模擬試験 2

Directly invoking the two Lambda functions tightly couples the intake Lambda to downstream work and does not provide durable FIFO ordering across concurrent requests, retries, and failures. Trap: Sequential calls sound controlled, but they do not create a reliable ordered queue for near-simultaneous requests.

SNS standard topics provide at-least-once delivery without ordering guarantees. A later reservation could be delivered before the first one for the same connector and timeslot. Trap: It supports fan-out, but standard SNS lacks the ordering needed for first-received wins.

A single SQS queue delivers each message to one consumer, so it does not naturally send the same reservation to both allocation and payment workflows. A standard queue also does not guarantee ordering. Trap: SQS decouples work, but one shared queue is not pub/sub fan-out to both processors.

Filtering in the Lambda handler can work, but it invokes the function for every stream record and requires the developer to write and test filtering code. That is more development effort than native event filtering. Trap: It is functionally plausible, but the question asks for least development effort.

DynamoDB Streams does not create an event source mapping directly to an SNS topic. A Lambda function or another consumer must process the stream and publish notifications. Trap: SNS is the right notification target, but it is not a direct DynamoDB Streams event source mapping destination.

CloudWatch alarms evaluate metrics, not individual DynamoDB stream record attributes. They cannot test per-record Status and TemperatureC values and publish only matching events. Trap: Alarms are good for operational thresholds, but this is content-based event routing.

A second API requires producer changes and still misses updates written by future dedicated functions unless they also call it. Trap: Another endpoint looks simple, but it couples archival to each producer.

Kinesis Data Streams alone does not directly deliver to S3, and each ingest Lambda would need publishing logic. Trap: Streaming is plausible, but the table already provides the common change source.

SNS publishing from producers requires changing every current and future ingest function and is not database-level change capture. Trap: SNS fan-out helps notifications, but only for events that producers explicitly publish.

AWS_PROXY with Lambda can easily return hardcoded JSON and status codes, but it requires provisioning and deploying a compute service (Lambda). The question explicitly forbids deploying any compute service. Also, proxy integrations reduce fine-grained control in API Gateway because the Lambda function is responsible for formatting the entire response, which is unnecessary for simple static stubs. Trap: It looks plausible because it mentions AWS and Lambda, but it misses backend-free static API responses.

HTTP_PROXY forwards requests to an existing HTTP endpoint. This violates the intent of “no backend available yet” and introduces dependency on an external placeholder API that still must be built/hosted somewhere. It also adds network and availability considerations outside API Gateway and does not inherently provide static responses without an upstream service. Trap: It looks plausible because it mentions API Gateway, but it misses backend-free static API responses.

This option misstates where status codes and payloads are configured. Method Request is for request parameters, validation, and authorization—not for defining response status codes. In API Gateway REST APIs, status codes are declared in Method Response and produced/mapped in Integration Response. Therefore, this configuration would not correctly implement the required 200/404/429 static responses. Trap: It looks plausible because it mentions Set the integration type to, but it misses backend-free static API responses.

CloudFormation does not natively model MSK Kafka topics and ACLs as attachable resources. Trap: It sounds declarative, but the specific Kafka objects are outside native CloudFormation coverage.

Running scripts on EC2 in each account is manual, persistent infrastructure-heavy, and weak for consistent later updates. Trap: It can reach private clusters, but it increases ongoing operations.

A single cross-account Lambda would require complex networking and permissions into every private VPC and is harder to govern than per-account stacks. Trap: Centralization sounds efficient, but private MSK networking makes it brittle.

It puts HTML in the response template, but configures the integration response Content-Type as application/json, which violates the HTML requirement. Trap: The body placement is partly right, so the wrong Content-Type is easy to miss.

The HTML belongs in the integration response template, not the request template, and the mock request should provide a statusCode for response selection. Trap: The text/html response mention is tempting, but the content is on the wrong side of the integration.

It puts the HTML in the request template and returns application/json, so it fails both the mock-response pattern and the required content type. Trap: Using text/html in the request sounds relevant, but clients see the response Content-Type.

A private REST API is reachable only from configured VPC endpoints and private network paths. A React Native app running on user devices cannot generally call that private API directly. Trap: It hides the key, but the private API endpoint does not match public mobile access.

This combines a private REST API with Lambda. The private API is not suitable for direct mobile clients, and Lambda is unnecessary just to add a static header and forward the request. Trap: Lambda could hide the key, but it adds cost and does not fix private endpoint reachability.

A public REST API with Lambda can hide the key, but it is not the most cost-effective option when API Gateway can directly proxy the third-party HTTP API and inject the required header. Trap: It solves secrecy, but adds a compute hop for a simple header-forwarding requirement.

Specifying aws/s3 (the S3-managed KMS key) with PutObject uses SSE-KMS, which is server-side encryption. The object is sent to S3 in plaintext (over TLS) and then encrypted by S3 after receipt. This does not guarantee the file is encrypted prior to transmission, and it also conflicts with the requirement that encryption must occur before upload. Trap: It may look tempting because it uses AWS KMS, but the decisive requirement is client-side encryption before the object leaves the task.

This mixes concepts incorrectly. SSE-S3 does not use KMS, so calling KMS GenerateDataKey is unrelated to SSE-S3. If you are generating a data key from KMS, you are doing client-side (envelope) encryption, not SSE-S3. As written, it does not clearly implement client-side encryption and is not a valid/consistent approach. Trap: It may look tempting because it uses Use an S3 managed key (SSE-S3) and call, but the decisive requirement is client-side encryption before the object leaves the task.

Using a customer managed KMS key in the upload request enables SSE-KMS, but it is still server-side encryption. The plaintext object is transmitted to S3 (protected only by TLS) and then encrypted at rest by S3. Because the requirement is encryption before transmission, SSE-KMS does not satisfy it even though it is a strong at-rest encryption option. Trap: It may look tempting because it uses AWS KMS, but the decisive requirement is client-side encryption before the object leaves the task.

The buildspec already uses aws s3 sync and the S3 website endpoint has the latest files. Trap: Repeating the upload step does not clear CloudFront caches.

Removing and redeploying S3 objects does not force CloudFront to drop cached responses before TTL expiration. Trap: The origin may change while CloudFront still serves cached objects.

CORS controls browser cross-origin access, not whether CloudFront serves stale cached HTML or JavaScript. Trap: The symptom is cache freshness, not blocked cross-origin requests.