41. Stale callback in a long effect
One second after Splash appears, the parent passes a new onTimeout lambda. Which lambda is called after 3 seconds?
@Composable
fun Splash(onTimeout: () -> Unit) {
LaunchedEffect(Unit) {
delay(3000)
onTimeout()
}
}- A.The newest lambda, because composables always read the latest parameters
- B.The original lambda captured when the effect started; use val currentOnTimeout by rememberUpdatedState(onTimeout) and call that instead
- C.Both lambdas, one after the other
- D.Neither; a new lambda parameter restarts every LaunchedEffect in the composable, so the 3 second timer resets each time the parent passes one
Show answer
Answer: B. The original lambda captured when the effect started; use val currentOnTimeout by rememberUpdatedState(onTimeout) and call that instead
The effect coroutine was started once with the onTimeout value from the first composition, and its key Unit never changes, so it keeps calling that old lambda. Keying the effect on onTimeout would restart the timer, which is not wanted. rememberUpdatedState keeps a reference that always points to the latest lambda without restarting the effect.
42. Removing a module that has its own provider
An old child module contains its own provider "aws" block. You delete the module call to destroy its resources, and plan fails with "Provider configuration not present". Why?
- A.The provider binary was deleted from the .terraform folder
- B.The provider config needed to destroy them left with the module
- C.The state lock is still held by the old module
- D.Child modules cannot hold resources that need destroying
Show answer
Answer: B. The provider config needed to destroy them left with the module
To destroy resources Terraform needs the provider configuration that manages them, and it disappeared with the module. Fix it by first destroying with the module still present, or move the provider to the root and pass it in. This is why child modules should not declare their own provider blocks.
43. S3 consistency model
An application overwrites an existing S3 object with a new version (a successful PUT), then immediately sends a GET for the same key from another service. What does the GET return today?
- A.The new version, because S3 provides strong read-after-write consistency
- B.Either the old or new version, because S3 overwrites are eventually consistent
- C.A 404 error until replication finishes
- D.The old version for up to 15 minutes
Show answer
Answer: A. The new version, because S3 provides strong read-after-write consistency
Since December 2020, Amazon S3 provides strong read-after-write consistency for PUTs and DELETEs of objects, including overwrites and LIST operations, in all regions at no extra cost. Older material describing eventual consistency for overwrites is outdated. Cross-region replication, however, is still asynchronous.
44. Active-active writes across regions
You run an active-active app in two regions using DynamoDB global tables (default multi-region eventual consistency mode). Users in both regions update the same item at nearly the same time. What happens?
- A.Both writes are merged field by field automatically
- B.Replication resolves the conflict with last writer wins, so one update is silently lost
- C.The second write fails with a conflict error that the client must retry
- D.The table goes read-only until an operator resolves the conflict
Show answer
Answer: B. Replication resolves the conflict with last writer wins, so one update is silently lost
In the default eventually consistent mode, DynamoDB global tables replicate asynchronously and resolve concurrent writes to the same item with last writer wins based on timestamps. One update can be lost without an error. Designs handle this by routing a given user or record to a single home region, using conditional writes or version counters, or choosing the strongly consistent multi-region mode where it fits.
45. Lambda spike breaks the database
During a traffic spike, a Lambda function scales to 800 concurrent executions and RDS PostgreSQL starts returning "too many connections". What is the best fix?
- A.Increase the Lambda timeout so connections can wait longer
- B.Move the Lambda out of the VPC to use public endpoints
- C.Give the function more memory to reuse connections
- D.Add RDS Proxy and cap the function with reserved concurrency
Show answer
Answer: D. Add RDS Proxy and cap the function with reserved concurrency
Each concurrent Lambda environment opens its own connections, so fast scaling overwhelms the database connection limit. RDS Proxy pools and reuses connections, and reserved concurrency caps how far the function can scale. Memory and timeout changes do not reduce connection count.
46. A function that triggers itself
A Lambda function is triggered by uploads to a bucket, resizes the image and writes the result back to the same bucket. The bill explodes overnight. Why?
- A.Image resizing is billed per pixel processed
- B.Each output upload re-triggers the function in a loop
- C.S3 charges more for objects written by Lambda
- D.Lambda retries every invocation 100 times by default
Show answer
Answer: B. Each output upload re-triggers the function in a loop
Writing outputs into the bucket that triggers the function creates a recursive loop. Write results to a different bucket, or filter the trigger by prefix or suffix so outputs do not match. Set alarms on invocation counts.
47. A new item missing from the index
Right after writing an order, a query on a DynamoDB global secondary index sometimes does not return it. Strongly consistent reads give an error on the GSI. Why?
- A.GSIs update asynchronously and allow only eventual reads
- B.The write must have failed silently in the table
- C.GSIs only show new items after a full hour
- D.The partition key value was too long to index
Show answer
Answer: A. GSIs update asynchronously and allow only eventual reads
Global secondary indexes are updated asynchronously from the base table and do not support strongly consistent reads. Usually the lag is short. If you need read-after-write, read the base table by its key.
48. An ML library too big for a zip
Your Lambda function needs ML libraries totalling 1.5 GB unzipped. The zip deployment fails. What is the supported option?
- A.Split the code across 10 Lambda layers
- B.Package it as a container image, which allows up to 10 GB
- C.Upload the zip to S3 first; it removes the limit
- D.Compress the libraries twice
Show answer
Answer: B. Package it as a container image, which allows up to 10 GB
Zip packages including layers are limited to 250 MB unzipped. Lambda container images can be up to 10 GB. Large images can slow cold starts, so trim dependencies and consider whether a container service fits better.
49. Protecting tags used for ABAC
Your ABAC policies grant access when aws:ResourceTag/team matches aws:PrincipalTag/team. What extra control is essential?
- A.Make all tag keys and values lowercase everywhere
- B.Turn on S3 versioning for every bucket in scope
- C.Use only AWS managed policies for the roles
- D.Stop principals from changing their own or resources' tags
Show answer
Answer: D. Stop principals from changing their own or resources' tags
If a user can run iam:TagRole on their own role or ec2:CreateTags to change a resource's team tag, they can grant themselves access to any team's resources. Restrict tag-changing actions with conditions on aws:TagKeys and aws:RequestTag, or set principal tags only from the identity provider as session tags.
50. KMS grants
An application needs to give an AWS service temporary permission to use a key for one job, then remove it, without editing the key policy each time. What KMS feature is designed for this?
- A.Grants, which delegate key use and can be retired or revoked
- B.Aliases, which point a friendly name at the key
- C.Multi-Region keys, which copy the key to other regions
- D.Key rotation, which creates a new key for each job
Show answer
Answer: A. Grants, which delegate key use and can be retired or revoked
Grants give a principal specific operations on a key and are created and retired programmatically, which is how services like EBS and RDS get key access. Key policies are for durable access rules. Use grant constraints, such as encryption context, to narrow what a grant allows.
51. Changing a bucket's default key
You change an S3 bucket's default encryption from key A to key B, then disable key A a week later. Users report old files fail to download. Why?
- A.Existing objects stay encrypted under key A until rewritten
- B.S3 re-encrypts old objects slowly and had not finished yet
- C.Key B cannot decrypt objects older than its own creation date
- D.Disabling a key deletes every object encrypted under it
Show answer
Answer: A. Existing objects stay encrypted under key A until rewritten
Default encryption applies only to new writes; existing objects keep the key they were written with. With key A disabled, S3 cannot decrypt them. Re-encrypt old objects first, for example with S3 Batch Operations copying them in place with key B, and only then disable the old key.
52. Preventive vs detective controls
Your organization blocks public S3 buckets with an SCP and Block Public Access, and also runs a Config rule that flags public buckets. Why keep both?
- A.Config rules are required before SCPs can be attached
- B.SCPs only work if a Config rule is also deployed
- C.There is no reason; the Config rule is fully redundant
- D.Detective controls catch gaps and exceptions the preventive ones miss
Show answer
Answer: D. Detective controls catch gaps and exceptions the preventive ones miss
Defence in depth assumes any single control can fail or be exempted, for example in an account outside the OU, an approved exception, or a new access path. Detective controls show you when reality drifts from intent. Preventive and detective controls work best together, with automated remediation where safe.
53. Building an S3 data perimeter
You want company buckets usable only by your own identities and only from your networks. Which combination expresses this data perimeter?
- A.Security groups on each bucket that allow only office IP ranges
- B.A NAT gateway in every VPC and a public bucket policy
- C.Bucket policies that deny unless PrincipalOrgID and SourceVpce match
- D.Encrypting every bucket with SSE-S3 and enabling versioning
Show answer
Answer: C. Bucket policies that deny unless PrincipalOrgID and SourceVpce match
A data perimeter uses deny statements with conditions such as aws:PrincipalOrgID (trusted identities) and aws:SourceVpce or aws:SourceIp (expected networks), with exceptions for AWS services acting for you. VPC endpoint policies add the mirror check that your networks reach only your resources. Buckets have no security groups, and SSE-S3 does not limit who can read.
54. Low traffic makes WAL archiving lag
DR relies only on WAL archiving to S3, with no streaming replica. At night traffic is low and a 16 MB WAL segment can take 3 hours to fill. What limits data loss to about one minute?
- A.Raise max_wal_size to 64 GB
- B.Set archive_timeout = 60s
- C.Set wal_level = minimal
- D.Lower checkpoint_timeout to 30s
Show answer
Answer: B. Set archive_timeout = 60s
A segment is archived only when it is full or a switch is forced. archive_timeout forces a switch after the given time, so at most about a minute of changes sit unarchived. Each forced switch still archives a 16 MB file, so very low values waste storage; streaming gives an even lower RPO.
55. A role trust policy that adds a stranger
CloudTrail shows UpdateAssumeRolePolicy on an admin role, adding an AWS account ID nobody recognises to the trust policy. What is the risk?
- A.The role is deleted after 24 hours
- B.The role loses all its permissions
- C.Only billing data is shared with that account
- D.That external account can now assume the admin role
Show answer
Answer: D. That external account can now assume the admin role
The trust policy says who may assume a role. Adding an outside account gives a persistent backdoor that survives password and key resets inside your account. Alert on trust policy changes and use IAM Access Analyzer to flag external access.
56. GitHub OIDC role without a sub check
An AWS role trusts GitHub's OIDC provider and its trust policy checks only that the token's aud is sts.amazonaws.com. What is the risk, and the fix?
- A.Tokens expire too fast; raise the session duration to 12 hours
- B.Workflows in other repos could assume it; restrict the sub claim
- C.GitHub will reject the role; add an access key as fallback
- D.Only public repos can use it; switch to a client secret
Show answer
Answer: B. Workflows in other repos could assume it; restrict the sub claim
Every GitHub Actions token has the same issuer and can carry that audience, so without a sub condition the role trusts workflows from repositories you do not own. Add a condition on token.actions.githubusercontent.com:sub such as repo:your-org/your-repo:ref:refs/heads/main or a specific environment. Keep the role's permissions narrow too.
57. Lambdas created in a loop
What does this print?
funcs = [lambda: i for i in range(3)]
print([f() for f in funcs])
- A.[2, 2, 2]
- B.[0, 1, 2]
- C.[0, 0, 0]
- D.It raises a NameError
Show answer
Answer: A. [2, 2, 2]
Each lambda looks up i when it is called, not when it is created, and by then the loop has finished with i equal to 2. This is called late binding. Capture the current value with a default argument, lambda i=i: i, to get [0, 1, 2].
58. Every task loads the last table
Three tasks are created in a loop. When they run, all three load "payments". Why?
for t in ["orders", "users", "payments"]:
PythonOperator(
task_id=f"load_{t}",
python_callable=lambda: load_table(t),
)- A.task_id must not contain f-strings
- B.PythonOperator caches the first callable
- C.The lambda reads t when it runs, after the loop has ended
- D.Airflow runs only the last task created in a loop
Show answer
Answer: C. The lambda reads t when it runs, after the loop has ended
The lambda captures the variable t, not its value at that moment. The worker parses the file, the loop finishes with t = "payments", and only then is the lambda called. Pass the value explicitly with op_kwargs={"table": t} or a default argument.
59. Retries leaving extra files
An extract task writes s3://raw/orders/2026-03-05/part_<current_timestamp>.json. A retry wrote a second file, and the loader read both. What is the root fix?
- A.Have the loader read only the newest file in the folder
- B.Name files only from the run's date so retries overwrite
- C.Disable retries for the extract task
- D.Add the timestamp in milliseconds instead
Show answer
Answer: B. Name files only from the run's date so retries overwrite
A name based on the current time is new on every attempt, so retries add files instead of replacing them. Deriving the path only from the data interval, or clearing the folder before writing, makes the task idempotent.
60. Mocking a third-party SDK
Tests mock the AWS SDK's S3 client methods directly in 40 places. An SDK upgrade changes return shapes, all tests stay green, and production breaks. What is the better design?
- A.Mock the SDK in even more detail so that the mocks match every possible response
- B.Wrap the SDK in your own small adapter, mock that, and test the adapter against the real service
- C.Pin the SDK version forever so that its responses can never change
- D.Remove all tests that touch storage and rely on manual checks
Show answer
Answer: B. Wrap the SDK in your own small adapter, mock that, and test the adapter against the real service
Mocks of a library you do not own encode your guesses about its behaviour and drift silently. An adapter with your own interface keeps mocks meaningful, and a few integration tests of the adapter against the real service (or a faithful local emulator) catch upgrade breaks.
