Quizzes · Glossary term

Lambda

Level 0 questions on Lambda. Read about it first if it's new to you.

15 questions, from a pool of 18
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1A Todo.io Lambda function must write to a DynamoDB table. How should it get that permission?

Give the function an execution role whose policy allows writing to that table.Correct. Software gets AWS permissions from a role. Lambda hands the function the role's temporary credentials.Store an IAM user's access keys in the function's environment variables.Not this one. Long-lived keys in configuration can leak, and never expire.Add a resource-based policy to the function that allows DynamoDB.Not this one. A function's resource-based policy says who may call it, not what it may call.Open the table's security group to the function.Not this one. DynamoDB has no security group. IAM approves every call.

Learn it: IAM role · Lambda

Question 2Todo.io's API Gateway invokes its Lambda function. In Todo.io's setup, which policy says that API Gateway may invoke the function?

A resource-based policy on the function.Correct. It lives on the function and names the caller (apigateway.amazonaws.com): who may use this resource.The function's execution role.Not this one. The execution role says what the function may do, not who may call it.An SCP on the account.Not this one. SCPs only cap permissions; they never grant them.A security group on the function.Not this one. Security groups filter network traffic. Invoking a function is an AWS API call, decided by IAM.

Learn it: API Gateway · IAM policy · Lambda

Question 3Todo.io wants an API with no servers to patch or scale. Which combination is the classic serverless pattern?

API Gateway → Lambda → DynamoDB.Correct. Every piece is managed and scales on its own; you pay for requests, not idle servers.EC2 → RDS.Not this one. Both run on servers you size, and EC2 you also patch.API Gateway → EC2 → RDS.Not this one. EC2 still means servers to manage.SQS → CloudWatch Logs.Not this one. That is a queue and a log store; neither serves an API.

Learn it: API Gateway · Lambda

Question 4Todo.io attaches its Lambda function to the VPC so it can reach the MySQL database in a private subnet. Since then, the function's calls to SQS time out. IAM allows sqs:SendMessage. What fixes it?

Add a NAT gateway in a public subnet, and route the private subnets' internet traffic (0.0.0.0/0) to it.Correct. A VPC-attached Lambda function can only reach what its subnet can reach. A NAT gateway lets it call out to public AWS endpoints such as SQS, while nothing can call in. (A VPC endpoint is another fix, in a later level.)Move the function's network interfaces to a public subnet.Not this one. Lambda's network interfaces never get a public IP, so a public subnet doesn't help. This is a classic exam trap.Add an outbound rule for port 443 to the function's security group.Not this one. Security groups allow all outbound traffic by default, and a timeout means there's no route out at all. An outbound rule can't create a route.Add sqs:SendMessage to the function's execution role again.Not this one. IAM already allows it. A permission problem shows up as AccessDenied, not as a timeout.

Learn it: NAT gateway · Lambda · IAM policy · ENI

Question 5Which of Todo.io's compute choices still leaves Todo.io patching an operating system?

Amazon EC2.Correct. With EC2 you get a server, and the operating system on it is yours to maintain.AWS Lambda.Not this one. Lambda has no server for you to manage.Amazon ECS on Fargate.Not this one. With Fargate, AWS runs and patches the servers under your containers.Amazon API Gateway.Not this one. It is a managed front door with nothing to patch.

Learn it: EC2 (Elastic Compute Cloud) · ECS and Fargate · Lambda

Question 6Todo.io's monthly export takes about 40 minutes. Which compute choice can run it in one go without managing servers?

A task on ECS with Fargate.Correct. Tasks run as long as they need to. Lambda stops at 15 minutes.A Lambda function with a 40-minute timeout.Not this one. The longest a Lambda function can run is 15 minutes.API Gateway.Not this one. It passes requests to backends; it doesn't run jobs.An SQS queue.Not this one. A queue holds the job; something else still has to run it.

Learn it: Lambda · ECS and Fargate

Question 7Todo.io's Lambda function processes large uploads and always stops at exactly 15 minutes, unfinished. What is the right fix?

Split the work into smaller pieces, or run it on a service without that limit, such as ECS on Fargate.Correct. 15 minutes is the most a Lambda function can ever run.Raise the function's timeout to 30 minutes.Not this one. The timeout can't go above 15 minutes.Give the function more memory, which extends the limit.Not this one. More memory makes it faster, but the 15-minute limit stays.Attach the function to a VPC.Not this one. Being in a VPC changes what it can reach, not how long it can run.

Learn it: Lambda

Question 8How is Todo.io billed for a Lambda function?

Per request, and for how long each run takes (by the millisecond, scaled by its memory size).Correct. No requests, no compute charge: you never pay for an idle server.Per hour while the function exists.Not this one. An unused function costs nothing to keep.A flat monthly fee per function.Not this one. There is no flat fee.Per GB of code stored only.Not this one. Requests and run time are what you pay for.

Learn it: Lambda

Question 9Todo.io creates a new Lambda function and doesn't attach it to any VPC. Can it call DynamoDB?

Yes. By default a function runs outside your VPC and can reach public AWS endpoints such as DynamoDB.Correct. With no VPC there are no subnets or security groups involved; IAM decides.No. It needs a NAT gateway first.Not this one. NAT is only needed once a function is attached to a VPC.No. Every function must be in a VPC to reach AWS services.Not this one. The default, outside a VPC, already reaches them.Only if the function has a public IP.Not this one. Lambda functions don't get IP addresses you manage.

Learn it: Lambda · DynamoDB

Question 10When should Todo.io attach a Lambda function to its VPC?

When it needs to reach something private inside the VPC, such as the RDS database.Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources.Whenever it needs the internet.Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway.To make it run faster.Not this one. Speed comes from memory size, not from the VPC.Always; IAM only works inside a VPC.Not this one. IAM has nothing to do with VPCs.

Learn it: Lambda

Question 11How many execution roles does a Lambda function have?

Exactly one. Its permissions are everything the function's code can do in AWS.Correct. Give that one role only what the function needs.One per caller.Not this one. Who may call the function is set by its resource-based policy, not by extra roles.One per run.Not this one. Every run uses the same role.None. Functions get permissions from the account.Not this one. Nothing gets permissions just by being in an account.

Learn it: Lambda · IAM role

Question 12Todo.io's Lambda function prints log lines, but nothing appears in CloudWatch Logs. What is the most likely cause?

Its execution role doesn't allow writing logs (such as logs:CreateLogStream and logs:PutLogEvents).Correct. Lambda sends output to CloudWatch Logs automatically, using the function's own role.Lambda can't send logs anywhere.Not this one. It sends them to CloudWatch Logs by default.The CloudWatch agent isn't installed.Not this one. The agent is for EC2. Lambda needs nothing installed.CloudTrail is turned off.Not this one. CloudTrail records API calls; it isn't where function output goes.

Learn it: Lambda · CloudWatch Logs

Question 13Todo.io's worker is a Lambda function that handles messages from an SQS queue. How do the messages reach the function?

Lambda polls the queue for you (an event source mapping) and runs the function with each batch.Correct. SQS never pushes. Lambda does the polling, so you don't write any.SQS pushes each message to the function.Not this one. SQS only hands out messages to whoever asks.The team writes a scheduled job that copies messages to the function.Not this one. The event source mapping already does this.Through API Gateway.Not this one. API Gateway is for HTTP requests, not for queues.

Learn it: Lambda · SQS

Question 14A Lambda function with a 60-second timeout processes an SQS queue whose visibility timeout is 30 seconds. Some messages are processed twice. What is the fix?

Raise the queue's visibility timeout well above the function's timeout; AWS suggests at least six times.Correct. A message becomes visible again after 30 seconds, while the first run is still working on it, so a second run picks it up.Shorten how long the queue keeps messages.Not this one. Retention is how long unread messages wait; it doesn't cause repeats.Add a dead-letter queue.Not this one. A DLQ catches messages that keep failing. These ones succeed, just twice.Lower the function's memory.Not this one. That only makes each run slower, which makes it worse.

Learn it: Lambda · SQS (Simple Queue Service)

Question 15Todo.io moves its API to Lambda. Which of these is still Todo.io's job?

The function's code and the permissions in its execution role.Correct. AWS runs the servers, the operating system and the scaling. What your code does, and what it is allowed to do, stay yours.Patching the operating system.Not this one. With Lambda there is no operating system for you to patch.Adding servers when traffic grows.Not this one. Lambda scales by itself.Replacing failed hardware.Not this one. Hardware is always AWS's job.

Learn it: Lambda

Question 16What does "Lambda" mean?

Upload a function; AWS runs it only when something calls it.Correct. Think of it as: A taxi. You pay for the ride, not for owning the car.Run containers on AWS. With Fargate, AWS also runs the servers underneath.Not this one. That describes ECS and Fargate.A managed HTTPS front door that passes requests to your code.Not this one. That describes API Gateway.Rent a virtual server by the second.Not this one. That describes EC2 (Elastic Compute Cloud).

Learn it: Lambda

Question 17Which term is this? "Upload a function; AWS runs it only when something calls it."

LambdaCorrect. Yes. Think of it as: A taxi. You pay for the ride, not for owning the car.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second.

Learn it: Lambda

Question 18Which AWS term is described by this analogy? "A taxi. You pay for the ride, not for owning the car."

LambdaCorrect. Yes: Upload a function; AWS runs it only when something calls it.ECS and FargateNot this one. ECS and Fargate is: Run containers on AWS. With Fargate, AWS also runs the servers underneath. Its analogy: Handing over a packed lunchbox and letting someone else heat it up.API GatewayNot this one. API Gateway is: A managed HTTPS front door that passes requests to your code. Its analogy: A receptionist who takes every visitor's request and phones the right person.EC2 (Elastic Compute Cloud)Not this one. EC2 (Elastic Compute Cloud) is: Rent a virtual server by the second. Its analogy: Renting a computer you have to look after yourself.

Learn it: Lambda

Lambda

Worth another look

Your weak spots

Services

Concepts