模擬試験 5

Maximum event age controls retry/discard behavior after Lambda is already invoked asynchronously. It does not convert a synchronous API Gateway invocation into an async one. Trap: It mentions an async-related Lambda setting, but it is not the setting that changes invocation type.

Increasing the API Gateway timeout is not the right control for a REST API workflow that takes minutes. The solution must decouple the request, not wait for the Lambda timeout. Trap: It tries to stretch the synchronous path instead of changing the invocation pattern.

X-Amz-Target is not the Lambda invocation type header. API Gateway must pass X-Amz-Invocation-Type: Event to request asynchronous Lambda invocation. Trap: The header name sounds like an AWS service integration control, but it is the wrong header for Lambda invocation mode.

Parameter Store can hold SecureString values, but the option relies on a generic rotation setting that is not the managed RDS/Aurora credential rotation feature. Trap: It preserves Aurora but misses the service designed for automatic database password rotation.

The workload is being moved to Aurora PostgreSQL, not DynamoDB, and Parameter Store is not the best fit for managed database rotation. Trap: DynamoDB is an AWS database, but it is the wrong database for this stem.

Secrets Manager is correct for secrets, but DynamoDB does not satisfy the explicit Aurora PostgreSQL cluster requirement. Trap: The secret service is tempting, but the database platform is wrong.

CloudFormation parameters, even with template encryption, are not a proper secret distribution mechanism and can still be mishandled by stack tooling or user data. Trap: Encrypting the template sounds protective but does not create managed secret retrieval.

S3 can store encrypted objects, but downloading a secret during bootstrap is not CloudFormation-native secret resolution and adds object access exposure. Trap: S3 is durable storage, not a secret manager for this requirement.

EFS is a shared file system, not a secret store, and mounting it for secrets increases access and operational complexity. Trap: Encryption on EFS protects storage, but it does not provide CloudFormation-native secret resolution.

Persisting the plaintext data key defeats the security purpose of KMS, and the encrypted data key is not usable directly as a local encryption key. Trap: It includes both GenerateDataKey outputs, but reverses their roles.

Storing the CiphertextBlob is correct, but using KMS Encrypt to encrypt 2-25 MB files is the wrong API pattern. Trap: It sounds KMS-centric, but KMS Encrypt is for small blobs, not multi-megabyte file encryption.

It stores plaintext key material and attempts to use the encrypted key with KMS Encrypt, so both the storage and encryption steps are wrong. Trap: Mentioning GenerateDataKey and KMS Encrypt can look official, but it violates envelope encryption basics.

Gateway Load Balancer is for inserting and scaling network appliances, not exposing Lambda as a simple HTTPS API. Trap: The word Gateway sounds related to APIs, but this service solves a network appliance problem.

A Network Load Balancer is not the least-configuration Lambda HTTP front end for a simple serverless POST route. Trap: Load balancers can expose applications, but this scenario asks for a lightweight Lambda endpoint.

Global Accelerator improves routing to existing endpoints but does not by itself expose a Lambda function over HTTP. Trap: It can improve public endpoint performance, but it is an added layer, not the endpoint service.

More memory can improve CPU and networking, but keep-warm invokes cannot guarantee enough initialized environments during scaling or bursts. Trap: Scheduled warming may reduce some cold starts, but it is not deterministic.

Optimizing initialization is useful, but new environments can still cold start when traffic scales. Trap: It improves duration but does not meet the ahead-of-invocation setup requirement.

Reserved concurrency protects capacity and caps concurrency, but it does not create initialized execution environments. Trap: Concurrency reservation is often confused with provisioned concurrency.

Incorrect. Long-lived access keys for an IAM user are explicitly discouraged by AWS security best practices (use roles and temporary credentials). It also increases operational overhead (key rotation, secret distribution to ECS, risk of leakage). While it could technically work, it is not least-privilege-friendly in practice and is not the recommended cross-account pattern for ECS workloads. Trap: It is tempting because it mentions Configure the ECS task in Dev-Render to use, but the scenario points to an assumable least-privilege IAM role in the account that owns the parameters.

This option is not the best choice here because, although AWS RAM can be used to share advanced Systems Manager parameters cross-account, the question does not state that these parameters are advanced tier or that the team wants to manage sharing through RAM. The most standard and broadly applicable solution for an ECS task reading another account's parameters is to assume a role in the owning account and call SSM directly. Trap: It is tempting because it mentions AWS RAM, but the scenario points to an assumable least-privilege IAM role in the account that owns the parameters.

Incorrect. Exporting parameters to S3 creates a second copy of configuration data, violating the "without copying them into Dev-Render" intent and adding operational overhead (scheduled job, synchronization, access controls, potential drift). It also broadens the attack surface and complicates least-privilege because S3 access and object lifecycle must be managed in addition to SSM. Trap: It is tempting because it mentions Amazon S3, but the scenario points to an assumable least-privilege IAM role in the account that owns the parameters.

Incorrect. Lambda functions cannot attach Amazon EBS volumes; EBS is block storage for EC2 instances. For this temporary per-invocation workload, configured ephemeral storage is the supported local storage choice. Trap: EBS sounds like high-performance storage, but it is not attachable to Lambda.

Incorrect. You cannot attach an Elastic Network Adapter directly to a Lambda function. It also would not solve the main bottleneck, which is reading the same large S3 object repeatedly. Trap: Networking terminology can distract from the simpler local-storage optimization.

Incorrect. Reading directly from S3 each time keeps the implementation simple, but it performs 3-5 full network transfers per invocation. That is exactly what the performance-optimized design should avoid. Trap: S3 is durable and scalable, but repeated full reads add avoidable latency.

Raising $util.error from the integration request template is not the documented mock integration selection mechanism and can fail request template processing instead of selecting clean mock responses. Mock integrations should emit a statusCode value for response selection. Trap: Selection patterns are real in API Gateway, but this answer applies an error-routing pattern where mock statusCode mapping is expected.

$context.responseOverride.status is used in response mapping contexts after an integration response exists. The question asks to update the integration request mapping template for a mock integration. Trap: Status override is an API Gateway feature, but this places it in the wrong phase.

Stage variables are static configuration values. They do not dynamically choose a method response status for each request. Trap: Stage variables can parameterize deployments, but they are not per-request response routing logic.