Question 290
A service uses DynamoDB to allocate each unique invoice number. During bursts, concurrent writers sometimes both believe they have reserved the same number because each first performs a read. What DynamoDB mechanism prevents the race?
- Use a strongly consistent GetItem before an unconditional PutItem to reserve each invoice number.
- Add a GSI keyed by invoice number, then perform an unconditional base-table write because indexed uniqueness is enforced automatically.
- Use DynamoDB Streams to detect duplicate invoice numbers after both concurrent writers commit.
- Use a conditional PutItem or transactional conditional write that succeeds only when the invoice key is not already present.
Explanation
Correct Answer
D:Server-side conditional writes enforce atomic reservation semantics instead of trusting an unsafe read-then-write sequence.
Incorrect Answers
A:A strongly consistent read gives the latest state at read time but does not make the later write atomic against competing writers.
B:A GSI does not enforce a unique constraint across independent concurrent writes. Use an atomic conditional operation on the item key.
C:Detection after committing does not prevent dual reservations. Conditional writes or transactions must reject the second write atomically.
Question 291
An outbound webhook consumer receives HTTP 429 and a documented Retry-After header during a vendor rate-limit episode. The consumer already uses SQS for durable buffering. Which retry control most directly prevents synchronized overload of the external service?
- Honor Retry-After but schedule every affected worker to retry at the same exact expiration time with no jitter or concurrency cap.
- Apply exponential backoff but ignore a larger server-provided Retry-After and allow unlimited simultaneous retry attempts.
- Move 429 responses directly to the dead-letter queue without bounded retries, even though the vendor explicitly marks the throttle as temporary.
- Honor Retry-After where provided, combine bounded exponential backoff with jitter and keep failed messages available for redrive.
Explanation
Correct Answer
D:A vendor-provided retry interval and randomized backoff reduce synchronized retry storms without dropping durably queued work.
Incorrect Answers
A:Synchronizing large numbers of clients creates a thundering herd when the vendor reopens. Jitter and bounded retry concurrency reduce synchronized overload.
B:Backoff should account for the vendor limit signal; ignoring Retry-After or removing bounds can continue the flood despite an exponential formula.
C:Treating a transient rate limit as permanently failed forfeits the intended controlled retry path while not coordinating arrival rates.
Question 292
A distributed checkout application uses SQS standard queues, and a message sometimes arrives more than once during normal retries. Order fulfillment must never charge the same customer twice. Which processing guarantee should be implemented?
- Increase the queue message retention period and assume retained copies cannot be processed twice.
- Design idempotent consumers using a durable transaction identifier and conditional state update before charging.
- Set the visibility timeout to a large value and assume SQS standard queues now guarantee exactly-once processing.
- Delete the message before verifying that the payment charge committed and assume failures will later be retried.
Explanation
Correct Answer
B:Standard queues provide at-least-once delivery, so application-level idempotency must prevent duplicate business side effects.
Incorrect Answers
A:Longer retention does not enforce idempotency or prevent multiple deliveries of the same logical message.
C:Changing visibility helps reduce premature retries but does not replace at-least-once semantics with an exactly-once business guarantee.
D:Early deletion can permanently lose uncompleted work and still does not protect against repeated payment attempts.
Question 293
A service must process per-customer account events in strict order. Different accounts can process in parallel, and producers occasionally retry publishing the same logical event. Which SQS configuration is appropriate?
- Give every account event a single global FIFO message group ID even though independent accounts require parallel processing.
- Publish order events to an EventBridge bus without preserving a FIFO message group identifier or ordering across parallel targets.
- Use an SQS FIFO queue with account-specific message group IDs and stable deduplication identifiers where appropriate.
- Use one standard queue with no idempotency design and assume it guarantees strict in-order delivery under retries.
Explanation
Correct Answer
C:FIFO ordering applies within a message group while different groups can progress concurrently, and deduplication limits repeated sends.
Incorrect Answers
A:A global group serializes unrelated accounts and unnecessarily restricts throughput relative to per-account groups.
B:EventBridge can route events to consumers, but does not replace the required per-customer FIFO queue ordering and deduplication semantics.
D:Standard queues can deliver out of order and more than once, so strict customer-level ordering is not guaranteed.
Question 294
A Lambda function consumes ten SQS messages per invocation. A single invalid payload causes the handler to throw, and the other nine messages that were processed successfully keep being delivered again. Which supported error-handling pattern reduces repeated successes?
- Enable partial batch response handling and report only failed message identifiers while preserving consumer idempotency.
- Configure a DLQ for the queue but keep throwing a generic exception for every batch with one invalid message.
- Disable all Lambda error reporting and assume the event source mapping can infer which record failed.
- Increase the queue visibility timeout to a month and assume it solves batch-level acknowledgment of one bad record.
Explanation
Correct Answer
A:Partial batch responses let supported SQS event-source mappings retry failed records without necessarily redelivering successfully processed messages.
Incorrect Answers
B:A DLQ helps isolate repeatedly failed records after redrives, but does not avoid reprocessing nine successful records on each failed batch.
C:Without a supported per-record failure response, the mapping cannot distinguish the bad record from other batch records.
D:Visibility length affects redelivery timing but does not identify which individual record in a batch should be retried.
Question 295
An EC2 Auto Scaling fleet uses Spot Instances for stateless workers. Spot interruptions during launch peaks reduce capacity abruptly even though unused capacity exists in other instance families and AZs. Which strategy improves workload continuity?
- Disable Auto Scaling replacement attempts and accept that lost Spot instances cannot ever be replenished.
- Increase the desired capacity using only a single Spot instance family in one AZ instead of allowing eligible replacement pools.
- Use multiple compatible instance types and Availability Zones with capacity rebalance and an interruption-tolerant worker design.
- Restrict the fleet to one extremely scarce instance type in a single AZ to ensure all capacity gets interrupted together.
Explanation
Correct Answer
C:Capacity diversity and proactive replacement can reduce correlated Spot interruption impact while queues and checkpoints preserve work.
Incorrect Answers
A:Suppressing replacements leaves capacity absent and does not leverage available alternate Spot pools.
B:More requests for the same constrained Spot pool cannot ensure capacity when alternate families and zones could fulfill replacement tasks.
D:Single-pool dependence makes interruption and launch-capacity failures more likely during peaks.
Question 296
An ALB serves stateless web instances across three Availability Zones, but one target group still routes requests to an application version that returns 500 errors while its TCP port accepts connections. What health-check improvement is needed?
- Disable ALB target health checks so clients can test whether the broken version is ready themselves.
- Increase the Auto Scaling group maximum capacity while leaving the target-group HTTP check at a superficial TCP-only readiness signal.
- Use the ALB traffic weight to pin failed requests to the known-broken target group and omit an application endpoint check.
- Use an application-aware health-check path and success criteria that represent actual service readiness, then verify unhealthy target removal.
Explanation
Correct Answer
D:A superficial port check can mark a broken application healthy; the ALB needs a meaningful HTTP readiness signal.
Incorrect Answers
A:Blind routing increases customer failures and cannot isolate the known unhealthy targets.
B:New capacity does not stop the ALB from directing clients to a broken application version marked healthy by an insufficient check.
C:Traffic steering toward known-broken targets does not detect or exclude failed application responses.
Question 297
A purchasing service must atomically create a new order record and decrement a reserved stock counter in DynamoDB. Either both changes succeed or neither change may be visible, and a condition must reject the order if stock is exhausted. Which database operation meets this multi-item consistency requirement?
- Use DynamoDB TransactWriteItems with a conditional stock check and both changes in a single supported transaction, handling transaction cancellation and client retries idempotently.
- Read the stock counter, write the order, and reduce the counter in three independent requests without a server-side transaction.
- Use individual DynamoDB ConditionExpression checks on the inventory decrement but commit the new order record as a separate nontransactional write.
- Enable a DAX read cache and rely on cached stock counts as a substitute for transaction isolation.
Explanation
Correct Answer
A:TransactWriteItems groups supported writes and conditions atomically, preventing a partial committed order when inventory checks fail; idempotency and contention behavior require care.
Incorrect Answers
B:Separate read-and-write operations permit races and partially committed state when a worker crashes between requests.
C:A conditional update protects one item, but two independent operations can still partially commit an order without the required all-or-nothing semantics.
D:A cache can return stale values and does not establish multi-item atomicity or conditional consistency.
Question 298
After a malformed-event processor bug was fixed, a financial application has 80,000 messages retained in an SQS dead-letter queue. A bulk replay would overload downstream inventory and billing databases. Workers are idempotent and the source queue is healthy. Which native SQS recovery operation allows a controlled replay rate?
- Delete all DLQ messages immediately and assume previously failed business transactions need no recovery.
- Use SQS dead-letter queue redrive back to an approved destination with a configured maximum message movement velocity and monitor consumer capacity.
- Raise the source queue visibility timeout to several days while leaving the DLQ messages stranded indefinitely.
- Schedule an EventBridge rule to call SendMessage repeatedly against the source queue without controlled per-second movement from the existing DLQ.
Explanation
Correct Answer
B:SQS DLQ redrive tasks support a configured maximum redrive velocity to move recovered messages at a rate that does not overwhelm destination consumers.
Incorrect Answers
A:Dropping retained failed messages would violate the business requirement for recoverable processing.
C:Visibility timeout affects in-flight message retries, not moving existing DLQ messages safely back to a source queue.
D:Scheduled retry sends may create unbounded duplicate traffic and do not supply native SQS redrive task velocity controls for the retained DLQ items.
Question 299
A Java microservice running on Amazon EKS already has a correct readiness probe that keeps unready Pods out of Service endpoints. However, initialization can legitimately take four minutes and an aggressive liveness probe begins failing after 20 seconds, repeatedly killing each new Pod before it finishes startup. Which probe configuration most directly fixes the restart loop while retaining quick liveness failure detection after initialization?
- Increase readinessProbe.initialDelaySeconds to four minutes while retaining the liveness probe that restarts the container after 20 seconds.
- Increase only the liveness failure timeout to several hours for the entire lifetime of the container, even after successful startup.
- Increase only the readiness probe initialDelaySeconds to four minutes while leaving the liveness probe configured to restart containers after 20 seconds.
- Add a startupProbe whose failure threshold covers realistic initialization time, keep the readiness probe, and allow normal liveness checks after the startup probe succeeds.
Explanation
Correct Answer
D:Kubernetes startup probes suppress liveness and readiness probe evaluation until initialization succeeds, permitting a long startup window without weakening subsequent liveness monitoring.
Incorrect Answers
A:Readiness gating controls endpoint membership but does not prevent the independent early liveness probe from restarting the initializing container.
B:A permanently lax liveness threshold sacrifices fast detection of later deadlocks rather than protecting only the legitimate initialization window.
C:A readiness delay protects Service routing but does not prevent the independent liveness probe from killing the container before its legitimate initialization finishes.
Question 300
A business critical API uses Lambda and SQS. Unexpected bursts of failed messages cause the event source mapping to consume most account concurrency and delay unrelated synchronous functions. What isolation setting matters?
- Cap the consumer Lambda reserved concurrency and, where suitable, configure SQS event-source maximum concurrency with DLQ handling.
- Increase SQS message retention but leave Lambda concurrency entirely unbounded for the misbehaving consumer.
- Raise every unrelated Lambda function timeout without limiting the problematic event-source concurrency.
- Increase the Lambda account concurrency quota alone while keeping the problem function’s event-source consumption unbounded.
Explanation
Correct Answer
A:Bounding consumption isolates shared account capacity while source throttling and failure redrive protect downstream systems and unrelated functions.
Incorrect Answers
B:Message retention controls recoverable time, not how much simultaneous execution capacity a function monopolizes.
C:Longer runtimes can worsen resource contention and do not reserve protected execution capacity for other services.
D:A larger shared quota can increase total workload but does not provide a dedicated maximum for the problematic consumer to protect unrelated functions.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests