Free DVA-C02 Practice Test Questions and Answers (2026)

The most direct and effective method to enforce encryption in transit for all requests to an Amazon S3 bucket is by using a resource-based policy attached to the bucket itself. The aws:SecureTransport global condition key is specifically designed for this purpose. By creating a bucket policy with a Deny effect for all actions (s3:) when the aws:SecureTransport condition is false, you explicitly block any request made over an unencrypted channel (HTTP). This single policy ensures that all principals, including those from other AWS accounts, must use HTTPS to access the objects, fulfilling the security requirement centrally and authoritatively.

B. This policy would explicitly allow insecure (HTTP) requests, which is the direct opposite of the stated security requirement.

C. Managing individual IAM policies in multiple external accounts is not scalable, is prone to error, and violates the principle of the resource owner controlling access.

D. The policy should be on the S3 bucket because the s3:GetObject request is made to the S3 service endpoint; the aws:SecureTransport key evaluates the user's connection to S3, not the backend connection from S3 to KMS.

1. Amazon S3 User Guide: Under the section "Security best practices for Amazon S3

" the guide provides a specific example of a bucket policy to enforce encryption in transit. It states

"To enforce encryption in transit

you can use the aws:SecureTransport condition key in your S3 bucket policies... The following example bucket policy denies access to any HTTP request..." This directly validates option A.

Source: AWS Documentation

Amazon S3 User Guide

"Security best practices for Amazon S3

" section "Enforce encryption in transit."

2. AWS IAM User Guide: This guide documents the aws:SecureTransport key as a global condition context key. It explains that this key checks "whether the request was sent using SSL" and can be used in policies to allow actions only when the request is made using HTTPS.

Source: AWS Documentation

IAM User Guide

"AWS global condition context keys

" section for aws:SecureTransport.

3. AWS Security Blog: The post "How to Use New S3 Features to Bolster the Security of Your S3 Buckets" details using the aws:SecureTransport condition in a bucket policy as a primary method to enforce HTTPS.

Source: AWS Security Blog

"How to Use New S3 Features to Bolster the Security of Your S3 Buckets

" July 26

2017.

The core requirement is to ensure messages are processed in order, which is the specific function of an Amazon SQS FIFO (First-In, First-Out) queue. Standard queues provide best-effort ordering and are therefore unsuitable. The second requirement is to handle the legacy system's 5-minute processing time. The SQS visibility timeout feature prevents a message from being redelivered to another consumer while the first consumer is processing it. By setting the visibility timeout to 5 minutes (or slightly longer), the developer ensures the legacy system has enough time to process and delete the message before it becomes visible again in the queue, thus preventing duplicate processing and potential out-of-order updates.

B. An SQS standard queue does not guarantee message order. DelaySeconds postpones a message's initial delivery, which does not solve the processing time issue.

C. An SQS standard queue does not guarantee message order, failing to meet the primary requirement of preventing out-of-order updates.

D. DelaySeconds is the wrong mechanism. It delays a message's initial delivery, whereas the visibility timeout is required to manage the consumer's processing window.

1. Amazon SQS Developer Guide

"Amazon SQS FIFO (First-In-First-Out) queues": This document states

"FIFO queues are designed to enhance messaging between applications when the order of operations and events is critical

or where duplicates can't be tolerated." It explicitly confirms that FIFO queues preserve the order in which messages are sent and received.

2. Amazon SQS Developer Guide

"Visibility timeout": This section explains

"When a consumer receives and processes a message from a queue

the message remains in the queue... To prevent other consumers from processing the message again

Amazon SQS sets a visibility timeout

a period of time during which Amazon SQS prevents other consumers from receiving and processing the message." This directly addresses the need to handle the 5-minute processing time.

3. Amazon SQS Developer Guide

"Message timers": This page clarifies the function of DelaySeconds: "To postpone the delivery of new messages to a queue

use a message timer... The default (minimum) delay for a message is 0 seconds. The maximum is 15 minutes." This confirms DelaySeconds is for initial delivery

not for managing in-flight processing.

AWS Lambda Layers are the designated feature for managing and sharing common dependencies across multiple functions. A layer is a .zip archive containing libraries or other dependencies. By creating a layer with the shared dependencies, the developer can attach it to all relevant Lambda functions. To update a dependency, the developer only needs to create a new version of the layer and update the functions to use it. This centralizes dependency management, eliminates redundant packaging efforts for each function, and simplifies the update process, directly addressing the problem with the least additional complexity.

A. Lambda does not have a "maintenance window" feature for function code updates; this approach does not solve the core problem of duplicated dependency packaging.

B. Upgrading the Lambda runtime updates the execution environment (e.g., Python version) but does not manage the application-specific dependencies packaged with the function code.

D. Using CodeCommit centralizes the source code but does not solve the problem of packaging and deploying the dependencies into each individual Lambda function's deployment artifact.

1. AWS Lambda Developer Guide

"Using Lambda layers": The documentation states

"You can use layers to keep your deployment packages small

which makes it easier to develop your function code. A layer is a .zip file archive that can contain additional code or data. A layer can contain libraries

a custom runtime

data

or configuration files." This directly supports using layers for shared libraries.

2. AWS Lambda Developer Guide

"Creating and sharing layers": This section explains the core benefit: "By separating common components into layers

you can make it easier to update your functions and share these components across multiple functions." This aligns perfectly with the scenario of updating dependencies for many functions.

3. AWS Well-Architected Framework

Serverless Applications Lens

"Operational Excellence Pillar - OPS 4": The guide recommends

"Separate the business logic from the dependencies... You can use Lambda Layers to separate dependencies from your function code. This simplifies the process of updating dependencies because you don't need to redeploy your function code." This identifies layers as a best practice for the exact problem described.

The most secure and recommended method for an application running on an Amazon EC2 instance to access other AWS services is to use an IAM role. By attaching an IAM role to the EC2 instance, the application can acquire temporary security credentials automatically through the instance metadata service. This avoids the need to store long-lived credentials, such as an access key and secret key, within the application or on the instance itself. Furthermore, the policy attached to the role should grant only the specific permissions required (least privilege), which in this case is access to Amazon S3. This approach aligns with AWS security best practices by using temporary credentials and enforcing the principle of least privilege.

A. Granting administrative access violates the principle of least privilege. The role should only have the permissions necessary to interact with Amazon S3, not manage the entire AWS account.

B. Using an IAM user with long-lived access keys is a significant security risk. It also violates the principle of least privilege by granting administrative access.

D. While this option correctly scopes permissions to S3, it relies on storing long-lived IAM user access keys on the instance, which is a security anti-pattern and less secure than using IAM roles.

1. AWS IAM User Guide

"IAM roles for Amazon EC2": "We strongly recommend that you use IAM roles with your applications. They provide temporary credentials that your application can use to sign requests

and you don't have to manage long-term credentials. Using roles is more secure than sharing access keys..."

2. AWS Whitepaper

"AWS Security Best Practices" (August 2023): Under the "Manage identities for workloads and applications" section (p. 19)

it states

"Use temporary credentials with IAM roles instead of long-term credentials like access keys. For workloads that run on AWS compute services

such as Amazon EC2

you can use IAM roles to provide temporary credentials to your workloads."

3. AWS IAM User Guide

"Security best practices in IAM": Under the "Grant least privilege" section

it advises

"When you set permissions with IAM policies

grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions..." This directly contradicts options A and B which grant administrative access.

Amazon API Gateway provides a built-in mock integration feature specifically for testing purposes. This allows developers to configure an API method to return a response directly from API Gateway without invoking any backend service. By using a request mapping template with the mock integration, a developer can define a static response, including the status code, headers, and body. This approach perfectly satisfies the requirement to simulate different backend responses for testing with the absolute minimum operational overhead, as it requires no additional compute resources like AWS Lambda or Amazon EC2.

A. This solution introduces unnecessary operational overhead by requiring the creation, deployment, and management of an AWS Lambda function, which is not needed when a built-in mock feature exists.

B. This is the highest overhead option, as it involves provisioning and managing an entire Amazon EC2 instance and deploying a mock service, which is complex and costly for simple response simulation.

C. API Gateway stages are for managing deployment lifecycles (e.g., dev, prod), not for simulating backend responses. Gateway responses handle API Gateway-level errors, not mock integration logic.

1. AWS API Gateway Developer Guide - Setting up mock integrations in Amazon API Gateway: "With mock integration

you can have API Gateway return a response without sending the request to the backend. Mock integrations are useful for testing an API without requiring a configured backend... You can also have the method integration return a response based on the request parameters by using a mapping template." This directly supports the use of mock integrations for the described scenario.

2. AWS API Gateway Developer Guide - Tutorial: Create a REST API with a mock integration: This tutorial provides a step-by-step guide on how to "create an API with a mock integration. A mock integration responds to any request that reaches it by returning a hardcoded response

which you configure in API Gateway." This demonstrates the low operational overhead of the feature.

3. AWS API Gateway Developer Guide - API Gateway mapping template and access logging variable reference: This document explains how mapping templates are used to transform data. For mock integrations

a response mapping template is configured to define the exact response returned by API Gateway. Section: "Mapping template overview".

The AWS Serverless Application Model (AWS SAM) is an open-source framework specifically designed for building serverless applications. It provides a simplified, shorthand syntax as an extension of AWS CloudFormation to define serverless resources like AWS Lambda functions, Amazon API Gateway APIs, and Amazon DynamoDB tables. Developers use a YAML or JSON template file (template.yaml) to model their application. During deployment, the AWS SAM CLI transforms this simplified template into a standard, more verbose AWS CloudFormation template, which is then used to provision the resources. This directly matches the developer's need to define serverless resources in YAML for a CloudFormation-based deployment.

A. CloudFormation serverless intrinsic functions: This is not a recognized AWS term. While CloudFormation has intrinsic functions, there is no specific category named "serverless intrinsic functions."

B. AWS Elastic Beanstalk: This is a Platform as a Service (PaaS) for deploying and scaling web applications, not a framework for defining serverless infrastructure in a YAML template.

D. AWS Cloud Development Kit (AWS CDK): The AWS CDK uses familiar programming languages (like Python, TypeScript, or Java) to define cloud infrastructure, not YAML directly. It synthesizes a CloudFormation template from the code.

1. AWS Serverless Application Model (AWS SAM) Developer Guide: In the section "What is the AWS Serverless Application Model (AWS SAM)?"

it states

"The AWS Serverless Application Model (AWS SAM) is an open-source framework that you can use to build serverless applications on AWS... With SAM

you define your application resources in a YAML or JSON template."

2. AWS CloudFormation User Guide: The "Intrinsic function reference" section lists all available intrinsic functions. It does not include a category or specific functions called "serverless intrinsic functions."

3. AWS Cloud Development Kit (AWS CDK) Developer Guide: The "What is the AWS CDK?" section clarifies

"The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define your cloud application resources using familiar programming languages."

4. AWS Elastic Beanstalk Developer Guide: The "What is AWS Elastic Beanstalk?" section describes it as a service to "deploy and manage applications in the AWS Cloud without worrying about the infrastructure that runs those applications

" highlighting its role as a PaaS

not a templating tool.

The question requires a notification within 30 seconds based on a custom metric with 1-second data granularity. This type of metric is known as a high-resolution metric. To trigger an alarm based on such a metric in under a minute, a high-resolution CloudWatch alarm is necessary. High-resolution alarms can evaluate metrics with periods of 10 or 30 seconds, allowing for rapid state change detection and notification, thereby meeting the 30-second notification requirement. Standard alarms have a minimum evaluation period of 60 seconds and would not be sufficient.

A custom CloudWatch dashboard is a visualization tool for monitoring metrics and logs; it does not actively trigger notifications.

Amazon CloudWatch Logs Insights is a service for interactively querying and analyzing log data, not for setting alarms on existing custom metrics.

Changing to a default CloudWatch metric would be counterproductive, as standard EC2 metrics have a minimum granularity of one minute, which cannot meet the 30-second notification requirement.

1. Amazon CloudWatch User Guide. "High-resolution alarms". This section states

"If you set an alarm on a high-resolution metric

you can specify a high-resolution alarm that has a period of 10 seconds or 30 seconds... High-resolution metrics are custom metrics that you can publish with a storage resolution of 1 second."

2. Amazon CloudWatch User Guide. "Publishing custom metrics". This page details how custom metrics can be published with a StorageResolution of 1

which designates them as high-resolution metrics

suitable for high-resolution alarms.

3. Amazon CloudWatch User Guide. "Using Amazon CloudWatch dashboards". This section describes dashboards as customizable pages for monitoring resources in a single view

confirming their purpose is visualization

not alerting.

The deployment fails because AWS Lambda@Edge functions have a strict regional requirement. To be associated with an Amazon CloudFront distribution, a Lambda function must be created in the US East (N. Virginia) Region, which has the region code us-east-1. The developer is attempting to deploy the AWS SAM stack, including the Lambda@Edge function, in the eu-west-1 Region. The AWS CloudFormation service, which underlies AWS SAM, will attempt to create the Lambda function in the same region as the stack (eu-west-1), causing the deployment to fail due to this service constraint.

A. Amazon CloudFront is a global service, not a regional one. While its API endpoint is global, you can create and manage distributions from any AWS Region using tools like the AWS CLI or CloudFormation.

C. AWS SAM is designed to manage serverless applications, which often consist of multiple functions and other resources. A single SAM template explicitly supports the definition of multiple AWS::Serverless::Function resources.

D. There is no restriction that prevents an S3 bucket and a CloudFront distribution from being defined in a stack created in the same AWS Region. An S3 bucket in any region can serve as an origin for the global CloudFront service.

1. AWS Lambda Developer Guide: In the section on setting up Lambda@Edge

it explicitly states the regional requirement.

Source: AWS Lambda Developer Guide

"Setting up Lambda@Edge".

Reference: Under the "To create a Lambda@Edge function" section

the guide notes: "Note that you must create Lambda@Edge functions in the US East (N. Virginia) Region."

2. Amazon CloudFront Developer Guide: This guide reiterates the same constraint for functions used with CloudFront.

Source: Amazon CloudFront Developer Guide

"Requirements and restrictions on Lambda functions".

Reference: The first requirement listed is: "The Lambda function must be in the US East (N. Virginia) Region."

3. AWS CloudFormation User Guide: This guide explains how CloudFormation handles resources

and service-specific constraints like this apply.

Source: AWS CloudFormation User Guide

"AWS::Lambda::Version".

Reference: In the documentation for associating a Lambda function version with a CloudFront distribution

it notes the function must be in us-east-1. This underlying CloudFormation constraint is what causes the SAM deployment to fail.

The requirement describes a canary deployment pattern: shifting a small percentage of traffic (10%) to the new version for a fixed time (10 minutes) before a full rollout. In AWS SAM, this is configured using the DeploymentPreference property on an AWS::Serverless::Function resource. The Type Canary10Percent10Minutes precisely matches this requirement. To enable any form of gradual deployment (Canary or Linear), the AutoPublishAlias property must be set. This property instructs AWS SAM to create a Lambda alias and manage traffic shifting between function versions through AWS CodeDeploy.

B: Linear10PercentEvery10Minutes implements a linear deployment, which would gradually increase traffic by 10% every 10 minutes, not the single 10% shift for a fixed duration as required.

C: The PreTraffic and PostTraffic properties are for specifying validation Lambda functions (hooks) that run before and after traffic shifting, not for enabling the deployment itself. The required AutoPublishAlias property is missing.

D: This option is incorrect for two reasons: it uses the wrong deployment type (Linear) and misuses the PreTraffic and PostTraffic properties instead of the required AutoPublishAlias.

1. AWS Serverless Application Model (SAM) Developer Guide: Under the AWS::Serverless::Function resource documentation

the DeploymentPreference object is detailed. It states

"To enable traffic shifting

you must specify an alias name in the AutoPublishAlias property."

Source: AWS Documentation

AWS SAM Developer Guide

"AWS::Serverless::Function"

section "Properties > DeploymentPreference".

2. AWS Serverless Application Model (SAM) Developer Guide: The same section lists the available predefined deployment preference types. It explicitly defines Canary10Percent10Minutes as a type that "Shifts 10 percent of traffic in the first increment. The remaining 90 percent is shifted 10 minutes later."

Source: AWS Documentation

AWS SAM Developer Guide

"AWS::Serverless::Function"

section "Properties > DeploymentPreference > Type".

3. AWS Serverless Application Model (SAM) Developer Guide: The documentation clarifies the purpose of the Hooks property

which contains PreTraffic and PostTraffic. It describes them as

"A Lambda function that is run before traffic is shifted to the new version... A Lambda function that is run after traffic is shifted to the new version." This confirms they are for validation

not for enabling the deployment.

Source: AWS Documentation

AWS SAM Developer Guide

"AWS::Serverless::Function"

section "Properties > DeploymentPreference > Hooks".

This option presents the most complete and robust solution for automating a CI/CD workflow for a serverless application on AWS. AWS CodePipeline is the service designed to orchestrate the entire workflow, from source control to deployment and testing. Using AWS CloudFormation (or AWS SAM, which is an extension of CloudFormation) is the standard for defining infrastructure as code. API Gateway stages are the correct mechanism for managing different environments (e.g., dev, test, prod). Finally, AWS CodeBuild is the appropriate service to integrate into the pipeline to run automated builds and integration tests against the newly deployed API Gateway stage, providing a fully automated process.

A: This option is incomplete. While it lists correct components like API Gateway stages, SAM, and CodeBuild, it omits AWS CodePipeline, which is essential for orchestrating the CI/CD workflow.

B: Similar to option A, this option is incomplete. It correctly identifies CloudFormation, API Gateway stages, and CodeBuild but fails to include the AWS CodePipeline service needed to automate and connect these steps.

D: This is a less robust and less automated solution. It lacks a pipeline orchestrator (CodePipeline) and suggests using the AWS CLI for testing, which is less manageable and scalable than using a dedicated service like AWS CodeBuild.

1. AWS CodePipeline User Guide: The "Tutorial: Create a pipeline that deploys an AWS SAM application" demonstrates the standard architecture. It shows a pipeline with a source stage

a build stage using AWS CodeBuild

and a deploy stage using an AWS CloudFormation action. This confirms that CodePipeline is the orchestrator for the workflow. (See: AWS CodePipeline User Guide

Tutorials

"Tutorial: Create a pipeline that deploys an AWS SAM application").

2. AWS API Gateway Developer Guide: The section on "Setting up stages for a REST API" states

"An API stage is a logical reference to a lifecycle state of your API (for example

dev

prod

beta

v2)." This validates the use of stages to represent different application environments. (See: API Gateway Developer Guide

"Develop a REST API"

"Deploy a REST API"

"Setting up stages for a REST API").

3. AWS CodeBuild User Guide: The "How CodeBuild works" section explains that a build project contains the commands to run

which can include compiling code

running tests

and packaging software. This confirms its role in running automated tests within a pipeline. (See: AWS CodeBuild User Guide

"What Is CodeBuild?"

"How CodeBuild works").

4. AWS CloudFormation User Guide: The "What is AWS CloudFormation?" section describes it as the service for modeling and setting up your AWS resources (infrastructure as code)

which is the standard for managing the Lambda and API Gateway resources in a repeatable way. (See: AWS CloudFormation User Guide

"Introduction"

"What is AWS CloudFormation?").

An AWS Lambda event source mapping is the essential component that connects a stream-based event source, such as an Amazon DynamoDB stream, to a Lambda function. This mapping is a resource managed by the Lambda service that reads records from the stream and invokes the target function synchronously with a batch of items. Although DynamoDB Streams are enabled on the table and the function's execution role has permissions, the Lambda service will not poll the stream and invoke the function until this explicit mapping is created. This is the missing step required to establish the trigger.

A. The StreamViewType parameter determines the content of the stream records (e.g., new image, old image). It does not affect the invocation mechanism itself.

C. Amazon DynamoDB Streams cannot be directly mapped to an Amazon SNS topic. This is not a supported integration pattern for triggering the function.

D. The function timeout setting is relevant only after a function has been invoked. The problem described is a failure to invoke, not a failure during execution.

1. AWS Lambda Developer Guide: In the section "Using AWS Lambda with Amazon DynamoDB

" it states

"To associate a function with a stream from Amazon DynamoDB

you first create a Lambda function... Then

you create an event source mapping to tell Lambda to send records from your stream to the Lambda function."

Source: AWS Lambda Developer Guide

"Using AWS Lambda with Amazon DynamoDB

" section on "Event source mapping."

2. Amazon DynamoDB Developer Guide: The documentation on triggers explains the architecture: "AWS Lambda polls the shard for records and invokes your Lambda function synchronously when records are detected in the shard. The event source mapping passes the stream records to the Lambda function as an event payload."

Source: Amazon DynamoDB Developer Guide

"Processing new items with DynamoDB Streams and Lambda

" section on "DynamoDB Streams and AWS Lambda Triggers."

3. AWS Lambda API Reference: The CreateEventSourceMapping API action is used to create the trigger. Its description confirms its purpose: "Creates a mapping between an event source and an AWS Lambda function. Lambda reads items from the event source and invokes the function."

Source: AWS Lambda API Reference

CreateEventSourceMapping action documentation.

The goal is to enhance the responsiveness of a popular, unauthenticated, read-heavy API where the underlying data changes infrequently (daily). Enabling API caching in API Gateway is the most effective solution. When caching is enabled, API Gateway stores responses from the backend Lambda function for a specified Time-To-Live (TTL). Subsequent identical requests are served directly from the cache, bypassing the Lambda invocation. This significantly reduces latency and improves responsiveness for end-users, while also lowering the load on the backend service.

B. Configure API Gateway to use an interface VPC endpoint.

This provides private access to an API from within a VPC. The scenario specifies the service is offered over the public internet, making this option irrelevant for external users.

C. Enable cross-origin resource sharing (CORS) for the APIs.

CORS is a browser security mechanism that allows or denies cross-origin requests. It is a functional requirement for certain clients, not a performance enhancement to reduce latency.

D. Configure usage plans and API keys in API Gateway.

Usage plans and API keys are for managing and authenticating access, including throttling and quotas. The API is unauthenticated, and these features are for control, not for improving general responsiveness.

1. Amazon API Gateway Developer Guide: Enabling API caching to enhance responsiveness. This document states

"You can enable API caching in Amazon API Gateway to cache your endpoint's responses. With caching

you can reduce the number of calls made to your endpoint and also improve the latency of requests to your API."

2. Amazon API Gateway Developer Guide: Create and attach an interface VPC endpoint for API Gateway. This guide explains

"To provide your private API clients in a VPC access to your API without using public IPs or exposing traffic to the public internet

you can use an interface VPC endpoint." This confirms its use for private

not public

access.

3. Amazon API Gateway Developer Guide: Creating and using usage plans with API keys. This section details that "After you create

test

and deploy your APIs

you can use API Gateway usage plans to make them available as a product offering for your customers." This highlights its purpose for access control and monetization

not latency reduction.

4. Amazon API Gateway Developer Guide: Enabling CORS for a REST API resource. This page clarifies

"Cross-origin resource sharing (CORS) is a browser security feature that restricts cross-origin HTTP requests that are initiated from scripts running in the browser." This confirms CORS is a security feature

not a performance tool.

Amazon CloudWatch Logs is the primary AWS service for centralizing application and system logs. For containerized microservices, the standard and most effective approach is to configure a log driver (e.g., awslogs for Amazon ECS) to forward container logs to CloudWatch. Creating a distinct log stream for each microservice instance within a shared log group provides a scalable and organized method for aggregation. This structure allows developers to easily isolate, search, and analyze logs from specific microservices while maintaining a central repository, directly addressing the need for a scalable, central logging solution for application logs.

B: AWS CloudTrail is used for auditing AWS API calls and account activity, not for capturing logs generated by the application's internal code.

C: VPC Flow Logs capture metadata about IP network traffic (source/destination IP, ports, etc.) within a VPC, not the content of application logs.

D: AWS Cloud Map is a service discovery tool that helps microservices find and connect to each other; it is not a logging solution.

1. Amazon CloudWatch Logs User Guide: Under "Concepts

" it defines a log stream as "a sequence of log events that share the same source." It further explains

"Each separate source of logs in CloudWatch Logs makes up a separate log stream." This supports the practice of using a separate stream for each microservice. (Source: AWS Documentation

Amazon CloudWatch Logs User Guide

"Logs concepts"

Section: "Log groups and log streams").

2. Amazon Elastic Container Service Developer Guide: The documentation for the awslogs log driver specifies its behavior: "The awslogs log driver sends container logs to Amazon CloudWatch Logs. In Amazon CloudWatch Logs

log events from each container instance are sent to different log streams in a log group." This directly validates the pattern described in the correct answer for containerized microservices. (Source: AWS Documentation

Amazon Elastic Container Service Developer Guide

"Logging and monitoring in Amazon ECS"

Section: "Using the awslogs log driver").

3. AWS CloudTrail User Guide: The introduction states

"AWS CloudTrail is an AWS service that helps you enable operational and risk auditing

governance

and compliance of your AWS account. Actions taken by a user

role

or an AWS service are recorded as events in CloudTrail." This confirms its purpose is unrelated to application logging. (Source: AWS Documentation

AWS CloudTrail User Guide

"What Is AWS CloudTrail?").

The simplest and most efficient method to automatically delete old items from a DynamoDB table is by using the built-in Time To Live (TTL) feature. This feature allows you to define a specific attribute that stores an expiration timestamp in Unix epoch time format. Once TTL is enabled on the table for that attribute, DynamoDB continuously evaluates items and deletes those that have expired, typically within 48 hours of expiration. This is a fully managed, no-cost feature that eliminates the need for custom application logic, provisioned throughput consumption for deletes, or managing separate compute resources, making it the ideal solution for ephemeral data like session information.

A. This is a valid but overly complex solution. It introduces operational overhead for managing the EC2 instance, the script, and potential costs for scan operations.

C. This architectural pattern is inefficient and complex, requiring application-level changes to manage multiple tables and risking data loss for active sessions during table deletion.

D. Merely adding an attribute is insufficient. The Time To Live (TTL) feature must be explicitly enabled on the table and configured to use that attribute.

1. AWS DynamoDB Developer Guide

"Using DynamoDB Time to Live (TTL)": This document states

"Time to Live (TTL) for Amazon DynamoDB automates the process of deleting expired items from your tables... TTL is provided at no extra cost... It is a low-impact

background process that doesn’t affect your table’s performance." (Section: Time To Live)

2. AWS DynamoDB Developer Guide

"How it works: Time to Live": This section explains the process: "You can set a specific timestamp for an item to expire. Once the timestamp expires

the item is marked for deletion... DynamoDB deletes expired items on a best-effort basis." (Section: How it works: Time to Live)

3. AWS API Reference

UpdateTimeToLive: The documentation for this API call confirms the required steps: specifying the attribute name and enabling the TimeToLiveSpecification. This shows that simply adding an attribute (as in option D) is not enough. (Action: UpdateTimeToLive

Request Parameters: TimeToLiveSpecification)

This solution correctly implements the centralized event bus pattern, which is the best practice for aggregating events from multiple AWS accounts. The process involves three key steps:

1. The main (receiving) account applies a resource-based policy to its event bus, granting permission for other specific accounts to send events to it.

2. Each source (sending) account creates an EventBridge rule to capture the desired EC2 lifecycle events and sets the target of that rule to be the event bus in the main account.

3. The main account creates a final rule on its event bus to process these aggregated events and forward them to the SQS queue. This architecture is scalable, manageable, and decouples event producers from the final consumer.

Why Incorrect Options are Wrong

A. This option misrepresents how cross-account event delivery works. EC2 instances publish events to their local account's event bus, not directly to an event bus in another account.

B. While technically possible to target a cross-account SQS queue directly from each source account, this creates tight coupling and is harder to manage. The central event bus pattern (Option D) is superior.

C. This describes an inefficient polling mechanism. An event-driven approach using Amazon EventBridge is the standard, real-time, and more cost-effective method for reacting to AWS service events like EC2 lifecycle changes.

---

References

1. AWS Documentation, Amazon EventBridge User Guide: "Sending and receiving Amazon EventBridge events between AWS accounts". This document explicitly details the recommended pattern. It states, "To send events to another account, you create a rule with the event bus in the other account as a target... The receiving account must grant permission to the sending account to send events to an event bus in the receiving account." This directly supports the steps outlined in option D.

2. AWS Documentation, Amazon EventBridge User Guide: "Tutorial: Route events to a different account". This tutorial provides a step-by-step guide that mirrors the solution in option D: "Step 1: Add permissions to the event bus in the receiving account," "Step 2: Create a rule in the sending account," and "Step 3: Create a rule in the receiving account."

3. AWS Documentation, Amazon EventBridge User Guide: "Amazon EventBridge resource-based policies". This section explains how to configure the permissions on the receiving event bus, which is the first step in option D. It provides policy examples for granting events:PutEvents permissions to other accounts.

4. AWS Documentation, Amazon EventBridge User Guide: "EC2 instance state-change events". This page confirms that EC2 instance state changes generate events that are sent to the default EventBridge event bus, making them available for rules to process.

The AWS SDKs and Command Line Interface (CLI) use a specific order of precedence to find credentials, known as the credential provider chain. By default, the shared credentials file (~/.aws/credentials) is checked before the IAM role attached to the EC2 instance. In this scenario, the application will find and use the IAM user's access keys from the credentials file. Since these keys grant full administrative access, the EC2 instance will be able to perform all S3 actions. The IAM role and its explicit deny policy are never evaluated because credentials were found earlier in the provider chain.

A. The EC2 instance will only be able to list the S3 buckets.

This is incorrect because the credentials being used provide full administrative access, not just the permission to list buckets.

B. The EC2 instance will only be able to list the contents of one S3 bucket at a time.

This is incorrect. The credentials used grant full administrative permissions, which are far more extensive than just listing bucket contents.

D. The EC2 instance will not be able to perform any S3 action on any S3 bucket.

This is incorrect because the IAM role with the explicit deny policy is not used. The credential provider chain selects the user credentials from the file first.

1. AWS SDK and Tools Reference Guide

"Configuration and credential settings": This document outlines the order of precedence for credentials. It states

"When you configure your credentials

you can use any of the methods described in this topic. The SDK or tool works through them in a specific order of precedence... 3. Shared credentials file (~/.aws/credentials and ~/.aws/config)... 5. IAM role for Amazon EC2". This confirms the credentials file is checked before the instance role.

2. AWS Identity and Access Management User Guide

"IAM roles for Amazon EC2": This guide explains how applications on an EC2 instance can use the credentials from an attached IAM role. However

it operates as part of the broader credential provider chain

which prioritizes other sources like the credentials file.

3. AWS Command Line Interface User Guide

Version 2

"Configuration and credential file settings": Under the section "Order of precedence for AWS CLI options and settings

" the documentation confirms the credential provider chain order

placing the shared credential file (awsaccesskeyid

awssecretaccesskey) before instance profile credentials.

To transition an AWS Lambda function from a .zip package to a container image, the container image must be stored in Amazon Elastic Container Registry (ECR). The process involves creating an ECR repository in the same AWS Region as the function, packaging the function code into a container image using a Dockerfile, and pushing this image to the ECR repository. Finally, the existing Lambda function's configuration must be updated to change the package type from .zip to image and to specify the full ECR image URI, which includes the repository URI and a specific image tag or digest. Option A accurately describes this complete, standard procedure.

B: This is incorrect because Lambda container images must be stored in Amazon ECR, not Amazon S3. S3 is used for .zip file deployments and storing IaC templates.

C: This is incorrect for the same reason as option B. AWS CloudFormation requires the container image to be located in an Amazon ECR repository, not an S3 bucket.

D: This option is incomplete. Simply specifying the repository URI is insufficient. Lambda requires the full image URI, which must include a specific image tag or digest to identify the exact version to deploy.

1. AWS Lambda Developer Guide

"Deploying Lambda functions as container images": This document explicitly states

"You upload your container images to Amazon Elastic Container Registry (Amazon ECR)." It then outlines the workflow: create a repository

build the image

push to ECR

and then create or update the function to use the image URI. This supports the entire process described in option A.

2. AWS Lambda Developer Guide

"Creating Lambda functions defined as container images": Under the "Prerequisites" section

it lists

"A container image uploaded to an Amazon ECR repository in the same AWS Region as your function." This confirms the ECR and same-region requirements.

3. AWS CLI Command Reference

update-function-code: The documentation for this command shows the --image-uri parameter. The required format is ECR-URI:TAG (e.g.

123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo:my-tag)

demonstrating the necessity of including both the repository URI and a tag

which makes option A more complete than option D.

Amazon ElastiCache is a fully managed in-memory caching service designed to improve application performance by providing a low-latency data store. For an application using Amazon RDS, implementing ElastiCache (with Redis or Memcached) is the standard AWS solution for a caching layer. The application logic is updated to first query the ElastiCache cluster for frequently accessed data, such as the most viewed products. If the data is not in the cache (a cache miss), the application then retrieves it from the RDS database and populates the cache for future requests. This cache-aside strategy significantly reduces latency and lessens the load on the primary database.

A. Amazon RDS for MySQL does not have a feature to "add a cache node" to a cluster. This describes a non-existent capability.

C. Amazon DynamoDB Accelerator (DAX) is a caching service exclusively for Amazon DynamoDB and is not compatible with Amazon RDS for MySQL.

D. A standby instance in an RDS Multi-AZ configuration is for high availability and automatic failover; it does not serve read traffic and is not a cache.

1. Amazon ElastiCache User Guide

"Database caching": This section explicitly details the use case for ElastiCache as an in-memory cache to reduce latency associated with querying a disk-based database like Amazon RDS. It states

"An in-memory cache can be put in front of a database... to improve the performance of your application."

2. AWS Documentation

"In-Memory Acceleration with DynamoDB Accelerator (DAX)": The introductory paragraph clearly states

"Amazon DynamoDB Accelerator (DAX) is a fully managed

highly available

in-memory cache for Amazon DynamoDB..." This confirms its exclusivity to DynamoDB.

3. Amazon RDS User Guide

"High availability (Multi-AZ) for Amazon RDS": Under the section for Multi-AZ DB instance deployments

the documentation clarifies the role of the standby instance: "You can't use the standby replica to serve read traffic." This confirms the standby is for failover

not read operations or caching.

This solution represents a standard, serverless, and scalable architecture for this use case, minimizing operational overhead. Amazon Cognito is the appropriate managed service for handling user sign-up, sign-in, and identity management for tens of thousands of application users. Integrating Cognito with an API Gateway authorizer provides a secure and managed way to control API access. Storing large binary objects like photos (up to 5 MB) in Amazon S3 is the correct approach, as DynamoDB has a 400 KB item size limit. Storing the S3 object key (metadata) in DynamoDB allows for efficient querying and retrieval of photo details.

A. Storing photos directly in DynamoDB is not feasible. DynamoDB has a maximum item size of 400 KB, while the photos can be up to 5 MB.

C. Creating an IAM user for each application user is an anti-pattern. IAM is for managing access to AWS resources, not for application end-users. This approach has high operational overhead and does not scale effectively.

D. Building a custom user management system in DynamoDB with a Lambda authorizer creates significant development and operational overhead for features like password hashing, session management, and password resets, which Amazon Cognito provides as a managed service.

1. Amazon Cognito for User Management: The AWS Documentation for Amazon Cognito states

"Amazon Cognito provides authentication

authorization

and user management for your web and mobile apps. Your users can sign in directly with a user name and password

or through a third party such as Facebook

Amazon

Google or Apple." This confirms Cognito is the correct choice for managing application users with low overhead.

Source: AWS Documentation

Amazon Cognito Developer Guide

"What Is Amazon Cognito?".

2. Amazon S3 for Object Storage: The AWS Documentation highlights S3's suitability for user-generated content. Storing large objects in S3 and metadata in DynamoDB is a common and recommended pattern.

Source: AWS Documentation

Amazon S3 User Guide

"Use cases for Amazon S3".

3. Amazon DynamoDB Item Size Limit: The official DynamoDB documentation explicitly states the service limit for item size

making option A technically impossible. "The maximum item size in DynamoDB is 400 KB

which includes both attribute name binary length (UTF-8 length) and attribute value lengths (again

binary length)."

Source: AWS Documentation

Amazon DynamoDB Developer Guide

"Service

account

and table quotas in Amazon DynamoDB".

4. IAM Users vs. Application Users: The AWS Identity and Access Management (IAM) best practices advise against using IAM users for application-level authentication. "Don't use IAM users for application access. Instead

your application should assume a role... For mobile or consumer-facing applications

we recommend that you use Amazon Cognito."

Source: AWS Documentation

IAM User Guide

"Security best practices in IAM".

The core issue identified is the latency caused by Lambda "cold starts," which is the time it takes to initialize a new execution environment. Provisioned Concurrency is a feature specifically designed to solve this problem for latency-sensitive applications. It works by initializing a specified number of execution environments and keeping them "warm" and ready to respond instantly to incoming requests. By routing invocations to these pre-initialized environments, the cold start latency is completely eliminated for those requests, directly addressing the performance issue.

A. Reserved concurrency guarantees that a certain number of concurrent executions are available for a function, preventing it from being throttled, but it does not keep execution environments pre-initialized or "warm."

B. Increasing the function's timeout allows it to run for a longer duration before being terminated. It has no impact on the initial startup time or cold start latency.

C. Increasing memory allocation also increases CPU power, which can reduce the duration of a cold start. However, it does not prevent the cold start from occurring in the first place.

1. AWS Lambda Developer Guide

"Configuring provisioned concurrency": "For latency-sensitive applications

you can use provisioned concurrency to keep your functions initialized and warm

ready to respond in double-digit milliseconds. Provisioned concurrency is the number of pre-initialized execution environments that you allocate to your function."

2. AWS Lambda Developer Guide

"Lambda function scaling": This section contrasts the different concurrency controls. It explains that on-demand functions scale from zero

incurring a cold start

while "for functions with provisioned concurrency

Lambda pre-initializes the requested number of execution environments."

3. AWS Lambda Operator Guide

"Performance optimization - Function initialization": "To reduce the duration of initialization

we recommend that you... configure provisioned concurrency for any function that has strict cold start latency requirements." This explicitly recommends provisioned concurrency as the solution for the problem described.