Practice Test #4

Changing from Regional to Edge-Optimized affects how clients reach API Gateway (CloudFront distribution in front) and can improve latency for global users, but it does not change the required Lambda proxy response format. Endpoint type mismatches or CloudFront issues typically show different symptoms (DNS/403/5xx at edge), not a consistent 502 caused by a malformed integration response after Lambda succeeds. Trap: It may look tempting because it uses Change the API Gateway endpoint type from Regional, but the decisive requirement is a response object with statusCode, headers, and a string body.

For a GET /shipments/{trackingId}, there is typically no request body. The request clearly reached API Gateway and invoked the Lambda function (as evidenced by Lambda logs). A malformed client payload would more likely cause a 400 (bad request) or mapping/template errors before invocation, not a 502 after Lambda returns. The core issue is the response format, not the request. Trap: It may look tempting because it uses Change the format of the client request payload, but the decisive requirement is a response object with statusCode, headers, and a string body.

Authorization issues (missing/invalid credentials) are handled by API Gateway before invoking Lambda and typically result in 401 Unauthorized or 403 Forbidden, not a 502. The evidence shows Lambda was invoked and completed successfully, so the request was authorized to reach the integration. The problem occurs when API Gateway tries to interpret the Lambda output, not when authenticating the caller. Trap: It may look tempting because it uses Change the Authorization header in the request to, but the decisive requirement is a response object with statusCode, headers, and a string body.

A Lambda alias points traffic to a version; it does not make CloudFormation fetch a new ZIP from S3. Trap: Aliases are useful for deployments, so they look related, but they do not solve S3 artifact change detection.

A different bucket is unnecessary unless the template also changes; the key/version reference is the actual trigger. Trap: Moving artifacts can appear to force a redeploy, but the core requirement is a template-visible Code change.

Code signing verifies trusted packages but does not cause CloudFormation to redeploy an unchanged S3 reference. Trap: It is a deployment security feature, not a change-detection mechanism.

Incorrect. AuthType=NONE allows anonymous invocation, directly violating the requirement to block anonymous access. Also, it suggests creating a resource-based policy and attaching it to an IAM group, which is not how resource policies work. Resource-based policies are attached to the resource (the Lambda function) and specify principals; they are not attached to IAM groups. Trap: It is tempting because it mentions Write a CLI script that adds a Lambda, but the scenario points to AWS_IAM function URLs plus one scalable identity-based IAM policy.

Incorrect. While AWS_IAM is the right auth type, creating 340 separate identity-based policies is unnecessary operational overhead and not a best-practice scalable approach. Additionally, identity-based policies do not grant access "from a group ARN" as a condition in the way implied; you attach the policy to the group (or users/roles), not reference the group as a principal. Trap: It is tempting because it mentions Write a CLI script that adds a Lambda, but the scenario points to AWS_IAM function URLs plus one scalable identity-based IAM policy.

Incorrect. AuthType=NONE permits anonymous access, failing the core security requirement. It also proposes adding a resource-based policy per function with the QA-Reviewers group ARN as principal. IAM groups are not valid principals in resource-based policies; you would need to specify roles/users/accounts. This option is both insecure and technically flawed. Trap: It is tempting because it mentions Write a CLI script that adds a Lambda, but the scenario points to AWS_IAM function URLs plus one scalable identity-based IAM policy.

Incorrect. Lambda can certainly return mocked JSON and varied HTTP status codes, but it introduces compute cost (Lambda invocations), operational overhead (code packaging, IAM, logging), and potentially VPC configuration later. The requirement explicitly states “no backend integration and no compute/VPC costs,” which MOCK integration satisfies more directly than Lambda proxy integration. Trap: It may sound plausible because it mentions Author an AWS Lambda function that returns mocked payloads and various HTTP status codes, integrate the methods with Lambda using AWS_PROXY, and deploy the API, but it does not satisfy the scenario's backend-free api mock requirement.

Incorrect. EC2 behind an ALB adds unnecessary infrastructure, cost, patching/maintenance, scaling considerations, and longer setup time. It violates the requirement for no compute costs and is not aligned with the goal of quickly publishing static responses with minimal operational burden. API Gateway can do this natively without standing up servers. Trap: It may sound plausible because it mentions Run a small Amazon EC2 application that serves mocked HTTP responses behind an Application Load Balancer, integrate API Gateway methods with HTTP integration to the ALB, and deploy a stage, but it does not satisfy the scenario's backend-free api mock requirement.

Incorrect. HTTP_PROXY requires a real upstream endpoint; pointing to an external mock still creates a backend dependency and potential latency/availability/security issues. Also, “attach an AWS Lambda layer to the API” is not a valid API Gateway construct—Lambda layers attach to Lambda functions, not directly to API Gateway. This option mixes incompatible concepts and doesn’t meet the no-backend requirement. Trap: It may sound plausible because it mentions Use HTTP_PROXY integration in API Gateway pointing to an external mock endpoint, add mapping templates, deploy the API, and attach an AWS Lambda layer to the API to emit different HTTP status codes, but it does not satisfy the scenario's backend-free api mock requirement.

A customer managed KMS key requires key creation, policies, permissions, and administration, which conflicts with the AWS owned key requirement. Trap: It encrypts data, but it chooses the most customer-managed key option.

alias/aws/dynamodb is an AWS managed KMS key in the customer account, not an AWS owned key. Trap: AWS managed sounds close to AWS owned, but they are separate key ownership models.

Customers cannot create an AWS owned key or provide an AWS owned key ARN in KMSMasterKeyId. Trap: It repeats the required key type, but the operation is not possible.

The network rule is right, but AWSLambdaBasicExecutionRole lacks the EC2 permissions Lambda needs to create and manage VPC ENIs. Trap: CloudWatch Logs permissions are not enough for Lambda VPC networking.

A Lambda function without VPC configuration cannot directly reach private Aurora IPs, and a Lambda interface endpoint is for invoking the Lambda service API. Trap: The word endpoint sounds private, but it is not a data path from Lambda runtime to Aurora.

The execution role policy alone does not attach a function to VPC subnets, and the Lambda API endpoint still does not provide database connectivity. Trap: It includes VPC access permissions but omits the actual VPC configuration.

Step Functions defines workflow orchestration, not the infrastructure template and local Lambda event debugging workflow required here. Trap: ASL is useful for state machines, but this is not primarily an orchestration question.

CloudFormation can define resources, but creating a separate pipeline violates the existing pipeline requirement and lacks SAM local conveniences. Trap: CloudFormation underlies SAM, but the option chooses the wrong pipeline approach.

SAM is appropriate, but deploying outside CodePipeline violates the requirement for existing pipeline stages. Trap: An automated script is still out of band.

codecommit:Put* is broader than needed and may grant unrelated write APIs. It is not the precise branch permission set requested. Trap: Wildcard write families often make pipelines work but fail least privilege.

codecommit:Update* is also a broad wildcard family and is not the explicit permission for creating or deleting branches. Trap: The word Update sounds related to branch changes, but CodeCommit branch lifecycle uses named actions.

codecommit:* grants full CodeCommit access, far beyond temporary branch creation and deletion. Trap: Full access would avoid AccessDenied, but it is the classic least-privilege violation.

sam package and sam deploy push resources to AWS, then the console test runs the deployed function. That contradicts the local-only requirement. Trap: SAM is involved, but package/deploy are deployment commands, not local invocation.

cdk deploy provisions the stack in AWS and the console test uses the remote Lambda function. The question requires testing on the laptop without deployment. Trap: cdk synth is needed, but cdk deploy is the wrong next step.

sam local start-lambda starts an endpoint that emulates the Lambda service API for clients that call Invoke. It is less direct than sam local invoke for running one function once with an event. Trap: It is a local SAM command, but it is not the purpose-built single-function test command.