The blueprint
A mock exam here has 65 questions in 130 minutes, split across the domains in the same proportions as the official exam guide. The official pass mark is 720 of 1,000 (scaled). FixOps scores practice against a target of 75%.
-
01
Development with AWS Services
-
02
Security
-
03
Deployment
-
04
Troubleshooting and Optimization
Sample questions
Three of the 10 questions in the free diagnostic. Open one to see the answer and why.
When an order is placed, three independent services (billing, shipping and analytics) must each receive the event and process it at their own pace. Which design fits?
- A DynamoDB table that the three services scan every minute
- A Lambda function that calls the three services in turn
- An SNS topic with one SQS queue per service subscribed
- One SQS queue that all three services poll
Answer: An SNS topic with one SQS queue per service subscribed. This is the fanout pattern: SNS delivers a copy of each message to every subscribed queue, and each service consumes its own queue independently, with its own retries. With a single shared queue each message goes to only one consumer, and a function calling the services in turn couples them together.
A worker takes about 90 seconds to process an SQS message. The queue's visibility timeout is 30 seconds. Messages are being processed two or three times. What should be changed?
- The delivery delay, to 90 seconds
- The message retention period, to at least one day
- The receive wait time, to 20 seconds
- The visibility timeout, to more than 90 seconds
Answer: The visibility timeout, to more than 90 seconds. A received message is hidden from other consumers for the visibility timeout. If processing takes longer, the message becomes visible again and another worker picks it up. The timeout should exceed the processing time (or be extended with ChangeMessageVisibility). Delay, retention and wait time do not affect redelivery during processing.
A table has partition key customerId and sort key orderDate. The application needs one customer's orders from the last 30 days. Which operation is the most efficient?
- A BatchGetItem with every possible date
- A Query on customerId and a date range
- A Scan with a filter expression on customerId
- A parallel Scan with four segments
Answer: A Query on customerId and a date range. A Query reads only the items with the given partition key and can narrow them by a condition on the sort key, so it touches just the matching items. A Scan reads the whole table and filters afterwards, consuming capacity for every item it reads.
Revision notes: Development with AWS Services
The notes for one domain, free to read here and in the app. FixOps Pro has them for all 4 domains.
Writing application code against AWS services: messaging and events, API Gateway, Lambda and its configuration, and data stores, with DynamoDB in most detail.
Patterns
- Fanout: an SNS topic delivers a copy of each message to every subscribed SQS queue, and each consumer works at its own pace.
- Orchestration (Step Functions) keeps a workflow's order, retries and state in one place; choreography (EventBridge) lets services react to events independently.
- A stateless tier keeps session data in a shared store such as ElastiCache or DynamoDB, so any instance can serve any request.
- Retries use exponential backoff with jitter, and handlers are idempotent, because standard queues and asynchronous invocations can deliver more than once.
- A circuit breaker fails fast with a fallback when a dependency keeps failing.
SQS, Kinesis and EventBridge
- The visibility timeout must exceed the processing time, or the message is delivered again. Long polling (up to 20 seconds) cuts empty receives.
- A redrive policy moves a message to a dead-letter queue after maxReceiveCount receives.
- FIFO queues keep order within a message group ID; different groups are processed in parallel.
- Payloads above the message size limit go to S3, with a pointer in the message.
- Kinesis keeps order within a shard and the partition key picks the shard; a low-cardinality key makes a hot shard. Several consumers can read and replay the same records.
- EventBridge rules match events with patterns and route them to targets. Custom events are published with PutEvents; an archive allows replay.
API Gateway
- A request validator with a model rejects bad requests before the backend runs.
- Mapping templates transform requests and responses for non-proxy integrations.
- With Lambda proxy integration the function returns statusCode, headers and a string body; anything else is a 502. Binary bodies are base64-encoded with isBase64Encoded.
- Usage plans with API keys meter and throttle clients; API keys are not authentication.
Lambda
- Timeout defaults to 3 seconds and goes up to 900. More memory also means more CPU.
- Reserved concurrency caps a function and guarantees that amount; provisioned concurrency keeps environments warm; SnapStart resumes from a snapshot.
- Code outside the handler runs once per execution environment: create SDK clients and connections there.
- A function in a VPC needs a NAT gateway (or VPC endpoints) to reach the internet, and its role needs the network interface permissions. RDS Proxy pools database connections.
- Asynchronous invocations are retried twice; destinations record success and failure with details, a dead-letter queue only the failed event.
- For SQS, ReportBatchItemFailures retries only the failed messages. For streams, bisect on error and a retry limit with an on-failure destination stop a bad record from blocking a shard.
- Services that push events (S3, SNS, API Gateway) are allowed in the function's resource-based policy; what the function may call is in its execution role.
DynamoDB and caching
- Choose a partition key with many distinct values. Query reads one partition key; Scan reads the whole table, and a filter is applied after the read.
- A global secondary index can use any key and be added later; a local secondary index shares the partition key and is created with the table.
- One RCU is one strongly consistent read per second of up to 4 KB (half that for eventually consistent). One WCU is one write per second of up to 1 KB. Sizes round up.
- Conditional writes detect conflicting updates; TransactWriteItems is all or nothing; batch operations can return unprocessed items to retry.
- TTL deletes expired items for free; streams deliver item changes to Lambda.
- DAX caches eventually consistent reads in memory. With ElastiCache, lazy loading fills on a miss and needs a TTL; write-through keeps the cache current.
Easy to mix up
- Reserved concurrency is a cap and a guarantee; provisioned concurrency is about cold starts.
- Execution role: what the function can call. Resource-based policy: who can invoke the function.
- Visibility timeout hides a message being processed; delay hides a message before it is first delivered.
- A filter expression reduces what is returned, not what is read and paid for.