Lab 2D part 2 — Lambda stats uploader → Aurora

15 timed scenario questions (~24 min, ~96 sec each). Reinforces night-17-lambda-aurora.md and night-17-lab-lambda-stats-setup scripts. Answer without peeking at night-17-quiz-answers.json first.

1. 1.night-17-lab deploys saa-study-gsa-stats-uploader in Night 9 private subnets with saa-study-gsa-lambda-stats-sg. Aurora saa-study-gsa-aurora-sg already allows TCP 5432 from lambda-stats-sg. What additional SG rule does the Lambda security group need for PostgreSQL writes?

   A.Inbound TCP 5432 from aurora-sg so Aurora can push query result sets back to LambdaB.No inbound rule — Lambda initiates outbound TCP 5432 to the Aurora writer endpointC.Inbound TCP 443 from 0.0.0.0/0 so Secrets Manager works over the public internetD.Inbound TCP 5432 from the entire VPC CIDR 10.0.0.0/16 to support Multi-AZ failover

2. 2.The stats uploader runs INSERT … ON CONFLICT to increment monthly_runs in resort_stats. Which Aurora endpoint must DB_HOST point to?

   A.Custom Route 53 CNAME you create for the current Aurora reader instance hostnameB.RDS Data API HTTPS endpoint enabled on the cluster for all INSERT and SELECT callsC.Cluster reader endpoint — load-balanced path for both SELECT queries and INSERT writesD.Cluster writer endpoint — all writes and default primary reads go to the writer

3. 3.First -TestInvoke after create-function takes 30+ seconds while later invokes finish in a few seconds. What is the most likely cause?

   A.Lambda VPC attachment creates or attaches ENIs in private subnets on cold startB.Aurora Serverless v2 scales to zero and must cold-start the database engine firstC.SQS long polling blocks the synchronous invoke until a completion message arrivesD.Secrets Manager rotates the master password on every GetSecretValue API call

4. 4.night-17-lab stores DB_SECRET_ARN in environment variables and calls secretsmanager:GetSecretValue at runtime. Why not put the master password directly in DB_PASSWORD?

   A.Lambda environment variables cannot exceed 4 KB total size across all key/value pairsB.PostgreSQL rejects passwords delivered via environment variables over the TCP sessionC.Secrets Manager supports rotation and audit; plaintext env vars leak in console and logsD.Aurora ManageMasterUserPassword only works with RDS Data API clients, not with TCP drivers

5. 5.Night 13 queue saa-study-gsa-iceland-completion has VisibilityTimeout=60. The Lambda timeout is 30 seconds. Is this pairing valid for the event source mapping?

   A.No — visibility timeout must exactly equal the configured Lambda function timeoutB.No — visibility timeout must be shorter so DLQ redrive triggers after each failure fasterC.Yes — visibility timeout should be at least Lambda timeout so the message stays hiddenD.Yes — but only if the queue is FIFO with content-based deduplication enabled on sends

6. 6.An SQS message body contains the full ECS Task State Change JSON from Night 13 EventBridge. The handler has no resort_id field. What should the uploader do in this study lab?

   A.Reject the message immediately and send it directly to the DLQ without any retry attemptsB.Parse taskArn and call ECS DescribeTasks to read container environment overridesC.Treat Iceland completion as the default IS-001 resort row UPSERT for this study labD.Forward the raw ECS JSON to Aurora using RDS Data API batch_execute_statement for inserts

7. 7.Lambda in private subnets must reach Secrets Manager and CloudWatch Logs. Night 9 VPC uses a NAT Gateway in the public subnet. What happens if you remove the NAT route from the private subnet route table?

   A.Outbound calls to AWS APIs fail unless VPC interface endpoints replace the NAT pathB.Lambda still reaches Secrets Manager because Aurora security groups allow AWS API egressC.Database TCP 5432 continues working but SQS event source polling stops permanentlyD.Lambda automatically uses the RDS Data API instead of NAT for all AWS service calls

8. 8.GSA wiki page views use DynamoDB UpdateItem ADD on a partition key. resort_stats monthly aggregates need SQL JOIN reports. Where should each workload live?

   A.DynamoDB for simple counters; Aurora for relational stats and SQL JOIN queriesB.Both in Aurora — use JSON columns in PostgreSQL for high-volume page view countersC.Both in DynamoDB — store resort_stats as a single-item document per resort_id keyD.S3 CSV files for both — Athena replaces DynamoDB and Aurora for all metric queries

9. 9.You add fifty concurrent Lambda pollers on the same completion queue without RDS Proxy. Aurora reports too many connections. What is the exam-best mitigation?

   A.Increase Lambda memory to 10 GB so each execution reuses one persistent DB connectionB.Open the Aurora security group to 0.0.0.0/0 so connections distribute across the internetC.Switch INSERT statements to the reader endpoint to split write connection load evenlyD.Place RDS Proxy between Lambda and Aurora to pool and multiplex database connections

10. 10.night-17-lab bundles pg8000 in the deployment package instead of using RDS Data API from Lambda. Why choose VPC TCP for this lab path?

    A.RDS Data API cannot run INSERT statements against Aurora PostgreSQL writer endpointsB.Exam scenarios often test Lambda-in-VPC plus SG-referenced DB access on port 5432C.Data API requires public accessibility enabled on the Aurora instance for HTTPS callsD.pg8000 is the only PostgreSQL driver the AWS Lambda Python runtime includes by default

11. 11.After -TestInvoke succeeds, -VerifyRow uses aws rds-data execute-statement from your laptop. Why can the laptop query resort_stats while the uploader uses pg8000 over TCP?

    A.VerifyRow connects through the Lambda ENI using SSM Session Manager port forwardingB.RDS Data API uses HTTPS with cluster ARN + Secrets Manager — no VPC path from laptopC.The writer endpoint is temporarily public only while the VerifyRow script is runningD.Aurora automatically mirrors Data API results to a public read replica for laptop access

12. 12.night-17-lab-lambda-stats-teardown.ps1 deletes the function and IAM role but leaves Aurora and SQS. A teammate runs Night 16 teardown next. What breaks for Night 13 consumers?

    A.Nothing — SQS and EventBridge rules are independent of the Aurora study clusterB.Night 13 queue is deleted automatically when the Aurora cluster is removed from the accountC.EventBridge stops publishing because Aurora was registered as the event source for ECSD.DLQ messages replay into the deleted Lambda and permanently block the completion queue

13. 13.The handler uses ON CONFLICT (resort_id) DO UPDATE to increment monthly_runs. Which property makes this safe when SQS delivers duplicate completion messages?

    A.SQS FIFO guarantees exactly-once delivery without needing MessageDeduplicationId valuesB.Lambda event source mapping deletes messages from the queue before invoking the functionC.Aurora reader endpoint deduplicates concurrent INSERT statements across all connectionsD.Standard SQS is at-least-once — idempotent UPSERT prevents double-count corruption

14. 14.You need sub-second wiki view counter updates globally with no JOINs. Iceland batch completion runs once per month. Which storage and trigger pairing fits?

    A.Aurora for wiki views; SQS triggers a monthly Lambda that updates counter rows onlyB.DynamoDB for wiki views; SQS → Lambda → Aurora for monthly batch resort_stats writesC.ElastiCache for both workloads — flush counter and stats data to S3 nightly for BID.RDS Multi-AZ provisioned instance for wiki views; EventBridge writes directly to DynamoDB

15. 15.Create-function fails with EC2 502 when attaching VpcConfig immediately after creating the IAM role. What is the first fix to try?

    A.Enable public accessibility on the Aurora cluster so Lambda VPC ENI creation can succeedB.Change the Lambda runtime from python3.12 to python3.9 for better VPC ENI compatibilityC.Wait for IAM role propagation, then retry create-function or update-function-configurationD.Remove Secrets Manager permissions — VPC-attached Lambdas cannot call Secrets Manager APIs