Quizzes · Service

DynamoDB

Level 0 questions on DynamoDB. Read about it first if it's new to you.

Works with: IAM (6), Lambda (4), VPC (4), EC2 (2), API Gateway (1)

15 questions, from a pool of 18
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?

Give the function an execution role whose policy allows writing to that table.Correct. Software gets AWS permissions from a role. Lambda hands the function the role's temporary credentials.Store an IAM user's access keys in the function's environment variables.Not this one. Long-lived keys in configuration can leak, and never expire.Add a resource-based policy to the function that allows DynamoDB.Not this one. A function's resource-based policy says who may call it, not what it may call.Open the table's security group to the function.Not this one. DynamoDB has no security group. IAM approves every call.

Learn it: IAM role · Lambda

Question 2Todo.io's report job only reads items from the Todos table. Which policy follows the principle of least privilege?

Allow dynamodb:GetItem and dynamodb:Query on the Todos table's ARN.Correct. Only the actions the job uses, only on the one table it reads.Allow dynamodb:* on every resource.Not this one. That lets the job delete every table in the account.Attach AdministratorAccess.Not this one. That lets the job do anything in the account.Allow every action on the Todos table's ARN.Not this one. Right table, but it could also delete it.

Learn it: IAM policy

Question 3Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?

API Gateway → Lambda → DynamoDB.Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers.EC2 → RDS.Not this one. Both run on servers you size, and EC2 you also patch.API Gateway → EC2 → RDS.Not this one. EC2 still means servers to manage.SQS → CloudWatch Logs.Not this one. That is a queue and a log store; neither serves an API.

Learn it: API Gateway · Lambda

Question 4The Todo.io app runs on an EC2 instance and must write to a DynamoDB table. What is the most secure way to give it AWS credentials?

Attach an IAM role to the instance through an instance profile.Correct. The SDK fetches temporary credentials for the role from the instance itself, and they rotate automatically. There are no long-lived keys to leak.Create an IAM user's access keys and put them in the app's config file.Not this one. Long-lived keys in a file get copied, committed to Git and forgotten. Anyone who finds them has the access.Pass access keys to the instance in its user data.Not this one. User data is readable by anything on the instance and isn't secret. It's no safer than a config file.Use the root user's access keys, because they never expire.Not this one. Never expiring is the problem. Root keys should not exist at all.

Learn it: EC2 (Elastic Compute Cloud) · Temporary credentials · IAM role · Design Todo.io on EC2

Question 5Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 6How does Todo.io's app read and write DynamoDB?

With HTTPS API calls such as GetItem and PutItem, each signed and checked by IAM.Correct. There is no server and no connection to open: every request is an AWS API call.Over a long-lived database connection on port 3306.Not this one. That is MySQL. DynamoDB has no connections.By mounting the table as a disk.Not this one. Tables are reached through the API, never mounted.Through a security group rule on the table.Not this one. DynamoDB has no security groups; IAM decides.

Learn it: DynamoDB

Question 7Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?

The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN.Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it.The table's security group.Not this one. DynamoDB has no security groups.The database password.Not this one. DynamoDB has no passwords; requests are signed with IAM credentials.The table is full and must be resized.Not this one. A full-table problem wouldn't be AccessDenied.

Learn it: DynamoDB · IAM policy

Question 8Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 9Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 10How should Todo.io design a DynamoDB table so that reads are fast?

Around how it will read the data, so each read finds items by their key.Correct. DynamoDB finds items by key. Plan your keys from your queries, not the other way round.Like a relational schema, and join tables when reading.Not this one. DynamoDB has no joins.Any way at all, then scan the whole table each time.Not this one. Scans read everything, which is slow and expensive as tables grow.One item per table.Not this one. A table holds many items.

Learn it: DynamoDB

Question 11A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 12Todo.io needs to store login sessions: millions of them, always looked up by session id, never joined to anything. Which service fits best?

Amazon DynamoDB.Correct. Lookups by key at any scale, with no server to run.Amazon RDS for MySQL.Not this one. It works, but you size and run a database server for something a key-value table does better.Amazon S3.Not this one. S3 stores files; it isn't built for fast small lookups.Amazon SQS.Not this one. A queue hands each message to one consumer once; it isn't a store you look things up in.

Learn it: DynamoDB

Question 13With DynamoDB, which of these does Todo.io manage?

Its tables, their keys, and who may access them.Correct. There are no servers. Data design and access are yours.The size of the database server.Not this one. There is no server to size.Operating system patches.Not this one. AWS runs everything underneath.A DB subnet group.Not this one. That is RDS. DynamoDB doesn't live in your subnets.

Learn it: DynamoDB

Question 14Todo.io created its Todos table in us-east-1. An app in eu-west-1 calls DynamoDB in eu-west-1 and gets ResourceNotFoundException. Why?

Tables are regional: Todos only exists in us-east-1.Correct. Call the us-east-1 endpoint, or copy the data across Regions (later levels).IAM blocks calls between Regions.Not this one. IAM is global, and this is "not found", not "denied".DynamoDB tables only exist in us-east-1.Not this one. You can create tables in any Region; this one was created in us-east-1.The table is still copying to eu-west-1.Not this one. Nothing is copied between Regions unless you set it up.

Learn it: Region · DynamoDB

Question 15A policy should cover only the Todos table, in us-east-1, in account 111122223333. Which Resource is right?

arn:aws:dynamodb:us-east-1:111122223333:table/TodosCorrect. Service, Region, account ID, then table/ and its name.arn:aws:s3:::TodosNot this one. That is the ARN of an S3 bucket named Todos.TodosNot this one. Policies name resources by ARN, not by bare name.arn:aws:dynamodb:::TodosNot this one. DynamoDB ARNs include the Region and account, and the table/ prefix.

Learn it: ARN (Amazon Resource Name)

Question 16What does "DynamoDB" mean?

A fully managed NoSQL database you use through AWS API calls.Correct. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Not this one. That describes RDS (Relational Database Service).Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.

Learn it: DynamoDB

Question 17Which term is this? "A fully managed NoSQL database you use through AWS API calls."

DynamoDBCorrect. Yes. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.

Learn it: DynamoDB

Question 18Which AWS term is described by this analogy? "A giant labelled locker wall where you fetch lockers by their exact key."

DynamoDBCorrect. Yes: A fully managed NoSQL database you use through AWS API calls.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you. Its analogy: A filing cabinet with a librarian AWS employs.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.

Learn it: DynamoDB

DynamoDB

Worth another look

Your weak spots

Services

Concepts