AWS Certified Developer – Associate — All Questions

A developer wants a Lambda function to reuse a database connection across invocations to reduce latency. Where should the connection be created?

• a.Inside the handler on every invocation
• b.Outside the handler, in the initialization code that runs once per execution environment✓
• c.In a separate Lambda layer that cannot run code
• d.In an environment variable

Code outside the handler runs once when the execution environment initializes and is reused across warm invocations, so creating the connection there avoids re-establishing it on every call. Creating it inside the handler would open a new connection each invocation. Layers package dependencies but do not execute standalone, and environment variables hold configuration, not live connections.

A team needs to fan out a single event to several independent microservices, each with its own processing logic. Which service is designed for this one-to-many delivery?

• a.Amazon SQS standard queue
• b.AWS Step Functions
• c.Amazon SNS✓
• d.Amazon Kinesis Data Firehose

Amazon SNS is a pub/sub service that fans out one published message to many subscribers such as multiple SQS queues or Lambda functions. A single SQS queue delivers each message to only one consumer. Step Functions orchestrates workflows, and Firehose loads streaming data to stores rather than fanning out events.

An application built on a FIFO SQS queue must ensure the same message is not processed twice when producers retry. Which feature prevents duplicates?

• a.Content-based or explicit message deduplication IDs on the FIFO queue✓
• b.Increasing the visibility timeout
• c.Enabling long polling
• d.Adding a dead-letter queue

FIFO queues use a message deduplication ID (supplied explicitly or derived from content) to discard duplicate sends within a five-minute window, guaranteeing exactly-once processing. Visibility timeout and long polling affect delivery timing, not duplicate detection, and a dead-letter queue only captures repeatedly failing messages.

A developer must store a database password so a Lambda function can retrieve it at runtime and have it rotated automatically. Which service best fits?

• a.Lambda environment variable in plaintext
• b.Amazon S3 object
• c.DynamoDB table
• d.AWS Secrets Manager✓

AWS Secrets Manager encrypts secrets with KMS and can automatically rotate database credentials on a schedule, which the function retrieves using its execution role. Plaintext environment variables and S3 or DynamoDB storage do not provide managed rotation and are less secure for credentials.

When calling AWS services from code running on an EC2 instance, what is the recommended way for the AWS SDK to obtain credentials?

• a.Hard-code access keys in the source
• b.Rely on the default credential provider chain, which uses the instance's IAM role✓
• c.Prompt the user to paste keys at startup
• d.Store keys in a public S3 bucket

The default credential provider chain automatically retrieves temporary, rotated credentials from the instance profile (IAM role) via the instance metadata service, so no long-lived keys are stored. Hard-coding or prompting for keys is insecure, and storing keys in a public bucket exposes them.

An application needs to let thousands of end users sign in with email or their Google account and then call AWS APIs with scoped permissions. Which combination is appropriate?

• a.Create one IAM user per end user
• b.Use an IAM role shared by all users with wildcard permissions
• c.Amazon Cognito user pools for sign-in plus identity pools to obtain temporary IAM credentials✓
• d.Embed root account credentials in the app

Cognito user pools handle sign-up and sign-in (including social federation) and issue tokens; identity pools exchange those tokens for temporary, scoped IAM credentials. Creating an IAM user per person does not scale, a shared wildcard role violates least privilege, and root credentials must never be embedded.

A developer wants every use of an encryption key to be auditable in CloudTrail and to control the key's rotation policy. Which S3 encryption option meets this?

• a.SSE-KMS with a customer managed key✓
• b.SSE-S3 with Amazon S3 managed keys
• c.No encryption with a restrictive bucket policy
• d.Client-side encryption with a static hard-coded key

A customer managed KMS key lets you set rotation and key policies and logs each encrypt/decrypt call in CloudTrail. SSE-S3 encrypts data but exposes no control or visibility over the key. A bucket policy does not encrypt data, and a hard-coded static key is insecure and unauditable.

A Lambda function returns AccessDenied when writing to a DynamoDB table. Assuming the table exists, what is the most likely cause?

• a.The function timeout is too low
• b.The execution role lacks a policy granting dynamodb:PutItem on the table✓
• c.DynamoDB is in a different Availability Zone
• d.The function memory is undersized

AccessDenied indicates the execution role does not grant the required action (for example dynamodb:PutItem) on the table's ARN. Timeout and memory affect performance, not authorization, and DynamoDB is a regional service, so Availability Zones are not a factor.

How should a developer protect data in transit between a client and an API hosted on API Gateway?

• a.Disable encryption to reduce latency
• b.Use a self-signed certificate over HTTP
• c.Rely on security groups only
• d.Require HTTPS/TLS so traffic is encrypted end to end✓

Requiring HTTPS/TLS encrypts data in transit and is the standard for protecting API traffic; API Gateway endpoints use TLS by default. Disabling encryption or using plain HTTP exposes data, and security groups control network reachability, not encryption of the payload.

A developer needs to grant a container running as an ECS task permission to read from a specific S3 bucket. What is the recommended mechanism?

• a.Bake access keys into the container image
• b.Use the EC2 instance role for all tasks
• c.Assign an ECS task role scoped to the required bucket and actions✓
• d.Make the bucket public

An ECS task role provides temporary credentials scoped to just that task, following least privilege. Baking keys into an image leaks them, sharing the instance role over-grants to every task on the host, and making the bucket public removes access control entirely.

A team wants to shift 10% of production traffic to a new Lambda version, then automatically roll back if a CloudWatch alarm fires. Which approach achieves this?

• a.Manually edit the function code in the console
• b.Use a CodeDeploy canary deployment with a Lambda alias and rollback on alarm✓
• c.Delete the old version before deploying
• d.Increase the function timeout

CodeDeploy's canary (or linear) deployment configurations shift a small percentage of traffic to the new version behind an alias and roll back automatically when a specified CloudWatch alarm triggers. Manual edits, deleting the old version, or changing timeouts do not provide controlled traffic shifting or automatic rollback.

Which file tells AWS CodeBuild the commands to run in each build phase and which artifacts to output?

• a.buildspec.yml✓
• b.appspec.yml
• c.Dockerfile
• d.template.yaml

CodeBuild reads buildspec.yml to run install, pre_build, build, and post_build phases and to declare output artifacts. appspec is used by CodeDeploy, a Dockerfile builds container images, and template.yaml is a SAM/CloudFormation template.

A developer wants to define a serverless application (Lambda, API Gateway, DynamoDB) with concise templates that can be tested locally. Which tool is designed for this?

• a.Amazon Inspector
• b.AWS Config
• c.AWS Serverless Application Model (SAM)✓
• d.Amazon Athena

AWS SAM extends CloudFormation with shorthand for serverless resources and offers the SAM CLI for local build and test. Inspector assesses security, Config tracks resource configuration, and Athena queries data in S3.

Why should Lambda deployments use published versions with an alias rather than always deploying to $LATEST?

• a.$LATEST runs faster
• b.Aliases reduce cold starts
• c.Versions cost less to invoke
• d.Immutable versions let you point a stable alias and roll back instantly by moving it✓

Published versions are immutable snapshots; an alias points to a version, so rolling back is as simple as moving the alias to a previous version. This gives predictable releases and fast rollback. Aliases and versions do not change execution speed, cold starts, or invocation cost.

A developer needs to see how a single request flows across API Gateway, Lambda, and DynamoDB to find where latency is introduced. Which service provides this end-to-end view?

• a.Amazon CloudWatch Logs alone
• b.AWS X-Ray✓
• c.AWS CloudTrail
• d.Amazon Macie

AWS X-Ray traces a request across services and produces a service map showing latency and errors at each hop. CloudWatch Logs stores log text but does not stitch a trace together, CloudTrail records API management events for auditing, and Macie discovers sensitive data in S3.

An application repeatedly receives ProvisionedThroughputExceededException from DynamoDB during traffic spikes. Which is an appropriate first response in code?

• a.Implement exponential backoff with jitter on retries✓
• b.Delete and recreate the table
• c.Switch to a Scan instead of a Query
• d.Disable encryption on the table

The exception signals throttling; retrying with exponential backoff and jitter (which the SDK does by default) smooths spikes, and switching to on-demand or higher provisioned capacity helps for sustained load. Recreating the table, using a costlier Scan, or disabling encryption do not address throttling.

A read-heavy application needs microsecond response times for cached DynamoDB reads without changing much application logic. Which service fits best?

• a.Amazon ElastiCache for Memcached
• b.Amazon S3
• c.DynamoDB Accelerator (DAX)✓
• d.Amazon Redshift

DAX is a fully managed, DynamoDB-compatible in-memory cache that returns cached reads in microseconds with minimal code changes. ElastiCache requires more integration work, S3 is object storage, and Redshift is a data warehouse for analytics.

To make Lambda logs easy to query for specific fields in CloudWatch Logs Insights, what should the developer do?

• a.Log everything as a single long string
• b.Disable logging to save cost
• c.Log only error messages
• d.Emit structured JSON log entries with consistent field names✓

Structured JSON logs let CloudWatch Logs Insights parse and filter by field, making troubleshooting far easier. Unstructured strings are hard to query, disabling logging removes visibility, and logging only errors hides the context needed to diagnose issues.

When designing a DynamoDB table, why is choosing a high-cardinality partition key important?

• a.It distributes reads and writes evenly and avoids hot partitions✓
• b.It reduces the cost per gigabyte stored
• c.It enables strongly consistent reads automatically
• d.It removes the need for a sort key

A high-cardinality partition key spreads traffic across many partitions, preventing a single hot partition that would throttle. It does not change storage pricing, does not set consistency (which is chosen per request), and is unrelated to whether a sort key is needed.

A developer must query a DynamoDB table by an attribute that is not the primary key. What should they create?

• a.A DynamoDB Stream
• b.A second table copied nightly
• c.A global secondary index on that attribute✓
• d.A CloudFront distribution

A global secondary index lets you query on a non-key attribute efficiently. Streams emit change events, a nightly copy would be stale and costly, and CloudFront is a content delivery network unrelated to querying items.

An application must guarantee it reads the most recent write immediately after updating an item in DynamoDB. What should it request?

• a.A Scan operation
• b.A strongly consistent read✓
• c.A global secondary index query
• d.A batch write

By default DynamoDB reads are eventually consistent; requesting a strongly consistent read returns the latest committed data. A Scan reads the whole table, a GSI is only eventually consistent, and batch writes are for writing, not reading.

A developer wants separate dev and prod configurations for the same API Gateway API without redeploying different code. Which feature supports this?

• a.A single stage for all environments
• b.Hard-coded backend URLs
• c.One API per environment only
• d.Stages with stage variables✓

API Gateway stages represent deployments such as dev and prod, and stage variables parameterize integrations (for example pointing to different Lambda aliases) without code changes. A single stage or hard-coded URLs cannot separate environments cleanly, and creating entirely separate APIs is unnecessary duplication.