A developer's application uses an AWS Lambda function to process messages from an Amazon SQS queue. The Lambda function sometimes fails or times out, and the developer must capture and investigate the messages that could not be processed with the least operational overhead. Which approach satisfies this requirement?

Creating a dead-letter queue (DLQ) for the SQS queue is the most effective solution. When a Lambda function fails to process a message from an SQS queue, or if it times out, the message can be automatically moved to the DLQ after a specified number of retries. This allows for easy isolation and investigation of problematic messages with minimal operational overhead. Increasing the Lambda timeout might reduce timeouts but doesn't address processing failures, and CloudTrail is for API activity, not application errors. Increasing the SQS visibility timeout only delays reprocessing; it doesn't capture failed messages for later analysis. Writing to DynamoDB requires custom code and management, increasing operational overhead compared to an SQS DLQ.