AWS Certified Developer – Associate — All Questions

A developer wants a Lambda function to reuse a database connection across invocations to reduce latency. Where should the connection be created?

• a.Inside the handler on every invocation
• b.Outside the handler, in the initialization code that runs once per execution environment✓
• c.In a separate Lambda layer that cannot run code
• d.In an environment variable

Code outside the handler runs once when the execution environment initializes and is reused across warm invocations, so creating the connection there avoids re-establishing it on every call. Creating it inside the handler would open a new connection each invocation. Layers package dependencies but do not execute standalone, and environment variables hold configuration, not live connections.

A team needs to fan out a single event to several independent microservices, each with its own processing logic. Which service is designed for this one-to-many delivery?

• a.Amazon SQS standard queue
• b.AWS Step Functions
• c.Amazon SNS✓
• d.Amazon Kinesis Data Firehose

Amazon SNS is a pub/sub service that fans out one published message to many subscribers such as multiple SQS queues or Lambda functions. A single SQS queue delivers each message to only one consumer. Step Functions orchestrates workflows, and Firehose loads streaming data to stores rather than fanning out events.

An application built on a FIFO SQS queue must ensure the same message is not processed twice when producers retry. Which feature prevents duplicates?

• a.Content-based or explicit message deduplication IDs on the FIFO queue✓
• b.Increasing the visibility timeout
• c.Enabling long polling
• d.Adding a dead-letter queue

FIFO queues use a message deduplication ID (supplied explicitly or derived from content) to discard duplicate sends within a five-minute window, guaranteeing exactly-once processing. Visibility timeout and long polling affect delivery timing, not duplicate detection, and a dead-letter queue only captures repeatedly failing messages.

A developer must store a database password so a Lambda function can retrieve it at runtime and have it rotated automatically. Which service best fits?

• a.Lambda environment variable in plaintext
• b.Amazon S3 object
• c.DynamoDB table
• d.AWS Secrets Manager✓

AWS Secrets Manager encrypts secrets with KMS and can automatically rotate database credentials on a schedule, which the function retrieves using its execution role. Plaintext environment variables and S3 or DynamoDB storage do not provide managed rotation and are less secure for credentials.

When calling AWS services from code running on an EC2 instance, what is the recommended way for the AWS SDK to obtain credentials?

• a.Hard-code access keys in the source
• b.Rely on the default credential provider chain, which uses the instance's IAM role✓
• c.Prompt the user to paste keys at startup
• d.Store keys in a public S3 bucket

The default credential provider chain automatically retrieves temporary, rotated credentials from the instance profile (IAM role) via the instance metadata service, so no long-lived keys are stored. Hard-coding or prompting for keys is insecure, and storing keys in a public bucket exposes them.