS cost point directly to setting ReceiveMessageWaitTimeSeconds above zero.

Correct answer: B. Use the AWS STS decode-authorization-message API to decode the message

The STS decode-authorization-message API decodes the encoded authorization failure message into readable JSON showing the principal, action, and policy conditions evaluated. Exam cue: the phrase encoded authorization failure message always maps to aws sts decode-authorization-message, which requires the sts:DecodeAuthorizationMessage permission.

Correct answer: B. Set up an Amazon DynamoDB table with a primary key that consists of the name as the partition key and the version number as the sort key. Create a global secondary index that has the category as the partition key and the name as the sort key

The composite primary key with name as partition key and version as sort key handles exact lookups and per-name queries, while a GSI on category supports category queries without scans. Schemaless items absorb the inconsistent extra attributes. Options using only the name as primary key cannot uniquely identify versions.

Correct answer: D. Create an Amazon CloudFront distribution with the ALB as the origin, and point the application's Route 53 alias to the CloudFront domain

CloudFront with the ALB as origin caches static assets at edge locations worldwide and accelerates dynamic requests, requiring only a distribution and a Route 53 alias change. Global Accelerator improves routing but does not cache content, and multi-Region deployment adds far more operational burden.

Correct answer: D. Configure provisioned concurrency for the Lambda function to respond immediately to the function's invocations

Provisioned concurrency keeps execution environments fully initialized and warm, eliminating cold-start delays during traffic spikes. Reserved concurrency only limits or reserves the concurrency ceiling and does nothing for initialization time, which is the stated bottleneck.

Correct answer: B. Deploy the new application version using the 'Immutable' deployment policy

Immutable deployment launches a fresh Auto Scaling group on a separate stack, so the original fleet keeps serving full capacity while new instances pass health checks. On failure, Elastic Beanstalk simply terminates the new group for a fast, automatic rollback. Rolling policies temporarily reduce capacity.

Correct answer: D. Use parallel scans while limiting the rate

A parallel scan splits the table into segments scanned concurrently, using idle off-peak throughput to finish faster, and rate limiting via the Limit parameter keeps it from starving production reads. Simply increasing RCUs raises cost, and sequential scans are slower.

Correct answer: D. Configure and push high-resolution custom metrics to CloudWatch that record the failures of the external payment processing API calls. Create a CloudWatch alarm that sends a notification via the existing SNS topic when the error rate exceeds the specified rate

Publishing custom metrics with PutMetricData for each external API outcome lets a CloudWatch alarm evaluate the hourly error rate and notify SNS automatically with no polling code. Scheduled Lambda checks of Logs Insights or metric filters add latency and operational overhead.

Correct answer: B. Opt for a rolling with additional batch deployment strategy. Set the batch size parameter to 1

Rolling with additional batch launches a new instance before taking one out of service, so capacity never drops and only one temporary instance is paid for. Rolling with batch size 2 would still drop capacity below the safe threshold, and traffic splitting duplicates the fleet cost.

Correct answer: C. Add an attribute with the expiration time; enable the Time to Live feature based on that attribute

DynamoDB Time to Live on an epoch-timestamp attribute deletes expired items automatically in the background at no extra cost or capacity usage. A cron script adds operational overhead, and merely naming an attribute without enabling TTL does nothing.

Correct answer: B. Add a random number suffix to the partition key values

Using the event date as the partition key creates a hot partition, which throttles writes even when overall consumed throughput is low. Adding a random number suffix spreads writes across partitions at zero extra cost, while raising capacity units increases the bill without fixing the hot key.

Correct answer: C. Leverage an Amazon Cognito user pool to manage user accounts and set up an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Set up a Lambda function to store the images in Amazon S3 and save the image object's S3 key as part of the photo details in a DynamoDB table. Have the Lambda function retrieve previously uploaded images by querying DynamoDB for the S3 key.

A Cognito user pool handles account management, and a user pool authorizer secures API Gateway with minimal overhead. Storing image files in S3 and keeping only the S3 key in DynamoDB is the correct pattern. Option A fails because DynamoDB is not suited for large binary objects.

Correct answer: C. Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version

Lambda alias traffic shifting lets you send only 10% of invocations to the new version and instantly shift back to 100% on the old one if errors appear. Option A exposes all users immediately, so a bad deploy affects everyone. Weighted alias shifting is the canary pattern to remember.

Correct answer: C. Store the frequently accessed data in an Amazon ElastiCache for Redis instance with encryption enabled for data in transit and at rest

Amazon ElastiCache for Redis supports sorted sets, which enable leaderboard-style ranking, and it offers encryption in transit and at rest to keep PHI protected. When a caching question mentions sorting, ranking, or advanced data structures, pick Redis over Memcached, since Memcached lacks those data structures.

Correct answer: C. Create a global secondary index with a partition key of sport_name and a sort key of score, and get the results

A global secondary index lets you change both the partition key and sort key, so an index keyed on sport_name and score returns results already sorted for each sport. Remember, a local secondary index must keep the base table's partition key, so it cannot work here.

Correct answer: A. Create an IAM role with S3 access in Account B and set Account A as a trusted entity. Create another role (instance profile) in Account A, attach it to the EC2 instances in Account A, and add an inline policy to this role to assume the role from Account B

The standard cross-account pattern puts the S3 access role in the resource-owning Account B with a trust policy for Account A, and the EC2 instance profile in Account A assumes that role via sts:AssumeRole. A bucket policy alone cannot scope permissions to specific instances, and the other options break the trust direction or the architecture.

Correct answer: D. Configure Application Auto Scaling to manage Lambda provisioned concurrency on a schedule

Provisioned concurrency pre-initializes execution environments so the function responds without cold-start delay, and Application Auto Scaling can raise it on a schedule ahead of a predictable surge. Reserved concurrency is a static limit, not manageable by Auto Scaling, and Lambda's automatic scaling alone does not prevent cold starts.

Correct answer: C. Leverage AWS Secrets Manager with an AWS KMS customer-managed key to store the access token as a secret and configure a resource-based policy for the secret to allow access from other accounts. Modify the IAM role of the EC2 instances with permissions to access Secrets Manager. Fetch the token from Secrets Manager and then use the decrypted access token to send the message to the chat.

AWS Secrets Manager with a KMS customer-managed key and a resource-based policy meets every requirement: encryption at rest and in transit, cross-account sharing, and minimal management overhead. Parameter Store cannot attach resource-based policies to parameters, so option D fails the cross-account requirement.

Correct answer: C. Deploy the new version to a separate environment via a blue/green deployment, and then swap the Amazon Route 53 records of the two environments to redirect traffic to the new version

Blue/green deployment on Elastic Beanstalk launches a separate, fully tested environment, then swapping Route 53 records shifts traffic instantly and enables fast rollback by swapping back. In-place policies like All at Once or Rolling cause downtime or gradual, harder-to-reverse rollouts.

Correct answer: C. CodeDeployDefault.ECSCanary10Percent15Minutes

CodeDeployDefault.ECSCanary10Percent15Minutes shifts 10% of traffic first, waits 15 minutes, then shifts the remaining traffic, exactly matching the requirements. Linear configurations shift traffic in equal increments rather than a two-stage shift, and the Lambda option targets the wrong compute platform.

Correct answer: A. Set up an SNS topic and subscribe each partner to the SNS topic. Modify the Lambda function to publish messages with specific attributes to the SNS topic and apply the appropriate filter policy to the topic subscriptions

One SNS topic with message attributes and per-subscription filter policies delivers each partner only its own order updates, and adding a partner means adding a subscription with a filter. Separate topics per partner work but require code changes for every new partner, failing the scalability requirement.

Correct answer: B. Set up reserved concurrency for Lambda function B so that it throttles if it goes above a certain concurrency limit

Reserved concurrency on function B caps how much of the account-level pool it can consume, throttling excess invocations and leaving concurrency available for function A. Provisioned concurrency pre-warms environments but does not throttle a function that exhausts the shared pool.

Correct answer: B. Invoke the PutObject API operation and set the x-amz-server-side-encryption header as AES256. Use an S3 bucket policy to deny permission to upload an object unless the request has this header

Setting the x-amz-server-side-encryption header to AES256 specifies SSE-S3, and a bucket policy Deny on the wrong or missing header enforces it. Option D uses aws:kms, which is SSE-KMS, not SSE-S3. Option A's sse:s3 value is not a valid header value.

Correct answer: A. Store the large files in Amazon S3 and use the Amazon SQS Extended Client Library for Java to manage SQS messages

SQS messages are capped at 256 KB, so the 1 GB passport file must be offloaded to Amazon S3. The SQS Extended Client Library for Java handles uploading the payload and sending a pointer message automatically. The queue's maximum message size cannot be raised to 1 GB.

Correct answer: D. Use an IAM instance role

An IAM instance role delivers temporary, automatically rotating credentials to the EC2 instance through the metadata service, eliminating hardcoded keys. Environment variables and hardcoded values remain long-lived secrets. Exam cue: an EC2 app needing AWS permissions means an instance role.

Correct answer: B. Rolling with additional batch

Rolling with additional batch spins up a temporary extra batch so full capacity is maintained during the deployment, then removes it when done. Immutable also keeps capacity but doubles the fleet at much higher cost. Exam cue: full availability plus cost-effectiveness means rolling with additional batch.

Correct answer: C. Use Amazon DynamoDB Accelerator (DAX) to cache the data

DAX is the in-memory cache for DynamoDB that cuts read latency to microseconds and offloads reads to reduce throttling and over-provisioning. Exponential backoff only retries throttled requests without improving latency. Exam cue: microsecond DynamoDB reads always point to DAX.

Correct answer: B. Rolling with additional batch

Rolling with additional batch launches one extra batch first, then updates the existing instances in batches, so full capacity is kept while reusing the current fleet. Immutable replaces the entire fleet with new instances, violating the reuse requirement. Cue: no capacity loss plus reuse existing instances means this policy.

Correct answer: C. Configure a second cache behavior for the distribution using the same origin as the default cache behavior, and set the path pattern for the second cache behavior to the path of the login page with viewer access as unrestricted. Keep the default cache behavior's settings unchanged

A second cache behavior on the same origin with a specific path pattern for the login page and unrestricted viewer access exposes only that path while the default behavior stays restricted. CloudFront matches more specific path patterns first, so avoid answers that modify the default behavior or add a separate distribution.

Correct answer: B. Attach a Lambda@Edge function to the CloudFront distribution. Trigger the function upon each viewer request. Give the function's execution role the permissions needed to call AWS STS. Move all SDK calls from the frontend to this function.

Lambda@Edge runs in a full Lambda environment with an IAM execution role, so it can call AWS STS and obtain temporary credentials at runtime with no hardcoded secrets. CloudFront Functions have no IAM role and cannot make SDK calls, and moving plaintext credentials elsewhere still fails the security requirement.

Correct answer: C. Use Amazon ElastiCache to maintain user sessions

Storing sessions in Amazon ElastiCache externalizes session state so users stay logged in even when a blue/green deployment replaces the entire fleet and load balancer. Sticky sessions would not help here because the new environment's load balancer and instances are completely fresh.

Correct answer: A. Configure a resource-based policy on the S3 bucket to deny access when a request has the condition "aws:SecureTransport": "false"

A bucket policy Deny statement with aws:SecureTransport set to false blocks all plain HTTP requests at the resource level, enforcing HTTPS for every account with GetObject permission. Options using Allow with SecureTransport false would permit insecure traffic instead of blocking it.

Correct answer: B. Amazon Kinesis Data Streams

Kinesis Data Streams captures high-volume flow log data in real time and lets multiple independent consumers replay the data, giving routing flexibility. Firehose only delivers to fixed destinations with no replay or multiple custom consumers. Exam cue: multi-consumer streaming with replay means Data Streams.

Correct answer: D. Deploy using the 'Rolling with additional batch' deployment policy

Rolling with additional batch adds one temporary batch of instances so full capacity is preserved throughout the deployment at modest cost. Immutable also protects availability but duplicates the entire environment, making it slower and more expensive. Watch for the cost-effective qualifier to rule out Immutable.

Correct answer: B. Add a rule to the Network ACLs to allow outbound traffic on ports 1024 – 65535

Network ACLs are stateless, so return traffic needs its own outbound rule on the ephemeral range 1024-65535 used by Elastic Load Balancing. Security Groups are stateful and already allow return traffic automatically, so the fix must be on the NACL side. Note the option set is truncated, which lowers question quality.

Correct answer: B. Add a listener to the ALB. Update the AppSpec file to link the Lambda function to the BeforeAllowTraffic lifecycle hook.

CodeDeploy blue/green for ECS needs a second test listener on the ALB, and the BeforeAllowTraffic hook runs validation Lambda before traffic shifts to the new task set. AfterAllowTraffic runs too late, and listeners belong to the ALB, never to the deployment group. The options list is truncated, leaving only one real choice.

Correct answer: B. Leverage an IAM policy with the Amazon Cognito identity prefix to allow users access to just their own objects in Amazon S3

An IAM policy using the Cognito identity variable scopes each guest's temporary credentials to only their own S3 prefix, enforced at request time with no extra compute. Lambda or CloudFront validation proxies are over-engineered, and 450 MB files exceed API Gateway payload limits. The options list is truncated to one real choice.

Correct answer: B. An outbound rule must be added to the Network ACL (NACL) to allow the response to be sent to the client on the ephemeral port range

Network ACLs are stateless, so a custom NACL that allows inbound HTTP still blocks outbound responses unless an explicit outbound rule permits the ephemeral port range. Security groups are stateful, so the existing inbound HTTP rule already allows the return traffic with no extra configuration.

Correct answer: B. Use Amazon RDS Proxy and update the Lambda function to connect to the proxy

RDS Proxy pools and multiplexes database connections so many concurrent Lambda invocations share a small number of database connections, fixing connection limit errors without downtime. Resizing the instance does not fix connection exhaustion and typically requires a maintenance reboot.

Correct answer: D. Use AWS Lambda aliases

A Lambda alias with weighted routing splits invocation traffic, for example 90 percent stable and 10 percent new, behind a single ARN so clients never change. Tags, environment variables, and VPC configuration serve other purposes and cannot shift traffic between versions.

Correct answer: C. An Amazon ElastiCache for Redis cluster

ElastiCache for Redis provides a managed, low-latency in-memory store with Multi-AZ failover, decoupling sessions from any single instance. Exam cue: externalizing session state to ElastiCache is the standard pattern for a stateless, fault-tolerant web tier behind a load balancer.

Correct answer: D. Deploy the function with its memory allocation set to the maximum amount

Lambda scales vCPU proportionally with the configured memory, so raising memory is the only code-free way to boost compute. Exam cue: there is no separate CPU setting in Lambda; option C is invalid because CPU cannot be configured directly.

Correct answer: C. Update the items in the table using the TransactWriteItems operation to group the changes

TransactWriteItems groups up to 25 writes into one all-or-nothing atomic transaction, and its client token prevents duplicate effects when the same transaction is retried. BatchWriteItem is not atomic, so partial failures can occur, which fails the all-or-nothing requirement.

Correct answer: C. Implement a dead-letter queue for failed orders from the CrestlineSensorOrders queue

A dead-letter queue automatically receives messages that exceed maxReceiveCount, preserving the full body so failed orders can be inspected and reprocessed later. Logging alone does not keep the message reprocessable, and SNS or CloudTrail provide no reprocessing mechanism.

Correct answer: D. Create an AWS Lambda function that uses Amazon Simple Email Service to send an email notification to the security team. Configure this function as an Amazon Cognito post-authentication Lambda trigger

The Cognito post-authentication Lambda trigger fires only after a successful sign-in, so a Lambda function using SES to email the security team meets the requirement with minimal effort. The pre-authentication trigger fires before success, so it cannot notify only on successful logins.

Correct answer: A. Use the AWS KMS GenerateDataKey API to acquire a data key, use the data key to encrypt the data, and store both the encrypted data key and the data.

GenerateDataKey returns a plaintext data key and a copy encrypted under the KMS key, enabling envelope encryption with a unique key per file while keeping KMS calls off the data path. The KMS Encrypt API alone cannot handle large files or per-file keys efficiently.

Correct answer: A. Store a secret in AWS Secrets Manager and enable automatic rotation every 30 days

AWS Secrets Manager natively stores the connection string and provides built-in automatic rotation for Amazon RDS on a 30-day schedule with no custom code. Parameter Store SecureStrings have no native rotation, so option D would require writing and maintaining a Lambda rotation function.

Correct answer: A. Use AWS Secrets Manager via the AWS SDK to generate a secure string. Use a dynamic reference to create the DB instance with the secret value.

Secrets Manager can generate a random secret, and a CloudFormation dynamic reference injects it directly into MasterUserPassword without exposing plaintext. The custom Lambda option requires far more development effort, which violates the minimum-effort requirement.

Correct answer: D. 20 RCU and 60 WCU

The 4.5 KB item rounds up to 8 KB, and eventually consistent reads of an item up to 8 KB consume one RCU each, so 20 reads need 20 RCU. Writes round to 5 KB at 1 WCU per KB, so each write costs 5 WCU and 12 writes per second require 60 WCU.

Correct answer: A. Adaptive authentication

Adaptive authentication assigns a risk score to each sign-in and lets you automatically block attempts at elevated risk levels. Plain MFA challenges every user the same way and cannot react to contextual risk signals.

Correct answer: D. Amazon Cognito identity pools

Amazon Cognito identity pools federate SAML and social logins and exchange them for temporary AWS credentials, letting the app access S3 and DynamoDB directly. User pools only authenticate; when the scenario demands direct AWS resource access after federated sign-in, choose identity pools.

Correct answer: B. Linear

A linear deployment configuration like LambdaLinear10PercentEvery10Minutes shifts traffic in equal increments at fixed intervals. Canary shifts in larger staged steps with baking periods, so it does not match equal 10% increments every 10 minutes.

Correct answer: B. Use the DelaySeconds parameter

The DelaySeconds parameter postpones visibility of a newly sent SQS message for up to 15 minutes, which covers the 10-second requirement. Visibility timeout only hides messages already received, and long polling affects retrieval wait, not delivery delay.

Correct answer: C. Modify the CloudFormation template to retain the security group resource. Then manually delete the resource after deployment.

Setting a DeletionPolicy of Retain on the security group lets the stack delete successfully while leaving the resource in place for manual cleanup later. Manually deleting the resource first does not fix a stack already stuck in DELETE_FAILED without retaining it.

Correct answer: C. Use the Parallel Scan API operation and limit the rate

A parallel scan divides the table into segments scanned concurrently, and a rate limiter keeps consumption within the 4,000 spare RCUs so live traffic is unaffected. Simply adding RCUs raises cost, and FilterExpression still consumes full scan capacity.

Correct answer: B. Opt for Blue/Green deployment

A Blue/Green deployment in CodeDeploy provisions a replacement environment and then shifts traffic from the original one, matching the requirement exactly. In-place deployment updates existing instances instead, so it cannot provision a parallel environment.

Correct answer: D. Contact AWS Support to increase the concurrent execution limit

Forty invocations per second times 100 seconds each requires about 4,000 concurrent executions, exceeding the default 1,000 limit per Region, so a quota increase is mandatory. Error handling, X-Ray, and dead-letter queues address failures, not throttling from concurrency limits.

Correct answer: C. binpack

The binpack placement strategy packs tasks onto instances with the least available CPU or memory, minimizing the number of instances used. Spread distributes tasks evenly across instances for availability, which actually increases instance usage.

Correct answer: B. Use conditional writes

Conditional writes add a condition expression that rejects the update if the item changed since it was read, preventing silent overwrites. Atomic counters are meant for incrementing values, not for guarding concurrent updates against loss.

Correct answer: D. Use an Amazon Cognito identity pool, federate with the SAML provider, and use a trust policy with an IAM condition key to limit employee access

A Cognito identity pool federates the SAML provider and issues temporary AWS credentials, with a trust policy condition key like cognito-identity.amazonaws.com:sub scoping each user to their own data. User pools authenticate but don't grant scoped AWS credentials, so that distractor misses the authorization half.

Correct answer: B. AWS Cloud Development Kit (CDK)

The AWS CDK lets developers model infrastructure in general-purpose languages like Python, .NET, and TypeScript, then synthesizes CloudFormation templates. CloudFormation and SAM use declarative templates, which the scenario explicitly rules out.

Correct answer: B. Configure a high-resolution CloudWatch alarm and use Amazon SNS to send the alert.

A high-resolution CloudWatch alarm supports evaluation periods as short as 10 seconds, meeting the 30-second notification window when paired with SNS. Standard alarms evaluate at 60-second granularity at best, so the default-metric option cannot respond fast enough.

Correct answer: B. AWS Kinesis Data Streams

Kinesis Data Streams retains records for a configurable period and preserves per-shard ordering, letting multiple consumers replay the same records days apart. SQS deletes messages after consumption and Firehose delivers rather than stores for replay, so both fail the audit requirement.

Correct answer: D. If you create a stage variable to call a Lambda function through your API, you must add the required permissions. Update your Lambda function's resource-based AWS Identity and Access Management (IAM) policy so that it grants invoke permission to API Gateway

When API Gateway invokes a Lambda function through a stage variable, the function's resource-based policy must explicitly grant API Gateway invoke permission. The console only adds this automatically for direct integrations. Exam cue: a 500 error plus a stage variable points to missing resource-based policy permissions, not throttling.

Correct answer: C. CodeDeployDefault.LambdaCanary10Percent5Minutes

The canary configuration shifts 10 percent immediately, waits 5 minutes, then shifts the remaining 90 percent, finishing in the shortest total time. Exam cue: canary deployments use two steps, so they complete faster than linear configurations with many small increments.

Correct answer: C. Utilize the canary release deployment feature in API Gateway. Configure the canarySettings to redirect a portion of the API traffic

API Gateway's built-in canary release with canarySettings percentTraffic sends a chosen percentage of traffic to the new version with no custom logic. Exam cue: 'canarySettings' and 'percentTraffic' are the giveaways; avoid building your own Lambda traffic splitter or Route 53 tricks.

Correct answer: B. Configure an ECS task IAM role for the application to use.

An ECS task IAM role grants containers temporary, per-task credentials through the container credentials endpoint, eliminating long-lived keys. Exam cue: instance profiles apply to the whole EC2 host, not individual tasks, so the task role is the right scope for fine-grained access.

Correct answer: B. Use BatchGetItem

BatchGetItem fetches up to 100 items by primary key in one parallel call, minimizing latency compared to sequential GetItem calls. Exam cue: when items are known by key and you need many at once, think BatchGetItem, not Scan or Query with filters.

Correct answer: D. MessageDeduplicationId

MessageDeduplicationId is the producer-supplied token that stops duplicate delivery of the same logical message within the five-minute interval. ContentBasedDeduplication is a queue-level setting rather than a message parameter, which is why the wording about a message parameter points to the ID.

Correct answer: D. Use the DynamoDB Encryption Client to enable end-to-end protection using client-side encryption.

The DynamoDB Encryption Client encrypts items inside the application before submission, satisfying the requirement that data be encrypted before reaching DynamoDB. Server-side CMK options protect data only after DynamoDB receives it, and ACM handles TLS certificates, not item encryption.

Correct answer: D. Create an S3 bucket policy that denies any S3 Put request that does not include the x-amz-server-side-encryption header

A bucket policy with an explicit Deny on PutObject requests missing the x-amz-server-side-encryption header blocks unencrypted uploads before they are stored. Default SSE-S3 encryption is only a default and never rejects a noncompliant request.

Correct answer: D. Redirect requests on cache misses to the S3 bucket nearest to the user's country. Create a Lambda@Edge function to redirect requests based on the value of the CloudFront-Viewer-Country header. Associate the Lambda@Edge function with the distribution's origin request event

Origin request events fire only on cache misses, and only Lambda@Edge supports them, so the Lambda@Edge function on origin request runs the country-based redirect exactly when needed. CloudFront Functions support only viewer events, which fire on every request.

Correct answer: B. Use a write-through caching strategy.

Write-through writes to the cache and database synchronously, keeping them consistent while every record stays cached for low-latency reads. Lazy loading only caches on read, and TTL or invalidation leaves windows of inconsistency.

Correct answer: D. Implement Blue/Green (CNAME swap) deployment using Elastic Beanstalk. Prepare a separate environment with the new version of Node.js and the new code, and once testing is complete, swap the CNAMEs of the two environments.

Blue/Green deployment with a CNAME swap stands up a full second environment with the new Node.js platform and code, tested before traffic shifts with no downtime. In-place platform upgrades and manual instance swaps carry downtime risk.

Correct answer: D. The AWS credential provider looks for instance profile credentials last

The SDK's default credential provider chain checks environment variables before instance profile credentials, so the old access keys still win. Remember that the instance role is last in the chain, making managed-versus-inline policy distractors irrelevant here.

Correct answer: D. Use SQS long polling to retrieve messages from the Amazon SQS queues

Long polling lets SQS wait up to 20 seconds for messages, cutting empty responses and therefore billable API requests. Short polling returns immediately when the queue is empty, while visibility timeout and message timers control different behaviors.

Correct answer: B. The Load Balancer does not have stickiness enabled

Without sticky sessions, the load balancer spreads requests across all eight targets, so users hit instances lacking their session data and must re-authenticate. Enabling ALB stickiness with the AWSALB cookie keeps each client on its original target.

Correct answer: C. Use Cognito Authentication via Cognito User Pools for your Application Load Balancer

The ALB authenticate action natively integrates with Cognito User Pools on an HTTPS listener, offloading authentication with no custom code. Identity Pools grant AWS credentials rather than authenticating users, so they do not fit this requirement.

Correct answer: D. Configure an Amazon SNS topic as an on-failure destination

An SNS topic configured as a Lambda on-failure destination automatically publishes the failed execution record, including error details, and notifies subscribers by email or SMS. SQS only queues failed records for later processing; it does not actively alert people, so it fails the notification requirement.

Correct answer: B. Create a role with the required permissions in the Production and Testing accounts and have the developer assume that role

Cross-account access uses an IAM role in each target account with a trust policy allowing the Development account, and the developer assumes it via STS for temporary credentials. Duplicate IAM users create long-term credential sprawl, and IAM groups cannot contain users from a different account.

Correct answer: C. Create a global secondary index with a partition key of "artist_name" and a sort key of "TopScore", and retrieve the results based on the score attribute

A global secondary index allows a completely different partition and sort key, here artist_name plus TopScore, so a Query returns the top score per artist efficiently. A local secondary index must keep the base table's partition key, and a Scan reads the whole table.

Correct answer: B. Set up Amazon RDS with one or more read replicas. Refactor the application code so that the queries use the endpoint for the read replicas

RDS read replicas offload read-heavy workloads using standard SQL against the replica endpoint, requiring only a small connection-string change. ElastiCache options demand application-level caching logic, and Multi-AZ standby instances cannot serve reads at all.

Correct answer: A. Set up an AWS CloudFormation template that defines the load test resources. Leverage the AWS CLI create-stack-set command to create a stack set in the desired Regions

CloudFormation StackSets deploy the same template across multiple Regions in one operation using the create-stack-set CLI command, requiring no new code. CDK would require new code, and AWS Organizations is not an infrastructure template service.

Correct answer: B. Issue the AWS KMS GenerateDataKey API to return an encryption key.

GenerateDataKey returns a plaintext key plus its encrypted copy for envelope encryption, the required pattern since KMS Encrypt only handles payloads up to 4 KB. Some argue D is defensible because 750 KB technically exceeds the 4 KB direct-Encrypt limit, making B the intended envelope-encryption answer.

Correct answer: C. Create a new version of the Lambda function. Build a new stage on API Gateway integrated with this new Lambda version. Utilize this new API Gateway stage for beta testing.

Publishing a new Lambda version and pointing a separate API Gateway stage at it gives beta testers an isolated endpoint while existing users stay on the current stage and alias. CodeDeploy traffic splitting mixes beta users with production traffic, which fails the isolation requirement.

Correct answer: C. Immutable

The Immutable policy launches a fresh fleet on a temporary Auto Scaling group and keeps the originals untouched, so a failed health check rolls back almost instantly. Rolling with additional batch is cheaper but rollback requires redeploying batches, which is slower.

Correct answer: A. Move the database connection logic outside of the handler function

Moving the database connection into the global scope outside the handler lets warm invocations reuse it, removing repeated connection setup cost. Exam cue: initialize SDK clients and DB connections outside the handler; otherwise environment reuse saves almost nothing.

Correct answer: C. Immutable

An immutable deployment launches fresh instances in a new Auto Scaling group, keeps the old environment serving traffic, and rolls back cleanly by terminating the new group. Exam cue: immutable is the pick when the scenario demands both zero downtime and fast, safe rollback.

Correct answer: D. Encrypt the data directly with a customer managed customer master key

Files of 1 KB fall under the 4 KB limit for direct KMS Encrypt calls, and a customer managed key gives full control over policy and rotation while key material stays inside KMS. Envelope encryption with a data key is meant for larger payloads and adds key-handling risk.

Correct answer: A. Create an IAM role for EC2

An IAM role attached through an instance profile delivers automatically rotating temporary credentials to the SDK or CLI on the instance, with no static secrets stored. Putting credentials in user data or running aws configure stores long-term keys on disk, which the requirement explicitly forbids.

Correct answer: B. Use ResultPath in a Catch statement to include the original input with the error.

ResultPath in a Catch statement appends the captured error to the original input instead of replacing it, so both appear in the state output. Exam cue: merging error data with input is a ResultPath job; InputPath and OutputPath only filter, and they do not work inside Retry.

Correct answer: B. Use a FIFO queue and configure the Lambda function to add a message deduplication token to the message body

SQS FIFO queues with a message deduplication ID or content-based deduplication discard duplicates arriving within the five-minute window. Message group IDs only control ordering, so that distractor does not stop duplicate deliveries.

Correct answer: B. Create an alias, assign the current and new versions, and use traffic shifting to assign a percentage of traffic to the new version

A Lambda alias pointing at two versions supports weighted traffic shifting, so the developer can ramp traffic to the new version and instantly revert weights for rollback. Options like Route 53 weighted routing or load balancers target DNS-addressable resources, not Lambda versions.

Correct answer: C. Create a ZIP file with the source code and all dependent libraries

A Lambda deployment package must bundle the source code together with any dependent libraries that the base runtime does not include. Exam cue: when libraries are missing from the native runtime, zip them into the deployment package or use a Lambda layer; Lambda cannot install packages at invocation time.

Correct answer: C. Set the ConsistentRead parameter to true when calling GetItem.

DynamoDB defaults to eventually consistent reads, which can return stale data right after a write; setting ConsistentRead to true on GetItem forces the latest committed data. Distractor cue: DAX is a read cache and actually worsens staleness rather than fixing it.

Correct answer: B. IAM Access Analyzer

IAM Access Analyzer continuously evaluates resource-based policies and flags resources shared outside your zone of trust, catching unintended public or cross-account S3 exposure automatically. Exam cue: Access Advisor only shows when IAM entities last used their permissions, not whether buckets are exposed.

Correct answer: D. Create an Amazon Elastic File System (EFS) file system.

Amazon EFS provides a fully managed, elastic NFS file system that multiple EC2 instances and Lambda functions can mount concurrently with no capacity planning. Exam cue: EBS Multi-Attach is limited to EC2 within one Availability Zone and cannot be used by Lambda at all.

Correct answer: D. Create a custom metric in CloudWatch and make the instances send data to it using PutMetricData. Then, create an alarm based on this metric

CloudWatch does not collect EC2 memory metrics by default, so the instances must publish RAM usage as a custom metric via PutMetricData and scaling alarms are built on that metric. Exam cue: detailed monitoring only changes granularity of existing metrics, never creates new ones.

Correct answer: D. Upload the bundle to an Amazon S3 bucket and specify the S3 location when performing a deployment using AWS CodeDeploy

CodeDeploy pulls application revisions from Amazon S3 or GitHub, so an externally built package must be uploaded to S3 before deployment to EC2. Exam cue: CodeBuild builds and tests while CodeCommit hosts source; neither deploys artifacts, and CodeDeploy cannot read a local on-premises file system.

Correct answer: C. Put the two containers into a single task definition using a Fargate launch type

Containers placed in the same ECS task definition share the task's CPU, memory, network namespace, and volumes, while Fargate removes server management entirely. Exam cue: the words serverless plus shared resources point to a single task definition with the Fargate launch type.

Correct answer: D. The Lambda function does not have IAM permissions to write to DynamoDB

The function's execution role must explicitly grant DynamoDB write actions like dynamodb:PutItem on the target table; a successful S3 trigger does not confer downstream permissions. Exam cue: trigger works but a specific API call fails almost always means missing IAM permissions on the execution role.

Correct answer: B. Create six separate IAM roles, each containing the required permissions for the associated ECS service, then configure each ECS task definition to reference the associated IAM role

Task IAM roles give each task definition its own scoped credentials, so each of the six services gets only the permissions it needs, following least privilege. Exam cue: instance profiles apply to the whole EC2 host and grant every container the same broad permissions.

Correct answer: D. Use a Lambda function alias that can point to the different versions

A Lambda alias is a mutable pointer with a stable ARN that can be repointed to any published version, giving an instant rollback with no extra infrastructure. CodeDeploy offers traffic shifting but adds pipeline overhead, making it more than needed for simple rollback.

Correct answer: D. Copy the AMI from the us-east-1 Region to the us-west-1 Region and use the new AMI ID in the CloudFormation template.

AMIs are Region-specific, so the fix is to copy the AMI to us-west-1 and reference the new AMI ID in the template. Cross-Region AMI references fail outright, and rebuilding or generating the AMI with Lambda adds unnecessary operational complexity.

Correct answer: B. { "Version":"2012-10-17", "Id":"PutObjectPolicy", "Statement":[{ "Sid":"DenyUnEncryptedObjectUploads", "Effect":"Deny", "Principal":"*", "Action":"s3:PutObject", "Resource":"arn:aws:s3:::northbridge-meter-readings/*", "Condition":{ "StringNotEquals":{ "s3:x-amz-server-side-encryption":"aws:kms" } } } ] }

A Deny on s3:PutObject with StringNotEquals s3:x-amz-server-side-encryption aws:kms blocks any upload that doesn't request SSE-KMS. The strongest distractor uses StringEquals aws:kms, which would deny exactly the uploads you want to allow.

Correct answer: D. Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)

SSE-KMS with a customer-managed CMK gives full control over creating, rotating, and deleting keys while AWS manages the cryptographic infrastructure. SSE-S3 offers no customer key control, and SSE-C moves the entire key management burden onto the customer.

Correct answer: C. AWS X-Ray

AWS X-Ray provides distributed tracing across services and supports cross-account aggregation of trace data, so it fits the multi-account debugging scenario. CloudTrail only records API activity, so it cannot trace requests flowing through applications.

Correct answer: B. Create a deny list and specify the API actions to deny

A service control policy set up as a deny list permits everything by default and blocks only the named API actions, leaving existing permissions intact. An allow-list SCP would require listing every permitted action and risks accidentally blocking other permissions.

Correct answer: C. A new deployment of the last known working version of the application is deployed with a new deployment ID

With automatic rollback enabled, CodeDeploy redeploys the last known good revision as an entirely new deployment with its own new deployment ID. CodeDeploy does not restore snapshots or reuse old deployment records, so options about S3 snapshots and CodePipeline fail.

Correct answer: B. Use the Enhanced Fan-Out feature of Kinesis Data Streams

Enhanced Fan-Out gives each registered consumer dedicated 2 MB per second read throughput per shard, eliminating the shared-throughput contention causing lag. SQS cannot preserve the ordered, real-time stream consumption semantics that multiple Kinesis consumers need.

Correct answer: C. Origin response

An origin-response trigger runs after the origin returns the 404, letting the function rewrite it as a redirect, and the response can be cached to reduce invocations. A viewer-request trigger would fire on every request before the cache, increasing invocations and cost.

Correct answer: C. Security groups are stateful, so allowing inbound traffic to the necessary ports enables the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic

Security groups are stateful, so inbound rules automatically permit return traffic, but network ACLs are stateless and need explicit outbound rules for ephemeral ports. When inbound rules look correct but connections fail, check the NACL outbound ephemeral range first.

Correct answer: A. Create an Amazon ElastiCache for Redis cluster, then implement session handling at the application level to leverage the cluster for session data storage

ElastiCache for Redis is an in-memory store, giving the lowest latency for external session state while keeping web servers stateless. DynamoDB and EFS introduce disk I/O latency, and Redshift is a data warehouse unsuitable for session handling.

Correct answer: D. Amazon ElastiCache for Redis in cluster mode

ElastiCache for Redis in cluster mode supports encryption at rest and in transit plus automatic failover across shards, meeting both requirements. Memcached offers neither encryption nor replication, making it the classic wrong choice when those keywords appear.

Correct answer: C. Enable DynamoDB Accelerator (DAX) for DynamoDB and CloudFront for S3

DAX is a fully managed, API-compatible cache for DynamoDB that speeds read-heavy workloads with no code changes, and CloudFront caches S3 static content at edge locations. ElastiCache cannot front DynamoDB or S3 the way these purpose-built services do.

Correct answer: C. Blue/green with canary

The blue/green deployment type in CodeDeploy supports a canary traffic-shifting option that shifts a small percentage first, waits a configured interval, then shifts the remaining traffic at once. Exam cue: "shift X% first, wait, then shift the rest" always identifies the canary strategy, while linear shifts in equal repeated increments.

Correct answer: B. Enable SQS KMS encryption

Enabling SQS server-side encryption with AWS KMS encrypts message bodies at rest through a queue configuration setting, requiring no application code changes. Exam cue: SSL endpoints protect data in transit, and client-side encryption or Secrets Manager would require code changes, so KMS SSE is the only configuration-only option.

Correct answer: C. Use the sam sync command from the AWS Serverless Application Model (AWS SAM) to deploy incremental changes

The sam sync command detects local code and infrastructure changes and pushes only the changed resources using direct API calls instead of a full CloudFormation update, which minimizes deployment time. Exam cue: for fast iterative SAM testing, remember sam sync; sam deploy performs the full CloudFormation deployment the team wants to avoid.

Correct answer: B. Use AWS Lambda triggered by DynamoDB Streams to process the records

DynamoDB Streams captures item-level changes, and AWS Lambda can be triggered on the stream without any change to the existing write logic, giving near-real-time event-driven processing. Exam cue: reacting to DynamoDB item changes with minimal code changes is the standard DynamoDB Streams plus Lambda serverless pattern.

Correct answer: D. Use Amazon DynamoDB to perform scalable session handling

DynamoDB stores session data outside the EC2 instances in a shared, durable data store, so any surviving instance can read it after a failure. Exam cue: sticky sessions and connection draining control traffic routing, not data durability, so look for a shared external store like DynamoDB or ElastiCache.

Correct answer: D. Deploy the API versions as unique stages with unique endpoints and use stage variables to provide further context

Each API Gateway stage is a named reference to a deployment with its own unique endpoint, and stage variables can point each stage at a different Lambda alias to run versions side by side. Exam cue: the words "stages" and "stage variables" signal the standard API Gateway mechanism for managing API versions.

Correct answer: C. Restrict access to specific items based on certain primary key values

DynamoDB fine-grained access control with the dynamodb:LeadingKeys condition key maps row access to the caller's identity, so each customer reaches only their own items in a shared table. Identity-based table-level policies cannot restrict individual items, and client-side filtering leaks data before filtering.

Correct answer: C. Deploy AWS Secrets Manager to store database credentials and set up automatic weekly rotation.

AWS Secrets Manager natively supports scheduled automatic rotation, including a built-in Lambda rotation function for Amazon RDS, satisfying weekly rotation with no manual work. Environment variables and S3 require manual updates, and IAM database authentication does not rotate passwords.

Correct answer: B. Keep the API key in AWS Secrets Manager, and fetch the API key at runtime by using the AWS SDK to make the API call

AWS Secrets Manager is purpose-built for storing and retrieving secrets like third-party API keys at runtime via the SDK, and its client-side caching library keeps latency negligible. Hardcoding in a local variable exposes the key, while RDS and S3 add unnecessary management overhead for a single secret.

Correct answer: B. Increase the function's memory

In Lambda, memory allocation proportionally controls CPU and network resources, so increasing memory is the direct way to speed up a CPU-bound function. Provisioned concurrency only removes cold starts, and a higher timeout just allows longer runs without making execution faster.

Correct answer: C. Amazon Elastic File System (EFS) Standard-IA storage class

EFS Standard-IA cuts storage costs for infrequently accessed files while keeping millisecond access and concurrent mounting across many EC2 instances. S3 Standard-IA is not a shared file system, and EBS volumes can only attach to one instance at a time, ruling both out.

Correct answer: B. Configure a VPC endpoint for DynamoDB that will provide the required internal access without using the public internet

A VPC gateway endpoint for DynamoDB routes traffic over the AWS private network with no code changes and no internet path. Internet gateways and NAT gateways still traverse public address space, and a corporate VPN adds cost and complexity without a direct private route.

Correct answer: D. Invoke the Lambda function asynchronously with the invocation type Event and process the files in parallel

Event invocation is asynchronous, so the CLI returns immediately and all files can be invoked in parallel, letting Lambda process them concurrently. RequestResponse blocks the caller until each three-minute run finishes, and the mismatched pairings pair the wrong type with the wrong mode.

Correct answer: D. Query operation using eventually consistent reads

A Query reads only items matching the index key, and eventually consistent reads consume half the RCUs of strongly consistent reads, so that combination uses the least capacity. A Scan reads every item, making it the most expensive option regardless of consistency.

Correct answer: B. Use an approval action in a stage before deployment

A manual approval action placed in a stage before the deployment stage stops the pipeline until an authorized IAM user approves or rejects it. Disabling stage transitions is a legacy console technique and does not provide a true sign-off workflow like approval actions do.

Correct answer: D. The health check type of the instance's Auto Scaling group must be changed from EC2 to ELB by using a configuration file

The Auto Scaling group defaults to the EC2 health check type, which only sees system status, so ELB-detected application failures are ignored until the type is switched to ELB. Exam cue: load balancer says unhealthy but the instance is never replaced means the health check type is still EC2.

Correct answer: D. The cluster name parameter has not been updated in the /etc/ecs/ecs.config file during bootstrap

The ECS container agent reads ECS_CLUSTER from /etc/ecs/ecs.config during bootstrap, so a user data script that doesn't insert the new parameter causes instances to join the old cluster. IAM, security groups, and the agent image do not control cluster registration.

Correct answer: C. Use Amazon Kinesis Data Streams with the Kinesis Client Library to ingest and deliver messages

Kinesis Data Streams handles continuous, high-throughput real-time ingestion from many producers, with the KCL consuming records as they arrive for live dashboards. SQS with EC2 lacks ordered, scalable stream replay, and Data Pipeline and S3 are batch-oriented.

Correct answer: C. Add a connection string to use an Amazon RDS read replica for read queries

An RDS read replica lets the code use a separate connection string to route read queries to a read-only copy, scaling read throughput horizontally. Multi-AZ improves availability, not read performance, and EC2-based replicas add unneeded operational work.

Correct answer: D. IAM policy variables

IAM policy variables like ${aws:username} let one policy dynamically scope each user to their own folder path, such as user/${aws:username}/. A Condition element is for contextual attributes like IP or MFA, not for building per-user resource paths.

Correct answer: A. 300 Read Capacity Units

A 12 KB item rounds up to three 4 KB blocks, needing 3 RCUs for strongly consistent reads, and eventually consistent reads cost half, so 1.5 RCUs per read times 200 reads per second equals 300 RCUs. Exam cue: for eventual consistency, divide item size by 8 KB before multiplying by reads per second.

Correct answer: B. Use the CloudFront signed URL feature to control access to the file

A CloudFront signed URL attaches expiration and access conditions to one specific file, giving precise per-object control for sharing a single restricted document. Exam cue: signed cookies suit multiple files behind one distribution, while signed URLs are the go-to for one restricted file.

Correct answer: A. Deploy the API versions as unique stages with unique endpoints and use stage variables to provide the context to identify the API versions

Deploying each API version as a separate stage with its own endpoint, plus stage variables pointing to the matching Lambda alias, is the built-in API Gateway versioning pattern. A custom header requires duplicated routing logic, and Lambda authorizers are for authentication, not version routing.

Correct answer: B. Use AWS Amplify for hosting, connect corresponding repository branches, and initiate deployments by merging changes to the needed branch.

AWS Amplify provides fully managed static hosting with Git-based deployments, per-branch environments, and HTTPS by default, matching every requirement with the least overhead. Elastic Beanstalk and EC2 still require server management, and the S3 option relies on manual scripts.

Correct answer: A. Use the AWS CLI associate-kms-key command and specify the KMS key ARN

The associate-kms-key CLI command attaches a KMS key to an existing log group without recreation, encrypting all newly ingested data. create-log-group only applies at creation time, and describe-log-groups is read-only, so neither works for a group already in use.

Correct answer: D. Install the CloudWatch agent on the on-premises servers and specify IAM credentials with permissions to CloudWatch

The CloudWatch agent installed on-premises sends both metrics and logs to CloudWatch, and because instance metadata doesn't exist outside AWS, it authenticates with long-term IAM user credentials, not an IAM role. Exam cue: on-premises plus CloudWatch agent always means IAM credentials.

Correct answer: B. Enable S3 Transfer Acceleration on the S3 bucket

S3 Transfer Acceleration routes uploads through CloudFront edge locations and the AWS backbone, speeding up transfers from distant offices with almost no operational effort. Multipart upload helps large objects but doesn't address geographic latency, and Direct Connect requires heavy setup.

Correct answer: D. Add annotations to the custom subsegments

Annotations are indexed key-value pairs that X-Ray can use in filter expressions and the GetTraceSummaries API, which is exactly what filtering requires. Metadata is the strongest distractor, but it is not indexed, so it can't be searched with filter expressions.

Correct answer: C. Contact AWS and request an increase to the account's concurrent execution limit

Forty invocations per second at eighty seconds each requires 3,200 concurrent executions, well above the default 1,000 limit, so only an AWS Support limit increase can prevent throttling. Reserved concurrency just partitions existing account capacity; it cannot raise the ceiling.

Correct answer: D. Add exponential backoff to the application logic

Exponential backoff spaces retries with progressively longer waits, easing pressure on the throttled table, and since no AWS SDK exists for the language, the retry logic must be written manually in the application. Cue: ThrottlingException plus no SDK means hand-rolled backoff.

Correct answer: D. The Lambda function did not handle the error, and the Lambda service attempted to reprocess the data

With a Kinesis event source mapping, Lambda only advances in the stream after a batch succeeds, so the unhandled error caused the same batch to be retried and reprocessed downstream. The pointer option is a distractor because developers don't manage that position themselves.

Correct answer: D. Set the RidgewoodMemeQueue's ReceiveMessageWaitTimeSeconds attribute to 20 seconds

Setting ReceiveMessageWaitTimeSeconds to 20 enables long polling, so ReceiveMessage waits for messages instead of returning empty responses, cutting billed API calls and cost. VisibilityTimeout controls redelivery of in-flight messages and has nothing to do with empty responses.

Correct answer: C. Create aliases and versions in AWS Lambda.

A Lambda alias is a stable pointer to a function version, so pointing the API Gateway integration at the alias ARN lets code updates happen without changing the API configuration. API Gateway stages and deployments control the API itself, not the Lambda target, so they do not solve this.

Correct answer: B. The createUsagePlanKey method must be called to associate the newly created API key with the correct usage plan

A newly created API key must be linked to a usage plan via createUsagePlanKey before API Gateway will accept it, which explains the 403 for new users only. Redeployment isn't needed because API keys are validated per request, not baked into a deployment.

Correct answer: C. Create a Docker image that runs the AWS X-Ray daemon, upload it to a Docker image repository, and deploy it to Beacon Corporation's Amazon ECS cluster.

For ECS, the recommended pattern is packaging the X-Ray daemon as its own container image deployed alongside the instrumented microservices so segments are sent over the local network. The EC2-instance option fails because ECS containers can't reliably reach a daemon on a separate host.

Correct answer: B. Use SSM Parameter Store

AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data that the application can query dynamically at runtime through the SDK or CLI, without redeploying. Exam cue: "externally managed, secure, dynamically loaded configuration without redeployment" points directly to Parameter Store, not environment variables or S3.

Correct answer: B. Elastic Beanstalk will replace the failed instances with instances running the application version from the most recent successful deployment

The Auto Scaling group behind the Elastic Beanstalk environment automatically replaces terminated instances using the most recently successfully deployed application version. Exam cue: replacement always references the latest successful deployment, not the oldest version and not the pre-deployment version.

Correct answer: B. The function execution role does not have permission to write log data to CloudWatch Logs.

The Lambda execution role must grant logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions; without them, the function still succeeds but silently writes no logs. Exam cue: successful invocations with zero log output after several minutes is the classic sign of a missing execution role IAM policy.

Correct answer: B. Use the 'Export' field in the Outputs section of the stack's template

The producing stack declares the value in its Outputs section using the Export field, making it available to other stacks in the same account and Region. Fn::ImportValue is the read side, used in the consuming stack, so it can't publish the value itself.

Correct answer: B. Use the awslogs log driver to configure the containers in your tasks to send log information to CloudWatch Logs. Add the required logConfiguration parameters to your task definition

The awslogs log driver with logConfiguration in the task definition streams container logs to CloudWatch Logs, the standard pattern for Fargate. Option A is a duplicated question stem rather than an answer, so only one real choice exists here.

Correct answer: D. Set the ReceiveMessage API with a WaitTimeSeconds of 20

Long polling is enabled by setting WaitTimeSeconds greater than zero on ReceiveMessage, up to the 20-second maximum, so SQS waits for messages and returns fewer empty responses. VisibilityTimeout, DelaySeconds, and MessageRetentionPeriod control other behaviors and do not affect polling cost.

Correct answer: B. GraphQL API on AWS AppSync

AWS AppSync GraphQL APIs can resolve fields from multiple data sources like Lambda and DynamoDB in a single query, minimizing endpoints and calls. REST on API Gateway would require multiple endpoints or a proxy that aggregates data.

Correct answer: B. Call the ReceiveMessage API with the WaitTimeSeconds parameter set to 20

Setting WaitTimeSeconds to 20 enables long polling, so SQS waits for messages instead of returning empty responses, cutting API calls and cost. VisibilityTimeout controls redelivery, not polling cost.

Correct answer: C. Create a Change Set

A Change Set previews how proposed template or parameter changes will affect a running stack without applying anything until executed. Drift detection only compares actual resources to the template; it does not preview pending updates.

Correct answer: C. Import the third-party SSL/TLS certificate to AWS Certificate Manager (ACM), link it with the custom domain name in API Gateway, and then create an alias (A) record in Route 53 for the custom domain name.

API Gateway custom domain names only accept certificates managed through ACM, so a third-party certificate must be imported into ACM and linked to the custom domain name. Then an alias A record in Route 53 points the domain to the API, since alias records natively target AWS service endpoints.

Correct answer: B. Move the Amazon S3 client initialization out of the function handler

Initializing SDK clients like the Amazon S3 client outside the function handler lets the warm execution environment reuse them across invocations, cutting latency and cost. Adding memory or X-Ray may help other bottlenecks but does not implement execution context reuse.

Correct answer: B. Increase the amount of memory available to the Lambda functions

In Lambda, the memory setting also controls the proportional CPU and network allocation, so raising memory directly speeds up CPU-bound functions. Reserved or provisioned concurrency addresses cold starts and throughput, not the compute power of each invocation.

Correct answer: B. Define an appspec.yml file in the root directory

The appspec.yml file belongs in the root directory and is required by AWS CodeDeploy to map files, set permissions, and define lifecycle event hooks. buildspec.yml is a CodeBuild concept and cannot set deployed file permissions or validate deployments.

Correct answer: C. Increase the RAM assigned to the Lambda function

Raising the memory allocation in Lambda proportionally increases CPU and network resources, improving compute-heavy performance with no code changes. Changing the runtime or timeout either requires code changes or only lets slow functions finish without running faster.

Correct answer: C. Application Load Balancer + Amazon ECS

Amazon ECS with an Application Load Balancer supports dynamic port mapping, letting multiple tasks from one service share a container instance behind different ephemeral ports. Classic Load Balancer cannot do dynamic port mapping, and Elastic Beanstalk does not fit the multi-task requirement as cleanly.

Correct answer: A. AWS X-Ray

AWS X-Ray traces requests end to end through API Gateway, Lambda functions, and Lambda authorizers, showing latency and errors at each hop. CloudWatch only gives logs and metrics per service, not a distributed request trace, so it cannot pinpoint where failures originate.

Correct answer: D. AWS CodeDeploy

AWS CodeDeploy automates deployments to Amazon EC2, Lambda, Fargate, and on-premises servers, making it the only option covering both environments. CodePipeline orchestrates the pipeline, and CodeBuild compiles and tests code, but neither deploys directly to on-premises servers.

Correct answer: C. WebSocket APIs

WebSocket APIs keep a persistent bidirectional connection so the backend can push real-time alerts to clients without polling. REST and HTTP APIs are request-response only, so they would require polling, which the scenario explicitly rules out.

Correct answer: B. Use Amazon Simple Notification Service (SNS) to push notifications when an order is created. Configure different Amazon Simple Queue Service (SQS) queues to receive these messages for downstream processing

The SNS-to-SQS fanout pattern pushes a notification on order creation, replacing the cron poller, while each SQS queue durably holds messages for independent downstream consumers. Lambda-only processing lacks the durable queuing reliability the scenario emphasizes.

Correct answer: C. Retry the call with exponential backoff

Retrying with exponential backoff and jitter is the standard first response to CloudWatch ThrottlingException, spreading attempts over time to avoid the rate limit. AWS SDKs often do this automatically; limit increases are a later step, not the first.

Correct answer: B. Stack B, then Stack C, then Stack A

CloudFormation blocks deletion of a stack while its exported outputs still have importers, so Stack B and Stack C must go before Stack A. Practical cue: always delete importing stacks first, then the exporting stack last.

Correct answer: A. Implement a cross-region read replica in the region where the reporting application will run

A cross-Region read replica gives the reporting app a local read-only copy with low latency and no load on the primary. A snapshot restore is one-time and goes stale, and Multi-AZ targets failover, not cross-Region read scaling.

Correct answer: A. Create a high-resolution custom Amazon CloudWatch metric for user activity data, then publish data every 5 seconds

High-resolution custom metrics support one-second granularity, and publishing every 5 seconds fits inside the 15-second window. Standard resolution only aggregates at one-minute intervals, so no publishing frequency with it can trigger scaling in 15 seconds.

Correct answer: C. Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access to resources

Amazon Cognito identity pools support unauthenticated guest identities mapped to a limited IAM role with temporary credentials. Option A describes authenticated users via user pools, which does not fit users who never log in.

Correct answer: A. SSE-C

SSE-C requires a plain-text customer-supplied key with every request, so S3 rejects it over HTTP to protect the key. SSE-KMS and SSE-S3 work over either protocol since no key travels with the request.

Correct answer: D. Use AWS KMS with automatic key rotation

SSE-KMS with automatic key rotation lets AWS rotate the key material yearly with a single setting and no code. SSE-C and imported key material require you to rotate keys yourself, so they are not the easiest path.

Correct answer: D. Exported output values in CloudFormation must have unique names within a single Region

CloudFormation export names must be unique per account and per Region, so the second stack exporting ELBDNSName in us-east-2 fails. The same export name in different Regions would be fine, which rules out the cross-Region options.

Correct answer: D. Add annotations to the segment document

X-Ray indexes annotations, simple key-value pairs, so they work in filter expressions and GetTraceSummaries. Metadata supports richer data types but is not indexed, so it cannot be used for filtering traces.

Correct answer: B. ALB access logs

ALB access logs record every request with client IP, latency, and path, which is exactly the per-request detail needed. CloudWatch metrics are aggregated and lack client IP data, so they cannot support this analysis.

Correct answer: D. kms:GenerateDataKey

Encrypting large datasets requires envelope encryption, so the key policy must allow kms:GenerateDataKey to produce data encryption keys. The existing Encrypt and Decrypt permissions alone cannot generate data keys for local bulk encryption.

Correct answer: B. Use an IAM role

An IAM role attached through an instance profile delivers temporary, auto-rotated credentials automatically, avoiding hardcoded keys. Storing access keys on the instance is an anti-pattern the exam consistently penalizes.

Correct answer: D. Enable CodeBuild timeouts

CodeBuild's timeout setting automatically terminates builds that run too long, such as those stuck resolving external dependencies. CloudWatch only monitors after the fact and cannot enforce an execution limit.

Correct answer: B. Leverage the capabilities offered by ElastiCache for Redis with cluster mode enabled

ElastiCache for Redis with cluster mode enabled supports horizontal scaling by adding shards and provides native geospatial commands plus rich query capabilities. Cluster mode disabled only scales vertically with read replicas, so it cannot grow write capacity as sensor coverage expands.

Correct answer: C. Enable storage auto scaling for the Amazon RDS for MySQL instance

RDS storage auto scaling automatically grows allocated storage when free space runs low, with a single configuration change and no application changes. Migrating to Aurora or DynamoDB may work technically but requires far more effort than the minimum asked for.

Correct answer: B. Create an IAM role in Account B with access to DynamoDB. Modify the trust policy of the role in Account B to allow the execution role of Lambda to assume this role. Update the Lambda function code to add the AssumeRole API call

The trust policy belongs on the role in the resource-owning Account B, and the Lambda code calls AssumeRole to get temporary credentials. Option A fails because trust policies live on the role being assumed, not on the caller's execution role.

Correct answer: C. Set up an Amazon EventBridge rule that uses CodePipeline as an event source with the target as the Lambda function

An EventBridge rule with CodePipeline as the event source and Lambda as the target fires automatically on pipeline state changes. CloudWatch alarms monitor metrics, not pipeline state transitions, so they cannot detect these events.

Correct answer: C. Create four distinct IAM roles, each containing the required permissions for the associated ECS services, then configure each ECS task definition to reference the associated IAM role

Task IAM roles are attached per task definition, giving each service exactly the permissions it needs without sharing the EC2 instance profile. Referencing roles at the service level or via the instance profile grants broader, shared access that violates least privilege.

Correct answer: A. Deploy each API version as a unique stage with a unique endpoint, and use stage variables to provide further context

Each API Gateway stage points to a deployment snapshot with its own invoke URL, so deploying each version as a separate stage runs them side by side. Stage variables then let each stage point to a different Lambda alias or function version for the backend.

Correct answer: B. Use envelope encryption and reference the data as a file within the code

Envelope encryption encrypts the large payload locally with a data key while KMS protects only that small key, so payloads over 5 MB work fine as a file in the deployment package. KMS direct encryption is capped at 4 KB, and environment variables are too small for this data.

Correct answer: C. Setup an alias that will point to the latest version

A Lambda alias is a pointer with its own stable ARN that can be repointed to each newly published version, so callers never change. An unqualified ARN resolves only to the unpublished $LATEST code, not to a published, immutable version.

Correct answer: D. CodeDeploy agent

The CodeDeploy agent archives revisions on instances and its max_revisions setting controls retention, so setting it to 2 meets the requirement. CodePipeline only orchestrates deployment stages and cannot limit revision archives on the instance.

Correct answer: D. Use a caching strategy to write to the backend first and then invalidate the cache

Writing to the backend first and immediately invalidating the cache guarantees reads fetch fresh data, meeting the strict consistency requirement. Relying on TTL expiration alone can serve stale prices for hours, which caused the original dispute.

Correct answer: A. Activate caching in API Gateway.

Enabling the built-in API Gateway cache stores responses for a TTL period, cutting backend Lambda calls and reducing latency. ElastiCache adds operational complexity that the native caching feature handles directly.

Correct answer: B. Configure the application to fetch the variables and credentials from AWS Systems Manager Parameter Store by leveraging hierarchical unique paths in Parameter Store for each variable in each of Pinegrove Ventures' environments

Parameter Store securely holds configuration values and uses hierarchical paths so each environment can organize its own variables with minimal code changes. KMS is a key management service, not a configuration store, so option A is not a practical fit.

Correct answer: B. You have a hot partition

One partition receiving disproportionate traffic while total capacity has headroom is the classic hot partition scenario, causing the throttling exception. The fix is redesigning the partition key for even distribution, since capacity is not shared account-wide.

Correct answer: B. X-Ray sampling

X-Ray sampling only controls which requests get recorded once delivery works, so it cannot diagnose a total delivery failure. The daemon status, instance role permissions, and CloudTrail logs all help find the actual connectivity or authorization problem.

Correct answer: B. Retrieve the messages from the queue using long polling with a wait time of 15 seconds

Long polling keeps the ReceiveMessage request open until a message arrives, so infrequent messages are picked up immediately. Short polling on an interval adds up to the full interval of delay and can even miss messages on unchecked servers.

Correct answer: B. Update the S3 bucket policy to include a condition that requires aws:SecureTransport for all actions.

A bucket policy denying requests where aws:SecureTransport is false enforces HTTPS regardless of caller identity. Server-side encryption protects data at rest and does nothing for connections in transit.

Correct answer: A. Configure the Lambda function to connect to the VPC using the private subnet and the security group needed to access the RDS instance

Configuring the Lambda function's VPC settings with the private subnet and matching security group creates ENIs that reach the RDS instance directly. Environment variables and layers only pass configuration or code; they provide no network path into the VPC.

Correct answer: B. Use VPC Flow Logs to check the inbound and outbound traffic of Subnet-Y.

VPC Flow Logs capture accepted and rejected IP traffic at the subnet, network interface, or VPC level, so they directly confirm whether packets are reaching Subnet-Y. CloudTrail logs API calls and AWS Config tracks configuration changes, so neither shows live packet flow.

Correct answer: B. Create one AWS CodePipeline for the entire flow and add a manual approval step

AWS CodePipeline has a built-in manual approval action that pauses the pipeline until a designated approver accepts or rejects the transition. Separate pipelines linked with Lambda or VPC endpoints add complexity without providing a native human approval checkpoint.

Correct answer: B. Use the TransactWriteItems API of DynamoDB Transactions

TransactWriteItems groups up to 25 writes across multiple tables into a single synchronous, all-or-nothing transaction, exactly matching the atomicity requirement. Only two options are present, and the other one is a distractor; remember batch operations never guarantee atomicity.

Correct answer: B. Use parallel scans

A parallel Scan divides the table into logical segments that multiple workers scan simultaneously, dramatically reducing wall-clock time on large tables. Remember that FilterExpression and ProjectionExpression only trim results after the scan has already consumed read capacity, so they never speed up a Scan.

Correct answer: A. The write capacity units on the GSI are under-provisioned

Every base-table write propagates to each GSI, which has its own provisioned WCUs, and under-provisioned GSI capacity causes throttling on the base table itself. Exam cue: write throttling with low base-table WCU usage plus a GSI points straight at GSI write capacity.

Correct answer: C. Use the AWS::Region pseudo parameter

The AWS::Region pseudo parameter is predefined and returns the deployment Region automatically with no declaration needed. A custom Lambda resource or a manual parameter adds unnecessary complexity for metadata CloudFormation already provides.

Correct answer: D. "dynamodb:UpdateItem", "dynamodb:GetItem", and "dynamodb:PutItem"

GetItem reads by primary key, and UpdateItem modifies specific attributes or creates the item if absent, so GetItem plus UpdateItem covers everything; PutItem is harmless here. Exam cue: pick UpdateItem when only certain attributes change, and avoid DeleteItem or table-level actions the scenario never requires.

Correct answer: C. Increase the VisibilityTimeout attribute on the queue

Increasing the visibility timeout keeps an in-flight message hidden from other consumers until processing finishes. DelaySeconds only postpones delivery, and ReceiveMessageWaitTimeSeconds controls long polling, so neither fixes duplicate processing.

Correct answer: D. Add an Amazon SQS queue between the web tier and the application tier

An SQS queue between the web and application tiers buffers burst traffic durably until consumers catch up, preventing message loss. SNS pushes immediately and offers fan-out, not buffering, and the queue must sit where the mismatch occurs, not near the database.

Correct answer: C. Set up an EC2 service role with read-only permissions for the S3 bucket and attach the role to the EC2 instance profile

An EC2 instance role delivers temporary, automatically rotated credentials with no long-term keys stored on the instance. IAM user credentials in user data or the CLI are static and violate the requirement, and S3 has no such thing as an S3 service role.

Correct answer: B. Create an S3 bucket policy that denies traffic where aws:SecureTransport is false

A bucket policy Deny on aws:SecureTransport false blocks all plain HTTP requests, forcing TLS for S3 traffic. The x-amz-server-side-encryption header enforces encryption at rest, not in transit, so it addresses the wrong requirement.

Correct answer: D. Use Amazon CloudFront

CloudFront caches the static content at edge locations close to users worldwide, fixing latency for regions far from the S3 bucket's Region. S3 Transfer Acceleration speeds uploads into S3, not downloads to website visitors, so it fails the scenario.

Correct answer: D. The IAM role or service role used by CodeBuild is missing the required permissions to access the image repository

CodeBuild uses its IAM service role to pull from ECR, and without permissions like ecr:BatchGetImage and ecr:GetAuthorizationToken the image pull fails. CodeBuild fully supports custom Docker images, so that distractor is simply wrong.

Correct answer: D. Make a snapshot of the database before it gets deleted

An RDS instance provisioned inside an Elastic Beanstalk environment is deleted when the environment terminates, so a manual snapshot beforehand preserves the data for later restore. Decoupling the database is the long-term fix, but among the options only snapshotting prevents data loss.

Correct answer: B. Use Amazon ElastiCache for Memcached to store and manage session data, while utilizing an Amazon RDS for MySQL DB instance for application data storage.

ElastiCache for Memcached provides a shared, fast in-memory session store that makes the web tier stateless, while RDS for MySQL holds durable transactional order data. Storing application data only in a cache loses durability, and EC2 instance store is ephemeral.

Correct answer: B. Set the value of the route selection expression to $request.body.action.

Setting the route selection expression to $request.body.action makes API Gateway route each WebSocket message by the action field's value with no extra logic. $default only catches unmatched routes and mapping templates add configuration overhead.

Correct answer: C. SSE-C

SSE-C has the customer supply the encryption key on every PUT, GET, Head, and Copy request while S3 performs the encryption. Client-side encryption would mean S3 never sees plaintext or does the crypto work, so it fails the stated requirement.

Correct answer: B. Set ConsistentRead to true when calling GetItem

Setting ConsistentRead to true on GetItem returns data reflecting all prior successful writes, at the cost of higher latency and capacity use. DAX caches data and can actually serve stale reads, making it the wrong fix here.

Correct answer: B. Create one customer-managed policy with policy variables and attach it to a group containing all users

A single customer-managed policy using the ${aws:username} policy variable grants each user access to only their own home prefix, and attaching it to a group scales without maintenance. Inline or per-user policies require ongoing manual work as users join.

Correct answer: C. MOCK

MOCK integration returns a response generated by API Gateway itself without contacting any backend. It is ideal for simulating other teams' APIs before they exist and avoids backend charges; the proxy and HTTP integrations still require a real backend endpoint.

Correct answer: A. Use a Lifecycle Policy

An Elastic Beanstalk application version lifecycle policy automatically deletes old application versions based on age or count, preventing the service limit from blocking deployments. For the exam, remember lifecycle policy is the built-in feature for cleaning up application versions; .ebextensions configure environments, not version retention.

Correct answer: C. Create a CloudWatch Event with an event pattern looking for EC2 state changes and a target set to use the Lambda function

A CloudWatch Events rule (now Amazon EventBridge) with an EC2 instance state-change event pattern can target Lambda directly, capturing instance launches in near real time. Exam cue: reacting to resource state changes means event pattern rules, not CloudTrail alarms or metric alarms, which add polling overhead.

Correct answer: D. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service

The X-Ray daemon listens on UDP port 2000 for segments from the SDK and relays them to the X-Ray API, and it runs on any on-premises host. Remember the exam distinction: the SDK instruments code, while the daemon forwards data; on-premises servers always need the daemon installed manually.

Correct answer: B. Enable a DynamoDB stream and trigger the Lambda function synchronously from the stream

A DynamoDB stream records item-level changes, and Lambda polls it internally, invoking the function synchronously and in order per batch of stream records. Exam cue: DynamoDB Streams with Lambda is always synchronous, ordered, poll-based invocation managed by AWS, unlike SNS or direct async invokes.

Correct answer: D. Delete the table and then re-create it

DeleteTable followed by CreateTable removes all items as a single metadata-level operation with no per-item read or write capacity consumption. Remember the rule: partial deletions use Query or Scan plus DeleteItem or BatchWriteItem; full-table purges drop and re-create the table.

Correct answer: C. Use the exponential backoff technique to introduce a delay before attempting to execute the operation again

The maximum sending rate error is retriable, and AWS recommends exponential backoff so the application automatically slows its send rate without manual intervention. Retrying all 4xx errors blindly is wrong because most 4xx errors are permanent failures, not throttling.

Correct answer: B. The cache is not being invalidated when the account balance data changes

Missing cache invalidation leaves stale balance values in ElastiCache that keep being served after the database changes, exactly matching the symptom. Exam cue: stale reads through a caching layer always point to invalidation strategy, not RDS IOPS or Multi-AZ replication, which stays consistent.

Correct answer: C. Encrypt the secret values client-side using encryption helpers

Lambda's client-side encryption helpers use envelope encryption with KMS so plaintext secrets never appear in the console or API output. When a question specifically asks to hide secret values from the console view, look for encryption helpers rather than just a customer-managed KMS key.

Correct answer: C. Configure a parameter with the list of EC2 instance types as AllowedValues in the CloudFormation template

AllowedValues on a template parameter restricts input to a predefined list, which CloudFormation validates at deployment time. Pseudo parameters are predefined by AWS and cannot be customized, so they cannot hold a list of instance types.

Correct answer: B. Use Amazon Cognito with web identity federation

Cognito identity pools with web identity federation support Login with Amazon, Facebook, and Google, then issue temporary AWS credentials scoped to the S3 access needed. SAML federation is for enterprise identity providers, not social logins, so that distractor fails here.

Correct answer: B. Configure Amazon CloudFront with multiple origins to serve both static and dynamic content at low latency to global users

One CloudFront distribution with multiple origins routes static paths to S3 and dynamic paths to the ALB using cache behaviors and path patterns. Global Accelerator optimizes TCP routing to AWS endpoints but cannot cache content at edge locations like CloudFront does.

Correct answer: A. S3 presigned URLs

An S3 presigned URL grants temporary access to a single private object and requires no AWS credentials for the recipient. ACLs or IAM roles would need account-level access for external parties, which violates the requirement.

Correct answer: B. Canary Deployment

API Gateway canary deployment splits a configurable percentage of live traffic to the new version while the rest goes to production. Stage variables only switch endpoints and do not split traffic, so they cannot do percentage-based testing.

Correct answer: C. The cache will become large and expensive because infrequently requested data is also written to the cache.

This is write-through caching: data stays fresh but rarely read items also fill the cache, increasing size and cost. Database load does not increase from cache updates, so focus on the storage-cost trade-off the question asks about.

Correct answer: C. Use Amazon Cognito user pools

Cognito user pools provide a fully managed directory handling registration, sign-in, and tokens, integrated with a COGNITO_USER_POOLS authorizer in API Gateway. A Lambda authorizer would require building custom user management, which the scenario rules out.

Correct answer: D. Use a task placement constraint

The distinctInstance task placement constraint is a hard rule that forces each task onto a different container instance. A placement strategy like spread or binpack is only a preference and cannot guarantee one task per instance, so it fails the requirement.

Correct answer: B. Create a high-resolution custom metric and push the data using a script triggered every 10 seconds

A high-resolution CloudWatch custom metric with StorageResolution of 1 lets a script publish CPU data as often as every second. EC2 detailed monitoring only reaches one-minute granularity, so it cannot meet a ten-second requirement.

Correct answer: B. Delete the compromised access keys

Deleting the compromised access keys immediately cuts off unauthorized programmatic access. Changing the password does nothing for API keys, deleting the IAM user breaks the scripts unnecessarily, and contacting support is not the first containment step.

Correct answer: D. Use launch templates to configure the EC2 Auto Scaling group for On-Demand and Spot Instances. When you create a launch template, use the User data field to add a configuration script that runs when the instance starts. This shell script can, in turn, install the CodeDeploy agent

Launch templates support a mixed instances policy for Spot plus On-Demand, and a user data script installs the CodeDeploy agent automatically at boot. Launch configurations cannot mix Spot and On-Demand, and RAM only shares resources across accounts.

Correct answer: B. Create an IAM role with an AmazonDynamoDBReadOnlyAccess policy and apply it to the EC2 instance profile

An IAM role with a read-only managed policy attached to the EC2 instance profile provides temporary credentials and least privilege. Embedding IAM user access keys in code or using root or admin credentials violates both rotation and least-privilege best practices.

Correct answer: A. Set up a Worker environment and a cron.yaml file

A Worker environment tier pulls tasks from an SQS queue, keeping background jobs off the web tier, and cron.yaml defines the periodic scheduled jobs. The .ebextensions file configures environment resources, not scheduled task execution, so it fails the requirement.

Correct answer: C. Store the session state in Amazon ElastiCache

ElastiCache, especially with Redis, provides an in-memory, shared session store with replication and Multi-AZ failover, so any instance can serve users. Sticky sessions tie users to single servers and undermine scalability and fault tolerance.

Correct answer: C. Define a development environment with a single instance and a separate load-testing environment configured with settings that closely resemble the production environment

Elastic Beanstalk supports multiple independent environments for the same application, each with its own configuration. When a scenario needs simultaneous development and production-like load testing environments, provision separate environments tailored to each purpose; the other options describe unsupported or irrelevant workarounds.

Correct answer: B. Increase the minimum instance capacity of the Auto Scaling Group to 2

A minimum of 1 means only one instance may exist, and it sits in a single Availability Zone, so one zone failure takes the app down. Raising minimum capacity to 2 forces instances into at least two zones; RDS Multi-AZ and fast failover do not fix the compute layer.

Correct answer: C. Use a cron job on the instances that pushes the EC2 RAM statistics as a custom metric into Amazon CloudWatch

CloudWatch does not collect memory metrics from EC2 by default because RAM lives inside the guest OS. A script or CloudWatch agent run via cron publishes memory as a custom metric; instance metadata and X-Ray do not expose RAM utilization.

Correct answer: D. Cross-Origin Resource Sharing is not enabled on the bluecrest-commission-images bucket

JavaScript on the site makes a cross-origin GET to the images bucket, which S3 blocks unless a CORS configuration on that bucket allows the origin. Remember CORS is configured on the bucket serving the resource, not the bucket hosting the calling page; region and Transfer Acceleration are irrelevant.

Correct answer: B. Increase the shard count of the stream using UpdateShardCount

Each shard provides fixed write throughput, so adding shards with UpdateShardCount directly increases ingestion capacity during traffic spikes. Batching with PutRecords or using the KPL improves efficiency but does not raise the stream's throughput ceiling when throttling already occurs.

Correct answer: C. The IAM permissions are incorrect for the CodeBuild service role

Pushing an image to ECR requires the CodeBuild service role to have ecr:GetAuthorizationToken plus repository push permissions like ecr:PutImage. An authorization error during docker push points to a missing IAM policy on the calling role; security groups do not govern ECR API calls.

Correct answer: D. Use Amazon DynamoDB to perform scalable session handling

Storing session data in Amazon DynamoDB externalizes state so any instance can serve the user's next request, and no data is lost when an EC2 instance fails. Sticky sessions only pin a user to one instance, so if that instance dies the session dies with it.

Correct answer: C. Publish the messages to an Amazon SNS topic and subscribe each SQS queue to the topic

The SNS fanout pattern pushes each published message to every subscribed SQS queue automatically with no custom code. A Lambda function duplicating messages could work but adds development and operational overhead, so it is not the best answer.

Correct answer: A. Implement exponential backoff in the Lambda function's error handling code to retry failed write operations.

Exponential backoff retries failed writes with increasing delays, smoothing out transient throttling without raising provisioned capacity, which satisfies the no-over-provisioning requirement. Note that on-demand capacity mode is a defensible alternative for eliminating throttling, making this somewhat ambiguous, but backoff is the classic application-level answer.

Correct answer: D. Implement developer-authenticated identities by using Amazon Cognito, and get credentials for these identities.

Amazon Cognito identity pools with developer-authenticated identities give each user one stable identity ID and temporary credentials across all devices. IAM users or access keys fail because IAM is meant for a limited number of account principals, not application end users.

Correct answer: B. Create a configuration file in the .ebextensions folder to configure the load balancer

An .ebextensions configuration file defining a port 443 listener with an ACM certificate ARN is the standard Elastic Beanstalk way to enable HTTPS at the load balancer. A separate CloudFormation template could also work in practice, but .ebextensions is the canonical exam answer; opening port 80 or health checks does nothing for TLS.

Correct answer: A. Cache dependencies on Amazon S3

CodeBuild supports S3-backed caching, letting dependency artifacts persist between builds so Ivy repositories are not re-resolved every run. Shipping dependencies in the source code works but bloats the repo and adds ongoing maintenance effort.

Correct answer: B. Implement a dead-letter queue

An SQS dead-letter queue, attached via a redrive policy, captures messages that exceed the maximum receive count so they can be inspected later. The question stem is malformed because the actual question text was merged into option A, leaving only one real answer choice.

Correct answer: B. All at once

The All at once policy updates every instance simultaneously, making it the fastest Elastic Beanstalk deployment method with possible brief downtime. The exam cue is that fastest deployment plus acceptable downtime points to All at once, while phrases like extra batch or new Auto Scaling group signal the other policies.

Correct answer: B. The ASG will terminate the EC2 instance

When a health check marks an instance unhealthy, the Auto Scaling group terminates it and launches a replacement to maintain desired capacity. An ASG never restarts applications inside an instance, reformats volumes, or detaches and leaves unhealthy instances running; exam cue is unhealthy instance means terminate and replace.

Correct answer: D. The Amazon S3 service principal (s3.amazonaws.com) will be granted permissions to perform the lambda:InvokeFunction action

The add-permission command adds a resource-based policy statement allowing the S3 service principal to invoke the function, scoped by source ARN and account. It grants no data access and creates no event source mapping, since S3 triggers Lambda via push, not polling.

Correct answer: D. Lambda Authorizer

A Lambda authorizer runs custom code that validates bearer tokens from third-party systems like OAuth or SAML before requests reach the backend. Cognito user pools are wrong because AWS would manage the directory, while the scenario explicitly requires a third-party authorization mechanism.

Correct answer: D. Create the table before loading the data and then delete the table after the task has completed

Deleting and recreating the table requires only two API calls and consumes no capacity while the table is gone, making it the cheapest way to empty a short-lived table. Item-level approaches like scans with DeleteItem or BatchWriteItem scale with the million items and burn read/write capacity.

Correct answer: B. Share pre-signed URLs with resources that need access

Pre-signed URLs let external partners download specific objects from a private bucket until the URL expires, satisfying the time-bound requirement. A bucket policy can block access but cannot easily grant per-object temporary external access.

Correct answer: D. The account administrator needs to activate IAM user access to the Billing and Cost Management console for all the users who need access

IAM policies for billing only take effect after an account administrator activates IAM user and role access to billing information in account settings. That one-time activation is the commonly missed step; attached policies alone stay ineffective.

Correct answer: B. The instance might have been part of an Auto Scaling group, which relaunched a similar instance to maintain the desired capacity

An Auto Scaling group maintains desired capacity, so after a manual termination it automatically launches a replacement from the same launch template. Load balancers distribute traffic and never launch instances, which is the classic distractor here.

Correct answer: B. Create a layer in Lambda that includes the external library

A Lambda layer packages the shared library once and makes it available to many functions via the /opt directory, keeping deployment packages small. Bundling the library in each deployment package repeats the work the question says to avoid.

Correct answer: A. Conditional writes

Conditional writes with a ConditionExpression let a PutItem succeed only when no item with the same primary key already exists, preventing silent overwrites. Watch for phrases like prevent overwriting; atomic counters and batch writes do not check for existing keys.

Correct answer: A. Use Cognito User pools to facilitate sign-up and user management for the rider mobile app

Cognito User Pools provide a fully managed user directory handling sign-up, sign-in, and MFA with minimal development effort. Identity pools grant AWS resource access rather than managing users, and custom Lambda or EC2 solutions require far more work.

Correct answer: B. Add a post_build phase to the buildspec file that uses the commands block to push the Docker image.

The post_build phase with its commands block runs only after the build phase succeeds, so a failed build skips the docker push. The finally block runs even on failure, and artifacts or install phases are not meant for pushing images.

Correct answer: C. The put data calls will be rejected with a ProvisionedThroughputExceededException exception

When a producer exceeds a shard's throughput or record limits, PutRecord calls fail with ProvisionedThroughputExceededException rather than losing data. Producers should retry with exponential backoff and add shards for sustained load; AccessDeniedException relates to permissions, not capacity.

Correct answer: B. Cognito User Pools

Cognito User Pools return JWT-based ID, access, and refresh tokens after successful authentication using the OpenID Connect standard. Whenever a scenario says JWT after login, choose User Pools; Identity Pools are for granting temporary AWS credentials.

Correct answer: C. Use S3 Object Ownership to set the bucket owner as the default owner of all objects in the bucket

Setting S3 Object Ownership to bucket owner enforced makes the bucket owner automatically own every uploaded object regardless of which account performed the upload. CORS controls browser cross-origin requests and has nothing to do with object ownership.

Correct answer: D. AWS AppSync

AWS AppSync queues mutations made while a device is offline and syncs them automatically once connectivity returns, with built-in conflict resolution across devices. Cognito pools handle sign-in and temporary credentials, not offline data synchronization.

Correct answer: B. If two writes are made to a single non-versioned object at the same time, it is possible that only a single event notification will be sent

S3 event notifications are delivered at least once, and two near-simultaneous writes to the same non-versioned object can produce only one notification. On the exam, intermittent missing notifications on a frequently updated, non-versioned object signal this behavior; enabling versioning fixes it.

Correct answer: A. Use Time to Live (TTL)

DynamoDB Time to Live deletes items automatically once a per-item expiration timestamp passes, at no extra cost and without consuming write throughput. Whenever a scenario asks for automatic item expiration after a fixed period, TTL is the expected answer.

Correct answer: B. Use ConsistentRead = true while performing the GetItem operation for any item

Setting ConsistentRead = true on GetItem forces a strongly consistent read that reflects all writes completed before the read. ConsistentRead is a read-only parameter, so options applying it to PutItem or UpdateItem are invalid distractors.

Correct answer: D. AWS Step Functions

AWS Step Functions orchestrates steps as a serverless state machine with built-in retry and catch for automatic reprocessing of failed steps. Glue handles ETL and Kinesis handles streaming, but neither provides sequenced workflow orchestration with retries.

Correct answer: C. Enable CORS

The video and website buckets are different origins, so the browser blocks the embedded video request unless the video bucket has a CORS configuration allowing the website's origin. If a resource loads by direct URL but fails only when embedded cross-domain, suspect missing CORS.

Correct answer: D. EBS volumes are AZ locked

An EBS volume lives in one Availability Zone and can only attach to instances in that same zone, so a us-east-1a volume cannot attach to a us-east-1e instance. The fix is snapshotting the volume and restoring it in the target zone.

Correct answer: D. Use the header X-Forwarded-For

Elastic Load Balancing injects the X-Forwarded-For header containing the original client IP into each forwarded request, which the application can read for compliance logging. Access logs are distractors; the requirement is capturing the IP in application logic per request.

Correct answer: B. Utilize the AWS::Region pseudo parameter.

The AWS::Region pseudo parameter natively resolves to the deployment Region with zero overhead or manual input. AWS::StackId with Fn::Split also technically works, but it is extra processing when a built-in pseudo parameter does the job directly.

Correct answer: C. Use ALB content-based routing. Create a separate target group for the test version of the platform and route requests identified by a specific cookie.

An ALB listener rule can match on a cookie and forward matching requests to a separate target group running the test version, leaving production traffic untouched. Manual routing or a separate Lambda function adds operational overhead the ALB handles natively.

Correct answer: C. Implement Amazon ElastiCache for Redis in Cluster Mode

ElastiCache for Redis in cluster mode is fully managed, highly available with replication and automatic failover, so expensive cached data survives node failures. Memcached lacks persistence and replication, and self-managed Redis on EC2 forfeits the managed reliability requirement.

Correct answer: B. Amazon EC2 Auto Scaling adds only 1 instance to the group

Auto Scaling caps the result at the group's maximum size, so going from 3 toward a max of 4 adds only 1 instance regardless of the policy requesting 3. Remember the boundary rule: scaling never exceeds maximum or drops below minimum.

Correct answer: A. Use a Write Through strategy

Write Through adds or updates the cache at the same time the database is written, so every read returns the freshest data with no stale window. Lazy Loading, even with TTL, can still serve stale values between the write and the TTL expiry; DAX is DynamoDB-specific, not ElastiCache.

Correct answer: B. Configure the CloudWatch agent on the on-premises server by using IAM user credentials with permissions for CloudWatch

The CloudWatch agent can be installed on on-premises servers and authenticated with IAM user access keys that have CloudWatch permissions. CloudWatch Logs cannot directly pull logs from servers, and relaying through EC2 or S3 adds unnecessary steps.

Correct answer: A. Create a saved configuration in the North America division's account and download it to your local machine. Make the account-specific parameter changes and upload the file to an S3 bucket in the Europe division's account. From the Elastic Beanstalk console, create an application from 'Saved Configurations'

Elastic Beanstalk saved configurations are YAML templates in S3, so you download, edit account-specific values, upload to the destination account, and create a new environment from Saved Configurations. There is no built-in cross-account import option, making that distractor invalid.

Correct answer: A. The first statement provides a specified IAM principal the ability to generate a data key and decrypt that data key from the CMK when necessary

The Principal element names an IAM role ARN, and the first statement grants it kms:GenerateDataKeyWithoutPlaintext and kms:Decrypt, which is exactly what option A describes. A KMS key policy principal is always an IAM entity, never a security group, eliminating the other options.

Correct answer: A. Run the aws cloudformation package command to upload the source code to an Amazon S3 bucket and produce a modified CloudFormation template

The aws cloudformation package command uploads local artifacts like index.js to S3 and outputs a modified template with the local paths replaced. Commands like compile, create-package, or lambda zip do not exist in the AWS CLI, making them easy eliminations.

Correct answer: A. 10

With cross-zone load balancing enabled, traffic is spread evenly across all 10 targets regardless of Availability Zone, so each instance gets 10%. Without cross-zone balancing, each zone would get 50% split among its own targets, a common trap.

Correct answer: D. Use the AWS X-Ray service

AWS X-Ray traces requests end-to-end across distributed microservices and builds a service map showing latency and failure points, so the team can isolate the source of the HTTP 501 errors. CloudWatch shows metrics and logs but cannot follow a single request through multiple services.

Correct answer: D. binpack

The binpack placement strategy packs tasks onto instances with the least available CPU or memory, filling existing instances before adding new ones, which minimizes instance count and cost. Spread distributes tasks for high availability and actually uses more instances.

Correct answer: A. Use the DynamoDB on-demand backup capability to write to Amazon S3 and download it locally

DynamoDB on-demand backups are stored in DynamoDB-managed storage, not a customer-accessible S3 bucket, so they cannot be downloaded locally. Glue, Data Pipeline, and Hive on EMR are all valid export paths to S3.

Correct answer: A. CodeDeploy Deployment Groups

A single CodeDeploy application can have multiple deployment groups, letting the same revision roll out to different sets of instances at different times with per-group configuration and rollback settings. Multiple CodeDeploy applications would fragment the deployment rather than stage it.

Correct answer: A. Geolocation

Geolocation routing routes based on the user's geographic location and can return no answer for locations outside Brazil. Latency routing optimizes performance and would still resolve for everyone, failing the access restriction requirement.

Correct answer: D. HTTP 503

HTTP 503 is correct because an Application Load Balancer returns 503 Service Unavailable when a target group has no registered targets or all targets are unhealthy. Exam cue: 504 points to target timeouts, 500 to internal errors, and 403 to blocked requests, so 503 is the empty-target-group signal.

Correct answer: C. Modify the existing API to include request validation, deploy this change to a new API Gateway stage, test it there, and then deploy the validated configuration to the production stage.

API Gateway stages let you deploy the same API configuration to a separate stage and test it there with minimal overhead before promoting it to production. Cloning or rebuilding an entire API creates unnecessary work, so the new-stage option is the low-overhead answer.

Correct answer: B. Configure a CORS configuration on Bucket B, which hosts the web fonts, to allow the origin of Bucket A to make requests

A CORS rule on Bucket B is required because CORS is enforced by the browser on the bucket serving the cross-origin resource, here the web fonts. Exam cue: put the CORS configuration on the bucket being fetched from, never on the bucket hosting the page making the request.

Correct answer: D. Use IAM roles and resource-based policies to delegate access across accounts within different partitions via programmatic access only

IAM roles and resource-based policies cannot delegate access across AWS partitions such as aws, aws-cn, or aws-us-gov, so that option is infeasible. Cross-account roles, bucket policies with IAM policies, and ACLs are all valid cross-account mechanisms within a partition.

Correct answer: A. AWS Security Token Service (STS)

AWS STS issues temporary credentials and is not a native API Gateway authorizer, so it cannot directly control access to API requests. Remember the four valid API Gateway options: IAM policies, Cognito user pools, Lambda authorizers, and resource policies.

Correct answer: B. Enable Health Checks

Enabling health checks lets the load balancer detect the crashed instance, mark it unhealthy, and stop routing traffic to it. Multi-AZ improves resilience but does not stop the balancer from sending requests to a specific failed instance.

Correct answer: A. Use advanced container definition parameters and define environment variables under the environment parameter within the task definition.

Environment variables are defined as key-value pairs in the environment parameter of the container definition inside the ECS task definition. Exam cue: environment variables belong in the task definition, never the service definition; the secrets parameter is for sensitive values from Secrets Manager or SSM.

Correct answer: A. Amazon EFS volumes

Amazon EFS provides persistent, shared file storage that multiple ECS tasks can mount simultaneously, even across Availability Zones, and it works with both Fargate and EC2 launch types. Docker volumes and bind mounts lack this cross-AZ shared access.

Correct answer: B. IAM Access Analyzer

IAM Access Analyzer's unused access analysis finds unused roles, access keys, passwords, and permissions, enabling safe removal toward least privilege. Trusted Advisor offers broad best-practice checks but does not track unused IAM access over time.

Correct answer: B. The load balancer is highly available and its public IP address may change over time. The DNS name remains constant

Elastic Load Balancing nodes can have their IP addresses changed as AWS scales or replaces them, while the DNS name stays constant for the load balancer's lifetime. Always resolve the DNS name at connection time rather than caching the IP address.

Correct answer: B. Use the AWS CLI –dry-run option

The AWS CLI –dry-run option checks permissions without performing the action, returning DryRunOperation when allowed and UnauthorizedOperation when denied. Note the option list is broken, with the question prompt placed as option A and only one real choice present.

Correct answer: B. Amazon ECS with the Fargate launch type

The Fargate launch type bills only for the vCPU and memory each running task consumes, matching the per-task billing requirement. Note the option list is broken, with the question prompt placed as option A and only one real choice present.