DynamoDB quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 2Todo.io needs reports that join users, todos and tags with SQL. Which service fits?

Amazon RDS, a relational database.Correct. Joins across related tables are what relational databases are built for.Amazon DynamoDB.Not this one. DynamoDB finds items by key and has no SQL joins.Amazon S3.Not this one. S3 stores files, not related tables.Amazon SQS.Not this one. SQS holds messages waiting to be processed.

Learn it: RDS (Relational Database Service) · DynamoDB

Question 3How does Todo.io's app read and write DynamoDB?

With HTTPS API calls such as GetItem and PutItem, each signed and checked by IAM.Correct. There is no server and no connection to open: every request is an AWS API call.Over a long-lived database connection on port 3306.Not this one. That is MySQL. DynamoDB has no connections.By mounting the table as a disk.Not this one. Tables are reached through the API, never mounted.Through a security group rule on the table.Not this one. DynamoDB has no security groups; IAM decides.

Learn it: DynamoDB

Question 4Todo.io's app gets AccessDeniedException when it calls PutItem on the Todos table. What should be fixed?

The app's role needs a policy allowing dynamodb:PutItem on the Todos table's ARN.Correct. IAM checks every DynamoDB request, and AccessDenied means no policy allowed it.The table's security group.Not this one. DynamoDB has no security groups.The database password.Not this one. DynamoDB has no passwords; requests are signed with IAM credentials.The table is full and must be resized.Not this one. A full-table problem wouldn't be AccessDenied.

Learn it: DynamoDB · IAM policy

Question 5Todo.io's app on EC2, in a public subnet, calls DynamoDB. Which way does the request travel?

Out through the internet gateway to DynamoDB's public AWS endpoint.Correct. DynamoDB isn't inside your VPC. A gateway endpoint (Level 1) can keep this traffic off the internet.Straight to the table inside the VPC.Not this one. Tables don't live in your VPC.Through the RDS database.Not this one. RDS and DynamoDB are unrelated.Through an SQS queue.Not this one. Queues pass messages between your own components.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · Internet gateway

Question 6Todo.io wants traffic from its VPC to DynamoDB to stay off the internet, without paying extra for it. What should it add?

A VPC gateway endpoint for DynamoDB.Correct. Gateway endpoints (for DynamoDB and S3) add a route to the service that never leaves AWS, and cost nothing.A NAT gateway.Not this one. A NAT gateway costs per hour and per GB, and the traffic still goes out to the public endpoint.A public IP on every instance.Not this one. That puts more traffic on the internet, not less.Move the table into the VPC.Not this one. DynamoDB tables can't be placed in a VPC.

Learn it: VPC (Virtual Private Cloud) · DynamoDB · NAT gateway

Question 7How should Todo.io design a DynamoDB table so that reads are fast?

Around how it will read the data, so each read finds items by their key.Correct. DynamoDB finds items by key. Plan your keys from your queries, not the other way round.Like a relational schema, and join tables when reading.Not this one. DynamoDB has no joins.Any way at all, then scan the whole table each time.Not this one. Scans read everything, which is slow and expensive as tables grow.One item per table.Not this one. A table holds many items.

Learn it: DynamoDB

Question 8A Lambda function that isn't attached to a VPC writes to DynamoDB. Which security group is involved?

None. With no VPC there are no security groups, and DynamoDB has none either; IAM decides.Correct. Security groups only exist on network interfaces in a VPC.The VPC's default security group.Not this one. The function isn't in the VPC.The DynamoDB table's security group.Not this one. Tables have no security groups.The NAT gateway's security group.Not this one. There is no NAT gateway on this path, and NAT gateways don't take security groups.

Learn it: DynamoDB · Security group

Question 9Todo.io needs to store login sessions: millions of them, always looked up by session id, never joined to anything. Which service fits best?

Amazon DynamoDB.Correct. Lookups by key at any scale, with no server to run.Amazon RDS for MySQL.Not this one. It works, but you size and run a database server for something a key-value table does better.Amazon S3.Not this one. S3 stores files; it isn't built for fast small lookups.Amazon SQS.Not this one. A queue hands each message to one consumer once; it isn't a store you look things up in.

Learn it: DynamoDB

Question 10With DynamoDB, which of these does Todo.io manage?

Its tables, their keys, and who may access them.Correct. There are no servers. Data design and access are yours.The size of the database server.Not this one. There is no server to size.Operating system patches.Not this one. AWS runs everything underneath.A DB subnet group.Not this one. That is RDS. DynamoDB doesn't live in your subnets.

Learn it: DynamoDB

Question 11Todo.io created its Todos table in us-east-1. An app in eu-west-1 calls DynamoDB in eu-west-1 and gets ResourceNotFoundException. Why?

Tables are regional: Todos only exists in us-east-1.Correct. Call the us-east-1 endpoint, or copy the data across Regions (later levels).IAM blocks calls between Regions.Not this one. IAM is global, and this is "not found", not "denied".DynamoDB tables only exist in us-east-1.Not this one. You can create tables in any Region; this one was created in us-east-1.The table is still copying to eu-west-1.Not this one. Nothing is copied between Regions unless you set it up.

Learn it: Region · DynamoDB

Question 12What does "DynamoDB" mean?

A fully managed NoSQL database you use through AWS API calls.Correct. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Not this one. That describes RDS (Relational Database Service).Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.

Learn it: DynamoDB

Question 13Which term is this? "A fully managed NoSQL database you use through AWS API calls."

DynamoDBCorrect. Yes. Think of it as: A giant labelled locker wall where you fetch lockers by their exact key.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.

Learn it: DynamoDB

Question 14Which AWS term is described by this analogy? "A giant labelled locker wall where you fetch lockers by their exact key."

DynamoDBCorrect. Yes: A fully managed NoSQL database you use through AWS API calls.RDS (Relational Database Service)Not this one. RDS (Relational Database Service) is: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you. Its analogy: A filing cabinet with a librarian AWS employs.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.

Learn it: DynamoDB

DynamoDB

Worth another look

Your weak spots

Services

Concepts