I85PREP
⌘ K
AWS Developer study materials
AWS Developer study resources

AWS Developer practice questions

One question at a time. Build your AWS Developer understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Development with AWS Services

A developer invokes an AWS Lambda function synchronously using the Invoke API. What is the maximum size of the request payload that can be sent?

  1. 1 MB
  2. 6 MB Correct answer.
  3. 10 MB
  4. 256 KB

Explanation

The synchronous invocation payload limit for Lambda is 6 MB for both request and response. Asynchronous invocations are limited to 256 KB, which is why larger payloads are normally staged in Amazon S3 and passed by reference.

Question 2Development with AWS Services

What is the maximum size of a single item that can be stored in an Amazon DynamoDB table?

  1. 1 MB
  2. 256 KB
  3. 400 KB Correct answer.
  4. 64 KB

Explanation

DynamoDB enforces a 400 KB limit on the total size of an item, including attribute names and values. Larger objects should be stored in Amazon S3 with a pointer kept in the item.

Question 3Development with AWS Services

A web application must let anonymous browser users upload files directly to an Amazon S3 bucket without distributing AWS credentials. What should the developer implement?

  1. Make the bucket public so browsers can upload directly
  2. Attach an unauthenticated Cognito identity to every browser
  3. Return a presigned URL with a short expiry Correct answer.
  4. Embed a long-lived IAM access key in the browser application

Explanation

A presigned URL carries the signer's permissions for a specific operation and expires after a configured period, so no credentials reach the browser. The application server generates the URL with credentials held only on the backend.

Question 4Development with AWS Services

A consumer receives an Amazon SQS message but crashes before deleting it. Which queue setting determines how long the message stays hidden before it becomes available to other consumers again?

  1. The receive request attempt ID
  2. The queue's visibility timeout Correct answer.
  3. The delay queue setting
  4. The message retention period

Explanation

The visibility timeout is the window during which a received message is hidden from other consumers. If the message is not deleted within that window, it becomes visible again and can be received by another consumer.

Question 5Development with AWS Services

A publisher must deliver each order event to three independent services, each with its own consumer, and no service may lose events while it is down. Which design meets these requirements?

  1. Send to a single SQS queue and let all three services poll it
  2. Publish to an SNS topic with one SQS queue subscribed per service Correct answer.
  3. Invoke all three services synchronously from the publisher
  4. Write the event to an S3 bucket and have each service poll listings

Explanation

The fan-out pattern combines SNS with one SQS queue per subscriber, so each service receives its own copy and can buffer events while offline. This also decouples the publisher from the availability of each consumer.

Question 6Development with AWS Services

A Lambda function must read items from a DynamoDB table at runtime. Which approach grants the required permission with least privilege?

  1. Store an IAM user's access key ID and secret access key in Lambda environment variables
  2. Add the function to a VPC security group that allows DynamoDB
  3. Attach an IAM policy to the DynamoDB table resource
  4. Use an execution role policy allowing the DynamoDB actions Correct answer.

Explanation

Lambda assumes an execution role at invocation time, and the permissions on that role determine what the function can call. Scoping the role policy to the specific table and actions satisfies least privilege without long-lived credentials.

Question 7Development with AWS Services

An API Gateway REST API integrated with Lambda starts returning HTTP 429 responses to legitimate clients during traffic spikes. What does this status code indicate?

  1. An authorizer rejected the caller's token
  2. The Lambda function's execution role is missing permissions
  3. The integration request timed out
  4. Requests exceeded the stage's throttling limits Correct answer.

Explanation

API Gateway returns 429 Too Many Requests when the request rate exceeds the configured account or stage throttling limits. Raising the limits, enabling usage-plan quotas, or adding client-side backoff addresses the cause.

Question 8Development with AWS Services

Where does Lambda send the log output written by a function's code with console.log?

  1. A CloudTrail trail dedicated to Lambda invocations
  2. The CloudWatch metrics namespace AWS/Lambda
  3. An S3 bucket created automatically by the function
  4. The log group /aws/lambda/<function-name> Correct answer.

Explanation

Lambda writes function logs to CloudWatch Logs in a log group named after the function, with one log stream per execution environment. CloudTrail, S3, and the metrics namespace serve different purposes.

Question 9Development with AWS Services

A team wants 10 percent of production traffic to reach a new Lambda version while the remaining 90 percent stays on the current version, with instant rollback. What should they configure?

  1. Weighted routing on a Lambda alias Correct answer.
  2. A Lambda layer referenced by both versions
  3. Reserved concurrency split across both versions
  4. Two API Gateway stages with different stage variables

Explanation

An alias can route traffic between two published versions using configurable weights, so shifting the weights or repointing the alias provides immediate rollback. Versions themselves are immutable, so traffic control belongs on the alias.

Question 10Development with AWS Services

A Lambda function is configured with event source mapping to a DynamoDB stream. How does Lambda deliver records that belong to the same partition key?

  1. Out of order, sorted only by the item's sequence number attribute
  2. In order, one batch at a time per shard Correct answer.
  3. In parallel, one record per invocation, in no guaranteed order
  4. Only after the 24-hour stream retention window has elapsed

Explanation

DynamoDB Streams keeps records for the same partition key in the same shard, and Lambda processes each shard sequentially with one invocation per batch. This preserves per-key ordering while different shards are processed concurrently.

Question 11Development with AWS Services

A workflow runs for at most five minutes, executes at very high volume, and needs the lowest cost per execution with no exactly-once requirement. Which AWS Step Functions workflow type fits?

  1. A Standard workflow
  2. A callback pattern task
  3. A nested Map state
  4. An Express workflow Correct answer.

Explanation

Express workflows are designed for high-volume, short-duration executions up to five minutes and are priced by number of requests, execution duration, and memory. Standard workflows provide exactly-once semantics and long durations at a higher cost per state transition.

Question 12Development with AWS Services

Which AWS SAM resource type declares a Lambda function together with its API Gateway event source in a single resource?

  1. AWS::Lambda::EventSourceMapping
  2. AWS::Serverless::Function Correct answer.
  3. AWS::Serverless::LayerVersion
  4. AWS::Serverless::Api

Explanation

AWS::Serverless::Function supports an Events property that declares triggers such as API, S3, SQS, and DynamoDB, and SAM transforms them into the underlying resources. The other types either model an API, a layer, or an existing stream mapping separately.

Question 13Development with AWS Services

A REST API on API Gateway uses Lambda proxy integration. What must the function return for the client to receive a well-formed response?

  1. An object with integrationResponse and stageVariables keys
  2. An object with statusCode, headers, and body Correct answer.
  3. A JSON object with an HTTP status field named code
  4. Only the response body as a plain string

Explanation

With Lambda proxy integration, API Gateway passes the function's response through without transformation, so the function must supply statusCode and body, with headers optional. The body should be a string, typically serialized JSON.

Question 14Development with AWS Services

An S3 bucket invokes a Lambda function on s3:ObjectCreated:* events, but a backlog of two million objects that already exist must also be processed. What is the most efficient approach?

  1. Enable S3 Transfer Acceleration and resync the bucket
  2. Re-upload each existing object so the event fires again
  3. Run an S3 Batch Operations job over the existing objects Correct answer.
  4. Add an s3:ObjectRemoved:* notification and invert the logic

Explanation

S3 event notifications only fire for new activity, so existing objects require a bulk process such as S3 Batch Operations, which can invoke a Lambda function for each object in an inventory or manifest. This avoids re-writing data or adding manual scripting.

Question 15Development with AWS Services

Several producers send messages to an SQS FIFO queue and multiple consumers poll it. How is ordering maintained?

  1. Messages sharing a message group ID are delivered in order Correct answer.
  2. Ordering applies only when a single consumer uses long polling
  3. Ordering is guaranteed only for messages with the same deduplication ID
  4. Ordering is maintained across the entire queue by send timestamp

Explanation

A FIFO queue delivers messages within the same message group ID in strict order, while different groups can be processed in parallel. Consumers must finish a group's batch before the next message in that group is delivered.

Question 16Development with AWS Services

A critical payment Lambda function must always have capacity available and must never run more than 100 concurrent executions. What should the developer configure?

  1. An account concurrency limit of 100
  2. Provisioned concurrency of 100 on the function's alias
  3. Reserved concurrency of 100 on the function Correct answer.
  4. A burst limit of 100 on the API Gateway stage

Explanation

Reserved concurrency both guarantees that the function can always scale up to the reserved amount and caps it at that number, isolating it from other functions in the account. Provisioned concurrency pre-warms environments but does not impose a hard ceiling on total concurrency.

Question 17Development with AWS Services

Database credentials must be rotated automatically every 30 days and retrieved at runtime with a single API call. Which service provides this with the least custom code?

  1. AWS Secrets Manager with a rotation function Correct answer.
  2. An encrypted environment variable using a KMS key
  3. SSM Parameter Store SecureString parameters
  4. Credentials stored in an S3 bucket with SSE-KMS

Explanation

Secrets Manager supports scheduled rotation by invoking a rotation Lambda function and lets applications fetch the current secret with a single GetSecretValue call. Parameter Store SecureString values are encrypted but have no built-in rotation scheduler.

Question 18Development with AWS Services

A Node.js Lambda function calls DynamoDB and SQS using the AWS SDK and must produce X-Ray subsegments for those downstream calls. What code change is required?

  1. Set the _X_AMZN_TRACE_ID environment variable manually
  2. Call AWSXRay.recordMetadata before each SDK call
  3. Increase the function's memory size to enable tracing
  4. Wrap the SDK client with AWSXRay.captureAWS Correct answer.

Explanation

Wrapping the SDK client with the X-Ray SDK instruments each AWS API call and records it as a subsegment of the function's segment. Active tracing must also be enabled on the function so the SDK can emit segments.

Question 19Development with AWS Services

Code running on an EC2 instance with an attached instance profile creates an S3 client without passing credentials explicitly. How does the SDK obtain credentials?

  1. From the S3 bucket policy attached to the client
  2. From the AWS_ACCESS_KEY_ID environment variable only
  3. From a Cognito identity pool linked to the instance
  4. From instance metadata via the instance profile Correct answer.

Explanation

The SDK's default credential provider chain queries the EC2 instance metadata service for temporary credentials associated with the instance profile. This keeps credentials off the instance and rotates them automatically.

Question 20Development with AWS Services

Two worker processes update the same DynamoDB item and must not silently overwrite each other's changes. Which technique should be used?

  1. A ConditionExpression on a version attribute Correct answer.
  2. A strongly consistent read before each write
  3. Increasing the table's write capacity units
  4. Enabling DynamoDB Streams on the table

Explanation

Optimistic locking uses a version attribute plus a ConditionExpression so the write succeeds only if the item still holds the version the writer read. A failed condition means another writer changed the item first, and the caller can retry.

Question 21Development with AWS Services

An asynchronously invoked Lambda function fails after all retries. The team needs the original request payload delivered along with the error details. Which feature should they use?

  1. A Lambda destination for failed invocations Correct answer.
  2. An X-Ray sampling rule with a high rate
  3. A dead-letter queue configured on the function
  4. A CloudWatch Logs subscription filter

Explanation

Destinations for asynchronous invocations record the full invocation record, including the original request payload, the response, and error details, and deliver it to SQS, SNS, S3, or EventBridge. This is richer than the older dead-letter queue mechanism and is the recommended approach.

Question 22Development with AWS Services

A Lambda function consumes a Kinesis data stream, and a malformed record makes the function throw on every attempt. What happens by default?

  1. Lambda retries the batch and blocks the shard until the record expires Correct answer.
  2. Lambda skips the record after three attempts and logs a warning
  3. The record is sent to the function's dead-letter queue automatically
  4. The record is discarded and processing continues with the next batch

Explanation

For stream-based event sources, Lambda retries the failing batch until it succeeds or the records expire from the stream, which halts progress on that shard. Developers mitigate this with a maximum retry count, on-failure destinations, or bisecting the batch on error.

Question 23Development with AWS Services

Which statement about the DynamoDB TransactWriteItems operation is accurate?

  1. It accepts up to 25 items and permits two actions on the same item
  2. It applies all included actions atomically or none at all Correct answer.
  3. It requires the target table to use on-demand capacity mode
  4. It is restricted to a single table per transaction

Explanation

TransactWriteItems groups up to 100 actions, potentially across multiple tables in the same account and Region, into an all-or-nothing operation. The transaction fails if any condition check fails or if two actions target the same item.

Question 24Development with AWS Services

A parallel write job intermittently receives ProvisionedThroughputExceededException from DynamoDB. Which client-side change is most appropriate?

  1. Catch the exception and retry immediately in a tight loop
  2. Disable SDK retries so failed batches fail fast
  3. Enable SDK retries with exponential backoff and jitter Correct answer.
  4. Increase the table's read capacity units

Explanation

The AWS SDK retries throttling errors automatically using exponential backoff with jitter, which spreads retries and relieves contention; the retry count or adaptive retry mode can be raised for bursty workloads. Tight-loop retries worsen throttling because they add load without a delay.

Question 25Development with AWS Services

A Lambda function must record about twenty custom metrics per invocation without extra network calls or added latency. Which approach should the developer use?

  1. Create X-Ray subsegments and convert them into metrics
  2. Call PutMetricData once per metric in the handler
  3. Publish metrics to an SNS topic for a separate aggregator
  4. Write Embedded Metric Format JSON events to stdout Correct answer.

Explanation

CloudWatch Embedded Metric Format lets a function emit structured JSON log events that CloudWatch Logs extracts into custom metrics asynchronously, so no API call is made from the function. This avoids the latency and cost of per-metric PutMetricData calls.

Question 26Development with AWS Services

A Lambda function downloads a large reference file during each invocation and needs local scratch space. Where can the function write this file, and what is the maximum size available?

  1. Write to /mnt, which defaults to 512 MB and can be resized per function
  2. Write to /var/task, which is writable and sized by the memory setting
  3. Write to /opt, which is writable and expands automatically as needed
  4. Write to /tmp, which can be configured from 512 MB up to 10,240 MB Correct answer.

Explanation

Each Lambda execution environment exposes writable scratch space only at /tmp, while /var/task (function code) and /opt (layers) are read-only at runtime. The /tmp size is configurable from 512 MB up to 10,240 MB and persists only for the lifetime of that execution environment.

Question 27Development with AWS Services

A development team wants to share a common logging library and its dependencies across 20 Python Lambda functions without packaging it into each deployment artifact. Which mechanism should they use?

  1. Store the library in S3 and download it at the start of every invocation
  2. Publish the library as a Lambda layer and attach it to each function Correct answer.
  3. Place the library in EFS and mount the file system on every function
  4. Copy the library into each function's /tmp directory during deployment

Explanation

A layer packages code and dependencies separately from function code and can be attached to many functions in the same account and Region. Lambda mounts layer content under /opt at runtime, so the library does not need to be bundled into each deployment package.

Question 28Development with AWS Services

A team needs a simple HTTPS endpoint that invokes a single Lambda function directly, without API Gateway, and wants AWS to manage the endpoint and its TLS certificate. What should they create?

  1. An Application Load Balancer with a Lambda target group
  2. A CloudFront distribution in front of the function's ARN
  3. A Lambda function URL configured with AWS_IAM auth Correct answer.
  4. An API Gateway HTTP API with a Lambda proxy integration

Explanation

A function URL provides a dedicated HTTPS endpoint for one function, and AWS manages the endpoint and its certificate without any additional service. Auth type AWS_IAM requires requests to be signed with SigV4 using IAM credentials.

Question 29Development with AWS Services

A web application lets authenticated users upload large files directly to an S3 bucket, and the browser must not hold AWS credentials. Which approach should the developer implement?

  1. Make the bucket public with a policy that allows s3:PutObject to everyone
  2. Send the IAM user's access key and secret key to the browser over HTTPS
  3. Proxy every upload through an EC2 instance that assumes an IAM role
  4. Generate a presigned PUT URL on the server and return it to the browser Correct answer.

Explanation

A presigned URL embeds the signer's permissions in the query string for a limited time, so the browser can upload without any AWS credentials. The server keeps its own credentials and should scope the URL to a single object key with a short expiry.

Question 30Development with AWS Services

An order service must notify three independent downstream systems about each new order, and more consumers will be added over time. Which architecture decouples the producer most effectively?

  1. Store orders in S3 and have each consumer poll the bucket on a schedule
  2. Publish orders to an SNS topic with one SQS subscription per consumer Correct answer.
  3. Write orders to a single SQS queue that all three consumers poll
  4. Call each downstream system's API synchronously from the order service

Explanation

The fan-out pattern publishes one message to an SNS topic, which delivers a copy to each subscribed SQS queue, so each consumer has its own durable backlog. New consumers can be added as new subscriptions without any change to the producer.

Question 31Development with AWS Services

A DynamoDB table stores session records that should expire one hour after creation, and expired items must be removed without consuming write capacity. Which feature should be used?

  1. A DynamoDB stream consumer that deletes items older than one hour
  2. DAX with an item cache TTL of 3,600 seconds
  3. A scheduled Lambda function that scans the table and deletes old items
  4. DynamoDB TTL on an attribute that holds an epoch timestamp Correct answer.

Explanation

Time to Live reads a Number attribute containing an epoch timestamp and deletes expired items in the background without consuming write capacity. Deletion is not immediate; expired items are typically removed within a few days of their expiry time.

Question 32Development with AWS Services

An application must sign users in with email and password and also obtain temporary AWS credentials mapped to an IAM role. Which Cognito combination is required?

  1. A user pool for authentication and an identity pool for AWS credentials Correct answer.
  2. An identity pool only, configured with a hosted sign-in UI
  3. An identity pool for authentication and a user pool for AWS credentials
  4. A single user pool with an attached IAM role

Explanation

A user pool authenticates users and issues tokens, while an identity pool exchanges those tokens for temporary AWS credentials associated with an IAM role. Sign-in plus AWS access therefore requires both resources.

Question 33Development with AWS Services

A developer wants to run a function from a SAM template on a laptop with a sample event to test it before deploying. Which SAM CLI command should be used?

  1. sam local invoke with the --event option Correct answer.
  2. sam build --use-container
  3. sam deploy --guided
  4. sam package with an S3 bucket and output template

Explanation

sam local invoke runs a single function locally in a container and accepts a JSON event file through --event. Building artifacts first with sam build is recommended, but the command that actually executes the function locally is sam local invoke.

Question 34Development with AWS Services

A function's environment variables contain a database password that must be encrypted with a customer managed KMS key and decrypted by the function at runtime. What must the developer configure?

  1. Enable log group encryption and grant kms:Encrypt to the execution role
  2. Pass the password as a plaintext SAM parameter with NoEcho set
  3. Set KMSKeyArn on the environment and grant kms:Decrypt to the role Correct answer.
  4. Store the password in a layer and grant kms:GenerateDataKey to the role

Explanation

Lambda encrypts environment variables at rest with an AWS managed key by default, and setting KMSKeyArn switches to a customer managed key. The execution role must then be allowed kms:Decrypt so the function can read the values when it initializes.

Question 35Development with AWS Services

A Lambda function processes messages from an SQS standard queue, and occasionally the same message is processed twice because the function runs longer than the queue's visibility timeout. What is the most direct fix?

  1. Raise the message retention period to the 14-day maximum
  2. Enable long polling with a 20-second wait time
  3. Raise the visibility timeout above the function timeout Correct answer.
  4. Switch the queue to FIFO to remove duplicate deliveries

Explanation

The visibility timeout hides a received message for a period, and if processing exceeds that period the message becomes visible again and can be delivered to a second consumer. Setting the visibility timeout above the maximum function runtime stops that redelivery during processing.

Question 36Development with AWS Services

An SQS queue is subscribed to an SNS topic that carries orders of several types, but the consumer should receive only priority orders. How can the other messages be prevented from reaching the queue?

  1. Set a redrive policy on the queue with a dead-letter target
  2. Apply an IAM policy to the queue that denies non-priority messages
  3. Attach an SNS filter policy matching the priority message attribute Correct answer.
  4. Use a DynamoDB stream filter on the orders table

Explanation

A subscription filter policy is a JSON policy evaluated against message attributes or message body keys, and only matching messages are delivered to that subscription. Placing it on the SNS subscription keeps non-matching messages out of the queue entirely.

Question 37Development with AWS Services

A Lambda function can be invoked twice with the same request ID because of an at-least-once event source, and the team wants the second write to fail instead of overwriting the first. Which approach achieves this?

  1. A ConditionExpression of attribute_not_exists(pk) on PutItem Correct answer.
  2. A Global Secondary Index with a unique partition key
  3. Optimistic locking with a version number updated on every write
  4. A Scan before each write that checks for the request ID

Explanation

A conditional PutItem succeeds only when the item does not already exist, so a duplicate invocation receives ConditionalCheckFailedException instead of overwriting data. The caller treats that exception as a duplicate and returns the stored result.

Question 38Development with AWS Services

A read-heavy application repeatedly fetches the same small set of DynamoDB items and needs microsecond read latency with minimal application changes. Which service should be added?

  1. S3 Transfer Acceleration for exports of the table
  2. An ElastiCache for Memcached cluster populated by the application
  3. DynamoDB global tables in a second Region
  4. DynamoDB Accelerator (DAX) in front of the table Correct answer.

Explanation

DAX is a write-through cache that is API-compatible with DynamoDB and serves eventually consistent reads in microseconds, requiring only a client change. It removes repeated read pressure from the table.

Question 39Development with AWS Services

A job calls BatchWriteItem with 25 items, and the response includes a non-empty UnprocessedItems collection. What should the application do?

  1. Resend each item as an individual PutItem call
  2. Retry only the unprocessed items with exponential backoff Correct answer.
  3. Retry the whole batch immediately with the same request
  4. Ignore the response because DynamoDB retries automatically

Explanation

Items returned in UnprocessedItems were not written, usually because capacity was exceeded, and the client is responsible for retrying them. Retrying only that subset with exponential backoff and jitter avoids resending successful writes and reduces further throttling.

Question 40Development with AWS Services

A Step Functions task calls a Lambda function that sometimes fails with a transient timeout. The workflow must retry up to three times with increasing intervals and then move to a cleanup state. Which features provide this?

  1. Retry with interval and backoff, plus a Catch field Correct answer.
  2. A Choice state that loops back to the task on any error
  3. A Parallel state with a Catch block on each branch
  4. A Wait state before the task and a Fail state afterwards

Explanation

The Retry field names error types and configures IntervalSeconds, MaxAttempts, and BackoffRate, producing bounded retries with growing delays. The Catch field then matches a named error and transitions to the cleanup state once retries are exhausted.

Question 41Development with AWS Services

A microservice must be invoked only when the event bus receives events whose source is orders and whose detail.type equals NEW. Which EventBridge capability should be used?

  1. An SNS topic with an email subscription for order events
  2. A scheduled rule with a cron expression that polls the orders service
  3. A rule with an event pattern matching source and detail Correct answer.
  4. An EventBridge archive that replays matching events

Explanation

EventBridge rules support event patterns that match on event fields such as source and detail.type, so only matching events invoke the target. Filtering happens at the rule, before the target is invoked.

Question 42Development with AWS Services

A Kinesis Data Streams producer sends all events for one high-volume customer with the same partition key, and a single shard is throttling while the others stay idle. What is the most likely cause?

  1. A single partition key maps to one shard, concentrating traffic Correct answer.
  2. The retention period is shorter than the producer's batch interval
  3. Consumers use enhanced fan-out, which limits producers
  4. Kinesis requires exactly one partition key per shard

Explanation

Kinesis hashes the partition key to select a shard, so every record with the same key lands on the same shard. Reusing one key for a high-volume customer creates a hot shard that exhausts its write capacity while other shards remain idle.

Question 43Development with AWS Services

An application calls an AWS API that returns paginated results and must collect every page. Which SDK feature avoids manually tracking continuation tokens?

  1. Use the SDK's built-in paginator for that operation Correct answer.
  2. Call the operation in a loop with identical parameters
  3. Set the MaxItems parameter to a very large value
  4. Set the client's retry mode to standard

Explanation

SDK paginators repeatedly call the operation and pass the service-provided continuation token until no more pages remain, exposing the results as an iterable. The application therefore never reads or stores the token itself.

Question 44Development with AWS Services

A company sells three tiers of an API and must meter and throttle each customer separately using API keys. Which API Gateway feature provides this?

  1. Resource policies attached to the API
  2. Stage variables per deployment
  3. Usage plans associated with API keys and stages Correct answer.
  4. Gateway responses that map 4XX errors

Explanation

Usage plans define throttling limits and quotas, and they are associated with API keys and one or more stages. Each customer's key maps to a plan, so consumption is metered and limited per tier.

Question 45Development with AWS Services

An API has a dev stage and a prod stage, and each stage must invoke a different Lambda alias without duplicating the API definition. Which feature should be used?

  1. Lambda environment variables that store the stage name
  2. Stage variables referenced in the integration URI Correct answer.
  3. Two separate REST APIs with hard-coded integration URIs
  4. A canary release deployment with a percentage split

Explanation

Stage variables are name-value pairs attached to a stage and can be referenced in the integration URI, so the dev stage can target the dev alias and prod can target the prod alias from one API definition.

Question 46Development with AWS Services

A Step Functions workflow must wait for a human approval that may take several days and then continue with the approver's result, without polling. Which pattern should be implemented?

  1. Pass a task token to the approver, who calls SendTaskSuccess to resume Correct answer.
  2. An Activity worker that calls GetActivityTask to poll for work
  3. A Wait state that polls an approval table until the record appears
  4. A Parallel state with a timeout that fails the workflow on expiry

Explanation

In the callback pattern Step Functions generates a task token and pauses the task until SendTaskSuccess or SendTaskFailure is called with that token. This supports waits of days or longer without polling and without consuming compute.

Question 47Development with AWS Services

A REST API uses a non-proxy Lambda integration. Clients send JSON in one shape, the function expects a different input shape, and the client must receive a custom JSON response structure. What should the developer configure?

  1. Gateway responses that map status codes to bodies
  2. A proxy integration that returns the Lambda proxy format
  3. Integration and method mapping templates written in VTL Correct answer.
  4. A Lambda authorizer that rewrites the request body

Explanation

With non-proxy integrations, API Gateway uses Velocity Template Language mapping templates on the integration request and integration response to reshape payloads. Method response mapping templates then define the structure the client receives.

Question 48Development with AWS Services

An application emits X-Ray traces, and the team must filter traces in the console by a business field such as orderId. How should that value be recorded?

  1. As an annotation, because annotations are indexed for filtering Correct answer.
  2. As a CloudWatch Logs line that includes the trace ID
  3. As a segment name, because segment names are searchable
  4. As trace metadata, because metadata is indexed for filtering

Explanation

Annotations are indexed key-value pairs attached to segments and subsegments, so filter expressions can select traces by values such as orderId. Metadata is stored with the trace but is not indexed for search.

Question 49Development with AWS Services

A service assumes a cross-account IAM role whose policy allows DynamoDB access to every table. The team must limit one specific session to a single table without changing the role for other callers. What should they do?

  1. Use a permissions boundary on the role listing the allowed table
  2. Create an IAM user with access keys scoped to the table
  3. Attach an inline deny policy to the calling IAM user
  4. Pass a session policy to AssumeRole that allows only that table Correct answer.

Explanation

The Policy parameter of AssumeRole applies a session policy whose permissions are intersected with the role's own policy, so the resulting credentials are limited to that one table. The role's identity policy remains unchanged for every other caller.

Question 50Development with AWS Services

A team must have CloudFormation provision a third-party SaaS resource that has no native resource type, with custom code performing the create and delete logic and reporting the result back to the stack. Which approach should they use?

  1. A WaitCondition with a presigned URL in the template
  2. A DeletionPolicy of Retain on the SaaS resource
  3. A CloudFormation custom resource backed by a Lambda function Correct answer.
  4. A nested stack that references the SaaS API endpoint

Explanation

A custom resource lets a Lambda function implement create, update, and delete behavior for a resource type CloudFormation does not natively support, then signal completion through the response URL. The function needs permission to call the third-party API and to send that response.