Free AWS Certified Developer - Associate (DVA-C02) Sample Questions

Correct answer: B — Amazon Kinesis Data Streams

• A. Incorrect. Amazon SQS is a fully managed message queuing service excellent for decoupling microservices. However, it is not optimized for ingesting high-volume, continuous streams of data. In a standard SQS queue, a message is consumed by only one consumer, which does not meet the requirement for multiple consumers to process the same data stream concurrently without implementing a more complex fan-out pattern (e.g., using SNS).
• B. Correct. Amazon Kinesis Data Streams is specifically designed for real-time ingestion, processing, and analysis of large-scale streaming data. It can durably capture terabytes of data per hour from sources like IoT devices. A key feature is its ability to support multiple, independent consumer applications that can read and process the data from the stream concurrently and in near real-time, making it the ideal choice for this scenario.
• C. Incorrect. Amazon S3 is an object storage service designed for high durability and scalability for storing data. While it can be a destination for streaming data (often via a service like Kinesis Data Firehose), it is not a streaming ingestion service itself and does not provide the capability for multiple consumers to process data in near real-time as it arrives.
• D. Incorrect. Amazon Aurora is a high-performance, relational database service compatible with MySQL and PostgreSQL. It is optimized for Online Transaction Processing (OLTP) workloads. It is not designed to handle the continuous, high-throughput ingestion of streaming data and would be an inappropriate choice for this use case.

Correct answer: B — Amazon SQS

• A. Incorrect. An Application Load Balancer (ALB) is used to distribute incoming HTTP/S traffic across multiple targets. While it can route requests to Service B, it does not provide a durable queue. If Service B is unavailable, the ALB cannot store the requests, leading to task loss.
• B. Correct. Amazon SQS (Simple Queue Service) is a fully managed message queuing service designed specifically to decouple and scale microservices. Service A can send tasks as messages to an SQS queue, where they are stored reliably. Service B can then poll the queue and process these messages at its own pace. If Service B is temporarily down or busy, the messages remain safely in the queue, ensuring no tasks are lost.
• C. Incorrect. AWS Step Functions is a serverless workflow orchestration service used to coordinate multiple AWS services into a state machine. While powerful for managing complex, multi-step processes, it is not the primary tool for simple, reliable decoupling between two services via a message buffer. SQS is a more direct and appropriate solution for this use case.
• D. Incorrect. Amazon ElastiCache is a managed in-memory caching service used to improve application performance by caching frequently accessed data. It is not designed for reliable, persistent message queuing and does not provide the durability guarantees required to prevent task loss if a consumer service is down.

Correct answer: C — Use a Paginator object provided by the Boto3 client for the `list_objects_v2` operation.

• A. Incorrect. While this approach is technically functional, it requires the developer to manually manage the pagination logic by extracting the `NextContinuationToken` from each response and passing it to the next request within a loop. This is not an automatic approach, is more complex, and is prone to errors.
• B. Incorrect. Using recursion for pagination is highly discouraged. For a large number of objects requiring many API calls, this pattern can easily lead to a 'maximum recursion depth exceeded' or stack overflow error, making the application unreliable.
• C. Correct. The Boto3 SDK provides high-level abstractions called Paginators to simplify handling paged API responses. Using a Paginator for the `list_objects_v2` operation abstracts away the underlying token management, automatically making subsequent API calls as needed. This is the official, recommended, and most robust method for automatic pagination.
• D. Incorrect. The `MaxKeys` parameter has a service-side limit, which is 1,000 for `list_objects_v2`. Setting it to a number higher than this limit will not return more than 1,000 objects per call. This parameter only controls the page size and does not solve the problem of paginating through a result set larger than the maximum page size.

Correct answer: C — A strongly consistent read of a 4 KB item consumes 1 RCU, so reading 10 items per second requires 10 RCU.

• A. This is incorrect. The base unit for calculating Read Capacity Units (RCU) in DynamoDB is 4 KB, not 1 KB. The 1 KB unit is used for Write Capacity Units (WCU). Therefore, the premise of this option is factually wrong.
• B. This is incorrect for two reasons. First, the premise that eventually consistent reads consume more capacity is false; they consume half the capacity of strongly consistent reads. Second, if the application were using eventually consistent reads, each 4 KB read would consume 0.5 RCU. Reading 10 items per second would require 10 * 0.5 = 5 RCUs, which matches the provisioned capacity and would not result in throttling.
• C. This is the correct answer. A single strongly consistent read operation can retrieve an item up to 4 KB in size and consumes 1 RCU. To read 10 items of 4 KB each per second using strongly consistent reads, the application would require 10 items/sec * 1 RCU/item = 10 RCUs. Since the table is only provisioned with 5 RCUs, the required capacity (10) exceeds the provisioned capacity (5), causing the requests to be throttled.
• D. This is incorrect. While a Scan operation can be less efficient and consume more RCUs than a Query to find specific items, the fundamental cause of throttling is always that the consumed capacity exceeds the provisioned capacity. The problem provides specific numbers (10 items/sec, 4 KB size) that allow for a direct calculation of the RCU requirement, which points to the read consistency model and capacity limits as the root cause, not the specific API call being used.

Correct answer: B — A cold start; it can be eliminated by configuring Provisioned Concurrency.

• A. Incorrect. Throttling is a rate-limiting mechanism that occurs when the number of invocation requests exceeds the function's concurrency limit, resulting in some requests being delayed or rejected. It is not related to the initial startup latency experienced after a period of inactivity.
• B. Correct. The phenomenon described is a 'cold start,' which is the latency incurred when a new execution environment must be initialized for a function that has been inactive. This involves downloading the code, starting the runtime, and running initialization code. Provisioned Concurrency is an AWS Lambda feature designed specifically to eliminate cold starts by keeping a specified number of execution environments pre-initialized and ready to respond instantly to requests.
• C. Incorrect. A timeout occurs when a Lambda function's execution time exceeds its configured maximum duration, leading to its forced termination by the service. Increasing the timeout setting allows a function to run for a longer period but does not affect or reduce the initial startup latency of a cold start.
• D. Incorrect. Container reuse is the mechanism that makes subsequent requests faster because an already initialized ('warm') execution environment is reused. This is the opposite of a cold start. While increasing a function's memory can reduce the duration of a cold start and improve overall performance, it does not eliminate it. Provisioned Concurrency is the most direct method to eliminate cold starts for a predictable workload.

Correct answer: C — The function is retried twice, with a delay between retries, before the event is discarded or sent to a DLQ.

• A. This is incorrect. AWS Lambda has a built-in, default retry mechanism specifically for asynchronous invocations to handle transient failures. Events are not simply discarded after the first failure.
• B. This is incorrect. The default behavior involves more than a single retry, and the retries are not immediate. Lambda waits for a period before re-attempting the invocation to allow transient issues to resolve.
• C. This is correct. For asynchronous invocations, the default behavior is for AWS Lambda to retry the function execution twice after the initial failure. There is a delay between these retries (1 minute before the first retry, 2 minutes before the second). If all three attempts (the original plus two retries) fail, Lambda discards the event unless an on-failure destination, such as a Dead-Letter Queue (DLQ), is configured.
• D. This is incorrect. Lambda does not retry indefinitely, as this could lead to infinite loops and excessive costs. The retry attempts are limited by a configurable setting, which defaults to two retries.

Correct answer: D — sam local invoke

• A. Incorrect. The `sam build` command is a necessary step that builds your source code and dependencies into deployment artifacts. However, it only prepares the application for local testing or deployment; it does not execute or invoke the function itself.
• B. Incorrect. The `sam deploy --guided` command is used to package and deploy your serverless application to your AWS account. This command is used after local testing is complete and does not facilitate local testing or event simulation.
• C. Incorrect. The `sam logs` command is used to fetch and view logs from an already deployed Lambda function in AWS CloudWatch Logs. It is not used for invoking a function locally or for testing prior to deployment.
• D. Correct. The `sam local invoke` command allows you to invoke a Lambda function locally in a Docker container. You can pass a payload or use the `--event` parameter with a file containing a simulated event, such as one from API Gateway. This is the ideal command for testing function logic on your local machine before deploying.

Correct answers: A, C — logs:CreateLogGroup; logs:PutLogEvents

• A. This permission is required for the Lambda function to create a new log group in CloudWatch Logs. When a function is invoked for the first time, the Lambda service attempts to create a log group (e.g., /aws/lambda/your-function-name) if it does not already exist. Without this permission, logging will fail if the log group has not been manually pre-created.
• B. The `logs:DescribeLogStreams` permission allows for retrieving information about log streams. While useful for monitoring, it is not a required permission for a Lambda function's execution role to write logs, as the Lambda service manages the creation and selection of log streams automatically.
• C. This is a fundamental permission required for the Lambda function to upload log events to a CloudWatch Logs stream. Without `logs:PutLogEvents`, the function cannot send its log data to CloudWatch, even if the log group and stream exist.
• D. The `iam:PassRole` permission is required for the user or service that is creating the Lambda function, allowing it to assign an execution role to the function. It is not a permission that belongs within the Lambda execution role itself to perform actions like logging.
• E. The `cloudwatch:PutMetricData` permission allows a function to publish custom metrics to Amazon CloudWatch Metrics. This is a separate service and capability from writing application logs to Amazon CloudWatch Logs.

Correct answer: B — Configure the Lambda function to write to an SQS queue, and have a separate Lambda function poll the queue at a controlled rate to write to RDS.

• A. This is an incorrect solution. Vertically scaling the RDS instance (increasing its size) is a temporary, expensive fix that does not address the core architectural problem of unregulated, spiky write traffic. The database could still become overloaded during a large enough spike, and this approach is not elastic.
• B. This is the correct answer. Introducing an Amazon SQS queue between the initial Lambda function and the database is a classic decoupling pattern. The first Lambda function can scale out to handle the burst of S3 events and write messages to the SQS queue quickly. A second, downstream Lambda function can then poll the queue and write to the RDS database at a controlled, sustainable rate. This use of SQS as a buffer protects the database from being overwhelmed, making the architecture significantly more scalable and resilient to traffic spikes.
• C. This is an incorrect solution that would worsen the problem. Increasing the Lambda function's reserved concurrency would allow more instances of the function to run simultaneously. This would result in even more concurrent connections and write operations to the RDS database, accelerating the overload and causing it to fail faster.
• D. This is a plausible but less optimal solution than using SQS. While DynamoDB with on-demand capacity is excellent for handling unpredictable, high-volume workloads, migrating from a relational database (RDS) to a NoSQL database (DynamoDB) is a major architectural change. It would require significant effort in data modeling, data migration, and application code changes. The SQS pattern directly solves the stated problem of protecting the existing RDS database with less disruption.

Correct answer: D — S3 Glacier Deep Archive

• A. S3 Standard is designed for frequently accessed data that requires low latency and high throughput. It is not cost-effective or designed for long-term archiving with delayed retrieval.
• B. S3 Intelligent-Tiering is designed to optimize storage costs for data with unknown or changing access patterns by automatically moving it between different access tiers. While it can move data to archive tiers, it is not specifically designed as a primary long-term archive solution where multi-hour retrieval is the standard.
• C. S3 Standard-Infrequent Access (S3 Standard-IA) is for data that is accessed less frequently but requires rapid, millisecond access when needed. It is not suitable for the use case described, which accepts retrieval times of several hours.
• D. S3 Glacier Deep Archive is AWS's lowest-cost storage class and is specifically designed for long-term data archiving and digital preservation. It is the ideal choice when data is rarely accessed and retrieval times of several hours (typically within 12 hours) are acceptable.

Correct answers: A, C — Partition key; Sort key

• A. Correct. A primary key in DynamoDB must always have a partition key (also known as a hash key). It is used to distribute data across partitions for scalability. A table's primary key can be a simple primary key (partition key only) or a composite primary key (partition key and sort key).
• B. Incorrect. A Global Secondary Index (GSI) is an index with a partition key and sort key that can be different from the table's primary key. It allows for additional, flexible query patterns but is not a component of the table's primary key itself.
• C. Correct. A sort key (also known as a range key) is the optional second component of a primary key. When a sort key is used in conjunction with a partition key, it forms a composite primary key. It is used to sort items with the same partition key value.
• D. Incorrect. A Local Secondary Index (LSI) is an index that has the same partition key as the base table but a different sort key. It provides an alternative sorting order for data within a partition but is not a component of the table's primary key.
• E. Incorrect. 'Attribute key' is not a standard term used to describe a component of a DynamoDB primary key. The valid components are the partition key and the optional sort key, both of which are attributes of an item.

Correct answer: D — AWS Systems Manager Parameter Store with a `SecureString` parameter, specifying the customer-managed KMS key.

• A. Incorrect. A `String` parameter in AWS Systems Manager Parameter Store stores data in plaintext. This does not meet the security requirement for encryption at rest.
• B. Incorrect. AWS AppConfig is a service for managing and deploying application configurations. While it can integrate with services that store secrets, it is not the primary service for securely storing and encrypting sensitive data like connection strings.
• C. Incorrect. Although AWS Secrets Manager is an excellent service for storing secrets and meets the encryption and auditing requirements, the statement is false because of the qualifier 'it is the only service'. AWS Systems Manager Parameter Store can also store connection strings securely.
• D. Correct. Using a `SecureString` parameter in AWS Systems Manager Parameter Store meets all the requirements. It encrypts the data at rest using AWS KMS, and you can specify a customer-managed KMS key. All API actions, including retrieving the parameter, are logged in AWS CloudTrail, fulfilling the auditing requirement.

Correct answers: B, C — Attach an IAM role to the EC2 instance profile.; Create an IAM policy that grants the `secretsmanager:GetSecretValue` permission.

• A. This is incorrect. Using long-lived credentials of an IAM user stored on an EC2 instance is a significant security risk and an anti-pattern. If the instance is compromised, these static credentials can be stolen. The best practice is to use temporary credentials provided by IAM roles.
• B. This is a correct best practice. By attaching an IAM role to an EC2 instance profile, the application on the instance can retrieve temporary security credentials from the EC2 metadata service. This avoids storing long-lived credentials and is more secure as these temporary credentials are automatically rotated by AWS.
• C. This is a correct and necessary step. The IAM role attached to the EC2 instance needs an IAM policy with permissions to access Secrets Manager. Granting only the `secretsmanager:GetSecretValue` permission adheres to the principle of least privilege, ensuring the application has only the exact permissions it needs to function and nothing more.
• D. This is incorrect and a critical security violation. The AWS root account credentials provide unrestricted access to the entire AWS account and should never be stored or used in an application or on an EC2 instance. The use of root credentials should be extremely limited.
• E. This is incorrect. The name of an IAM role is a user-defined identifier and has no effect on its functionality or permissions. Any valid name can be used for the role, as long as it has the correct trust relationship and permission policies attached.

Correct answer: B — Create an IAM role with the necessary S3 permissions and attach it to the EC2 instances using an instance profile.

• A. This is incorrect. Embedding long-lived IAM user credentials (access key and secret key) directly in application code is a significant security risk. It makes credentials vulnerable to exposure if the code is compromised and complicates the essential security practice of credential rotation.
• B. This is the correct answer and the AWS-recommended best practice. By creating an IAM role with the specific S3 permissions needed and attaching it to the EC2 instance via an instance profile, the application can securely obtain temporary, automatically rotated credentials from the EC2 instance metadata service. This approach eliminates the need to manage and store long-lived credentials, adhering to the principle of least privilege.
• C. This is incorrect and a severe security anti-pattern. Making an S3 bucket public for read/write access exposes its contents to anyone on the internet, creating a major data breach risk. Access control should always be managed through IAM policies and roles, not solely through application logic.
• D. This is incorrect. While storing IAM user credentials in AWS Secrets Manager is significantly more secure than embedding them in code, it is not the best practice for this scenario. It still involves managing long-lived IAM user credentials. The preferred and more secure method for granting AWS service permissions to an EC2 instance is to use an IAM role, which provides seamless and automatic management of temporary credentials.

Correct answers: A, C — Amazon Cognito User Pools; Amazon Cognito Identity Pools

• A. Correct. Amazon Cognito User Pools is a fully managed user directory service. It handles user registration, sign-in, profile management, and password recovery for mobile and web applications, directly addressing the first requirement of the scenario.
• B. Incorrect. AWS Directory Service is designed for integrating AWS resources with existing on-premises or cloud-based Microsoft Active Directory environments. It is not suitable for managing end-user identities for a consumer-facing mobile application.
• C. Correct. Amazon Cognito Identity Pools (Federated Identities) enable you to grant users temporary, limited-privilege AWS credentials to access AWS resources, such as an S3 bucket. After a user is authenticated by a User Pool, the Identity Pool can provide the necessary credentials for the S3 upload, fulfilling the second requirement.
• D. Incorrect. Creating individual IAM users for each application end-user is not scalable, manageable, or secure. IAM users represent long-term credentials intended for administrators, developers, or services that manage AWS resources, not for application end-users.
• E. Incorrect. AWS Single Sign-On (now AWS IAM Identity Center) is used to centrally manage SSO access to multiple AWS accounts and business applications for an organization's workforce. It is not designed to provide user authentication or authorization for a custom mobile application's end-users.

Correct answers: B, D — Defining a custom key policy to control access; Disabling the key temporarily

• A. This is incorrect. Both key types support automatic rotation. AWS managed keys are automatically rotated every year by AWS, and this behavior cannot be changed. For customer managed keys, you can optionally enable automatic key rotation, which also occurs annually. Since both types have a mechanism for automatic rotation, it is not an exclusive feature of customer managed keys.
• B. This is a key capability exclusive to customer managed keys (CMKs). With CMKs, you have full, granular control over the key policy, allowing you to define exactly which IAM users and roles can manage and use the key. In contrast, the key policy for an AWS managed key is predefined and managed by the associated AWS service, and it cannot be modified by the customer.
• C. This is incorrect. Many AWS services that integrate with KMS, such as S3, EBS, and RDS, can use either AWS managed keys or customer managed keys to encrypt data. This capability is not unique to customer managed keys.
• D. This is a key control feature exclusive to customer managed keys (CMKs). A developer can temporarily disable and later re-enable a CMK to prevent it from being used in any cryptographic operations. This acts as a temporary revocation of all permissions. AWS managed keys cannot be disabled by the customer.
• E. This is incorrect. All AWS KMS keys, whether AWS managed or customer managed, have their cryptographic material protected by FIPS 140-2 validated hardware security modules (HSMs). This is a fundamental feature of the KMS service itself and not a differentiator between the key types.

Correct answers: C, D — The old backing keys are preserved indefinitely to allow for decryption of data encrypted under them.; The rotation period can be customized by the developer.

• A. Incorrect. When a KMS key is rotated, only the backing key material changes. All other metadata, including the key ID, ARN, alias, and policies, remains the same. This provides a stable, logical reference for applications, which do not need to be updated to use the new key material.
• B. Incorrect. Automatic key rotation is an optional feature for customer-managed keys and is disabled by default. A developer must explicitly enable it either during the key creation process or by modifying the key's configuration after it has been created.
• C. Correct. AWS KMS preserves all previous versions of the backing key material indefinitely. When you use a rotated KMS key to decrypt data, KMS automatically uses the correct version of the backing key that was used for encryption, ensuring seamless decryption of older data.
• D. Correct. For customer-managed keys with automatic rotation enabled, the rotation period can be customized. The research indicates the period can be set between 90 and 2560 days. The default period is 365 days, but it can be changed to meet specific organizational or compliance requirements.
• E. Incorrect. While 'once per year' (365 days) is the default rotation period for customer-managed keys, it is not the only option, as the period is customizable. This statement is strictly true for AWS-managed keys, which are automatically rotated annually on a non-configurable schedule, but the question specifically asks about customer-managed keys.

Correct answer: A — Create a new branch from the main branch.

• A. Correct. The standard and best practice for starting new feature development in Git is to create a new branch from the main (or development) branch. This practice, known as feature branching, allows the developer to work in an isolated environment without affecting the stable, production-ready code in the main branch. It enables parallel development and ensures that the main branch remains clean and deployable at all times, with features being merged back only after they are complete and tested.
• B. Incorrect. Cloning the repository is the initial action taken to get a local copy of a remote repository. It is not something a developer would typically do for each new feature. The developer should work within their existing local clone and use branches to manage different streams of work.
• C. Incorrect. Committing changes directly to the main branch is precisely what should be avoided. The main branch is used for production releases and should only contain stable, tested, and complete code. Committing incomplete feature work directly to it would introduce instability and disrupt the production line.
• D. Incorrect. Pushing is the action of synchronizing local commits with the remote repository. It is not the first step to begin work on a new feature. This action would typically be performed after committing changes to a feature branch, not as a way to start development.

Correct answers: B, D — `COPY ./app /app`; `RUN pip install -r requirements.txt`

• A. Incorrect. `EXECUTE` is not a valid Dockerfile instruction. The correct instruction to execute commands during the image build process is `RUN`.
• B. Correct. `COPY` is a valid Dockerfile instruction used to copy files or directories from the build context (the source) into the filesystem of the Docker image at a specified destination path.
• C. Incorrect. `INSTALL` is not a valid instruction in a Dockerfile. To install software packages or dependencies, you must use the `RUN` instruction followed by the appropriate command, such as `apt-get install`, `yum install`, or `pip install`.
• D. Correct. `RUN` is a fundamental Dockerfile instruction that executes any commands in a new layer on top of the current image and commits the results. It is commonly used to install application dependencies, as shown here with `pip install`.
• E. Incorrect. `DEFINE` is not a valid Dockerfile instruction. To specify the port on which the container will listen at runtime, the `EXPOSE` instruction is used. To define environment variables, you would use the `ENV` instruction.

Correct answer: B — Use a configuration file, such as `samconfig.toml`, with different profiles for each environment.

• A. This is not a recommended practice as it leads to significant code duplication and increases maintenance overhead. Any change to the core infrastructure would need to be replicated across all template files, making the process error-prone and violating the Don't Repeat Yourself (DRY) principle.
• B. This is the recommended approach for managing environment-specific configurations with AWS SAM. The `samconfig.toml` file allows you to define different configuration environments (e.g., `dev`, `prod`) with their respective parameter values. This centralizes configuration, keeps the `template.yaml` file generic, and simplifies automated deployments by allowing you to specify the target environment with a simple flag (e.g., `sam deploy --config-env prod`).
• C. This is poor practice because it mixes deployment configuration with application logic, violating the principle of separation of concerns. This makes the function code harder to maintain, less portable, and more difficult to test. Configuration should be external to the application code and injected at deployment time, for example, through environment variables.
• D. While possible, manually passing all parameters via the command line is highly error-prone, not scalable, and unsuitable for automated CI/CD pipelines. This approach makes the deployment command complex and difficult to manage, undermining the reliability and repeatability that automation aims to achieve.

Correct answers: A, C — Use CloudFormation StackSets to deploy the template to different AWS accounts or Regions.; Deploy the same template multiple times, providing a different parameter file for each deployment.

• A. AWS CloudFormation StackSets are designed to deploy a single template across multiple AWS accounts and/or Regions. While their primary use case is large-scale, multi-account deployments, they are a valid method for this scenario. You can create different stack instances, each representing a testing environment, and use parameter overrides to specify variations like different EC2 instance types for each.
• B. This approach is an anti-pattern in Infrastructure as Code (IaC). Modifying and creating separate copies of the template for each environment leads to configuration drift, makes maintenance difficult, and defeats the purpose of having a single, version-controlled source of truth.
• C. This is the most common and recommended method. By using parameters within the CloudFormation template for values that change (like EC2 instance types), you can deploy the same template multiple times. Each deployment creates a new, independent stack with its own unique configuration by simply providing a different set of parameter values, often through a separate parameter file.
• D. While CloudFormation supports nested stacks, this option describes an incorrect implementation. You would not create a new parent template for each environment. This approach introduces unnecessary complexity and redundancy. Nested stacks are meant to break down complex templates into reusable components, not to manage environmental variations in this manner.
• E. Importing resources is a feature used to bring existing, manually-created resources under CloudFormation management. It is not a method for creating new environments from a template. This approach is for brownfield scenarios and is the opposite of the automated, greenfield deployment requested.

Correct answer: B — An event name and the JSON payload.

• A. Incorrect. The function's ARN (Amazon Resource Name) and its associated IAM role are related to the function's identity and permissions, respectively. These are part of the function's configuration, not the input data required to create a test event.
• B. Correct. When creating a test event in the AWS Lambda console, a developer must provide an 'Event name' to identify the test and the 'Event JSON' payload. The JSON payload simulates the input data that the Lambda function would receive from a trigger, which is essential for testing the function's logic.
• C. Incorrect. Timeout and memory settings are fundamental configuration parameters of the Lambda function itself. They define the execution environment's resources and limits but are not part of the test event's input payload.
• D. Incorrect. VPC and subnet configurations are part of the Lambda function's networking setup, allowing it to access resources within a VPC. This is a configuration setting for the function, not a requirement for creating a test event payload.

Correct answer: B — Change Sets

• A. Incorrect. Stack Policies are JSON documents that act as a safeguard, preventing specified stack resources from being unintentionally updated or deleted during a stack update. They are a protective measure, not a tool for previewing proposed changes.
• B. Correct. Change Sets are the specific CloudFormation feature designed for this scenario. They allow a developer to preview the changes AWS CloudFormation will make to a stack, including which resources will be added, modified, or deleted. This enables a thorough review of the potential impact on running resources before executing the actual update.
• C. Incorrect. Drift Detection is used to identify differences between a stack's expected configuration (defined in the template) and the actual configuration of its resources. It detects unmanaged, out-of-band changes that have already occurred, rather than previewing planned updates.
• D. Incorrect. StackSets are a feature for managing and deploying CloudFormation stacks across multiple AWS accounts and regions from a single template. Their purpose is to scale deployments, not to preview changes within a single stack update.

Correct answer: A — By appending the alias name to the Lambda function ARN in the integration request, using a stage variable like `${stageVariables.lambdaAlias}`.

• A. This is the correct approach. API Gateway stage variables are designed for this exact purpose, allowing you to create dynamic configurations for different deployment stages. By defining a stage variable (e.g., `lambdaAlias`) and setting its value to `DEV` for the 'dev' stage, `QA` for the 'qa' stage, and so on, you can use the variable in the Lambda integration ARN like `...:function:my-function:${stageVariables.lambdaAlias}`. This allows you to promote the same API definition through different stages without modification, simply by changing the variable's value in each stage's configuration.
• B. Incorrect. A Lambda resource-based policy is used for granting permissions, i.e., defining which principal (like an API Gateway) is allowed to invoke the function. It does not specify which version or alias of the function should be invoked. The invocation target is defined in the API Gateway integration URI, not the Lambda's permission policy.
• C. Incorrect. Hardcoding the full ARN of a specific Lambda alias in the integration request is inflexible and goes against the requirement to easily change it for other stages. This method would require you to manually edit the API Gateway integration for each stage, which is inefficient, error-prone, and an anti-pattern for CI/CD pipelines.
• D. Incorrect. Mapping templates in API Gateway are used to transform the request or response payload (the body of the HTTP request/response). They modify the data being sent to or returned from the backend integration but cannot be used to change the integration endpoint ARN itself, which is where the Lambda alias is specified.

Correct answer: B — In the `Policies` section of the `AWS::Serverless::Function` resource in the `template.yaml` file.

• A. This is incorrect. The IAM user's permissions are for deploying the AWS resources (e.g., using CloudFormation), not for the runtime execution of the Lambda function. The function runs with its own IAM execution role, which is the principal that requires permissions to interact with other AWS services like S3.
• B. This is the correct answer and aligns with Infrastructure as Code (IaC) best practices. The AWS SAM template (`template.yaml`) is the source of truth for the application's infrastructure. By defining permissions in the `Policies` section of the `AWS::Serverless::Function` resource, the Lambda function's execution role is automatically created or updated with the correct permissions during each deployment. This ensures consistency, repeatability, and version control for permissions.
• C. While a resource-based policy on the S3 bucket could grant the Lambda function access, it is not the best practice in this scenario. It's better to use an identity-based policy attached to the function's execution role. This co-locates the permission definitions with the function definition in the SAM template, making the application component more self-contained and easier to manage and audit.
• D. This is incorrect and considered an anti-pattern. Manually modifying resources in the AWS console after a deployment from an IaC template leads to 'configuration drift,' where the deployed state no longer matches the code. This manual step is error-prone, not repeatable, and any changes would likely be overwritten on the next SAM deployment.

Correct answer: C — AWS Cloud Development Kit (AWS CDK)

• A. Incorrect. AWS CloudFormation is a declarative Infrastructure as Code (IaC) service that uses JSON or YAML templates. It does not allow developers to use general-purpose programming languages like Python or imperative constructs like loops and objects directly within the templates to define infrastructure.
• B. Incorrect. The AWS Serverless Application Model (SAM) is an open-source framework that extends CloudFormation specifically for building serverless applications. While it simplifies the syntax for serverless resources, it is still based on declarative YAML templates and does not support defining infrastructure using programming languages like Python.
• C. Correct. The AWS Cloud Development Kit (CDK) is an open-source software development framework that allows developers to define cloud infrastructure in code using familiar programming languages, including Python. It enables the use of powerful programming constructs like loops, conditionals, and objects to create reusable infrastructure components. The CDK code is then synthesized into standard AWS CloudFormation templates for deployment.
• D. Incorrect. The AWS Amplify CLI is a toolchain designed to simplify the development and deployment of cloud-powered mobile and web applications. It abstracts away much of the underlying infrastructure and is not a general-purpose IaC tool for defining arbitrary cloud resources using programming constructs.

Correct answers: A, B — `sam` commands can automatically transform AWS SAM resources (e.g., `AWS::Serverless::Function`) into standard CloudFormation resources.; `sam` commands provide a way to run the serverless application locally for testing.

• A. This is a core benefit. The AWS SAM specification is a superset of AWS CloudFormation that provides simplified syntax for defining serverless resources. The `sam build` command processes the SAM template and transforms the simplified resources (like `AWS::Serverless::Function`) into their more verbose, standard AWS CloudFormation equivalents. This abstraction simplifies template authoring and maintenance.
• B. This is a major advantage of the SAM CLI. It includes a suite of `sam local` commands (e.g., `sam local invoke`, `sam local start-api`) that allow developers to test their functions and API endpoints in a local, Docker-based environment that simulates the Lambda runtime. This significantly accelerates the development feedback loop compared to deploying to the cloud for every test.
• C. The SAM CLI does not automatically create a VPC. If a Lambda function needs to operate within a VPC, the developer must explicitly define the VPC configuration in the SAM template. The VPC, subnets, and security groups must either already exist or be defined as resources within the same CloudFormation stack.
• D. The `sam deploy` command targets a single AWS Region per execution, specified either through a command-line flag or the default AWS CLI profile configuration. Deploying to multiple Regions requires executing the command multiple times, once for each target Region, often orchestrated by a CI/CD pipeline or custom script.
• E. The SAM CLI uses the IAM credentials of the principal (user or role) executing the command. It does not provision its own IAM users. A developer must have their environment configured with an IAM principal that possesses the necessary permissions to create and manage AWS CloudFormation stacks and the resources defined within them.

Correct answer: B — Writing log events in the Embedded Metric Format (EMF) to standard output.

• A. This approach is incorrect because it directly contradicts the requirement for a single write operation. Making two distinct API calls, one for metrics (`PutMetricData`) and one for logs (`PutLogEvents`), increases application latency and can lead to higher costs compared to a single, combined operation.
• B. This is the correct method. The CloudWatch Embedded Metric Format (EMF) is a JSON specification that allows you to embed custom metric values within structured log events. By writing a single EMF-formatted log entry to standard output, the application completes its task with minimal latency. The CloudWatch Agent, configured for EMF, then asynchronously parses these log entries, sending the log data to CloudWatch Logs and extracting and submitting the metric data to CloudWatch Metrics on the application's behalf. This meets the requirement for a single write operation from the application's perspective, minimizing both latency and cost.
• C. This is incorrect. The AWS X-Ray daemon is used for collecting distributed tracing data (segments and subsegments), not for generating custom application metrics and logs. While X-Ray provides insights into application performance and dependencies, it does not fulfill the requirement of combining custom metrics and logs into a single write operation.
• D. This approach is incorrect for this scenario. While the unified CloudWatch Agent can scrape Prometheus-formatted metrics from an endpoint, this method only addresses metrics. It does not combine the generation of logs and metrics into a single write operation. A separate mechanism would still be required to send application logs to CloudWatch.

Correct answer: C — To track a single request's journey through multiple services, identifying latency and errors at each step.

• A. Incorrect. This describes the function of a centralized logging system, such as Amazon CloudWatch Logs or an ELK stack. While centralized logging is a crucial part of observability, its primary function is to collect and aggregate logs, not to trace a single request's path across different services.
• B. Incorrect. This option describes infrastructure or resource monitoring, which is typically handled by services like Amazon CloudWatch Metrics. While monitoring metrics like CPU and memory is essential for understanding the health of individual services, it does not provide insight into the flow of requests between services.
• C. Correct. This is the precise definition of distributed tracing. Its core function is to follow a single request or transaction as it propagates through multiple services in a distributed system. By doing so, it helps developers visualize the entire request path, identify performance bottlenecks by measuring latency at each step, and pinpoint the source of errors. AWS X-Ray is the primary AWS service for distributed tracing.
• D. Incorrect. This describes the function of auto-scaling, a feature provided by services like Amazon EC2 Auto Scaling or AWS Fargate. Auto-scaling is a resource management mechanism that adjusts capacity based on load, whereas distributed tracing is an observability tool focused on understanding request behavior.

Correct answer: B — Monitoring tells you when something is wrong based on predefined metrics, while observability lets you ask why it's wrong by exploring rich, contextual data.

• A. This statement is an oversimplification. While metrics are a key part of monitoring, a good monitoring strategy also involves logs and traces. Observability is a broader concept that relies on high-cardinality data from all three pillars—metrics, logs, and traces—to provide deep insights into a system's behavior, not just one type of data.
• B. This is the most accurate description. Monitoring is about observing pre-defined signals (metrics against thresholds) to know *that* a system is not working as expected (the 'what'). Observability provides rich, high-cardinality data (logs, metrics, and distributed traces) that allows you to freely explore and ask new questions to understand *why* it's failing, especially for novel or unexpected problems (the 'why').
• C. This is incorrect. Monitoring and observability are broad industry concepts, not features exclusive to specific AWS services. While Amazon CloudWatch is a primary tool for monitoring and AWS X-Ray is a key tool for achieving observability (specifically through tracing), they are just AWS implementations of these broader practices. Many other tools exist for both.
• D. This statement generally reverses the roles. Monitoring is often considered reactive, as it typically alerts you when a predefined threshold has already been crossed. Observability, by providing deep insights into system behavior, enables a more proactive stance. It allows developers to understand complex system interactions and anticipate potential issues before they escalate into critical failures.

Correct answers: B, D — `metrics`; `logs`

• A. Incorrect. The `traces` section in the CloudWatch Agent configuration file is used for collecting trace data for services like AWS X-Ray, not for logs or custom metrics.
• B. Correct. The `metrics` section is a required part of the configuration file to define and collect custom application metrics from an EC2 instance. It allows specifying the metrics to collect, their namespaces, and dimensions.
• C. Incorrect. The `alarms` section is not a valid part of the CloudWatch Agent configuration file. CloudWatch Alarms are configured separately in the CloudWatch service itself (via the console, CLI, or IaC) based on the metric or log data that has already been collected.
• D. Correct. The `logs` section is necessary to configure the agent to collect log data from specific files. This section is where you define the file paths to monitor, the log group, and the log stream names for the collected logs.
• E. Incorrect. The `dashboard` section is not a feature of the CloudWatch Agent configuration. CloudWatch Dashboards are created and managed within the CloudWatch console to visualize the metrics and logs after they have been ingested into the service.

Correct answer: C — Amazon SQS

• A. Incorrect. Amazon Kinesis Data Streams is designed for collecting, processing, and analyzing real-time streaming data at a massive scale. While it can handle high-throughput data, its primary purpose is for streaming analytics, not for decoupling application components in a request/response pattern. It is more complex and costly than what is required for this use case.
• B. Incorrect. Amazon Simple Notification Service (SNS) is a pub/sub messaging service used to send notifications to a large number of subscribers. It pushes messages to subscribers immediately and does not provide an inherent queuing or buffering mechanism. This makes it unsuitable for absorbing traffic spikes and allowing a backend to process messages at its own pace.
• C. Correct. Amazon Simple Queue Service (SQS) is a fully managed message queuing service that is ideal for decoupling application components. It allows the front-end to send order messages to a queue, and the backend service can poll and process these messages at its own rate. The queue acts as a buffer, absorbing the sudden spikes in traffic and preventing the backend from being overwhelmed.
• D. Incorrect. Elastic Load Balancing (ELB) distributes incoming application traffic across multiple targets, such as EC2 instances or Lambda functions. While it helps manage traffic and improve scalability, it does not decouple the front-end from the backend. ELB forwards requests synchronously and does not provide a queue to buffer requests for asynchronous processing.

Correct answer: D — AWS Lambda Power Tuning

• A. Incorrect. AWS X-Ray is a service for analyzing and debugging distributed applications, such as those built using a microservices architecture. It helps developers identify performance bottlenecks and trace requests as they travel through an application, but it does not provide specific tools for analyzing and optimizing Lambda memory configurations or visualizing cost trade-offs.
• B. Incorrect. AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices across cost optimization, performance, security, and fault tolerance. It does not offer granular, detailed analysis for tuning an individual Lambda function's memory configuration.
• C. Incorrect. AWS Cost Explorer is a tool for visualizing, understanding, and managing your AWS costs and usage over time. While it can show you the overall cost of your Lambda functions, it does not provide the performance metrics needed to analyze the trade-offs between memory, execution time, and cost.
• D. Correct. AWS Lambda Power Tuning is an open-source tool, often deployed via a Step Functions state machine, specifically designed to help developers find the optimal memory/power configuration for their Lambda functions. It runs the function with different memory settings and visualizes the trade-offs between execution time and cost, allowing a developer to choose the best balance for their needs.

Correct answer: C — Examine the application logs on the EC2 instances for errors occurring around the time the health checks failed.

• A. Incorrect. While ALB access logs can help analyze traffic patterns, they do not directly explain why an instance is failing its health check. The root cause is likely an issue on the instance itself, such as an application error or resource exhaustion, rather than the source of the incoming user traffic. This might be a useful secondary step, but it is not the best initial diagnostic action.
• B. Incorrect. A misconfigured security group would typically block all traffic from the ALB to the instances, leading to a persistent and total failure of health checks, causing the `HealthyHostCount` to be constantly zero. Since the problem is described as intermittent, a security group misconfiguration is a highly unlikely cause.
• C. Correct. This is the most direct and effective first step. The fact that instances are intermittently failing health checks points to a problem within the application or the instance environment. Analyzing the application logs (and potentially system logs) on the EC2 instances from the time the failures occurred is the most likely way to find the root cause, such as out-of-memory exceptions, database connection timeouts, high resource utilization, or other application-specific errors.
• D. Incorrect. This action does not diagnose the problem; it only masks the symptoms. Increasing the health check interval or threshold makes the health checks less sensitive, which might reduce the frequency of `503` errors but allows the underlying application issue to persist and potentially worsen. This is a temporary mitigation strategy, not a step in root cause analysis.

Correct answer: C — To enable applications to generate complex, high-cardinality custom metrics by writing structured JSON to standard output, which is then processed by CloudWatch Logs.

• A. Incorrect. While EMF is a standardized format, its primary purpose is not for general parsing by third-party tools, but specifically for integration with AWS CloudWatch to automatically extract and publish custom metrics from log data.
• B. Incorrect. The Embedded Metric Format is concerned with the structure and content of log events for metric generation. Encryption of log data at rest in CloudWatch Logs is a separate feature managed by AWS, typically using AWS Key Management Service (KMS), and is independent of the log format.
• C. Correct. The primary purpose of EMF is to simplify the generation of detailed, high-cardinality custom metrics. Developers can embed metric definitions within a structured JSON log message. When CloudWatch Logs receives a log in this format, it automatically extracts and publishes the metric data, avoiding the need for direct, potentially throttled, `PutMetricData` API calls. This is highly efficient, especially in serverless applications like AWS Lambda.
• D. Incorrect. EMF is used for generating custom metrics for Amazon CloudWatch. AWS X-Ray is a separate service for distributed tracing and uses its own distinct format and daemon for collecting and sending trace data.