Free AWS Certified Developer - Associate (DVA-C02) Sample Questions

Correct answers: A, E — DynamoDB encrypts all table data at rest by default using an AWS-owned key at no additional cost, and this can optionally be changed to an AWS managed or customer managed KMS key; When a customer managed KMS key replaces the default AWS-owned key, no application code changes are needed, since DynamoDB transparently decrypts data on access

• A. AWS documentation states that DynamoDB encrypts all customer data at rest by default using an AWS-owned key with no additional charge, and developers can optionally switch to an AWS managed key or a customer managed key for more control.
• B. Encryption at rest is not an opt-in feature that must be explicitly enabled; every DynamoDB table has encryption at rest applied automatically from creation, regardless of whether the developer configures anything.
• C. Encryption at rest applies uniformly to DynamoDB tables regardless of capacity mode; there is no distinction between provisioned and on-demand tables in whether data is encrypted at rest.
• D. A customer managed key is an optional choice for organizations that need full control over key policies and rotation; it is not required, since every table already defaults to encryption with an AWS-owned key.
• E. Switching the encryption key type is a table-level configuration change; DynamoDB continues to transparently encrypt and decrypt data regardless of which key type is used, so no application code changes are required.

Correct answers: A, B — Create a new global secondary index with `orderStatus` as the partition key and `orderDate` as the sort key to support this specific access pattern directly; Update application code to use `Query` with a key condition on the new index instead of `Scan` with a filter expression on `orderStatus`

• A. A GSI with `orderStatus` as the partition key and `orderDate` as the sort key lets the application run a `Query` targeted directly at matching orders, which is the standard way to support a new access pattern DynamoDB does not natively provide for a non-key attribute.
• B. Creating the index only helps if the application actually queries it; switching the code from a table-wide `Scan` with a filter to a `Query` against the new index is what eliminates the cost of reading every item before filtering.
• C. Projecting an attribute into an index changes what data is returned by queries against that index; it does not turn a `Scan` into a targeted lookup, and a `Scan` against any index still reads every item in that index before filtering.
• D. Raising the throughput ceiling lets more expensive `Scan` operations complete without throttling, but it does not reduce the actual cost or latency of scanning the whole table; it treats the symptom rather than the access-pattern problem.
• E. Renaming an attribute has no effect on indexing; DynamoDB does not automatically index arbitrary attributes regardless of their name, and only attributes explicitly defined as part of a primary key or secondary index are indexed.

Correct answers: A, B — Write unit tests that mock the SNS and DynamoDB SDK clients to verify the function calls them with the expected parameters; Deploy the function to a staging environment and run integration tests that exercise a real SNS topic and DynamoDB table

• A. This is correct because mocking the SDK clients in unit tests isolates the function's logic and verifies it calls SNS and DynamoDB with the correct parameters, catching logic errors quickly without needing live infrastructure.
• B. This is correct because integration tests against real staging resources validate that IAM permissions, request formats, and service behavior actually work end-to-end, catching issues that mocks cannot reveal, such as permission gaps or malformed requests.
• C. This is incorrect because IAM permissions only authorize an API call; they do not guarantee the call succeeds, since malformed requests, throttling, or logic bugs can still cause failures that testing is meant to catch.
• D. This is incorrect because reviewing a CloudFormation template only validates that resources are declared correctly; it says nothing about whether the function's runtime code correctly calls those services.
• E. This is incorrect because waiting for production traffic to surface bugs is a reactive strategy that risks real customer impact; pre-deployment unit and integration testing are standard practices for catching these issues earlier.

Correct answer: A — Use the AWS AppConfig Lambda extension, which caches configuration data locally and serves it to the function over a local HTTP endpoint

• A. This is correct because the AWS AppConfig Lambda extension runs as a companion process that fetches and caches configuration data locally within the execution environment, letting the function's code retrieve values over a local endpoint instead of calling the AppConfig API remotely on every invocation.
• B. This is incorrect because API Gateway does not cache AppConfig responses; API Gateway caching, if enabled, applies to the API's own method responses, not to calls a Lambda function separately makes to AppConfig.
• C. This is incorrect because embedding the flag value in the deployment package requires a full redeploy for every flag change, defeating the purpose of using AppConfig for dynamic, redeploy-free configuration updates.
• D. This is incorrect because adding a second synchronous Lambda invocation in the request path adds more latency and cost from an extra function call, rather than reducing the latency of retrieving configuration.

Correct answers: A, B — Wrap the third-party call in retry logic with exponential backoff and jitter for transient errors such as timeouts or 5xx responses; Catch exceptions from the third-party call and distinguish retryable errors from non-retryable ones before deciding how to respond

• A. This is correct because implementing retry logic with exponential backoff and jitter inside the function's code for transient failures like timeouts or 5xx responses reduces unnecessary failures reported upward, since many such errors resolve on a short retry.
• B. This is correct because distinguishing retryable errors (like network timeouts) from non-retryable ones (like a declined card) lets the function make an informed decision about whether to retry internally or fail fast and report accurately, avoiding wasted retries on errors that will never succeed.
• C. This is incorrect because letting every exception propagate without any handling treats all failures identically, missing the opportunity to retry genuinely transient errors internally before they count against the function's overall retry or failure budget.
• D. This is incorrect because memory configuration affects CPU allocation and cost; it has no relationship to retrying failed calls to an external payment API, which requires explicit application-level retry logic.
• E. This is incorrect because silently suppressing exceptions and always reporting success would falsely tell callers a payment succeeded when it may not have, which is a dangerous correctness bug rather than sound error handling.

Correct answers: A, B, C — Message attributes, such as an eventType key-value pair, can be set at publish time so a filter policy evaluates them without parsing the body.; A subscription filter policy is attached to the individual subscription, so different subscribers to one topic can each filter on different criteria.; Subscribers whose filter policy does not match the message attributes simply do not receive that particular message, while matching subscribers still do.

• A. Setting message attributes at publish time gives filter policies structured key-value data to evaluate directly, without needing to parse the message body to determine routing.
• B. Because the filter policy lives on each individual subscription, different subscribers to the same topic can independently define their own criteria for which messages they receive.
• C. This describes the core selective-delivery behavior of SNS filtering: a message is only delivered to subscribers whose filter policy matches its attributes, and skipped for the rest.
• D. SNS filter policies are commonly evaluated against message attributes, and body-based filtering support exists separately, so restricting filtering to body text only is not an accurate description.
• E. This contradicts the purpose of filter policies entirely; when a filter policy is configured, only subscribers whose policy matches actually receive a given message, not every subscriber.
• F. Filter policies are configured per subscription rather than once per topic, so they do not automatically and identically apply to every current and future subscription on that topic.

Correct answer: A — Configure the boto3 client with a retry mode, such as standard or adaptive, applying automatic exponential backoff to retryable throttling errors.

• A. Configuring a boto3 retry mode enables the SDK's built-in exponential backoff for retryable errors such as throttling, which is exactly the automatic behavior the developer wants without custom retry code.
• B. Immediately re-raising the exception provides no retry behavior at all, so the throttling error would simply propagate to the caller instead of being automatically retried.
• C. Raising capacity to its maximum does not by itself configure the SDK's retry behavior, and this is a costly, table-level change rather than an SDK-level retry configuration in application code.
• D. Extending the function's timeout gives more wall-clock time overall but does nothing to configure automatic backoff retries for throttling errors from the DynamoDB SDK calls themselves.

Correct answer: A — The AWS SDK automatically retrieves temporary credentials from the instance metadata service based on the role attached to the instance profile.

• A. The SDK's default credential provider chain automatically fetches short-lived credentials from the instance metadata service for the role attached to the instance profile, requiring no hardcoded keys in application code.
• B. IAM roles do not expose a static access key and secret key to be copied into environment variables; the whole point of an instance profile is that the SDK retrieves temporary credentials automatically instead.
• C. A manually distributed credentials file with long-term keys is precisely the hardcoded-key pattern that using an IAM instance profile is meant to avoid on EC2 instances.
• D. The SDK's credential provider chain already resolves temporary credentials from the instance profile automatically, so explicitly calling AssumeRole before every single call is unnecessary extra code.

Correct answer: A — Send the Cognito access token in the `Authorization` header as a bearer token on every request to the API.

• A. A bearer token in the Authorization header is the standard OAuth 2.0 pattern, and a Cognito access token carries the scopes an API Gateway authorizer needs to validate the request without re-checking the password.
• B. Resending the plaintext password on every call multiplies the exposure of a long-term credential and defeats the purpose of issuing short-lived tokens after a single sign-in.
• C. Refresh tokens are meant to be exchanged privately for new access tokens through a token endpoint, not attached to every API call, and query strings are frequently logged by proxies and browsers.
• D. API Gateway is a managed, mostly stateless service and does not maintain per-user server-side session cookies, so the client must present a verifiable token on each request.

Correct answer: A — The second AssumeRole call fails, because role chaining caps a session at one hour regardless of the requested duration or either role's configured maximum.

• A. When credentials from an already-assumed role are used to assume a second role, that is role chaining, and AWS caps the resulting session at a maximum of one hour regardless of the requested duration or any role's configured maximum.
• B. RoleB's own maximum session duration setting is not the limiting factor here; the one-hour role-chaining cap applies on top of it whenever the calling credentials already came from an assumed role.
• C. Using one role's temporary credentials to assume a different role is a supported and common pattern called role chaining; it is limited in duration, not disallowed.
• D. A successfully assumed role session takes on the permissions defined by that role's own permissions policy, not the permissions of whichever role's credentials were used to make the AssumeRole call.

Correct answers: A, B — Store the database credential in AWS Secrets Manager and enable its built-in automatic rotation feature for the RDS-compatible secret type.; Grant the microservice's IAM role permission to call `secretsmanager:GetSecretValue` so it retrieves the current value at runtime.

• A. Secrets Manager's built-in rotation feature for RDS-compatible secrets automatically updates the credential on a schedule and coordinates the change with the database, without requiring anyone to redeploy application code.
• B. Granting the microservice's role permission to fetch the secret at runtime means the application always retrieves the current rotated value instead of relying on a stale value baked into its configuration or code.
• C. Hardcoding the password and redeploying manually on every rotation is exactly the manual redeployment burden the requirement is trying to eliminate, and it embeds a static secret in source code.
• D. A password baked into an environment variable at build time becomes stale the moment the credential rotates, since the running containers have no way to pick up the new value without a rebuild and redeploy.
• E. Disabling authentication on the database entirely removes any access control on the data store, which is a severe security regression rather than a solution to credential rotation.

Correct answer: A — AWS Secrets Manager, which supports configuring an automatic rotation schedule backed by a rotation Lambda function for supported credentials.

• A. AWS Secrets Manager offers configurable automatic rotation schedules and native integrations that invoke a rotation Lambda function for supported credential types, matching this requirement directly.
• B. Parameter Store SecureString parameters encrypt values with KMS but do not natively rotate them on a schedule; rotation would require custom automation outside the service.
• C. AWS AppConfig targets feature flags and configuration deployments with validation and rollback, not credential storage or automatic secret rotation.
• D. Storing a password as an encrypted S3 object provides encryption at rest but has no built-in scheduling or mechanism for rotating the credential automatically.

Correct answers: A, B — Attach an IAM policy condition that restricts `dynamodb:LeadingKeys` to the tenant identifier embedded in the caller's session tags.; Pass the tenant identifier as a session tag when assuming the tenant-scoped role, then reference that tag in the table's IAM policy condition.

• A. A `dynamodb:LeadingKeys` condition tied to the session's tenant tag restricts DynamoDB itself to only return items whose partition key matches that tenant, enforcing isolation independent of application code.
• B. Passing the tenant identifier as a session tag during AssumeRole gives the IAM policy a verified value to match against, letting the access-control layer enforce tenant scoping consistently.
• C. Filtering only in application logic after data has already been retrieved does not prevent a bug from returning or acting on another tenant's items, since the access control happens too late.
• D. STS AssumeRole issues temporary credentials but does not itself scope permissions; granting broad `dynamodb:*` access on the whole table would let a role read every tenant's data.
• E. Placing every tenant's data under the same partition key value removes the very attribute that IAM condition keys and query logic rely on to separate tenants.

Correct answer: B — Provision a separate customer managed KMS key per tenant, so a compromise of one tenant's key cannot be used to decrypt another tenant's data.

• A. A single shared key means compromising that one key would expose every tenant's data, which is exactly the blast-radius outcome the requirement is meant to prevent.
• B. Provisioning a separate customer managed key per tenant confines the impact of a key compromise to that one tenant's data, since no other tenant's data was ever encrypted with the compromised key.
• C. Leaving data unencrypted at rest removes at-rest protection entirely; TLS only protects data while it is moving over the network, not while it is stored.
• D. Rotating a single shared key more often still leaves all tenants dependent on that one key at any given time, so a compromise during an active rotation period still exposes every tenant.

Correct answer: B — Generate a self-signed certificate and an SSH key pair locally using OpenSSL or `ssh-keygen`, since these artifacts never need public trust or long-term management

• A. Public ACM certificates are designed for use within AWS with integrated services, and their private keys for ACM-issued certificates are not exportable, so this approach does not fit a standalone local development scenario.
• B. For a purely local, disposable development environment, generating a self-signed certificate and an SSH key pair with standard command-line tools is the simplest option and needs no managed AWS service.
• C. AWS Secrets Manager stores and rotates secret values but does not generate SSH key pairs or certificates itself, so it cannot produce the key material this scenario needs.
• D. Standing up an entire private certificate authority hierarchy is a heavyweight, ongoing-cost solution meant for organizational internal trust, unnecessary overhead for one developer's disposable local testing artifacts.

Correct answer: D — Configure the function to use a customer managed KMS key for its environment variables, which also enables console helpers to encrypt values

• A. Lambda does not infer sensitivity from a variable name prefix; encryption of environment variables is configured at the function level with a KMS key selection, not through naming conventions.
• B. Placing the key as plaintext in the deployment package means anyone who can view the package or source can read the secret directly, and S3's storage encryption does not protect the value within the function code itself.
• C. Hardcoding a secret into source code makes it visible to anyone with code access and typically ends up committed to version control, which is a worse security posture than an encrypted environment variable.
• D. Lambda supports specifying a customer managed KMS key for environment variable encryption instead of the default AWS managed key, and this also unlocks the console's helper to encrypt individual values before display.

Correct answers: B, C — DNS validation lets ACM automatically renew the certificate indefinitely as long as that required CNAME record stays in the hosted zone unchanged; Email validation requires a person to click a confirmation link sent to domain contacts, which must be repeated for renewal unless the team switches

• A. DNS validation is fully supported, and in fact simplified, when a domain is hosted in Route 53, since ACM can add the required validation record automatically, so this statement about Route 53 blocking it is false.
• B. Once the CNAME validation record is in place, ACM can automatically re-validate and renew the certificate without any manual action, which is the main operational advantage of DNS validation.
• C. Email validation depends on a person receiving and clicking a link at the time of issuance, and because it is not automated the same way DNS validation is, renewals can require repeating that manual step, making this correct.
• D. The two methods do differ in renewal behavior, since DNS-validated certificates can renew automatically via the existing record while email-validated ones may require repeated manual confirmation, so claiming identical behavior is false.
• E. Email validation is not inherently faster; it depends on someone checking their inbox and clicking a link, whereas DNS validation with Route 53 access can complete automatically and quickly, so this comparison is incorrect.

Correct answer: A — `src/handlers/process_order.handle`, matching the module's exact file path relative to the deployment package root.

• A. Lambda resolves the handler as `<path-to-module>.<function-name>` relative to the root of the deployment package, so a handler file at `src/handlers/process_order.py` must be referenced as `src/handlers/process_order.handle` for the import to succeed.
• B. Lambda does not recursively search subdirectories for a matching filename; it imports the exact module path given in the handler setting, so a bare filename fails when the file lives in a nested directory.
• C. The handler value always names the importable module path before the function name, never the reverse, so swapping the order produces an import error rather than resolving the nested file correctly.
• D. Lambda does not selectively convert only the first path segment; the module path portion of the handler value must reflect the full relative path with the separators the runtime's import mechanism expects.

Correct answers: A, B — The application's compiled or interpreted source code files that implement the handler and business logic.; Third-party library dependencies the application imports, installed into the package's dependency directory.

• A. The application's own source files are the core of the deployment package by definition; without them there is no code for Lambda or the compute service to execute.
• B. Installed third-party dependencies must be present in the package's dependency directory (such as `node_modules` or a Python site-packages folder) because the execution environment does not install them for you.
• C. Credentials belong in Secrets Manager or Parameter Store and should be retrieved at runtime with least-privilege IAM permissions, not embedded in the package where they would sit in version control and build artifacts.
• D. Feature flags are meant to change without a redeploy, so they belong in a service like AppConfig that the application queries at runtime rather than in values baked into the shipped artifact.
• E. Data that changes on its own schedule outside the application's release cycle, like a frequently refreshed exchange rate table, should be fetched from its source at runtime rather than frozen into a static artifact.

Correct answers: B, E — Add a manual approval action between the `dev` stage and the `staging`/`prod` deployment actions; Parameterize the SAM deployment step with a stage name so one template deploys any of the stages

• A. Automatically deleting production based on a dev failure is destructive and unrelated to gating promotion with approvals.
• B. A manual approval gate is the standard CodePipeline mechanism to require human sign-off before changes reach staging and production.
• C. A single shared stack for all three environments removes the isolation needed to test dev changes independently before promoting them.
• D. Bypassing the build tool for staging and prod removes the pipeline's automated, repeatable deployment path in favor of error-prone manual commands.
• E. Parameterizing the deployment with a stage name lets one IaC template be reused across dev, staging, and prod without duplicating the definition.
• F. Restricting every environment's trigger to main prevents feature-branch commits from reaching dev at all, blocking the intended per-commit dev deployment.

Correct answers: C, F — Amplify can automatically host a separate environment for each connected Git branch, like `develop` or `staging`; Copilot lets a team create named environments, such as `test`, each with its own infrastructure and service versions

• A. Amplify branch environments can be configured with their own backend resources and are not forced to share a single database or bucket with production.
• B. Copilot supports placing environments in different VPCs; production isolation across VPCs is a common and supported pattern, not a restriction.
• C. Amplify's branch-based deployment model spins up an isolated hosting environment per connected branch, which is how teams typically map git branches like develop or staging to test environments.
• D. Amplify branch environments are hosted within the existing Amplify app and do not require provisioning a separate AWS account per branch.
• E. The Copilot CLI includes commands such as `copilot env init` specifically for creating environments; console-only creation is not accurate.
• F. Copilot's environment concept explicitly provisions its own infrastructure per named environment, letting a team deploy an approved service version into a test environment separate from production.

Correct answer: A — Configure the pipeline's Source stage with the CodeCommit repository and branch, which creates an Amazon EventBridge rule that starts the pipeline on new commits.

• A. When a CodePipeline Source stage is configured against a CodeCommit repository and branch, CodePipeline provisions an EventBridge rule that automatically detects new commits on that branch and starts an execution, requiring no manual trigger.
• B. A custom polling cron rule duplicates functionality CodePipeline already provisions natively for CodeCommit sources and adds unnecessary latency and complexity compared to the built-in change-detection integration.
• C. Requiring every developer to manually invoke a CLI command after pushing is error-prone and defeats the purpose of automatic triggering; it is not how CodePipeline is designed to detect source changes.
• D. CodeCommit repositories are not backed by S3 objects that emit S3 event notifications; this describes a mechanism that does not apply to how CodeCommit integrates with CodePipeline.

Correct answer: A — Define separate `install`, `pre_build`, and `build` phases in `buildspec.yml`, placing the test command in `pre_build` so a failure stops the build before packaging runs.

• A. CodeBuild's `buildspec.yml` phases run in order, and by default a failing command in an earlier phase like `pre_build` stops the build, so placing tests in `pre_build` before the `build` phase packages the artifact correctly separates and gates the steps.
• B. The `artifacts` section only describes which files to collect as build output after phases complete; it is not a place to run shell commands, so this structure would not execute or gate anything correctly.
• C. Chaining three separate projects through S3 overwrites is a fragile, manual workaround for something CodeBuild already supports natively through ordered buildspec phases within a single project.
• D. Environment variables hold static or parameter-derived values available to the build; they are not executed as commands and cannot run a test suite before the buildspec phases begin.

Correct answers: A, B, C — A build stage using CodeBuild that compiles the application and runs the automated test suite before any deployment action runs.; A deploy stage targeting the staging environment, positioned before the manual approval stage in the pipeline's sequence of stages.; A manual approval action configured between the staging and production deploy stages, which pauses execution until someone approves it.

• A. Correct: a build stage backed by CodeBuild running compilation and the automated test suite is the standard way to gate later deploy stages on passing tests before anything reaches staging or production.
• B. Correct: deploying to staging before the approval stage lets QA validate the release candidate in a real environment, which is the input the human approver needs before signing off on production.
• C. Correct: CodePipeline's manual approval action type pauses the pipeline execution at that stage until a designated approver explicitly approves or rejects it, which is exactly the gate this workflow requires.
• D. Incorrect: splitting production into a second independent pipeline manually triggered by a developer bypasses the orchestrated, auditable staged workflow that a single pipeline with a built-in approval action already provides.
• E. Incorrect: IAM policies control API-level permissions and are configured on roles or users, not embedded as statements inside a buildspec.yml file, and they do not grant console button access on their own.

Correct answer: A — Run `sam local generate-event sqs receive-message` to produce a sample SQS-to-Lambda event payload, then redirect it into a JSON file for local invocation.

• A. The SAM CLI's event generator ships built-in templates for common event sources, including SQS, so it can produce a structurally correct sample payload without deploying anything.
• B. Starting the local invoke endpoint still requires the developer to already have a correctly shaped payload; it does not generate the SQS event structure itself.
• C. Deploying resources just to capture a sample payload defeats the purpose of testing before deployment and is unnecessary since a built-in event template already exists.
• D. DynamoDB Streams records use a different shape than SQS messages, so manually reshaping one into the other risks producing an inaccurate test payload.

Correct answers: A, B — Testing against real deployed resources verifies the function's IAM permissions and service quotas, which mocked SDK calls cannot validate.; Mock-based tests generally run faster and do not require network access, making them well suited for exercising business logic in isolation.

• A. Only a real deployment can confirm the execution role actually has the DynamoDB and SNS permissions it needs, and that the account's service quotas allow the operation to succeed.
• B. Because mocks avoid real network calls, they execute quickly and are useful for exercising the function's internal logic in isolation from AWS service behavior.
• C. Mocks are static and must be manually updated whenever the underlying API's request or response schema changes; they do not track vendor changes automatically.
• D. A mock-only test can pass while the real deployment fails, for example due to a missing IAM permission or an incorrect table name, so passing mocks are not a deployment guarantee.
• E. Cloud-based testing validates configuration and integration behavior, but it does not remove the value of fast, isolated unit tests for internal business logic.

Correct answers: A, B — Enable canary settings on the `prod` stage and set a traffic percentage so a small share of requests route to the new deployment while the rest continue to baseline.; Configure CloudWatch alarms on the canary's error rate and latency metrics so the team can detect problems before promoting the canary to 100% of traffic.

• A. API Gateway's canary release settings let a configured percentage of a stage's traffic reach a new deployment while the remainder continues to the current baseline, exactly the gradual validation the team wants.
• B. Watching canary-specific error and latency metrics with alarms gives the team an early signal to hold or roll back the canary before it is promoted to handle all traffic.
• C. A canary release is designed to avoid client-facing URL changes entirely, so standing up a second API and updating every caller defeats the purpose of a gradual, transparent rollout.
• D. Canary settings support overriding stage variables specifically so the canary deployment can point at a different backend alias than the baseline, which is often required for meaningful canary testing.
• E. API Gateway stages explicitly support canary settings for partial traffic shifting, so recreating the stage from scratch is unnecessary and discards the ability to compare against a stable baseline.

Correct answer: A — Open the function's CloudWatch Logs Insights log group and run a query filtering `@message` for `Traceback` or `ERROR`, then inspect the matching log entries for the exception type and stack trace lines.

• A. Filtering the log messages for Python's traceback marker or an error-level tag surfaces the exact log entries containing the exception type and stack trace, which is the fastest direct path to the failure detail already captured.
• B. The X-Ray status field only records a numeric response status; X-Ray does not capture the Python stack trace text unless the application explicitly adds it as metadata, so this does not deliver the exception detail.
• C. Redeploying and waiting for a natural recurrence is slower and unnecessary, since the exception and stack trace for the failures that already occurred are already sitting in the existing CloudWatch Logs.
• D. The Monitoring tab's error count graph only shows the number of errors over time; it does not display the exception message text or stack trace for individual invocations.

Correct answers: A, B — Enable delivery status logging for the SNS topic and configure the IAM roles, so SNS writes per-attempt delivery outcomes, including HTTP response codes, to CloudWatch Logs.; Configure a redrive policy with a dead-letter queue on the topic's HTTPS subscription, so messages that exhaust SNS's retry attempts land in the DLQ for inspection instead of being dropped.

• A. SNS delivery status logging records the outcome of each delivery attempt, including the HTTP response code returned by the endpoint, giving the team the per-attempt diagnostic detail needed to see why deliveries are failing.
• B. A subscription-level dead-letter queue captures the messages SNS could not deliver after exhausting its retry policy, letting the team inspect exactly which messages failed and their content.
• C. SNS delivery status logging works for HTTPS subscriptions as well as queue-based ones, so switching away from the HTTPS endpoint is unnecessary and does not match how the feature actually works.
• D. CloudTrail data events record that a publish API call occurred and its parameters; they do not capture the HTTP response returned by a subscriber endpoint, so this does not reveal the delivery failure reason.
• E. The topic's message retention setting does not exist as a retry-extension control for SNS deliveries; SNS retries follow its own fixed and configurable backoff policy independent of any retention setting.
• F. A missing `sns:Publish` permission would prevent the publisher from sending to the topic at all, which is unrelated to the topic delivering a message onward to a subscribed HTTPS endpoint, and it is not the only possible cause of a silent delivery failure.

Correct answers: A, B — A CloudWatch alarm on the `Throttles` metric that transitions to the ALARM state as soon as the metric value exceeds zero.; An SNS topic that the alarm publishes to, with an AWS Chatbot integration subscribed and configured for the target Slack channel.

• A. An alarm evaluating the Throttles metric against a zero threshold is what actually detects the condition and changes state the moment throttling occurs.
• B. An SNS topic with a Chatbot integration subscribed is the managed delivery path that turns the alarm state change into an actual Slack message, with no custom webhook code to maintain.
• C. A custom scheduled poller reinvents alarm evaluation and webhook delivery that CloudWatch alarms and Chatbot already provide, adding unnecessary code to build and maintain.
• D. CloudTrail records management and data-plane API calls on an hourly cadence at best, which is far too coarse for a within-a-minute notification requirement.
• E. A dead-letter queue captures failed asynchronous invocation payloads for later reprocessing; it has no built-in mechanism to post directly to an external Slack endpoint.

Correct answer: A — Define an ALB target group health check against a `/health` endpoint that only returns success once the task's database connection pool has finished initializing.

• A. A health check endpoint that reports ready only after the connection pool is initialized lets the ALB target group hold traffic back from a task until it can genuinely serve requests, which directly addresses a readiness gap rather than just an existence check.
• B. Controlling how many existing tasks stay running during deployment does not change whether the ALB considers a brand-new task ready before its dependencies finish initializing.
• C. A fixed sleep delays startup by a guessed duration regardless of actual readiness, so it can still route traffic too early on a slow start or waste time on a fast one.
• D. Alerting on CPU utilization after the fact notifies engineers of a symptom but does nothing to stop the load balancer from routing requests to an unready task in the first place.

Correct answers: A, B — The CloudWatch agent can be configured to scan structured log output for embedded metric format entries and forward the extracted metrics to CloudWatch.; Emitting metrics through embedded metric format via the agent only requires the `logs:PutLogEvents` permission, not the `cloudwatch:PutMetricData` permission.

• A. The CloudWatch agent supports reading embedded metric format log output and forwarding the extracted metrics to CloudWatch, which is the documented mechanism for generating custom metrics without direct PutMetricData calls.
• B. Embedded metric format only requires the `logs:PutLogEvents` permission to ship the structured log entries; CloudWatch extracts the metric from the log content, so `cloudwatch:PutMetricData` is not needed.
• C. Applications write embedded metric format entries as standard structured log output, not by opening a dedicated raw TCP socket to the agent process for each metric.
• D. The task still needs `logs:PutLogEvents` permission to write the log entries the agent processes; embedded metric format removes the need for PutMetricData specifically, not all logging or metrics permissions.
• E. Embedded metric format is itself a JSON-based log structure, and it is the format the agent is designed to parse; it is not limited to forwarding legacy XML-based PutMetricData requests.

Correct answer: A — Configure provisioned concurrency on the function so a set number of execution environments stay pre-initialized and ready to respond immediately.

• A. Provisioned concurrency keeps a specified number of execution environments initialized and ready in advance, which is exactly what eliminates cold-start latency for interactive, latency-sensitive workloads like this one.
• B. Reserved concurrency sets a ceiling and floor on how many concurrent invocations are allowed, but it does not pre-initialize environments, so the first invocation into a new environment still incurs a cold start.
• C. A longer timeout lets a slow invocation run longer without erroring, but it does nothing to shorten the cold-start delay itself, so the double-digit millisecond requirement would still be missed.
• D. Filter policies control which messages reach a subscriber based on attributes or body content; they do not affect how quickly an execution environment initializes.

Correct answers: A, B — Move the HTTPS client and database connection objects to global scope so they are created once and reused across invocations in a warm execution environment.; Use a connection pooling mechanism, such as RDS Proxy, so database connections are reused across invocations instead of opening a new connection every time.

• A. Declaring HTTP and database clients outside the handler, in global scope, lets a warm execution environment reuse the already-established client across multiple invocations instead of paying setup cost every time.
• B. RDS Proxy pools and reuses database connections across Lambda invocations, avoiding the overhead of establishing a new connection on every call and reducing both duration and load on the database.
• C. Reserved concurrency governs how many concurrent invocations are permitted; it does not change the CPU time or duration of any single invocation's work.
• D. Swallowing exceptions hides failures rather than reducing work performed; it does not shorten the time spent making the external API call and can mask real production issues.
• E. Lambda allocates CPU proportionally to memory, so minimizing memory can slow down CPU-sensitive or network-serialization work rather than universally shortening duration.

Correct answer: A — Amazon ElastiCache, used as an in-memory cache that the application checks before falling back to the relational database on a cache miss.

• A. ElastiCache provides an in-memory data store that applications check first and populate on a miss, which is the standard pattern for offloading repeated reads of the same data away from a relational database.
• B. Secrets Manager is designed to store and rotate credentials and other sensitive secrets; it enforces size and access patterns unsuited to serving general application read-through caching of catalog data.
• C. EventBridge schedules and routes events; it has no built-in storage layer for serving cached query results back to the application on demand.
• D. CloudTrail records API calls for auditing and governance; it does not capture or replay application-level database query results.