Practice Test #5

Incorrect. A scheduled table scan is extremely expensive and inefficient at this scale because Scan reads large portions of the table repeatedly, consuming significant read capacity (or on-demand read charges) and requiring ongoing EC2 costs and operations. BatchWriteItem helps reduce API calls but does not eliminate the fundamental cost of scanning and explicit deletes. This is not the most cost-effective approach for time-based expiration.

Incorrect. Running scheduled ECS/Fargate tasks adds compute cost and operational overhead, and the approach still relies on scanning the table to find expired items. Even if it runs frequently, it will generate substantial DynamoDB read traffic and explicit deletes. Fargate is convenient but not cost-optimal for a simple, continuous cleanup job when DynamoDB TTL can handle expiration natively.

Incorrect. While querying a GSI is better than scanning the base table, it still incurs ongoing read costs on the index plus Lambda invocation costs and explicit delete write operations. Also, DynamoDB does not have a native “Date” attribute type; you’d store dates as String or Number. This design is more complex than necessary and is not as cost-effective as TTL.

Incorrect. AWS Systems Manager Parameter Store can securely store encrypted values using SecureString, but it is not the primary AWS service for managed database credential rotation. The phrase 'turn on rotation' aligns with AWS Secrets Manager, which is purpose-built for scheduled secret rotation and database integration. For Aurora PostgreSQL credentials that must rotate automatically every 30 days, Secrets Manager is the better and expected choice.

Incorrect. This option fails the core database requirement because the workload is being migrated to an Amazon Aurora PostgreSQL-Compatible cluster, not Amazon DynamoDB. It also pairs that incorrect database choice with Parameter Store, which is not the best service for managed automatic database credential rotation. Therefore it is wrong on both the database platform and the secret-management requirement.

Incorrect. Although AWS Secrets Manager is the correct service for securely storing and rotating credentials, DynamoDB is not the database specified in the scenario. The question explicitly requires an Aurora PostgreSQL-Compatible cluster with one writer and two readers, which describes an Aurora architecture rather than DynamoDB. Because the database service is wrong, this option cannot be the best answer.

Incorrect. Directly invoking allocation and then payment from the initial Lambda introduces tight coupling and reduces parallelism (the question states allocation and payment run in parallel). It also does not provide durable ordering across concurrent requests, retries, or partial failures. Two near-simultaneous requests could still interleave, and without FIFO semantics or a distributed lock/conditional write, “first received wins” is not reliably enforced.

Incorrect. SNS standard topics provide at-least-once delivery with no ordering guarantees and possible duplicates. With concurrent requests arriving within milliseconds, the second request could be delivered/processed before the first, violating the “first request received must get the slot” rule. Duplicate deliveries could also cause multiple payment attempts unless additional idempotency and coordination logic is implemented beyond what the option provides.

Incorrect. A single SQS standard queue does not guarantee ordering and can deliver messages more than once. Even if it were FIFO, using one queue for two Lambda consumers is problematic: each message would be processed by only one consumer, not both, so you would not reliably run allocation and payment in parallel for the same reservation. Fan-out requires separate queues or a pub/sub mechanism.

Incorrect. A customer managed KMS key requires key creation, key policy management, and potentially rotation/permissions administration. That directly violates the requirement to avoid KMS key administration. While it would satisfy encryption at rest, it is the most operationally heavy option and not aligned with “AWS owned key.”

Incorrect. alias/aws/dynamodb is an AWS managed KMS key, not an AWS owned key. Although AWS managed keys reduce some overhead (AWS handles rotation), they still involve KMS constructs in your account and are not the same as AWS owned keys. The requirement explicitly calls for AWS owned keys to avoid KMS key administration.

Incorrect. Customers cannot create or supply an ARN for an AWS owned key. AWS owned keys are fully controlled by AWS and are not visible or manageable in the customer account, so there is no ARN you can reference in SSESpecification.KMSMasterKeyId. This option is not technically feasible.

Incorrect. CloudWatch Logs Insights is designed for ad hoc analysis and scheduled queries, not the primary near-real-time alerting mechanism for every incoming log line within 60 seconds. While CloudWatch supports alarms on certain metric math and query-based metrics in some contexts, relying on Logs Insights queries for continuous detection is typically higher latency and not the standard exam answer versus metric filters.

Incorrect. The concept of a “subscription filter” exists in CloudWatch Logs, but it delivers matching log events to destinations like Amazon Kinesis Data Streams, Kinesis Data Firehose, or AWS Lambda—not directly to Amazon SNS. SNS subscriptions filter messages within SNS (filter policies) based on message attributes, but CloudWatch Logs does not publish log events to SNS via an SNS subscription filter.

Incorrect. CloudWatch alarms evaluate metrics and do not support embedding a CloudWatch Logs filter pattern directly in the alarm definition. There is no native alarm configuration that specifies a log group dimension and a log filter pattern to trigger notifications. You must first convert log matches into a metric (metric filter) or process logs via a subscription (e.g., Lambda) to emit a metric/event.

AWS_PROXY with Lambda can easily return hardcoded JSON and status codes, but it requires provisioning and deploying a compute service (Lambda). The question explicitly forbids deploying any compute service. Also, proxy integrations reduce fine-grained control in API Gateway because the Lambda function is responsible for formatting the entire response, which is unnecessary for simple static stubs.

HTTP_PROXY forwards requests to an existing HTTP endpoint. This violates the intent of “no backend available yet” and introduces dependency on an external placeholder API that still must be built/hosted somewhere. It also adds network and availability considerations outside API Gateway and does not inherently provide static responses without an upstream service.

This option misstates where status codes and payloads are configured. Method Request is for request parameters, validation, and authorization—not for defining response status codes. In API Gateway REST APIs, status codes are declared in Method Response and produced/mapped in Integration Response. Therefore, this configuration would not correctly implement the required 200/404/429 static responses.

Incorrect. A private REST API in API Gateway is accessible only from within a VPC through an interface VPC endpoint (AWS PrivateLink). A React Native app running on client devices over the public internet cannot directly reach a private API endpoint. While HTTP integration header injection would work technically, the connectivity model does not meet the “mobile app with no backend” requirement.

Incorrect. This uses a private REST API plus Lambda proxy integration. It fails for the same reason as A: private APIs are not reachable from public mobile clients. Additionally, adding Lambda increases cost and operational complexity (timeouts, concurrency, retries) without being necessary for simply adding a static x-api-key header and proxying small requests.

Incorrect. A public REST API with Lambda proxy integration would hide the third-party API key, but it is not the MOST cost-effective. Lambda adds per-invocation charges and potential data transfer/latency overhead compared to a direct HTTP integration. Choose Lambda only if you need custom logic (validation, aggregation, dynamic secrets, complex transformations) beyond simple header injection.

Incorrect. Long-lived access keys for an IAM user are explicitly discouraged by AWS security best practices (use roles and temporary credentials). It also increases operational overhead (key rotation, secret distribution to ECS, risk of leakage). While it could technically work, it is not least-privilege-friendly in practice and is not the recommended cross-account pattern for ECS workloads.

This option is not the best choice here because, although AWS RAM can be used to share advanced Systems Manager parameters cross-account, the question does not state that these parameters are advanced tier or that the team wants to manage sharing through RAM. The most standard and broadly applicable solution for an ECS task reading another account’s parameters is to assume a role in the owning account and call SSM directly. On AWS exams, STS-based cross-account access is usually preferred unless the question explicitly points to a supported resource-sharing feature and its prerequisites.

Incorrect. Exporting parameters to S3 creates a second copy of configuration data, violating the “without copying them into Dev-Render” intent and adding operational overhead (scheduled job, synchronization, access controls, potential drift). It also broadens the attack surface and complicates least-privilege because S3 access and object lifecycle must be managed in addition to SSM.

Incorrect. The override identifier is not the variation name; it must be the entity ID value used during evaluation (here, userId such as qa-7788). Also, setting “variation to 100%” is not how overrides work for a single user; that would imply changing allocation for a broader set, not targeting one identifier deterministically.

Incorrect. Creating an experiment and setting Variation B to 0% would affect the experiment’s traffic allocation at a population level, not specifically guarantee behavior for user qa-7788. Additionally, “experiment identifier” is not used to target a specific userId; it identifies the experiment resource, not the evaluation entity.

Incorrect. Using the AWS account ID as an experiment identifier does not map to the userId-based evaluation used by the application. Experiments don’t target a specific userId unless your application uses that identifier as the entity ID and you use overrides/targeting. This option confuses resource identifiers with evaluation identifiers and would not ensure qa-7788 gets Variation A.