DVA-C02 Practice Exam 2: every answer explained.

Why B

Express workflows are built for high-volume, short-lived executions: they run for up to five minutes, accept far higher start rates than Standard workflows, and are billed by request count and duration instead of per state transition. Asynchronous Express executions are at-least-once, which is acceptable because every step is idempotent, and their history goes to CloudWatch Logs rather than the console, which is what the team wants. Raising the Standard quotas lets executions start but keeps the per-transition pricing that drives the bill. Merging the steps into one Task state trims a few transitions but leaves the Standard start-rate throttling and per-transition billing in place and loses per-step retries. Feeding executions through Pipes from a queue only delays the throttled starts, adding latency without lowering cost.

Why A

Code running in a browser or on a phone cannot keep a secret, so the recommended flow for these public clients is the authorization code grant with Proof Key for Code Exchange: the app sends a hashed code challenge on the authorize request and proves possession of the matching code verifier when it redeems the code, so an intercepted authorization code is useless, and the app client has no secret to leak. Downloading the secret from an unauthenticated API just hands the secret to anyone who calls that API, which is the same exposure as embedding it. Shortening token lifetimes under the implicit grant still delivers tokens in the URL fragment, where browser history, logs and referrers can capture them, and the implicit grant is no longer recommended. The client credentials grant is for machine-to-machine access, requires a client secret, and issues tokens that represent the app rather than a signed-in user.

Why C and E

A multi-stage build keeps only the layers of the final stage, so the compiler, devDependencies and full base image stay in a discarded builder stage while the runtime stage ships a slim base, the compiled dist folder and production dependencies. A .dockerignore file keeps .git, node_modules and the fixtures out of the build context, so COPY . . can no longer bake them into a layer. An ECR lifecycle policy only removes old images from the repository to save storage; the image each task pulls is unchanged. The CodeBuild layer cache makes builds faster but produces exactly the same layers. A later RUN that deletes files only adds a layer that hides them, because the earlier layers still contain the files and are still pulled.

Why C

A Duration equal to the configured 30,000 ms with Max Memory Used far below Memory Size is the signature of a timeout, while Max Memory Used equal to Memory Size on an invocation that ended well before the timeout is the signature of an out-of-memory exit, so the first needs a longer timeout or a faster dependency and the second needs more memory or a smaller working set. Raising memory for both treats the first invocation as a memory problem although it used only 388 MB of 1,024 MB. Raising the timeout for both ignores that the second stopped after 6.4 seconds, far inside the limit. Swapping the diagnoses reads each signal backward: the run that hit 30 seconds was not short of memory, and the run that hit 1,024 MB was not near the timeout.

Why C

A Distributed Map state reads its items directly from S3 with an ItemReader, so the 4.2 million keys never pass through the state payload, and it runs each batch of items as a separate child workflow with its own history, so the parent execution stays far below the 25,000-event limit. MaxConcurrency controls how many child workflows run at once (up to 10,000), and a ResultWriter writes per-item success and failure results to S3. Chunking the list into many Standard executions means writing and operating custom splitting and tracking code. A listing-and-invoking Lambda function needs its own pagination, throttling and result tracking, and listing millions of keys and invoking for each risks its 15-minute timeout. An inline Map keeps every iteration in one history, and a Pass state Result is part of the definition and state data, so both limits still apply.

Why B and C

A user pool federates a SAML 2.0 identity provider natively: creating the SAML provider in the pool from the metadata document, with attribute mapping from assertion attributes to user pool attributes, lets Cognito create a federated user and issue its own ID and access tokens, so the existing user pool authorizer keeps working. The provider must then be enabled on the app client so managed login offers it, and the customer's identity provider must trust the pool by registering its saml2/idpresponse URL and its urn:amazon:cognito:sp entity ID. An identity pool with a SAML provider issues temporary AWS credentials, not user pool tokens, so the authorizer would reject the requests. AssumeRoleWithSAML likewise returns IAM credentials for SigV4 signing, which a Cognito authorizer does not accept. A user migration trigger receives each password through Cognito, which breaks the rule that the vendor never handles them, and it is a one-time migration rather than single sign-on.

Why D

On Amazon Linux 2023 platforms, files in .platform/hooks/predeploy run after the platform has set up the application, including the requirements.txt packages, and before the new version moves to its final location, and a nonzero exit aborts the deployment. Hooks in .platform/hooks/prebuild run before the application is set up, so Django is not installed yet. The commands section of an .ebextensions file runs earlier still, before the application and web server are set up; only its container_commands section runs after setup in the staging directory, just before predeploy hooks, and would also work, but platform hooks are the mechanism these platforms recommend: a plain executable file with no YAML wrapper. A Procfile entry defines a long-running process started after deployment, so a one-off script would run too late and be relaunched whenever it exits.

Why B

An SNS FIFO topic orders messages within each message group and deduplicates publishes within a five-minute window, using content-based deduplication or an explicit deduplication ID, so a retried Publish of the same event is accepted but not delivered again,, and it delivers to subscribed SQS FIFO queues in that same order, so one Publish call reaches all three consumers in prescription order. Using the prescription ID as the group keeps each prescription ordered while different prescriptions flow in parallel. An SNS standard topic cannot have SQS FIFO queues subscribed to it, so that design cannot be built. SNS FIFO topics can deliver to SQS standard queues, but standard queues offer best-effort ordering and at-least-once delivery, losing both guarantees at the consumer. EventBridge does not guarantee delivery order across events, so rules targeting the queues can enqueue amendments out of sequence.

Why C

A metric math expression that divides the Sum of Errors by the Sum of Invocations over the same period yields the failure percentage directly, so the threshold of 2 means the same thing at 2,000 invocations an hour as at 60,000, and the alarm evaluates the expression rather than either raw metric. Anomaly detection still models the raw error count, so it judges whether the count is unusual for the time of day, not whether more than 2 percent of calls failed. A composite alarm only combines the states of other alarms with AND, OR and NOT; it cannot compute a ratio, and both child alarms still use raw thresholds. Raising the count threshold to 1,200 silences the mornings but lets an overnight failure rate of 50 percent pass unnoticed, because 1,000 errors in 2,000 calls never reaches it.

Why B

The access token is the one meant for resource servers: it carries the granted OAuth scopes, including custom resource server scopes such as catalog/write, plus client_id and token_use set to access, and libraries such as aws-jwt-verify check exactly those claims when configured for access tokens. Requesting the scope on the app client does not put it into the ID token, because Cognito writes scopes only to the access token, and the ID token describes who the user is for the client app. The refresh token is an opaque, encrypted value that only the Cognito token endpoint can read, so the service cannot validate it locally, and redeeming it on every request would mint new tokens rather than authorize a call. The ID token's aud claim does identify the app client, but that proves which app the user signed in to, not what the caller is permitted to do, and it still contains no scope.

Why D

Fargate bills for the task-level size and accepts only fixed CPU and memory pairs: 512 CPU units allow 1 GB to 4 GB, while 1024 units (1 vCPU) allow 2 GB to 8 GB, so 1024 with 8192 is the smallest valid size that still gives the job its 7.5 GB, and the 7,680 MiB container limit fits inside it. Changing only the container-level cpu and memoryReservation leaves the invalid 512/8192 task-level pair in place, so registration still fails. Fargate requires task-level cpu and memory, so a definition that sizes only its containers is rejected for the FARGATE launch type. A task-level cpu of 2048 with 8 GB is also a valid pair and would run, but it pays for twice the vCPU the job needs, which fails the lowest-cost requirement.

Why A

Moving session and cart state to a shared store such as ElastiCache (Valkey or Redis OSS) or a DynamoDB table keyed by session ID makes every instance interchangeable: any instance can read the session, a terminated instance takes nothing with it, and with stickiness off the load balancer spreads load to new instances immediately. A DynamoDB TTL attribute or a cache TTL can expire abandoned sessions. A longer stickiness duration and deregistration delay only postpone the loss, because in-flight connections drain but the memory holding the sessions is still destroyed at termination, and stickiness keeps starving new instances. An EBS file is still per-instance state, and hourly snapshots do not make it readable by other instances. A lifecycle hook that copies sessions between instances is custom, fragile code that still leaves the tier stateful.

Why D

PostgreSQL row-level security lets one policy per table restrict every SELECT, UPDATE and DELETE to rows whose tenant_id matches a session setting, and setting app.tenant_id with SET LOCAL scopes the value to the current transaction, so a pooled connection never carries one tenant's value into another request; because app_rw neither owns the tables nor holds BYPASSRLS, the policies apply to it, whereas an owning role would also need FORCE ROW LEVEL SECURITY. IAM database authentication controls who may connect, not which rows a query returns, and 1,800 database users would defeat the shared connection pool. An ORM default scope with a unit test still lives in application code, so a raw query or a missed test reintroduces exactly the leak that occurred. Per-tenant views and roles would mean thousands of views to create and migrate, and the single pooled role app_rw cannot switch to a different role for each request without extra connection handling.

Why D

A REST API can call SQS directly through an AWS service integration: API Gateway assumes an IAM role allowed to call sqs:SendMessage and a mapping template places the request body in the message, so the queue absorbs the burst and no function concurrency is consumed at all. The worker fleet keeps reading at its own pace. Reserved concurrency protects other functions, but the forwarding function is still capped and returns throttling errors to callers during the spike, and the function still exists to operate. Swapping the queue for a Kinesis data stream keeps the same forwarding function and its concurrency problem, and adds shard management. Stage caching is meant for idempotent reads, and every trip event is a distinct write that must reach the queue, so caching would drop events rather than buffer them.

Why B

A published Lambda version is an immutable snapshot of the code and the configuration, including environment variables, so the console edit changed only $LATEST; publishing a new version captures the new PRICING_URL, and moving the live alias to it switches production without touching API Gateway, while version 14 stays available for rollback. Configuration updates apply only to $LATEST, so a version qualifier cannot be used to edit version 14 in place. Recycled execution environments for version 14 are rebuilt from the same frozen snapshot and keep the old value forever. Pointing the integration at the unqualified ARN would serve the new value, but it abandons the alias, sends every unpublished change straight to production and removes the one-step rollback.

Why D

IteratorAge is the age of the last record in each batch the function has just processed, so a steady climb with no errors or throttles means the consumer is falling behind the producers, here because the new enrichment lookup lengthened each invocation; if the age reaches the 24-hour retention period, unread records expire and are lost. Producer throttling would show in the stream's WriteProvisionedThroughputExceeded metric and delays a record before it enters the stream, which IteratorAge does not measure. Expiring records are a future consequence of the lag, not its cause, and the age is still under an hour. A batch retried in a loop would show in the Errors metric, which has stayed at zero.

Why A

The asynchronous request/response pattern decouples the client from the long-running work: the POST stores a job record, starts the analysis (for example through a queue, an asynchronous invocation or a Step Functions execution) and immediately returns 202 Accepted with a job ID, and the client polls GET /jobs/{id} until the stored status shows the result. A dropped mobile connection costs nothing, because the result is waiting when the app polls again. The 29-second default is not a ceiling: since June 2024 Regional and private REST APIs can raise it through a quota request (at the cost of account throttle quota), and REST response streaming can keep a response open for up to 15 minutes. Either way, though, each client holds one connection open for up to 12 minutes, so any cellular drop loses the result, which fails the reliability requirement that polling meets with no change to the analysis logic. HTTP APIs cap the integration timeout at 30 seconds. An asynchronous invocation returns quickly but gives the client no job ID or way to fetch the finished analysis.

Why A

Because the studio already runs IAM Identity Center, aws configure sso writes an sso-session and a named profile for each account and permission set, aws sso login opens the corporate sign-in in a browser, and both the CLI and boto3 then obtain role credentials that expire automatically, with no IAM users or access keys left to manage. Requiring MFA with get-session-token still depends on each IAM user keeping a long-lived access key to call it, which is exactly what the audit flagged. IAM Roles Anywhere does issue temporary credentials, but it adds a certificate authority, certificate distribution and renewal, and trust anchors and profiles, duplicating identities that Identity Center already holds. Rotating keys every 30 days leaves long-lived credentials in place, and emailing secret keys creates a new path for them to leak.

Why D

A configuration profile can carry up to two validators, JSON Schema or Lambda, and AppConfig runs them when StartDeployment is called, so a version that violates the schema's type, minimum, maximum or required rules fails validation and AppConfig refuses to deploy it to any environment, even though saving the hosted version itself succeeds; the schema is declarative and needs no code. An alarm used as a deployment monitor reacts only after the bad version has reached functions and broken enough checkouts to trip the alarm, then rolls back. A linear strategy with bake time limits the blast radius, but some functions still receive the broken version. Validation inside each function changes function code, which the requirement rules out, and it runs after the bad version has already been deployed.

Why B

API Gateway WebSocket APIs give each client a connection ID, and a backend pushes to a client by calling the @connections callback URL for that ID (PostToConnection in the API Gateway Management API) with execute-api:ManageConnections permission. Recording connection IDs per auction on $connect and removing them on $disconnect gives placeBid the list to fan out to, and a 410 GoneException identifies stale IDs to delete. Making browsers send empty bids every second turns the push channel back into polling, multiplies invocations, and a route response is returned only to the caller anyway. A connection ID is not an addressable HTTPS endpoint, so it cannot be subscribed to an SNS topic. A route response goes only to the connection that sent the message; API Gateway has no built-in broadcast to all connections.

Why A

The pattern command clusters log events that share a text structure and replaces the parts that vary, such as invoice numbers and carrier IDs, with tokens, returning each template as @pattern with its @sampleCount and @ratio, so sorting on @sampleCount ranks the recurring messages without any format being declared first. Grouping with stats count(*) by @message treats every distinct line as its own group, and because each line embeds unique IDs the counts are almost all 1. The parse query only extracts fields from lines that match the one format it names, so it counts a single known template and drops everything else. The dedup query removes exact duplicate messages, which barely exist here, and it returns raw lines with no grouping or counts.

Why D

The default chain stops at the first provider that returns credentials, and it checks environment variables before the shared profile files, then container credentials, then the instance metadata service, so the ci-builder keys baked into the image win over the task role; removing them lets the chain reach the container credentials endpoint that ECS exposes for the task role. Instance metadata is the last provider, after container credentials, so removing the instance profile changes nothing here and would break the ECS agent. Moving the keys into a shared credentials file in the image changes nothing, because the profile file is also read before container credentials, so the SDK would still sign as ci-builder. ECS already sets AWS_CONTAINER_CREDENTIALS_RELATIVE_URI for every task with a task role, and the default chain uses it without any explicit provider, so setting it again has no effect while the environment keys remain.

Why A

botocore's Stubber intercepts calls on a client inside the test process: add_response queues a canned reply together with expected_params, a call with different parameters raises an error, and assert_no_pending_responses proves every expected call happened, all without credentials or network; moto, or aws-sdk-client-mock for JavaScript, fills the same role. LocalStack can emulate both services offline, but it is an extra container that must run beside the tests, and it does not check the parameters sent to Publish. sam local invoke runs the handler in a local Lambda container, yet the SDK calls inside it still go to real AWS endpoints with real credentials. A dedicated test account isolates the data but keeps the network calls, the credential dependency and the slow runs.

Why C

AppSync subscriptions are triggered by mutations made through the same API: annotating a subscription field with @aws_subscribe(mutations: ["updateCourierLocation"]) makes AppSync push each mutation result over its managed WebSocket connection, and an orderId argument (or an enhanced subscription filter) ensures each customer receives only the courier for their order. Because couriers already call the mutation through AppSync, no new service is needed. A separate WebSocket API with a stream-driven function would work, but it duplicates connection management and authorization that AppSync already provides. Mobile push notifications are for user-visible alerts and are not designed for a continuous stream of map coordinates every few seconds. Server-side caching cuts resolver cost but keeps the polling, and cached responses make the marker even staler.

Why D

Task role credentials are themselves a role session, so assuming finance-reader with them is role chaining, and IAM caps a chained session at one hour whatever the target role's MaxSessionDuration says; only a first assumption from user credentials and applications on EC2 using instance profiles are exempt. The trust policy fix was right, and the job must now work in hourly sessions, which the SDK's STS assume-role credentials provider handles by refreshing before expiry. Raising the MaxSessionDuration of finance-reader to four hours would admit a 14,400-second request from a non-chained caller, but this chained request still fails. The MaxSessionDuration of the task role does not limit sessions that ECS obtains for the task, and it has no bearing on the chaining cap. An IAM user in the finance account would avoid chaining, but its access key is exactly the long-lived credential the requirement rules out, and storing it in Secrets Manager does not make it temporary.

Why B

Errors raised by API Gateway before or instead of the integration, such as authorizer failures, missing API keys and throttling, are generated from gateway responses, and by default they carry no CORS headers. Adding Access-Control-Allow-Origin (and any other needed CORS headers) to the DEFAULT_4XX and DEFAULT_5XX gateway responses and redeploying the stage applies the headers to every such error at once, so the browser exposes the status code to the app. Adding headers in the Lambda error paths does nothing here, because these requests are rejected before any function runs. An OPTIONS method answers the preflight request only; the actual failed request still returns without the header. Integration response mappings are not used with Lambda proxy integrations, and requests rejected by the authorizer or throttling never reach an integration response.

Why B

TestEventPattern takes an event pattern and a sample event, which must include id, account, source, time, region, resources and detail-type, and returns a Result of true or false, so a build script can assert each labeled sample and fail on any mismatch without creating a single resource. Deploying rules to a temporary bus with a log target would test real matching, but it creates exactly the rules, buses and targets the team wants to avoid and adds delivery delays to the build. Schema discovery records the structure of events that arrive on a bus and generates code bindings; it never evaluates a pattern. cfn-lint checks that the template and the EventPattern property are well formed, but it cannot tell whether a pattern matches a given event.

Why B

Latency measures from the moment API Gateway receives the request until it returns the response, while IntegrationLatency covers only the time between relaying the request to the backend and receiving its answer, so the difference between the two at the same percentile is time spent before and after the backend call, and both are published by default. Because every method here uses a Lambda TOKEN authorizer, that gap includes the authorizer function's run time as well as API Gateway's own processing, so a large gap points first at the authorizer, which its own Duration metric can confirm. Execution logging would also expose timings, but enabling it changes the stage configuration and adds logging cost, which the constraint rules out. The spread between Average and p99 Latency describes how the latency is distributed, not which tier contributes it. The cache hit and miss metrics are published only when stage caching is enabled, and even then a miss says nothing about how long the backend took.

Why C

SNS delivers to SQS by calling SendMessage as the sns.amazonaws.com service principal, so the queue resource policy must allow that, and an ArnEquals condition on aws:SourceArn limits the grant to the order-events topic, which prevents any other topic, including one in another account, from using SNS to write to the queue. A statement on the topic policy controls who may publish to the topic, and SQS never publishes, so it leaves the queue denying delivery. SNS has no delivery role for SQS endpoints; a subscription role exists for Amazon Data Firehose subscriptions, and delivery to a queue is authorized only by the queue policy. Allowing sns.amazonaws.com without a source condition lets every topic send, and the AWS managed key aws/sqs would break delivery outright, because its key policy cannot be edited to let SNS use the key.

Why C

Content-based deduplication derives the deduplication ID from a SHA-256 hash of the message body, and the rebuilt message carries a new sentAt timestamp, so each retry hashes differently and is accepted as new. An explicit MessageDeduplicationId takes precedence over the content hash, so using the payout ID makes SQS accept the retry but not deliver it again within the five-minute deduplication interval. A message group ID controls ordering, not deduplication; every message in a group is still delivered, one after another. A queue delay postpones delivery of both copies equally and removes neither. FIFO exactly-once processing is itself the deduplication mechanism: with content-based deduplication off, every send must supply a deduplication ID, so the change fails or relies on the same missing key.

Why A

TestState runs a single state definition, or one named state from a full definition, with the input provided and without creating or updating a state machine; at the DEBUG level its inspectionData shows the input, afterInputPath, afterParameters, the task result, afterResultSelector and afterResultPath, which pinpoints the field that writes the wrong key. Running a copy of the state machine creates a new resource and starts at the first state, so the 20-minute run and the partner calls happen again. Step Functions Local is unsupported, lacks feature parity, and still needs a local emulator and a full workflow run. Invoking the function with sam remote invoke shows only the raw Lambda response and none of the state's processing, leaving the faulty step to guesswork.

Why D

A visibility heartbeat solves both problems: the worker keeps a short timeout, such as 10 minutes, and while the job is still running it calls ChangeMessageVisibility every few minutes to push the timeout out again, up to 12 hours from the original receipt. A healthy long job never reappears, and a crashed worker stops sending heartbeats, so its message becomes visible within minutes. Deleting messages on receipt removes the duplicate, but a crash then loses the job entirely. FIFO queues use the same visibility timeout model; a message whose timeout lapses becomes available again, so FIFO alone changes nothing. A dead-letter queue with a maxReceiveCount of 1 would move every long-running job aside the moment it reappears, and it would also stop a crashed worker's job from being retried at all.

Why B

Access Analyzer policy generation reads the CloudTrail events recorded for a role over a chosen window of up to 90 days and returns a policy listing the actions the role actually called, with resource placeholders to tighten before attaching it, which is the activity-based least-privilege draft the review asks for. Policy validation checks a policy for grammar errors, security warnings and best-practice suggestions; it knows nothing about which actions were used, so it cannot shrink a full-access policy to the used set. The policy simulator reports whether actions are allowed, and with full-access policies attached every action is, so it would keep everything. Last accessed data is real usage information, but turning it into a policy is manual authoring, which the generator already does from the same trail.

Why D

DecodeAuthorizationMessage turns the encoded text that EC2 returns into JSON stating whether the request was allowed, whether an explicit deny matched, and the principal, action, resource and condition key values that were evaluated, which answers all three questions from the failure the developer already has. The policy simulator evaluates the policies it is shown and the request context typed into it, so it can miss the exact tags and condition values the script sent and needs manual setup. CloudTrail records the failed call with an errorCode and errorMessage, but for EC2 that message carries the same encoded blob rather than naming the denying statement. A DryRun call only reports whether the request would have succeeded, returning UnauthorizedOperation again with the same encoded message.

Why A

A condition built with Fn::Equals on EnvType and attached to a resource through its Condition attribute makes CloudFormation create that resource only when the condition is true, and Fn::If on the same condition returns a Variables map containing PAGER_TOPIC_ARN with a Ref to the topic in prod and a map without it elsewhere, which is also the only safe way to reference a resource that may not exist. Mappings return values for properties but cannot decide whether a resource exists, so a CreatePager flag would still create the topic everywhere. A Rules assertion validates parameter values and fails the whole stack operation when it is false; it never skips resources. A nested stack adds a second template and would still need its own condition to skip the resources.

Why A

SDK paginators handle continuation tokens for any paginated operation, so iterating the list_objects_v2 paginator yields every page until all 380,000 keys are returned, and SDK waiters poll a describe call on a built-in schedule, so the table_exists waiter returns only when the table is ACTIVE and ready for writes. Both replace hand-rolled loops with tested SDK code. MaxKeys is capped at 1,000 per call, so a larger value still returns one page, and retrying PutItem on errors is the same sleep loop in a different form. Adaptive retry mode retries throttling and transient errors, but it never fetches the next page of a listing, and ResourceNotFoundException is not a retryable error. The older list_objects call also returns at most 1,000 keys per page, and polling describe_table by hand recreates exactly what the waiter already does.

Why D

Amazon Verified Permissions stores fine-grained rules as Cedar policies in a policy store, evaluates them with one IsAuthorized call per request, using entity attributes such as practice group and context such as engagement dates, and lets the team change and test policies without touching function code. IAM roles mapped from Cognito groups can allow or deny API methods, but they cannot express rules about individual documents, practice groups or engagement dates, because those are application records rather than AWS resources. An AppConfig document with a shared evaluator layer centralizes the data but means writing and maintaining a policy engine. A single Lambda authorizer moves the if statements to one place, yet the rules are still code that must be redeployed to change, and it has to fetch document metadata for every method call.

Why D

Access logging writes one line per request in a format the team defines, so a JSON template with $context.requestId, $context.identity.sourceIp, $context.status, $context.integrationLatency and $context.authorizer.principalId produces exactly the structured record the pipeline needs. Lowering execution logging to ERROR keeps the same unstructured, API Gateway-defined lines and drops every successful request, so most requests leave no record at all. Full request and response data logging adds bodies and headers to the execution logs, making them larger, noisier and more sensitive without making them structured. Detailed CloudWatch metrics publish aggregated counts and latencies per method, not a record per request, and they never carry a source IP or principal ID.

Why B

The --lint flag makes sam validate run cfn-lint, which checks every resource against the CloudFormation resource specification, so it reports the misspelled VisibilityTimout property, the ON_DEMAND value outside BillingMode's allowed values of PAY_PER_REQUEST and PROVISIONED, and the Fn::GetAtt to an attribute the resource type does not expose, all locally in seconds. Plain sam validate checks only that the file is a valid AWS SAM template that the SAM transform can process, so property-level errors on standard CloudFormation resources pass. aws cloudformation validate-template checks that the template is valid JSON or YAML with a correct overall structure, not that property names and values are right. sam build packages function code and dependencies and does not inspect resource properties.

Why B and D

A single PutObject request is limited to 5 GB, while multipart upload splits a file into parts that upload in parallel, can be retried individually, and are assembled into one object by CompleteMultipartUpload, which is what the SDK transfer manager does automatically above a size threshold. Parts of uploads that were never completed or aborted are stored and billed but do not appear in object listings, and a lifecycle rule with AbortIncompleteMultipartUpload deletes them a set number of days after initiation, now and for future crashes. Transfer Acceleration speeds long-distance transfers through edge locations but does not raise the single-request size limit. Versioning keeps prior versions of completed objects and has no effect on incomplete uploads. Intelligent-Tiering applies to stored objects, and orphaned parts are not objects it can move.

Why A and D

API Gateway enforces mutual TLS on a Regional custom domain name that uses TLS 1.2, validating each client certificate during the handshake against a PEM truststore stored in Amazon S3, so the truststore with the private CA chain is the core step. Mutual TLS applies only to the custom domain, however, and the default execute-api hostname still accepts requests without a certificate, so disabling it closes the bypass. A stage client certificate is the certificate API Gateway presents to the backend integration, the opposite direction, and it authenticates nothing about the banks. A Lambda authorizer reading a certificate from a header proves nothing, because a header can carry any certificate without the private key that a TLS handshake requires. Edge-optimized custom domains do not support mutual TLS, so the change would remove the capability instead of adding it.

Why A

On-demand capacity mode is designed for unpredictable traffic: Kinesis manages the shards, accommodates up to double the peak write throughput seen in the previous 30 days and scales automatically within those bounds, and charges for data written and read rather than for provisioned shards, so no scaling jobs are needed. It does not promise zero throttling: a spike that more than doubles the prior peak within 15 minutes can still be throttled while capacity grows, so producers should keep retrying throttled writes. Provisioning 25 shards would cover the spikes but pays for idle shards most of the week and still leaves the team adjusting the count by hand as the game grows. Enhanced fan-out adds dedicated read throughput for consumers, while the errors here are on the write side. A constant partition key sends every record to a single shard, creating a hot shard and making throttling far worse.

Why D and E

A Regional custom domain name needs an ACM certificate in the same Region as the API, so a DNS-validated certificate in eu-west-1 lets API Gateway serve the partner hostname and hand the DNS team a target domain name for the alias record, and an API mapping routes the claims base path to the v1 stage, so the backend can later be remapped without partners noticing. A client certificate is what API Gateway presents to a backend so the backend can verify the caller; it cannot serve TLS for a custom hostname. A self-managed CloudFront distribution could front the API, but it needs a certificate in us-east-1, cache and origin settings and path handling, which is more to operate. Adding a claims resource changes the API's routes, not the hostname partners call.

Why C

CloudFront is a global service that reads ACM certificates only from US East (N. Virginia), so the certificate must be requested or imported in us-east-1; a DNS-validated ACM certificate there renews automatically as long as its validation record stays in place. The IAM certificate store does work with CloudFront, but it needs the private key, which ACM does not release for this certificate, and certificates in IAM never renew automatically. A certificate on a load balancer origin secures only the connection from CloudFront to the origin, and CloudFront refuses an alternate domain name unless the distribution has a certificate that covers it. ACM offers no resource policy that lets CloudFront read certificates from another Region, so the eu-west-1 certificate can never appear in the distribution settings.

Why C

ReceiveMessage returns message system attributes only when they are requested, so the worker must ask for AWSTraceHeader, pass its value through the AWS X-Ray propagator to rebuild the producer's trace context, and start the processing span with that context as its parent, after which the spans carry the producer's trace ID; only Lambda consumers get this propagation automatically. A 100 percent sampling rule records more worker traces, but each still starts with a new trace ID because no context is read from the message. An annotation holding the producer's trace ID makes the two traces findable together with a filter expression, yet they remain two traces. An X-Ray group filters which traces appear in its view and in its metrics; it does not merge segments from different traces.

Why C

An EventBridge API destination is a rule target for an HTTP endpoint: its connection handles authorization, including OAuth client credentials, by obtaining and refreshing the token and storing secrets in AWS Secrets Manager, and the API destination's invocation rate limit holds delivery at 20 requests per second while EventBridge retries failures and can send exhausted events to a dead-letter queue. No function code remains. An SNS HTTPS subscription can throttle delivery, but it cannot obtain or attach an OAuth client-credentials token. A Step Functions HTTP Task can authenticate through an EventBridge connection, but it adds a workflow per event and has no invocation rate limit, so bursts still exceed what the partner accepts. A queue drained by a capped function keeps all of the token, posting and retry code the team wants to remove, and concurrency does not translate into a requests-per-second limit.

Why B

A Regional endpoint is meant for clients in or near the API's Region: requests go straight to eu-central-1 without the AWS-managed CloudFront distribution, which removes the extra hop for a client base concentrated in one country. Edge-optimized endpoints help geographically dispersed clients by carrying their traffic over the AWS network from the nearest point of presence; for clients already next to the Region, that detour adds latency rather than removing it. A private endpoint is reachable only from a VPC through an interface VPC endpoint, so home gateways on consumer internet connections could not call it at all. Stage caching stores responses in the API's Region, not at edge locations, so it cannot remove the CloudFront hop and suits read traffic rather than writes of new readings.

Why C

With S3 Bucket Keys enabled, S3 obtains a short-lived bucket-level key from KMS and uses it to create the data keys for many objects, which AWS says can cut KMS request traffic and cost by up to 99 percent while the customer managed key and its key policy stay in charge; it is a bucket setting, so the uploading code does not change, and it applies to objects written after it is enabled. SSE-S3 removes the KMS requests by removing the customer managed key, which the security team has ruled out. A quota increase can stop the throttling, but every object would still cost a KMS request, so the bill would keep growing. DSSE-KMS performs more cryptographic work per object, and it does not support S3 Bucket Keys, so it would raise KMS usage rather than reduce it.

Why C

A Lambda function URL is a dedicated HTTPS endpoint built into the function, and with the AWS_IAM auth type Lambda rejects any request that is not SigV4-signed by a principal with permission. For callers in the same account, granting lambda:InvokeFunctionUrl and lambda:InvokeFunction in the task roles' identity policies is enough (function URLs created since October 2025 require both actions), so there is nothing else to deploy. An API Gateway REST API with IAM authorization also works, but it adds an API, stages and deployments that provide features the team said it does not need. A NONE function URL accepts requests from anyone who has the URL, and a hand-checked shared secret has to be stored, rotated and compared in code. An internal load balancer needs a VPC, a certificate and hourly charges, and it performs no IAM authentication.

Why A and C

Lambda advanced logging controls let the function configuration set the log format to JSON, which makes the Python runtime emit each logging call as a JSON object with level, message and request ID fields, and set an application log level, which Lambda enforces on supported runtime loggers without code changes; log-level filtering requires the JSON format, so both settings are needed. An environment variable named LOG_LEVEL does nothing unless code or a library reads it, and this handler reads nothing. The system log level filters the platform records Lambda itself writes, such as START and REPORT, and leaves application logs untouched. A subscription filter forwards matching events to a destination such as Kinesis or Lambda, while the log group still ingests and stores every DEBUG and INFO line.

Why C

Minimum healthy hosts is the number of instances that must stay available, and CodeDeploy deploys to as many instances at once as that floor allows, so 75 percent of 12 keeps 9 serving and updates up to 3 at a time, about four times faster than one at a time. HalfAtATime keeps only 50 percent healthy, so 6 instances could be out of service together, which breaks the 9-instance floor. AllAtOnce tries to update every instance in one pass, which can leave no instance serving behind the load balancer. A minimum healthy hosts value of 25 percent does not mean deploying to a quarter at a time; it lets CodeDeploy take up to 9 instances out of service together, leaving only 3 serving. OneAtATime meets the floor but is the slowest option.

Why A

Response streaming lets a function send its payload as it is produced: with the function URL invoke mode set to RESPONSE_STREAM and the handler wrapped in streamifyResponse on the Node.js managed runtime, each page of rows reaches the client immediately, improving time to first byte, and streamed responses can be up to 200 MB instead of the 6 MB buffered limit. After the first 6 MB, which streams without a bandwidth cap, the rate is capped at 2 MBps, so the first bytes arrive quickly while a 40 MB export still takes several more seconds to finish downloading. More memory adds CPU, but a buffered response is still limited to 6 MB, so 40 MB exports keep failing and users still wait for the whole file. Compressing the finished file still waits for the entire export and cannot guarantee that a large CSV shrinks below 6 MB. CloudFront caching helps only identical repeat requests, and each export is unique and still subject to the function's payload limit.

Why B

An asymmetric KMS key with the SIGN_VERIFY key usage keeps its private key inside the KMS hardware security modules, the Lambda function calls Sign on a digest of each document, and anyone holding the public key returned by GetPublicKey can verify the signature with standard cryptographic libraries and no AWS access. An HMAC key is symmetric and cannot be exported, so checking a tag requires calling VerifyMac in KMS, which brokers without AWS accounts or connectivity cannot do. Encrypting a hash with a symmetric key is not a signature scheme, and decrypting it would again require KMS access and the right to decrypt. Having brokers call Verify requires AWS credentials, network access and a grant, all of which they lack, even though the signing side of that design is correct.

Why A and E

SnapStart initializes the function when a version is published, snapshots the initialized execution environment, and resumes new environments from that snapshot, cutting framework start-up from seconds to as low as sub-second at no extra cost on Java runtimes; it works only on published versions and aliases that point to them. Because every environment resumes from the same memory, state created during initialization is shared, so an afterRestore runtime hook (the CRaC interface on Java) must reseed the generator and rebuild the connection pool after each restore. SnapStart cannot be enabled on $LATEST, so the unqualified ARN would get no benefit. SnapStart does not support provisioned concurrency. Moving the seeding and pool into static initialization puts them into the snapshot, which is exactly what makes references repeat across environments and connections go stale.

Why A

In QUEUED mode, available on V2 pipelines, a stage still processes one execution at a time, but waiting executions form a queue in arrival order and never overtake one that started earlier, so every revision and its migration is deployed in sequence. PARALLEL mode runs executions independently and at the same time, so two migrations could hit the same database concurrently and finish out of order. In SUPERSEDED mode, an execution waiting at a disabled transition can still be superseded by a newer one, so disabling the transition skips revisions in the same way. Moving the approval into its own stage only adds another place where executions wait between stages, and waiting executions in SUPERSEDED mode are exactly the ones a newer run replaces.

Why C

In the AWS Encryption SDK for JavaScript, data key caching wraps the KMS keyring in a NodeCachingMaterialsManager backed by a local cache, which reuses data keys within the maxAge and maxMessagesEncrypted thresholds set on it, so a 5-minute maximum age and a 10,000-message limit turn thousands of GenerateDataKey calls a second into a handful while the SDK still handles the envelope format. A quota increase removes the throttling but keeps one paid request per record, so the cost problem stays. Adaptive retries slow the function down until requests succeed; they do not remove any request, and at sustained peak load they add latency. A single data key generated at deployment has no age or message limit, sits in plaintext in the function configuration, and replaces the SDK with hand-written AES-GCM code, which breaks the agreed limits and adds custom cryptography.

Why B

Required concurrency is the request rate multiplied by the average duration in seconds, so 2,500 requests per second times 0.4 seconds is about 1,000 concurrent executions; added to the 150 the other functions use, that exceeds the default quota of 1,000, so the team must raise the quota first, and only then can reserved concurrency set aside capacity for geo-lookup while leaving the required 100 unreserved. Treating requests per second as concurrency ignores that each execution environment finishes a 400 ms request and takes another, serving 2.5 requests each second. Equating the duration in milliseconds with concurrency has no basis in the arithmetic. Dividing the rate by the duration inverts the formula and would provision six times the needed environments at a large standing cost.

Why A

A Query consumes read capacity for every item its key condition selects, and a FilterExpression is applied only afterward, so the current call reads and pays for 12 years of work orders and then discards most of them. Because openedAt is the sort key, a range condition on it belongs in the KeyConditionExpression, and DynamoDB then reads only the last 30 days of items for that vehicle. A ProjectionExpression trims the response, but capacity is still calculated on the full size of every item read. Limit caps the number of items evaluated before the filter runs, not the number of matches, so the dashboard would receive a partial page and need more calls. A Scan reads the entire table across every vehicle, which consumes far more capacity than even the current Query.

Why D

In a Lambda AppSpec file, the BeforeAllowTraffic hook runs after the new version is published but before the alias sends it any traffic, and the hook function reports Succeeded or Failed with PutLifecycleEventHookExecutionStatus, so a Failed status stops the deployment while the alias still points entirely at the old version. AfterAllowTraffic runs only after all traffic has shifted, so customers would already have hit the broken version. ValidateService is a lifecycle event of EC2 and on-premises deployments that runs scripts on instances; it does not exist in a Lambda AppSpec, and a Lambda hook signals its result through the API rather than an exit code. An alarm on the smoke-test function's errors still acts only through alarm-based rollback, which reacts after traffic shifting has begun.

Why D

Asymmetric KMS keys, like HMAC keys and keys in custom key stores, support neither automatic nor on-demand rotation, and a symmetric key with imported key material cannot auto-rotate either, so the documented method is manual rotation: create a new key of the same type and key usage, then repoint the alias with UpdateAlias, which the code already uses; publishing the new public key first and leaving the old one for at least 8 hours means every token in flight still verifies. Automatic rotation with a 365-day period can be enabled only on symmetric encryption keys with KMS-generated key material, so the request fails on this key. RotateKeyOnDemand is likewise limited to symmetric encryption keys and fails on an asymmetric one. Switching to a key ARN needs a configuration change and deployment, and removing the old public key at once makes every unexpired token signed with it fail verification for up to 8 hours.

Why D

DynamoDB writes an item into a global secondary index only when the item has the index key attributes, so adding reviewQueue and flaggedAt to flagged claims alone creates a sparse index holding just the 3,000 flagged items. A Query on the index with reviewQueue as partition key returns them sorted by flaggedAt, and deleting the attributes on clearance removes the claim from the index automatically. A GSI keyed on a status attribute present on every item replicates all 55 million claims, paying index storage and writes for every claim, with the CLEAR value forming one enormous partition. A local secondary index can only be created with the table and shares the claimId partition key, so it cannot list claims across the table. A stream-fed copy table works, but it adds a function, its error handling and a second table to keep consistent.

Why A

A content-hashed file name is a new object to every cache, so CloudFront and browsers fetch it on first request and can keep each version for a year, while the small index.html that names the current files is the only object that needs a short TTL, giving instant releases and a high hit ratio. An invalidation of /* removes objects from CloudFront edge caches only; browsers still hold app.js under its one-day lifetime, and every deployment also discards the whole edge cache. A TTL of 0 makes CloudFront go back to S3 on every request, which collapses the hit ratio and adds latency for the static files. A release query string changes nothing at the edge here, because the cache policy leaves query strings out of the cache key, so CloudFront keeps serving the old object.

Why C

Each layer version is immutable and has its own ARN, and a function configuration pins the exact version ARN it lists, so the functions must be updated to the version 9 ARN; because the aliases point to published versions, which freeze the layer list, the team must also publish new function versions and move the live aliases. Deleting version 8 only stops it from being added to new configurations, and functions that already use it keep working with their copy. Updating only $LATEST to the version 9 ARN fixes the unpublished configuration, but the live aliases still point at published versions whose layer list still names version 8, so production traffic keeps the bug. Lambda requires a versioned layer ARN in a function configuration, and there is no unversioned reference that resolves to the latest version automatically.

Why B

The AWS Parameters and Secrets Lambda Extension runs in the execution environment and serves secrets over a local HTTP endpoint on port 2773, authenticated with the X-Aws-Parameters-Secrets-Token header set from AWS_SESSION_TOKEN, and it caches each value for a default 300 seconds, so most invocations make no Secrets Manager call and a rotated password is picked up within 5 minutes. A dynamic reference resolves only when the stack deploys, stores the password in plaintext in the function configuration, and keeps the old value after rotation until the next deployment. Fetching the secret in initialization code calls Secrets Manager once per environment, but warm environments can live for hours and would keep using the old password after rotation. An ElastiCache cluster adds infrastructure and a network hop on every invocation, and it puts a copy of the secret in a second store to secure.

Why B

Write-through updates the cache in the same code path that writes the database, so a price change is visible to shoppers immediately, and keeping lazy loading for misses fills in anything not yet cached. Adding a TTL to every key bounds how long any entry can be stale if a write ever bypasses the cache, and lets records that are never read again, such as discontinued products, expire instead of accumulating. Lazy loading with a 5-minute TTL only shortens the stale window; shoppers can still see an old price for up to five minutes after every change. DynamoDB Accelerator is a write-through cache for DynamoDB tables only and cannot sit in front of an RDS for PostgreSQL database. Moving to Memcached on bigger nodes changes the engine and the capacity but neither the staleness nor the unbounded growth.