Independent: not affiliated with AWS. Free to try; the study bundle adds a study guide and two practice exams.
5 original questions, none of them in the practice exams.
Pick an answer. Show answer explains every option and links its AWS source.
5 questions / Explanations link AWS sources / Last updated Oct 27, 2026
Question 1
Multiple choice
Domain 1 / Development with AWS Services
A single-page application served from https://app.example.com calls GET /orders on an API Gateway REST API at https://api.example.com. The method uses a Lambda proxy integration, and the browser sends an Authorization header with the request. The developer used Enable CORS in the API Gateway console, which created an OPTIONS method, and the browser's preflight request now succeeds, but the GET request is still blocked with a CORS error. The same request from the command line returns 200. What should the developer do?
Show answerHide answer
Answer: A
Why
With a Lambda proxy integration the backend is responsible for returning the CORS headers, because a proxy integration does not return an integration response. The function must therefore include Access-Control-Allow-Origin, along with the other CORS headers, in its response to the GET request. The OPTIONS method that Enable CORS created answers only the preflight, which is why the preflight succeeds while the browser still rejects the GET response.
Why not the others
BThe preflight already succeeds, so the OPTIONS method already returns what the browser needs for it; the header that is missing is on the GET response, which the browser checks as well.
CAuthorization is not what is failing, since the same request returns 200 from the command line; removing it would also drop the API's access control, and the GET response would still lack Access-Control-Allow-Origin, so the browser would still block it.
DA proxy integration does not return an integration response, so API Gateway has no integration response to hold the header; with a proxy integration the backend returns the CORS headers.
An inventory service runs on several Amazon ECS tasks. Each task reads a stock item from an Amazon DynamoDB table, subtracts the quantity ordered, and writes the new quantity back with UpdateItem. When two tasks sell the same SKU at the same moment, the second write replaces the first and the stock count ends up too high. The team does not want to add a lock item or switch to transactions. Which change stops the lost update?
Show answerHide answer
Answer: B
Why
A conditional write succeeds only if the item still meets the condition, and DynamoDB checks the condition against the most recently updated version of the item. If the other task changed the quantity after this task read it, the condition is false, the write fails with ConditionalCheckFailedException, and the task re-reads and retries instead of overwriting. Because the condition checks the same attribute that the update changes, DynamoDB applies the same request only once even if it is retried after a network error.
Why not the others
AA strongly consistent read returns the latest quantity, but the UpdateItem that follows is still unconditional, so two tasks can read the same value and the second write still replaces the first.
CA stream record appears only after the overwrite has been committed, so the function can repair the count afterward at best, and the table holds the wrong quantity until it does.
DCapacity mode and retries address throttling, not an unconditional write replacing the stored value; two tasks that read the same quantity still overwrite each other.
A bank's customer chatbot calls an Amazon Bedrock model through the Converse API. Compliance requires that the assistant stay out of investment advice in both directions: customer messages that ask for it must be blocked, and model responses that offer it must be blocked. The compliance team wants to tighten or loosen the rule later without a change to the application code. What should the developer do?
Show answerHide answer
Answer: C
Why
A denied topic in a guardrail is evaluated against both the user input and the model response, so requests for investment advice are blocked on the way in and answers that offer it are blocked on the way out. The compliance team edits the rule in the guardrail's working draft and creates a new version; because the application reads the guardrail ID and version from configuration, switching to the new version is a configuration change, not a code change.
Why not the others
ACustom word filters use whole-word and whole-phrase matching, so advice that avoids those exact words passes, while any message that merely uses one of them, such as a question about the customer's own stock purchase, is blocked.
BContextual grounding checks run only on model responses and score them for grounding in a supplied source and relevance to the query; they do not block a subject, so a customer's request for investment advice is not stopped.
DA system prompt instruction is not enforced by anything outside the model, and temperature controls how random the output is, not which topics the model will discuss; nothing in this option blocks the customer's message.
A build server runs on an Amazon EC2 instance with an instance profile. Its deployment script runs docker build and then docker push to a private Amazon ECR repository in the same account and Region, with no login step, and the push fails with "no basic auth credentials". The instance profile role's only Amazon ECR permissions are ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload and ecr:PutImage on the repository. Which two changes make the push succeed? Choose two.
Show answerHide answer
Answers: D and E
Why
The Docker CLI does not support native IAM authentication, so the script must retrieve an Amazon ECR authorization token and pass it to docker login. The aws ecr get-login-password command retrieves and decodes the token for that purpose, and docker login takes it with the username AWS and the registry URI. Retrieving the token calls the GetAuthorizationToken API, which the role must allow on all resources; the token carries the role's permissions and is valid for 12 hours.
Why not the others
Adocker login takes an ECR authorization token as the password, not IAM access keys, and the Docker CLI has no native IAM authentication to fall back on.
BAmazon ECR requires the ecr:GetAuthorizationToken permission to come from an IAM policy, so a repository policy cannot supply it, and the role's own policy already allows the push actions on the repository.
Caws ecr get-authorization-token returns a base64-encoded token that holds the username AWS and an encoded password, not the password itself; get-login-password retrieves and decodes the token for docker login.
A Lambda function that imports nightly files must never be throttled because other functions in the account are busy. The account's Lambda concurrency quota in the Region is 1,000, and no function in the account has reserved or provisioned concurrency. The developer sets the function's reserved concurrency to 1,000 and Lambda rejects the setting with an error. Which value is the highest reserved concurrency Lambda accepts for the function?
Show answerHide answer
Answer: A
Why
A function can reserve up to the account's unreserved concurrency minus 100, because Lambda keeps those 100 units for functions that have no reserved concurrency; with a 1,000 quota and nothing else reserved, the most one function can reserve is 900. Reserved concurrency is also the function's maximum, and configuring it incurs no additional charges.
Why not the others
BThere is no rule tied to whether the function is receiving invocations; the limit is the unreserved pool minus 100.
CThere is no half-of-quota rule; the only ceiling is the unreserved account concurrency minus 100.
DProvisioned concurrency allocates pre-initialized environments and incurs additional charges; it does not raise how much concurrency a function can reserve.
The study bundle has two practice exams with 130 original questions, an answer key and an explanation for every answer, plus the 65-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
130 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.