Quizzes · Service

Lambda

Level 0 questions on Lambda. Read about it first if it's new to you.

Works with: IAM (8), VPC (5), DynamoDB (4), API Gateway (4), SQS (3), ECS + Fargate (2), EC2 (1), RDS (1), CloudWatch Logs (1)

15 questions, from a pool of 21
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?

Give the function an execution role whose policy allows writing to that table.Correct. Software gets AWS permissions from a role. Lambda hands the function the role's temporary credentials.Store an IAM user's access keys in the function's environment variables.Not this one. Long-lived keys in configuration can leak, and never expire.Add a resource-based policy to the function that allows DynamoDB.Not this one. A function's resource-based policy says who may call it, not what it may call.Open the table's security group to the function.Not this one. DynamoDB has no security group. IAM approves every call.

Learn it: IAM role · Lambda

Question 2A developer may create Lambda functions, but gets AccessDenied when choosing an existing execution role for a new function. What is missing?

Permission for iam:PassRole on that execution role.Correct. Giving a role to a service is "passing" it. PassRole stops people giving a service more power than they have themselves.Permission for lambda:InvokeFunction.Not this one. That is for calling a function, not creating one.Only the root user can give a role to a function.Not this one. Anyone with iam:PassRole on the role can.The role's trust policy must name the developer.Not this one. The trust policy must trust lambda.amazonaws.com, because Lambda is what assumes the role.

Learn it: iam:PassRole

Question 3What does a security group attach to?

A network interface (ENI): the one on an EC2 instance, a Fargate task or a VPC-attached Lambda function.Correct. Security groups filter traffic at the network card, not at the subnet.A subnet.Not this one. Subnets don't take security groups. (Network ACLs attach to subnets, in Level 1.)The whole VPC.Not this one. Each network interface has its own security groups.A route table.Not this one. Route tables decide where traffic goes. They hold no rules about who may connect.

Learn it: ENI (Elastic Network Interface) · Security group

Question 4Todo.io's backend runs on Lambda. Browsers need an HTTPS address to send requests to. What should sit in front of the function?

Amazon API Gateway.Correct. API Gateway gives you a managed HTTPS endpoint and passes each request to Lambda: the classic serverless API.A public IP address on the function.Not this one. Lambda functions don't have IP addresses you can call.Put the function in a public subnet.Not this one. A subnet doesn't give a function an HTTPS endpoint.An SQS queue.Not this one. A queue holds work for later. A browser waiting for an answer needs a request and a response.

Learn it: API Gateway

Question 5Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 6Todo.io's Lambda function tries to push a message to a browser by POSTing to the WebSocket API's @connections URL, and gets AccessDenied. What fixes it?

Allow execute-api:ManageConnections in the function's execution role.Correct. Pushing to a connection is an AWS API call, so IAM must allow it like any other.Open port 443 in the function's security group.Not this one. AccessDenied is an IAM answer. A network problem would time out instead.Enable CORS on the API.Not this one. CORS is about browsers calling across websites. This call comes from Lambda.Give the browser an IAM role.Not this one. The browser is the receiver here, and app users are never IAM principals.

Learn it: WebSocket (API Gateway WebSocket API) · IAM policy

Question 7Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?

API Gateway → Lambda → DynamoDB.Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers.EC2 → RDS.Not this one. Both run on servers you size, and EC2 you also patch.API Gateway → EC2 → RDS.Not this one. EC2 still means servers to manage.SQS → CloudWatch Logs.Not this one. That is a queue and a log store; neither serves an API.

Learn it: API Gateway · Lambda

Question 8Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 9Todo.io's Lambda function processes large uploads and always stops at exactly 15 minutes, unfinished. What is the right fix?

Split the work into smaller pieces, or run it on a service without that limit, such as ECS on Fargate.Correct. 15 minutes is the most a Lambda function can ever run.Raise the function's timeout to 30 minutes.Not this one. The timeout can't go above 15 minutes.Give the function more memory, which extends the limit.Not this one. More memory makes it faster, but the 15-minute limit stays.Attach the function to a VPC.Not this one. Being in a VPC changes what it can reach, not how long it can run.

Learn it: Lambda

Question 10How is Todo.io billed for a Lambda function?

Per request, and for how long each run takes (by the millisecond, scaled by its memory size).Correct. No requests, no compute charge: you never pay for an idle server.Per hour while the function exists.Not this one. An unused function costs nothing to keep.A flat monthly fee per function.Not this one. There is no flat fee.Per GB of code stored only.Not this one. Requests and run time are what you pay for.

Learn it: Lambda

Question 11Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 12When should Todo.io attach a Lambda function to its VPC?

When it needs to reach something private inside the VPC, such as the RDS database.Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources.Whenever it needs the internet.Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway.To make it run faster.Not this one. Speed comes from memory size, not from the VPC.Always; IAM only works inside a VPC.Not this one. IAM has nothing to do with VPCs.

Learn it: Lambda

Question 13How many execution roles does a Lambda function have?

Exactly one. Its permissions are everything the function's code can do in AWS.Correct. Give that one role only what the function needs.One per caller.Not this one. Who may call the function is set by its resource-based policy, not by extra roles.One per run.Not this one. Every run uses the same role.None. Functions get permissions from the account.Not this one. Nothing gets permissions just by being in an account.

Learn it: Lambda · IAM role

Question 14Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?

Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents).Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role.Lambda can't send logs anywhere.Not this one. It sends them to CloudWatch Logs by default.The CloudWatch agent isn't installed.Not this one. The agent is for EC2. Lambda needs nothing installed.CloudTrail is turned off.Not this one. CloudTrail records API calls; it isn't where function output goes.

Learn it: Lambda · CloudWatch Logs

Question 15Todo.io's worker is a Lambda function that handles messages from an SQS queue. How do the messages reach the function?

Lambda polls the queue for you (an event source mapping) and runs the function with each batch.Correct. SQS never pushes. Lambda does the polling, so you don't write any.SQS pushes each message to the function.Not this one. SQS only hands out messages to whoever asks.The team writes a scheduled job that copies messages to the function.Not this one. The event source mapping already does this.Through API Gateway.Not this one. API Gateway is for HTTP requests, not for queues.

Learn it: Lambda · SQS

Question 16A Lambda function with a 60-second timeout processes an SQS queue whose visibility timeout is 30 seconds. Some messages are processed twice. What is the fix?

Raise the queue's visibility timeout well above the function's timeout; AWS suggests at least six times.Correct. A message becomes visible again after 30 seconds, while the first run is still working on it, so a second run picks it up.Shorten how long the queue keeps messages.Not this one. Retention is how long unread messages wait; it doesn't cause repeats.Add a dead-letter queue.Not this one. A DLQ catches messages that keep failing. These ones succeed, just twice.Lower the function's memory.Not this one. That only makes each run slower, which makes it worse.

Learn it: Lambda · SQS (Simple Queue Service)

Question 17Todo.io moves its API to Lambda. Which of these is still Todo.io's job?

The function's code and the permissions in its execution role.Correct. AWS runs the servers, the operating system and the scaling. What your code does, and what it is allowed to do, stay yours.Patching the operating system.Not this one. With Lambda there is no operating system for you to patch.Adding servers when traffic grows.Not this one. Lambda scales by itself.Replacing failed hardware.Not this one. Hardware is always AWS's job.

Learn it: Lambda

Question 18A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 19What does "Lambda" mean?

Upload a function; AWS runs it only when something calls it.Correct. Think of it as: A taxi. You pay for the ride, not for owning the car.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.Rent a virtual server by the second.Not this one. That describes EC2 (Elastic Compute Cloud).

Learn it: Lambda

Question 20Which term is this? "Upload a function; AWS runs it only when something calls it."

LambdaCorrect. Yes. Think of it as: A taxi. You pay for the ride, not for owning the car.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second.

Learn it: Lambda

Question 21Which AWS term is described by this analogy? "A taxi. You pay for the ride, not for owning the car."

LambdaCorrect. Yes: Upload a function; AWS runs it only when something calls it.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second. Its analogy: Renting a computer you have to look after yourself.

Learn it: Lambda

Lambda

Worth another look

Your weak spots

Services

Concepts