4.1 - Tracing and observability with X-Ray
AWS Certified Developer Associate objective 4.1 covers observability and distributed tracing. AWS X-Ray traces a request as it flows across services such as Lambda, API Gateway and DynamoDB, showing a service map and where latency or errors occur. To filter and group traces by a business value, a developer adds an annotation, which X-Ray indexes so you can search on it, unlike metadata which is stored but not indexed. If a Lambda is instrumented with the X-Ray SDK but shows no traces, the fix is to enable active tracing on the function and grant X-Ray write permissions in its execution role, so segments are actually sent. You should also know sampling rules, subsegments and CloudWatch integration. Expect scenario questions that describe tracing a request across services, filtering traces by a value, or missing traces from an instrumented function, and ask which X-Ray feature or fix applies.
Trace a request across Lambda/API Gateway/DynamoDB = X-Ray. Filter/group traces by a business value = annotation (indexed; metadata is not). No traces from an instrumented Lambda = enable active tracing + X-Ray write permission.
Practice questions
1. Which service traces a request across Lambda, API Gateway, and DynamoDB to find latency bottlenecks?
- Amazon CloudWatch Logs
- AWS X-Ray (correct answer)
- AWS CloudTrail
- Amazon Athena
X-Ray provides distributed tracing with a service map and segment timings, revealing where latency accrues across a request path. CloudTrail records API calls; Logs store text logs.
2. Where do a Lambda function's console output and errors appear by default for debugging?
- Amazon S3 access logs
- AWS CloudTrail events
- The EC2 system log
- Amazon CloudWatch Logs (correct answer)
Lambda automatically streams stdout/stderr and errors to a CloudWatch Logs log group (needs logs permissions in the execution role). CloudTrail records the management API calls, not function output.
3. Messages that repeatedly fail processing in an SQS queue should be isolated for later inspection using which feature?
- Long polling on the main queue
- A dead-letter queue (DLQ) (correct answer)
- Per-message delay timers
- Short polling on the queue
A dead-letter queue receives messages that exceed the maxReceiveCount, isolating poison messages so the main queue keeps flowing and you can debug them separately.
4. Which service records who made a given AWS API call and when, for auditing and security investigations?
- Amazon CloudWatch metrics
- AWS X-Ray traces
- Amazon Inspector
- AWS CloudTrail (correct answer)
CloudTrail logs management and (optionally) data API activity, capturing the identity, time, source IP, and parameters of each call, which is the primary tool for auditing and forensics.
5. An SDK call intermittently returns a 500-series error from a service. What is the appropriate client behavior?
- Fail immediately and alert the user
- Retry with exponential backoff and jitter (correct answer)
- Loop retry instantly without any delay
- Switch to a different AWS Region permanently
5xx errors are typically transient server-side issues; the SDK retries idempotent calls with exponential backoff and jitter. Instant tight-loop retries can worsen load and trigger throttling.
6. In X-Ray, a developer wants to filter and group traces by a business value such as customerId. What should they add to the segment?
- Extra metadata fields, which are indexed
- An annotation, which is indexed for filtering (correct answer)
- A larger sampling rate on the service
- A subsegment for every downstream call
X-Ray annotations are indexed key-value pairs you can filter and group traces by. Metadata is stored but not indexed, so it cannot be used in filter expressions.