Least privilege limits each function or user to only the permissions required for its tasks.
Incorrect! Try again.
18Which AWS service is commonly used to monitor Lambda metrics and logs?
Applying Well-Architected principles to serverless architectures
Easy
A.Amazon Lightsail
B.Amazon AppStream 2.0
C.Amazon CloudWatch
D.AWS Direct Connect
Correct Answer: Amazon CloudWatch
Explanation:
Amazon CloudWatch collects Lambda metrics and logs to help monitor application behavior.
Incorrect! Try again.
19Which serverless pricing characteristic supports the Cost Optimization pillar?
Applying Well-Architected principles to serverless architectures
Easy
A.Buying servers in advance
B.Paying for idle capacity
C.Paying for actual usage
D.Maintaining unused hardware
Correct Answer: Paying for actual usage
Explanation:
Serverless services commonly charge according to actual requests and resource usage, reducing idle-capacity costs.
Incorrect! Try again.
20Which practice can improve the reliability of event-driven serverless processing?
Applying Well-Architected principles to serverless architectures
Easy
A.Disabling application logs
B.Ignoring all failed events
C.Using retries and dead-letter queues
D.Sending every event to one permanently running desktop computer
Correct Answer: Using retries and dead-letter queues
Explanation:
Retries handle temporary failures, while dead-letter queues preserve events that could not be processed successfully.
Incorrect! Try again.
21An image-processing workload receives unpredictable traffic spikes and remains idle for several hours each day. Which architecture best minimizes operational effort and idle cost?
Serverless and architectural considerations
Medium
A.Run AWS Lambda functions triggered by Amazon S3 events
B.Run a dedicated EC2 instance for each uploaded image
C.Run containers continuously on self-managed EC2 instances
D.Run a fixed-size Amazon EC2 Auto Scaling group
Correct Answer: Run AWS Lambda functions triggered by Amazon S3 events
Explanation:
Lambda scales in response to S3 events and charges primarily for requests and execution time, making it suitable for intermittent workloads.
Incorrect! Try again.
22A serverless shopping-cart function must preserve cart data across multiple invocations. Where should the application store this state?
Serverless and architectural considerations
Medium
A.In a larger Lambda deployment package that is updated after every request
B.In the function's global variables
C.In the function's temporary /tmp directory
D.In an external service such as Amazon DynamoDB
Correct Answer: In an external service such as Amazon DynamoDB
Explanation:
Lambda execution environments are ephemeral and may not be reused. Durable state should therefore be stored in an external service such as DynamoDB.
Incorrect! Try again.
23A synchronous serverless API has strict latency requirements, but users occasionally experience delays when new Lambda execution environments are created. Which change most directly reduces this issue?
Serverless and architectural considerations
Medium
A.Store the deployment package in Amazon EFS
B.Increase the API Gateway integration timeout
C.Increase reserved concurrency to a very high value so that every possible request receives a permanently active environment
D.Enable provisioned concurrency for the function
Correct Answer: Enable provisioned concurrency for the function
Explanation:
Provisioned concurrency keeps a specified number of Lambda environments initialized, reducing cold-start latency for synchronous requests.
Incorrect! Try again.
24An order API invokes a payment-processing component. Temporary payment-service failures must not cause orders to be lost, and the API should respond quickly. Which design is most appropriate?
Serverless and architectural considerations
Medium
A.Store pending orders only in Lambda environment variables
B.Call the payment service synchronously from the API
C.Retry the payment call continuously within the original API request
D.Place orders in Amazon SQS and process them asynchronously
Correct Answer: Place orders in Amazon SQS and process them asynchronously
Explanation:
SQS decouples the API from payment processing, preserves messages during temporary failures, and allows the API to return without waiting for payment completion.
Incorrect! Try again.
25A Lambda function must create thumbnails whenever users upload images to a specific Amazon S3 bucket. What is the most direct event configuration?
Building serverless applications with AWS Lambda
Medium
A.Configure an API Gateway route for every uploaded object
B.Configure an S3 object-created event to invoke the function
C.Configure Lambda to poll the S3 bucket every minute
D.Configure an EC2 scheduled task to scan S3 and submit each image to Lambda
Correct Answer: Configure an S3 object-created event to invoke the function
Explanation:
An S3 object-created event can invoke Lambda automatically when a new image is uploaded, avoiding polling and additional infrastructure.
Incorrect! Try again.
26An SQS-triggered Lambda function may receive the same message more than once. The function writes payment records to a database. Which implementation prevents duplicate charges?
Building serverless applications with AWS Lambda
Medium
A.Reduce the SQS message retention period
B.Use an idempotency key for each payment operation
C.Delete every message before the function begins processing it
D.Increase the Lambda function's memory allocation
Correct Answer: Use an idempotency key for each payment operation
Explanation:
SQS and Lambda provide at-least-once processing, so duplicate delivery is possible. An idempotency key ensures repeated processing has the same effect as one operation.
Incorrect! Try again.
27A Lambda function consumes records rapidly, but its relational database can handle only 50 simultaneous connections. Which configuration best protects the database?
Building serverless applications with AWS Lambda
Medium
A.Configure provisioned concurrency above 500 so all requests immediately obtain database connections
B.Set the function timeout to 50 seconds
C.Set the function's reserved concurrency to 50
D.Increase the function's ephemeral storage to 50 GB
Correct Answer: Set the function's reserved concurrency to 50
Explanation:
Reserved concurrency can cap the function's concurrent executions, limiting the number of simultaneous attempts to connect to the database.
Incorrect! Try again.
28A document workflow contains validation, approval, and notification Lambda functions. It needs branching, retries, and execution history. Which AWS service should coordinate the workflow?
Building serverless applications with AWS Lambda
Medium
A.AWS Step Functions
B.Amazon Route 53
C.Amazon Elastic Container Registry
D.AWS CloudFormation
Correct Answer: AWS Step Functions
Explanation:
Step Functions orchestrates multiple functions using state machines and supports branching, retries, error handling, and execution history.
Incorrect! Try again.
29A company wants to expose a Lambda function as a synchronous HTTPS endpoint that accepts POST requests. Which integration is most appropriate?
Extending functionality using Amazon API Gateway
Medium
A.An Amazon S3 event notification integrated with Lambda
B.An Amazon EventBridge scheduled rule integrated with Lambda
C.An Amazon CloudFront distribution that invokes the function without an HTTP API origin
D.An API Gateway route integrated with Lambda
Correct Answer: An API Gateway route integrated with Lambda
Explanation:
API Gateway can expose HTTPS routes, process POST requests, and synchronously invoke a Lambda function as the backend.
Incorrect! Try again.
30A mobile application receives JSON Web Tokens from an identity provider. The API must reject invalid tokens before invoking its Lambda backend. Which API Gateway feature should be used?
Extending functionality using Amazon API Gateway
Medium
A.A usage plan that validates token signatures and user claims inside each throttling rule
B.A JWT authorizer
C.A request mapping template
D.A stage variable
Correct Answer: A JWT authorizer
Explanation:
A JWT authorizer validates token signatures and claims at API Gateway before an authorized request reaches the Lambda integration.
Incorrect! Try again.
31A public REST API is overwhelming its backend during sudden traffic bursts. Which API Gateway configuration most directly limits the request rate reaching the backend?
Extending functionality using Amazon API Gateway
Medium
A.Configure stage-level throttling
B.Increase the integration timeout for every method
C.Add a custom domain name
D.Enable binary media support
Correct Answer: Configure stage-level throttling
Explanation:
Stage-level throttling sets request-rate and burst limits, helping protect backend services from excessive traffic.
Incorrect! Try again.
32A legacy backend expects a field named customer_id, but API clients send customerId. The backend code cannot be changed. Which API Gateway feature can adapt the request?
Extending functionality using Amazon API Gateway
Medium
A.A usage plan that stores both field names and synchronizes them with the legacy database
B.An integration request mapping template
C.An API Gateway edge-optimized endpoint
D.A Lambda reserved concurrency setting
Correct Answer: An integration request mapping template
Explanation:
An integration request mapping template can transform the incoming payload before API Gateway forwards it to the backend.
Incorrect! Try again.
33A team wants to run containerized microservices using Amazon ECS without provisioning or managing EC2 worker instances. Which compute option should it select?
Running microservices with AWS container services
Medium
A.Amazon EC2 Dedicated Hosts
B.AWS Fargate
C.AWS Lambda layers
D.Amazon EKS managed node groups with manually maintained worker nodes and operating systems
Correct Answer: AWS Fargate
Explanation:
Fargate provides serverless compute for ECS tasks, so the team does not need to provision or manage container hosts.
Incorrect! Try again.
34An organization has existing Kubernetes manifests and requires Kubernetes APIs for its containerized microservices. Which AWS service is the best fit?
Running microservices with AWS container services
Medium
A.Amazon Elastic Container Service configured without Kubernetes compatibility
B.Amazon Elastic Container Registry
C.Amazon Simple Queue Service
D.Amazon Elastic Kubernetes Service
Correct Answer: Amazon Elastic Kubernetes Service
Explanation:
Amazon EKS provides a managed Kubernetes control plane and supports standard Kubernetes APIs and manifests.
Incorrect! Try again.
35Three ECS services must share one public endpoint. Requests to /orders, /users, and /catalog must be sent to different services. Which component should perform this routing?
Running microservices with AWS container services
Medium
A.An Application Load Balancer with path-based rules
B.A Network Load Balancer with source-IP rules
C.An Amazon ECR repository with image-tag rules
D.An Amazon S3 bucket configured with a separate prefix for every container task
Correct Answer: An Application Load Balancer with path-based rules
Explanation:
An Application Load Balancer supports HTTP path-based routing and can forward each path to a different ECS target group.
Incorrect! Try again.
36An order microservice must notify an inventory microservice, but inventory updates can occur asynchronously. Which design best reduces tight coupling between the services?
Running microservices with AWS container services
Medium
A.Deploy both microservices in one container so they always scale and fail together
B.Call the inventory container by its current task IP
C.Publish inventory update messages to Amazon SQS
D.Store inventory updates in the order container's memory
Correct Answer: Publish inventory update messages to Amazon SQS
Explanation:
SQS provides asynchronous message delivery and buffers requests, allowing the two microservices to scale and recover independently.
Incorrect! Try again.
37Five Lambda functions currently share one IAM role with broad permissions. Which change best follows the security pillar of the AWS Well-Architected Framework?
Applying Well-Architected principles to serverless architectures
Medium
A.Store long-term IAM user credentials in environment variables
B.Use one shared role and add every permission that any future function might require
C.Assign all functions the AdministratorAccess policy
D.Assign each function a least-privilege IAM role
Correct Answer: Assign each function a least-privilege IAM role
Explanation:
Separate least-privilege roles reduce the permissions available to each function and limit the impact of a compromised component.
Incorrect! Try again.
38An asynchronously invoked Lambda function occasionally fails after all configured retries. The application must retain failed events for later investigation and reprocessing. What should be configured?
Applying Well-Architected principles to serverless architectures
Medium
A.A shorter CloudWatch Logs retention period
B.A larger Lambda deployment package
C.A higher API Gateway cache capacity that stores every failed asynchronous invocation
D.An on-failure destination or dead-letter queue
Correct Answer: An on-failure destination or dead-letter queue
Explanation:
An on-failure destination or dead-letter queue preserves events that could not be processed, supporting recovery and operational analysis.
Incorrect! Try again.
39A request passes through API Gateway and several Lambda functions. Operators need to identify where latency occurs across the complete request path. Which approach provides the most useful observability?
Applying Well-Architected principles to serverless architectures
Medium
A.Increase every function's timeout to the maximum
B.Write all diagnostic data to local /tmp directories and retrieve it after execution
C.Enable AWS X-Ray tracing and propagate correlation identifiers
D.Inspect only the final function's CloudWatch log stream
Correct Answer: Enable AWS X-Ray tracing and propagate correlation identifiers
Explanation:
Distributed tracing and correlation identifiers connect activity across services, helping operators locate latency and failures in an end-to-end request.
Incorrect! Try again.
40A Lambda function has been assigned 3,008 MB of memory, but monitoring shows low CPU use and short, simple executions. Which action best supports cost optimization without assuming that the smallest memory setting is ideal?
Applying Well-Architected principles to serverless architectures
Medium
A.Test multiple memory sizes and compare cost-duration results
B.Immediately set memory to the minimum supported value
C.Move the function to a permanently running EC2 instance
D.Keep the current memory because Lambda pricing is based only on request count and not execution resources
Correct Answer: Test multiple memory sizes and compare cost-duration results
Explanation:
Lambda memory also affects CPU allocation and execution time. Testing several configurations identifies the best balance between duration, performance, and cost.
Incorrect! Try again.
41An order service writes an order to DynamoDB and then publishes an OrderCreated event to EventBridge. A process failure between these operations sometimes leaves orders without events. Which design most reliably eliminates this dual-write inconsistency?
Serverless and architectural considerations
Hard
A.Retry both operations from the Lambda function until DynamoDB and EventBridge return successful responses
B.Publish the event first, then write the order after EventBridge confirms that all targets accepted it
C.Write the order and an outbox item in one DynamoDB transaction, then relay outbox records through DynamoDB Streams
D.Place the DynamoDB write and EventBridge call in parallel branches of an AWS Step Functions workflow
Correct Answer: Write the order and an outbox item in one DynamoDB transaction, then relay outbox records through DynamoDB Streams
Explanation:
The transactional outbox pattern atomically persists the business change and event intent. DynamoDB Streams can then relay the event with idempotent processing, avoiding an unsafe cross-service dual write.
Incorrect! Try again.
42A workload maintains thousands of long-lived bidirectional connections, performs steady CPU-intensive processing continuously, and has highly predictable 24-hour utilization. Which architecture is the strongest default choice?
Serverless and architectural considerations
Hard
A.Invoke Lambda through EventBridge every minute and reconstruct all connection state from DynamoDB
B.Run each connection in Lambda and renew the execution before the maximum duration is reached
C.Run the workload as long-running ECS services and scale tasks around sustained capacity requirements
D.Use API Gateway REST APIs with Lambda proxy integrations for every bidirectional connection
Correct Answer: Run the workload as long-running ECS services and scale tasks around sustained capacity requirements
Explanation:
Long-lived connections and sustained CPU utilization favor container services. Lambda execution limits and repeated state reconstruction make it a poor fit for continuously running connection-oriented processing.
Incorrect! Try again.
43A multi-tenant event processor has one high-volume tenant that can exhaust concurrency and delay events for premium tenants. Which redesign provides the strongest workload-level bulkhead isolation?
Serverless and architectural considerations
Hard
A.Place every tenant on one FIFO queue and use the tenant identifier as the message group ID
B.Route tenant classes to separate queues and functions, then assign reserved concurrency to each function
C.Store tenant priorities in DynamoDB and let every invocation inspect them before processing
D.Increase the shared function's memory and configure one account-wide concurrency alarm
Correct Answer: Route tenant classes to separate queues and functions, then assign reserved concurrency to each function
Explanation:
Separate queues and functions create independent backlogs, while reserved concurrency prevents one class from consuming capacity allocated to another. FIFO message groups preserve ordering but do not provide concurrency bulkheads.
Incorrect! Try again.
44One domain event must be consumed independently by billing, analytics, and notification services. A failure or slowdown in analytics must not delay the other consumers. Which topology best satisfies this requirement?
Serverless and architectural considerations
Hard
A.Publish to one SQS queue and let all three consumers compete for messages from that queue
B.Invoke the three services sequentially from a single Lambda function and retry the entire sequence
C.Publish to an SNS topic with a separate SQS queue and dead-letter queue for each consumer
D.Store events in one DynamoDB item that each consumer updates after completing its work
Correct Answer: Publish to an SNS topic with a separate SQS queue and dead-letter queue for each consumer
Explanation:
SNS provides fan-out, and a queue per consumer isolates buffering, retries, scaling, and failures. A shared queue distributes messages among consumers rather than delivering every event to each consumer.
Incorrect! Try again.
45A Lambda event source mapping reads SQS messages in batches of 10. If one message fails, nine successful messages are repeatedly processed with the retried batch. Which change minimizes redundant work without assuming exactly-once delivery?
Building serverless applications with AWS Lambda
Hard
With ReportBatchItemFailures, Lambda retries only the reported SQS messages. Idempotency remains necessary because SQS and Lambda event source mappings can still deliver duplicates.
Incorrect! Try again.
46A Lambda function consumes a Kinesis shard in order. One malformed record repeatedly fails its batch and prevents later records in the shard from being processed. Which configuration best limits the blockage while preserving recovery evidence?
Building serverless applications with AWS Lambda
Hard
A.Enable batch bisection, configure finite retry or record-age limits, and send discarded failures to a destination
B.Increase the batch size, configure unlimited retries, and raise reserved concurrency for the function
C.Increase ParallelizationFactor and allow later batches to commit before every earlier batch succeeds
D.Disable stream retries and configure the Lambda function's asynchronous dead-letter queue
Correct Answer: Enable batch bisection, configure finite retry or record-age limits, and send discarded failures to a destination
Explanation:
Batch bisection isolates the poison record, while bounded retries or record age eventually unblock the shard. An event source mapping failure destination preserves information for investigation and recovery.
Incorrect! Try again.
47An AWS account has a Lambda regional concurrency quota of 1,000. Function A is assigned reserved concurrency of 400 but currently uses only 100. Function B has no reserved concurrency. Ignoring burst-rate limits and other functions, what is Function B's maximum concurrency?
Building serverless applications with AWS Lambda
Hard
A.500, because Lambda always retains half of regional concurrency for unreserved functions
B.1,000, because reserved concurrency limits Function A but does not reserve regional capacity
C.600, because Function A's reserved allocation is removed from the shared unreserved pool
D.900, because Function A currently consumes only 100 of the regional concurrency quota
Correct Answer: 600, because Function A's reserved allocation is removed from the shared unreserved pool
Explanation:
Reserved concurrency both caps a function and reserves capacity for it. Function A's full allocation of 400 is unavailable to unreserved functions, leaving for Function B.
Incorrect! Try again.
48A team needs to shift 10% of production traffic to a new Lambda release and automatically return all traffic to the previous release when a CloudWatch alarm enters ALARM. Which deployment mechanism is most appropriate?
Building serverless applications with AWS Lambda
Hard
A.Create two reserved-concurrency settings and let API Gateway alternate between function names
B.Publish immutable versions, route through a weighted alias, and use CodeDeploy alarm-based rollback
C.Update the unpublished $LATEST version in place and configure Route 53 weighted records
D.Upload both packages to one function and select the package through an environment variable
Correct Answer: Publish immutable versions, route through a weighted alias, and use CodeDeploy alarm-based rollback
Explanation:
Lambda aliases can split traffic between immutable versions. CodeDeploy supports canary or linear traffic shifting and can roll back the alias when configured CloudWatch alarms fire.
Incorrect! Try again.
49An API Gateway REST API caches GET /profile, whose response depends on the authenticated user. The method path and query string are identical for all users. Which configuration prevents one user's cached profile from being returned to another user while retaining caching?
Extending functionality using Amazon API Gateway
Hard
A.Reduce the cache TTL and rely on token expiration to prevent cross-user cache responses
B.Add the validated Authorization header to the method's cache key and keep authorization enabled
C.Use the stage name as the only cache key and create a deployment whenever a user signs in
D.Encrypt cached responses with the API Gateway stage key and share one cache entry among users
Correct Answer: Add the validated Authorization header to the method's cache key and keep authorization enabled
Explanation:
User-dependent inputs must participate in the cache key. Using the validated authorization value isolates cached entries, although a stable trusted user identifier may provide better cache efficiency when available.
Incorrect! Try again.
50An API operation starts a report that can require several minutes. Clients currently keep an API Gateway request open until a Lambda workflow finishes, causing integration timeouts and retries. Which API design is most resilient?
Extending functionality using Amazon API Gateway
Hard
A.Stream periodic whitespace from Lambda through the REST integration until report generation completes
B.Increase client timeouts indefinitely and repeatedly invoke the synchronous API until one request succeeds
C.Return 202 Accepted with an operation ID, start work asynchronously, and expose a status endpoint
D.Return 200 OK immediately, continue processing in the same Lambda invocation, and omit job status
Correct Answer: Return 202 Accepted with an operation ID, start work asynchronously, and expose a status endpoint
Explanation:
The asynchronous request-reply pattern decouples API latency from long-running work. An operation resource supports polling, callbacks, retries, and explicit job-state management.
Incorrect! Try again.
51A Lambda proxy integration completes successfully but returns { "result": "ok" } directly. API Gateway responds to the client with 502 Bad Gateway. What is the most likely correction?
Extending functionality using Amazon API Gateway
Hard
A.Return the same object after adding an API key and an IAM execution-role identifier
B.Base64-encode the entire Lambda invocation result and place it in a response header
C.Configure API Gateway to interpret every successful Lambda invocation as an HTTP 200 response
D.Return a proxy response containing statusCode, optional headers, and a string-valued body
Correct Answer: Return a proxy response containing statusCode, optional headers, and a string-valued body
Explanation:
Lambda proxy integrations require a specific response envelope. A malformed output, even from a successful invocation, causes API Gateway to return a 502 response.
Incorrect! Try again.
52An HTTP API exposes routes to OAuth 2.0 clients. Only tokens with the orders.write scope may call POST /orders, and the Lambda function must not be directly invocable by unrelated AWS resources. Which design best meets both requirements?
Extending functionality using Amazon API Gateway
Hard
A.Use an API key with a usage plan and grant the Lambda function a broad service-principal permission
B.Validate the token only inside Lambda and allow invocation from every API Gateway API in the account
C.Use a JWT authorizer with route scopes and restrict Lambda invocation permission by API execution ARN
D.Use CORS allowed origins as authorization and restrict Lambda invocation by the client's source IP
Correct Answer: Use a JWT authorizer with route scopes and restrict Lambda invocation permission by API execution ARN
Explanation:
A JWT authorizer validates issuer, audience, signature, and required route scopes. A Lambda resource-based permission constrained by the API's execution ARN reduces unintended direct invocation.
Incorrect! Try again.
53ECS tasks on Fargate run in private subnets without public IP addresses. They must pull private ECR images and send logs to CloudWatch Logs without using a NAT gateway. Which endpoint set is required for this path?
Running microservices with AWS container services
Hard
A.An ECS interface endpoint, a DynamoDB gateway endpoint, and an EventBridge interface endpoint
B.ECR API and ECR Docker interface endpoints, an S3 gateway endpoint, and a CloudWatch Logs interface endpoint
C.Only an ECR API interface endpoint, because ECR returns image layers and forwards logs automatically
D.Only an S3 gateway endpoint, because Fargate proxies all control-plane and logging traffic through S3
Correct Answer: ECR API and ECR Docker interface endpoints, an S3 gateway endpoint, and a CloudWatch Logs interface endpoint
Explanation:
Private ECR pulls require ECR API and Docker registry connectivity, while image layers are retrieved through S3. The awslogs driver also needs connectivity to CloudWatch Logs.
Incorrect! Try again.
54An ECS Fargate task has an application container reserving 512 CPU units and 1,024 MiB, plus a sidecar reserving 256 CPU units and 512 MiB. What is the smallest listed valid task size that can satisfy the combined reservations?
Running microservices with AWS container services
Hard
A.0.5 vCPU and 2 GiB
B.1 vCPU and 1 GiB
C.2 vCPU and 4 GiB
D.1 vCPU and 2 GiB
Correct Answer: 1 vCPU and 2 GiB
Explanation:
The containers require 768 CPU units and 1,536 MiB in total. A 0.5-vCPU task provides only 512 CPU units, while the valid 1-vCPU and 2-GiB combination satisfies both totals.
Incorrect! Try again.
55An ECS worker service processes an SQS queue. Message arrival rates vary sharply, and processing time per message is approximately stable. CPU utilization remains low even when the queue is growing. Which scaling signal best reflects required capacity?
Running microservices with AWS container services
Hard
A.A target-tracking metric based on visible queue messages divided by the number of running tasks
B.A scheduled policy that doubles desired count at the beginning of every hour regardless of backlog
C.A target-tracking metric based only on the average CPU utilization of the ECS cluster instances
D.A deployment policy based on the percentage of healthy targets registered with the load balancer
Correct Answer: A target-tracking metric based on visible queue messages divided by the number of running tasks
Explanation:
Backlog per task represents the amount of queued work each worker must absorb. CPU can remain low for I/O-bound processing and therefore may not track service latency or queue growth.
Incorrect! Try again.
56An ECS service uses Fargate and awsvpc networking with an Application Load Balancer. Tasks receive dynamically allocated private IP addresses. Which target group configuration is required?
Running microservices with AWS container services
Hard
A.Use target type alb and register the ECS service discovery namespace as the downstream load balancer
B.Use target type instance and register the Fargate infrastructure hosts in the target group
C.Use target type ip and allow ECS to register each task's elastic network interface address
D.Use target type lambda and configure each task as a Lambda-compatible invocation target
Correct Answer: Use target type ip and allow ECS to register each task's elastic network interface address
Explanation:
Fargate tasks using awsvpc have their own elastic network interfaces and are registered by IP address. The underlying infrastructure instances are not exposed for instance target registration.
Incorrect! Try again.
57Critical and best-effort Lambda workloads share an account. During traffic spikes, best-effort invocations consume all unreserved concurrency and throttle the critical function. Which Lambda control most directly creates a concurrency bulkhead?
Applying Well-Architected principles to serverless architectures
Hard
A.Increase the best-effort function's timeout and configure both functions with identical memory
B.Assign reserved concurrency to the critical function and cap the best-effort function's reserved allocation
C.Place both functions behind one alias and distribute traffic using equal alias weights
D.Enable provisioned concurrency only for the best-effort function during peak traffic periods
Correct Answer: Assign reserved concurrency to the critical function and cap the best-effort function's reserved allocation
Explanation:
Reserved concurrency guarantees capacity for the critical function and can cap the best-effort workload. Provisioned concurrency reduces cold starts but does not by itself provide the required cross-workload isolation.
Incorrect! Try again.
58A Lambda function uses 1 GiB and averages 900 ms per invocation. Testing shows that 2 GiB reduces average duration to 430 ms with the same request count and result. Ignoring free tier and architecture-specific price differences, which configuration has lower duration-based compute usage?
Applying Well-Architected principles to serverless architectures
Hard
A.Both configurations, because Lambda charges only for invocation count and not allocated memory
B.The 1-GiB configuration, because GB-s per invocation
C.Neither configuration, because increasing Lambda memory always doubles total invocation cost
D.The 2-GiB configuration, because GB-s per invocation
Correct Answer: The 2-GiB configuration, because GB-s per invocation
Explanation:
Duration-based usage is allocated memory multiplied by execution time. The tested values are 0.86 GB-s versus 0.90 GB-s, so the larger setting is slightly cheaper and also faster.
Incorrect! Try again.
59A Lambda function needs a rotating database password. The password is currently stored in an encrypted environment variable, but rotations still require function configuration updates. Which design best follows the security pillar?
Applying Well-Architected principles to serverless architectures
Hard
A.Store the password in Secrets Manager, grant narrowly scoped access, and use rotation-aware local caching
B.Store the password in a DynamoDB item readable by every function role in the AWS account
C.Store the password in Lambda layer code and publish a new layer whenever the password rotates
D.Store the password in an API Gateway stage variable and let Lambda read it from each request
Correct Answer: Store the password in Secrets Manager, grant narrowly scoped access, and use rotation-aware local caching
Explanation:
Secrets Manager centralizes retrieval and rotation, while least-privilege IAM limits access. Rotation-aware caching reduces latency and API calls without embedding the secret in deployment configuration.
Incorrect! Try again.
60A request travels through API Gateway, Lambda, SQS, another Lambda function, and an ECS service. Operators cannot connect failures in the final service to the initiating request. Which observability design best addresses this gap?
Applying Well-Architected principles to serverless architectures
Hard
A.Use one CloudWatch alarm for total account errors and omit identifiers to reduce log storage costs
B.Record only API Gateway access logs because downstream services can reconstruct every internal transition
C.Increase log retention for every service but continue writing unrelated unstructured text messages
D.Propagate a correlation identifier through messages, emit structured logs, enable tracing, and publish service-level metrics
Correct Answer: Propagate a correlation identifier through messages, emit structured logs, enable tracing, and publish service-level metrics
Explanation:
Correlation identifiers connect asynchronous boundaries where trace continuity may be incomplete. Structured logs, distributed tracing, and service-level metrics together support diagnosis, alerting, and end-to-end operational visibility.
Incorrect! Try again.
Did this save you a night before the exam?
LPU Notes is free, and it stays free. Ads cover part of the server bill.
The rest comes out of a student's own pocket: the domain, the storage,
and keeping the site up through the weeks everyone needs it at once.
The payment button didn't load. An ad blocker or a filtered network is the usual reason.
to try again.
Nothing here is ever locked, and nothing unlocks. Chip in only if it was worth it.
What it pays for →