139 free AWS DVA-C02 practice questions from the CertStash pack of 557, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 139 free here, all 557 in the pack, and each step includes the one before it.
Get all 557 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions. When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API. A developer needs to implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts. Which solution will meet these requirements with the LEAST management overhead?
Show answer and explanation
Correct answer: C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
AWS Secrets Manager is purpose-built for storing sensitive data like access tokens with automatic encryption at rest using KMS, encryption in transit via TLS, and built-in resource-based policy support for cross-account access. It requires the least management overhead compared to alternatives because it handles rotation, versioning, and access control natively. Parameter Store lacks native cross-account support without workarounds, DynamoDB and S3 require manual encryption and decryption logic on the application side.
Why the other options are wrong
- A. Parameter Store SecureString requires additional workarounds for cross-account access and is not optimized for sensitive secrets management.
- B. DynamoDB requires manual encryption/decryption logic on EC2 instances and is not designed for secrets storage.
- D. S3 is not designed for secrets storage and requires manual encryption/decryption handling on the application side.
Question 2
A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amazon SQS) queue in the company's main AWS account for further processing. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.
Option D correctly implements cross-account event routing by configuring the main account's event bus to receive events from other accounts, creating forwarding rules in each child account to send EC2 lifecycle events to the main account event bus, and then matching those events with an SQS queue target. This is the standard AWS pattern for centralized event collection across accounts using EventBridge's event bus permissions and rules.
Why the other options are wrong
- A. EC2 cannot be directly configured to deliver events to another account's EventBridge; EventBridge rules in source accounts must forward events.
- B. SQS resource policies do not directly work with EventBridge event routing across accounts; EventBridge rules and event bus permissions are the correct mechanism.
- C. Polling Lambda every minute is inefficient, non-real-time, and not the recommended approach for event-driven architectures.
Question 3
An application is using Amazon Cognito user pools and identity pools for secure access. A developer wants to integrate the user-specific file upload and download features in the application with Amazon S3. The developer must ensure that the files are saved and retrieved in a secure manner and that users can access only their own files. The file sizes range from 3 KB to 300 MB. Which option will meet these requirements with the HIGHEST level of security?
Show answer and explanation
Correct answer: D. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.
Using IAM policies within Cognito identity prefixes allows fine-grained, attribute-based access control where users can only access S3 paths matching their identity (e.g., s3:::bucket/cognito-identity/${cognito-identity.amazonaws.com:sub}/*). This provides the highest security by enforcing access at the AWS credential level rather than relying on application-level validation. It works for all file sizes and is built-in to AWS IAM.
Why the other options are wrong
- A. S3 Event Notifications are for triggering actions after uploads, not for validating or securing access.
- B. DynamoDB filtering in the UI provides no actual security; users could bypass the UI and directly access files belonging to other users.
- C. API Gateway and Lambda add complexity and management overhead compared to native IAM policy-based access control through Cognito identity.
Question 4
A company is building a scalable data management solution by using AWS services to improve the speed and agility of development. The solution will ingest large volumes of data from various sources and will process this data through multiple business rules and transformations. The solution requires business rules to run in sequence and to handle reprocessing of data if errors occur when the business rules run. The company needs the solution to be scalable and to require the least possible maintenance. Which AWS service should the company use to manage and automate the orchestration of the data flows to meet these requirements?
Show answer and explanation
Correct answer: B. AWS Step Functions
AWS Step Functions is purpose-built for orchestrating workflows with sequential execution of tasks, built-in error handling and retry logic, and automatic reprocessing capabilities. It requires minimal maintenance, scales automatically, and provides state machine-based orchestration ideal for managing complex business rules and transformations in sequence.
Why the other options are wrong
- A. AWS Batch is for large-scale parallel batch computing, not sequential orchestration with error handling.
- C. AWS Glue is an ETL service focused on data cataloging and transformation, not workflow orchestration.
- D. AWS Lambda alone lacks native orchestration, sequencing, and error handling for complex multi-step workflows.
Question 5
A developer has created an AWS Lambda function that is written in Python. The Lambda function reads data from objects in Amazon S3 and writes data to an Amazon DynamoDB table. The function is successfully invoked from an S3 event notification when an object is created. However, the function fails when it attempts to write to the DynamoDB table. What is the MOST likely cause of this issue?
Show answer and explanation
Correct answer: C. The Lambda function does not have IAM permissions to write to DynamoDB.
The Lambda function successfully reads from S3 (proven by successful invocation and data reading), but fails on DynamoDB writes. This indicates the execution role lacks DynamoDB write permissions. IAM permissions are the most common cause of such write failures in Lambda. The function needs explicit permissions to perform PutItem or similar write operations on the DynamoDB table.
Why the other options are wrong
- A. Concurrency limits would prevent invocation, not individual write failures; the function is being invoked successfully.
- B. GSI is optional and not required for basic write operations; tables write to the base table automatically.
- D. Lambda can write to DynamoDB in any region/AZ; there is no AZ-based restriction for DynamoDB writes.
Question 6
A developer is creating an AWS CloudFormation template to deploy Amazon EC2 instances across multiple AWS accounts. The developer must choose the EC2 instances from a list of approved instance types. How can the developer incorporate the list of approved instance types in the CloudFormation template?
Show answer and explanation
Correct answer: D. In the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.
CloudFormation parameters with AllowedValues constraint restrict user input to a predefined list of approved EC2 instance types. This is the cleanest, most maintainable approach that enforces the list at template design time and provides validation during stack creation. Users cannot select instance types outside the approved list.
Why the other options are wrong
- A. Creating separate templates for each instance type is inefficient and not scalable.
- B. Creating resources for each instance type in the Resources section would create all instances, not allow selection of one.
- C. Creating separate parameters for each instance type is redundant and does not provide a unified list constraint.
Question 7
A developer has an application that makes batch requests directly to Amazon DynamoDB by using the BatchGetItem low-level API operation. The responses frequently return values in the UnprocessedKeys element. Which actions should the developer take to increase the resiliency of the application when the batch response includes values in UnprocessedKeys? (Choose two.)
Show answer and explanation
Correct answer: B, D. Retry the batch operation with exponential backoff and randomized delay; Increase the provisioned read capacity of the DynamoDB tables that the operation accesses.
When BatchGetItem returns UnprocessedKeys, it indicates throttling or temporary unavailability. Option B addresses the immediate issue by implementing exponential backoff with jitter, which is the AWS-recommended approach for handling throttling. Option D addresses the root cause by increasing provisioned capacity to handle the workload, preventing UnprocessedKeys from occurring in the first place.
Why the other options are wrong
- A. Immediate retry without backoff will likely result in the same throttling error; backoff is essential.
- C. Using the SDK doesn't directly solve UnprocessedKeys issues; the issue is capacity/throttling, not the API client.
- E. UnprocessedKeys for BatchGetItem is a read issue, not a write issue; increasing write capacity is irrelevant.
Question 8
A company is running a custom application on a set of on-premises Linux servers that are accessed using Amazon API Gateway. AWS X-Ray tracing has been enabled on the API test stage. How can a developer enable X-Ray tracing on the on-premises servers with the LEAST amount of configuration?
Show answer and explanation
Correct answer: B. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.
The X-Ray daemon is the minimal installation required on on-premises servers to capture and relay trace data to the X-Ray service. The daemon runs as a background process, receives trace segments from applications via UDP, and forwards them to AWS. This requires the least configuration compared to SDK installation, which needs code integration and language-specific setup.
Why the other options are wrong
- A. The SDK requires code integration into the application itself, which is more configuration than just running a daemon.
- C. Lambda-based pulling and processing adds unnecessary complexity and latency; the daemon is simpler.
- D. PutTelemetryRecords is for sampling statistics, not trace segments; PutTraceSegments is used for trace data, but Lambda is still overkill.
Question 9
A company wants to share information with a third party. The third party has an HTTP API endpoint that the company can use to share the information. The company has the required API key to access the HTTP API. The company needs a way to manage the API key by using code. The integration of the API key with the application code cannot affect application performance. Which solution will meet these requirements MOST securely?
Show answer and explanation
Correct answer: A. Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
AWS Secrets Manager is specifically designed for managing API keys, credentials, and other sensitive data. It provides automatic rotation, fine-grained access control via IAM, encryption at rest and in transit, and integrates seamlessly with the AWS SDK for runtime retrieval without impacting performance. The secret can be accessed programmatically without storing credentials in code.
Why the other options are wrong
- B. Storing credentials in code variables and pushing to Git, even a secure repository, violates security best practices and creates exposure risks.
- C. S3 is not designed for secrets management; it lacks features like automatic rotation and is primarily for object storage, making it less secure for sensitive credentials.
- D. DynamoDB is not appropriate for secrets storage; it lacks encryption features purpose-built for credentials and should not be used for managing sensitive authentication data.
Question 10
A developer is deploying a new application to Amazon Elastic Container Service (Amazon ECS). The developer needs to securely store and retrieve different types of variables. These variables include authentication information for a remote API, the URL for the API, and credentials. The authentication information and API URL must be available to all current and future deployed versions of the application across development, testing, and production environments. How should the developer retrieve the variables with the FEWEST application changes?
Show answer and explanation
Correct answer: A. Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.
AWS Systems Manager Parameter Store allows centralized management of application configuration across multiple environments with minimal code changes. It supports hierarchical paths for environment-specific variables, integrates with IAM for access control, and works across all deployed versions. Credentials are separately stored in Secrets Manager, which provides additional security features. The application needs only one update to retrieve from Parameter Store.
Why the other options are wrong
- B. AWS KMS is a key management service, not designed for storing and retrieving configuration variables; it would require multiple code updates and doesn't support the hierarchical organization needed.
- C. Encrypted files stored with the application require code changes for each environment and complicate version management across environments.
- D. Defining variables in ECS task definitions requires code changes for each deployment and doesn't provide a centralized management approach for current and future versions.
What people say about the full DVA-C02 pack 5.0 from 4
Anyone getting ready for the AWS DVA-C02 test would benefit greatly from this resource. The practice questions were excellent and the explanations helped the students grasp the difficult subjects. Strongly Recommended!
Question 11
A developer is creating an application that will give users the ability to store photos from their cellphones in the cloud. The application needs to support tens of thousands of users. The application uses an Amazon API Gateway REST API that is integrated with AWS Lambda functions to process the photos. The application stores details about the photos in Amazon DynamoDB. Users need to create an account to access the application. In the application, users must be able to upload photos and retrieve previously uploaded photos. The photos will range in size from 300 KB to 5 MB. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
Amazon Cognito user pools handle account management without operational overhead. S3 is the appropriate service for storing large binary files (300 KB to 5 MB photos), while DynamoDB stores metadata including the S3 object keys. This design leverages AWS managed services, eliminates the need to manage file storage within Lambda or database, scales to tens of thousands of users, and requires minimal operational effort.
Why the other options are wrong
- A. Storing photos directly in DynamoDB is inefficient for large binary files, causes database bloat, and negatively impacts performance and cost.
- C. Creating an IAM user for each application user is operationally overhead-intensive, doesn't scale well, and is not the intended use of IAM for customer-facing applications.
- D. Manually managing a users table in DynamoDB with custom Lambda authorizers adds unnecessary operational complexity compared to using Cognito, which is a fully managed service.
Question 12
A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a RE ST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Define an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish to the canary stage.
By defining an alias on the $LATEST version and updating the API Gateway endpoint to reference this alias, the developer can upload new code without changing the API Gateway URL. API Gateway canary release functionality then splits traffic between the alias (which will route to different versions based on alias configuration) and allows gradual testing. This approach keeps the API Gateway URL constant while enabling traffic shifting through the alias mechanism.
Why the other options are wrong
- A. Using function versions directly requires updating the API Gateway endpoint multiple times, and the process described is convoluted with unnecessary steps.
- B. Creating a new API Gateway stage changes the URL or requires additional routing complexity, violating the requirement to not change the API Gateway URL.
- D. This approach fails to utilize the API Gateway canary release feature and requires endpoint updates, making it operationally inefficient for the stated requirements.
Question 13
A developer has created an AWS Lambda function that makes queries to an Amazon Aurora MySQL DB instance. When the developer performs a test, the DB instance shows an error for too many connections. Which solution will meet these requirements with the LEAST operational effort?
Show answer and explanation
Correct answer: D. Create a proxy in Amazon RDS Proxy. Query the proxy instead of the DB instance.
Amazon RDS Proxy manages database connections through connection pooling, reducing connection overhead and preventing 'too many connections' errors. It sits between Lambda and the database, reusing connections across multiple Lambda invocations with minimal configuration. This is the least operationally intensive solution because it requires no application code changes and solves the connection limit problem directly.
Why the other options are wrong
- A. Read replicas improve read scalability but don't address connection limit issues and add operational complexity.
- B. Migrating to DynamoDB requires significant application redesign and doesn't solve the underlying connection pooling problem.
- C. Multi-AZ deployment improves availability but doesn't reduce connection limits or prevent connection exhaustion.
Question 14
A developer wants to debug an application by searching and filtering log data. The application logs are stored in Amazon CloudWatch Logs. The developer creates a new metric filter to count exceptions in the application logs. However, no results are returned from the logs. What is the reason that no filtered results are being returned?
Show answer and explanation
Correct answer: B. CloudWatch Logs only publishes metric data for events that happen after the filter is created.
CloudWatch Logs metric filters only process and publish metric data for log events that arrive after the filter is created. Historical log data existing before the filter creation will not be evaluated by the new filter. If the application hasn't generated exceptions after the filter was created, no data would be returned.
Why the other options are wrong
- A. VPC endpoints are not required for filtering CloudWatch Logs; metric filtering works in all environments regardless of VPC configuration.
- C. CloudWatch Logs can be filtered independently without streaming to OpenSearch Service; OpenSearch is optional for advanced analytics but not required for basic metric filtering.
- D. Metric filtering does not require exporting logs to S3; filtering is performed on logs in CloudWatch natively and in real-time.
Question 15
A company has migrated an application to Amazon EC2 instances. Automatic scaling is working well for the application user interface. However, the process to deliver shipping requests to the company’s warehouse staff is encountering issues. Duplicate shipping requests are arriving, and some requests are lost or arrive out of order. The company must avoid duplicate shipping requests and must process the requests in the order that the requests arrive. Requests are never more than 250 KB in size and take 5-10 minutes to process. A developer needs to rearchitect the application to improve the reliability of the delivery and processing of the requests. What should the developer do to meet these requirements?
Show answer and explanation
Correct answer: D. Create an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the requests to the SQS queue.
SQS FIFO (First-In-First-Out) queues guarantee message ordering and exactly-once delivery, eliminating duplicates and out-of-order issues. The FIFO queue with Lambda as an event source ensures requests are processed in the order they arrive. Request size (250 KB) and processing time (5-10 minutes) are well within SQS capabilities, and this avoids the operational complexity of stream management.
Why the other options are wrong
- A. Kinesis Data Firehose is designed for data delivery to destinations like S3, not for processing individual requests with ordering guarantees.
- B. SNS with Lambda does not guarantee ordering or prevent duplicates; SNS is publish-subscribe, not a queue.
- C. SQS standard queues do not guarantee ordering and allow duplicates, which are the exact problems the company is experiencing.
Question 16
A developer is migrating some features from a legacy monolithic application to use AWS Lambda functions instead. The application currently stores data in an Amazon Aurora DB cluster that runs in private subnets in a VPC. The AWS account has one VPC deployed. The Lambda functions and the DB cluster are deployed in the same AWS Region in the same AWS account. The developer needs to ensure that the Lambda functions can securely access the DB cluster without crossing the public internet. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Configure the VPC, subnets, and a security group for the Lambda functions.
Configuring the VPC, subnets, and security group for Lambda functions enables them to run within the same VPC as the Aurora DB cluster in private subnets. This allows direct, private network communication between Lambda and the database without traversing the public internet. Lambda must be deployed with VPC configuration to access resources in private subnets securely.
Why the other options are wrong
- A. Making the DB cluster publicly accessible exposes it to the internet, violating the secure access requirement.
- B. RDS Proxy helps with connection pooling but doesn't solve the fundamental requirement that Lambda must be VPC-configured to access private DB instances.
- C. A NAT gateway enables outbound internet access for private resources, which is unnecessary when Lambda and the database are in the same VPC.
Question 17
A company is using AWS CloudFormation to deploy a two-tier application. The application will use Amazon RDS as its backend database. The company wants a solution that will randomly generate the database password during deployment. The solution also must automatically rotate the database password without requiring changes to the application. What is the MOST operationally efficient solution that meets these requirements?
Show answer and explanation
Correct answer: D. Use an AWS Secrets Manager resource to generate and rotate the password.
AWS Secrets Manager is purpose-built for generating, storing, and automatically rotating database credentials. It integrates seamlessly with RDS, can automatically rotate passwords on a schedule without application changes, and provides secure secret storage. This is the most operationally efficient solution as it requires minimal configuration and handles rotation natively.
Why the other options are wrong
- A. Lambda custom resources require manual coding and management of rotation logic, making them operationally less efficient than a managed service.
- B. Systems Manager Parameter Store does not provide automatic rotation capabilities for database passwords.
- C. A cron daemon on the application host requires manual management, adds operational overhead, and introduces security risks by running on the application server.
Question 18
A team is developing an application that is deployed on Amazon EC2 instances. During testing, the team receives an error. The EC2 instances are unable to access an Amazon S3 bucket. Which steps should the team take to troubleshoot this issue? (Choose two.)
Show answer and explanation
Correct answer: A, B. Check whether the policy that is assigned to the IAM role that is attached to the EC2 instances grants access to Amazon S3; Check the S3 bucket policy to validate the access permissions for the S3 bucket.
To troubleshoot EC2 instances unable to access S3, check both the IAM role policy attached to the instances (which controls what permissions the instance has) and the S3 bucket policy (which controls who can access the bucket). These two points control the complete permission chain: the instance's role must grant S3 access, and the bucket policy must allow that role to access it.
Why the other options are wrong
- C. IAM users are not attached to EC2 instances; instead, IAM roles are attached to instances, making this factually incorrect.
- D. S3 Lifecycle policies manage object retention and transition rules, not access permissions.
- E. Security groups control network traffic at layer 4; S3 is accessed via HTTPS and does not require specific security group rules.
Question 19
A developer is troubleshooting an application in an integration environment. In the application, an Amazon Simple Queue Service (Amazon SQS) queue consumes messages and then an AWS Lambda function processes the messages. The Lambda function transforms the messages and makes an API call to a third-party service. There has been an increase in application usage. The third-party API frequently returns an HTTP 429 Too Many Requests error message. The error message prevents a significant number of messages from being processed successfully. How can the developer resolve this issue?
Show answer and explanation
Correct answer: D. Configure maximum concurrency on the SQS event source based on the third-party service’s documented rate limits.
The HTTP 429 error indicates the third-party API is being overwhelmed by requests. The solution is to limit the rate at which the Lambda function invokes the third-party API by configuring maximum concurrency on the SQS event source. This setting controls how many Lambda function instances can process messages concurrently, thereby throttling the rate of API calls to the third-party service based on their documented rate limits. This is the most direct way to prevent overwhelming an external API.
Why the other options are wrong
- A. Increasing batch size would actually make the problem worse by sending more messages per invocation, causing more API calls.
- B. Provisioned concurrency guarantees execution capacity but does not limit concurrency; it would exacerbate the rate-limiting problem.
- C. Modifying asynchronous retry configuration does not address the root cause of rate limiting from the third-party API.
Question 20
A company caches session information for a web application in an Amazon DynamoDB table. The company wants an automated way to delete old items from the table. What is the simplest way to do this?
Show answer and explanation
Correct answer: B. Add an attribute with the expiration time; enable the Time To Live feature based on that attribute.
Option B is correct because DynamoDB's Time To Live (TTL) feature is the simplest, most cost-effective, and automated way to delete expired items. You add a TTL attribute with an expiration timestamp and enable TTL on that attribute; DynamoDB automatically deletes items after the specified time with no manual intervention required.
Why the other options are wrong
- A. Running cron jobs on EC2 requires provisioning and managing servers, introducing unnecessary operational overhead and cost.
- C. Creating a new table daily is inefficient, wasteful, and doesn't scale; it's also more complex than using TTL.
- D. Simply naming an attribute 'ItemExpiration' does nothing; DynamoDB only automatically deletes items when TTL is explicitly enabled on that attribute.
Question 21
A developer needs to perform geographic load testing of an API. The developer must deploy resources to multiple AWS Regions to support the load testing of the API. How can the developer meet these requirements without additional application code?
Show answer and explanation
Correct answer: B. Create an AWS CloudFormation template that defines the load test resources. Use the AWS CLI create-stack-set command to create a stack set in the desired Regions.
CloudFormation StackSets are the purpose-built AWS service for deploying resources across multiple Regions without additional application code. The create-stack-set command creates a stack set, and then stack instances are created in the specified Regions, automatically deploying the same resources defined in the template. This is the standard, operationally efficient approach for multi-Region deployments.
Why the other options are wrong
- A. Using Lambda functions to invoke CloudFormation stack creation adds unnecessary custom code and operational complexity compared to native StackSets.
- C. AWS Systems Manager documents are for operational automation and automation runbooks, not for defining and deploying infrastructure resources.
- D. Using the AWS CLI deploy command requires manual invocation in each Region and does not provide the automated, managed multi-Region orchestration that StackSets offers.
Question 22
A developer is creating an application. New users of the application must be able to create an account and register by using their own social media accounts. Which AWS service or resource should the developer use to meet these requirements?
Show answer and explanation
Correct answer: C. Amazon Cognito user pools
Amazon Cognito user pools are specifically designed to handle user registration and authentication, including social media account integration. User pools allow users to sign up and sign in with their own credentials or through federated identity providers like Facebook, Google, and other social media platforms. This is the primary service for managing user authentication and registration flows.
Why the other options are wrong
- A. IAM roles are for AWS service access control, not for managing end-user authentication and registration.
- B. Cognito identity pools are for obtaining temporary AWS credentials, not for user registration and authentication.
- D. AWS Directory Service is for managing corporate directories and Active Directory, not for social media authentication.
Question 23
A real-time messaging application uses Amazon API Gateway WebSocket APIs with backend HTTP service. A developer needs to build a feature in the application to identify a client that keeps connecting to and disconnecting from the WebSocket connection. The developer also needs the ability to remove the client. Which combination of changes should the developer make to the application to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: D, E. Add code to track the client status in Amazon ElastiCache in the backend service; Implement $connect and $disconnect routes in the backend service.
To identify and manage client connections, implement $connect and $disconnect routes to track connection/disconnection events (option E). Use ElastiCache to maintain client status state in the backend service (option D), enabling the ability to identify problematic clients and coordinate disconnection through the callback URL.
Why the other options are wrong
- A. HTTP APIs do not support WebSocket connections; switching away from WebSocket APIs defeats the requirement.
- B. REST APIs do not support persistent WebSocket connections needed for real-time messaging.
- C. While the callback URL is used for sending messages to clients, it is not the primary mechanism for tracking and managing client status.
Question 24
A developer has code that is stored in an Amazon S3 bucket. The code must be deployed as an AWS Lambda function across multiple accounts in the same AWS Region as the S3 bucket. An AWS CloudFormation template that runs for each account will deploy the Lambda function. What is the MOST secure way to allow CloudFormation to access the Lambda code in the S3 bucket?
Show answer and explanation
Correct answer: A. Grant the CloudFormation service role the S3 ListBucket and GetObject permissions. Add a bucket policy to Amazon S3 with the principal of “AWS”: [account numbers].
The most secure approach grants the CloudFormation service role both ListBucket and GetObject permissions on S3, then adds a bucket policy explicitly listing the account numbers of the accounts that need access. This implementation follows least privilege by specifying exact principals and permissions, avoiding wildcard principals while maintaining security across multiple accounts.
Why the other options are wrong
- B. Using a wildcard principal ("*") in the bucket policy allows unrestricted access from any AWS account, violating the principle of least privilege.
- C. Service-linked roles are created and managed by AWS services for specific purposes; they are not used to grant cross-account S3 access in this scenario.
- D. Using wildcards for the resource and service-linked roles creates overly permissive access and is not the proper mechanism for cross-account CloudFormation deployments.
Question 25
A company's new mobile app uses Amazon API Gateway. As the development team completes a new release of its APIs, a developer must safely and transparently roll out the API change. What is the SIMPLEST solution for the developer to use for rolling out the new API version to a limited number of users through API Gateway?
Show answer and explanation
Correct answer: D. Use the canary release deployment option in API Gateway. Direct a percentage of the API traffic using the canarySettings setting.
Option D is correct because canary releases in API Gateway are specifically designed for safe, transparent rollouts to a limited percentage of users. The canarySettings parameter allows directing a percentage of traffic to the new API version while monitoring for issues, which is the simplest built-in solution for this exact use case.
Why the other options are wrong
- A. Creating a separate API and using Route 53 weighted routing adds unnecessary complexity and requires SCM webhook reconfiguration.
- B. Promoting during low-utilization windows still risks issues and doesn't limit exposure to a subset of users for gradual validation.
- C. CloudWatch alarms only trigger rollbacks after problems occur; they don't prevent problems or limit initial exposure like canary deployments do.
Question 26
A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to retrieve the data from the S3 bucket. How can the developer enforce that all requests to retrieve the data provide encryption in transit?
Show answer and explanation
Correct answer: A. Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”.
A resource-based policy on the S3 bucket with a condition denying access when 'aws:SecureTransport' is 'false' ensures all requests use HTTPS/TLS encryption in transit. This policy applies to all principals accessing the bucket, including cross-account access, making it the most effective enforcement point for encryption in transit requirements.
Why the other options are wrong
- B. Allowing access when SecureTransport is 'false' is the opposite of the requirement and would permit unencrypted traffic.
- C. Role-based policies on other accounts' roles would need to be replicated across multiple accounts and are harder to enforce centrally than a bucket policy.
- D. While a KMS key policy could restrict access, encryption in transit is an S3 transport concern, not a KMS key concern; the bucket policy is the correct enforcement point.
Question 27
A developer is updating several AWS Lambda functions and notices that all the Lambda functions share the same custom libraries. The developer wants to centralize all the libraries, update the libraries in a convenient way, and keep the libraries versioned. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: C. Create a Lambda layer that contains all the custom libraries.
Lambda layers are purpose-built for sharing code and libraries across multiple Lambda functions. They provide centralized management, easy versioning, and convenient updates without modifying function code. Layers are versioned independently, allowing teams to manage library updates while maintaining backward compatibility. This approach requires minimal development effort compared to other solutions.
Why the other options are wrong
- A. CodeArtifact requires package management system setup and additional deployment complexity in Lambda functions.
- B. Custom container images add operational overhead and require rebuilding and redeploying containers for library updates.
- D. EFS requires VPC configuration, adds latency for library access, and introduces unnecessary complexity for static library storage.
Question 28
A developer is designing a serverless application that customers use to select seats for a concert venue. Customers send the ticket requests to an Amazon API Gateway API with an AWS Lambda function that acknowledges the order and generates an order ID. The application includes two additional Lambda functions: one for inventory management and one for payment processing. These two Lambda functions run in parallel and write the order to an Amazon Dynamo DB table. The application must provide seats to customers according to the following requirements. If a seat is accidently sold more than once, the first order that the application received must get the seat. In these cases, the application must process the payment for only the first order. However, if the first order is rejected during payment processing, the second order must get the seat. In these cases, the application must process the payment for the second order. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Send the order ID to an Amazon Simple Notification Service (Amazon SNS) FIFO topic that fans out to one Amazon Simple Queue Service (Amazon SQS) FIFO queue for inventory management and another SQS FIFO queue for payment processing.
FIFO (First-In-First-Out) messaging ensures orders are processed in the exact sequence received. SNS FIFO topics can fan out to multiple SQS FIFO queues, allowing parallel processing of inventory and payment while maintaining order. This guarantees the first order to be received gets priority for seats, and payment is only processed if that order succeeds, meeting all requirements.
Why the other options are wrong
- B. Sequential Lambda invocation (first inventory, then payment) loses parallelism and doesn't provide the ordering guarantees needed when multiple orders arrive simultaneously.
- C. Standard SNS topics don't guarantee order, and subscribers would process messages in parallel without maintaining sequence, potentially giving seats to the wrong order.
- D. Standard SQS queues don't preserve order across multiple consumer functions, risking out-of-order processing and incorrect seat allocation.
Question 29
A developer has been asked to create an AWS Lambda function that is invoked any time updates are made to items in an Amazon DynamoDB table. The function has been created, and appropriate permissions have been added to the Lambda execution role. Amazon DynamoDB streams have been enabled for the table, but the function is still not being invoked. Which option would enable DynamoDB table updates to invoke the Lambda function?
Show answer and explanation
Correct answer: B. Configure event source mapping for the Lambda function.
Event source mapping creates the connection between a DynamoDB stream and a Lambda function. Even with streams enabled on the table and proper IAM permissions in place, the Lambda function won't be invoked without an event source mapping that tells AWS which function to invoke when stream records are available.
Why the other options are wrong
- A. StreamViewType determines what information is written to the stream, but changing it doesn't create the invocation mechanism itself.
- C. SNS topics are not used to invoke Lambda from DynamoDB streams; event source mapping is the correct mechanism.
- D. Timeout settings have no impact on whether the function is invoked in the first place.
Question 30
An application needs to use the IP address of the client in its processing. The application has been moved into AWS and has been placed behind an Application Load Balancer (ALB). However, all the client IP addresses now appear to be the same. The application must maintain the ability to scale horizontally. Based on this scenario, what is the MOST cost-effective solution to this problem?
Show answer and explanation
Correct answer: C. Alter the application code to inspect the X-Forwarded-For header. Ensure that the code can work properly if a list of IP addresses is passed in the header.
When traffic passes through an ALB, the source IP becomes the ALB's IP address. However, ALBs automatically add the X-Forwarded-For header containing the original client IP address. By inspecting this header, the application can extract the true client IP while maintaining horizontal scalability. This is the standard, cost-effective approach and requires only application code changes.
Why the other options are wrong
- A. Removing the ALB eliminates load balancing capabilities, preventing horizontal scaling and reducing availability.
- B. Classic Load Balancers also replace source IP with their own IP; they don't solve this problem and are more expensive than ALBs.
- D. Creating custom headers requires changing client code across all clients, which is impractical and not a standard solution when X-Forwarded-For is already provided.
Question 31
A company is using an Amazon API Gateway REST API endpoint as a webhook to publish events from an on-premises source control management (SCM) system to Amazon EventBridge. The company has configured an EventBridge rule to listen for the events and to control application deployment in a central AWS account. The company needs to receive the same events across multiple receiver AWS accounts. How can a developer meet these requirements without changing the configuration of the SCM system?
Show answer and explanation
Correct answer: C. Grant permission to the central AWS account for EventBridge to access the receiver AWS accounts. Add an EventBridge event bus on the receiver AWS accounts as the targets to the existing EventBridge rule.
Option C is correct because it uses EventBridge's cross-account capabilities: the central account's EventBridge rule can target event buses in receiver accounts, allowing events from a single SCM webhook to be distributed to multiple accounts without reconfiguring the SCM system or deploying multiple API Gateway instances.
Why the other options are wrong
- A. Deploying API Gateway to all accounts and using the same domain name is technically complex, requires DNS management, and doesn't align with EventBridge's purpose.
- B. Creating multiple SCM webhooks defeats the requirement to avoid changing SCM configuration.
- D. Converting from REST API to HTTP API doesn't solve the multi-account distribution problem; EventBridge cross-account capabilities work with both API types.
Question 32
A company is planning to deploy an application on AWS behind an Elastic Load Balancer. The application uses an HTTP/HTTPS listener and must access the client IP addresses. Which load-balancing solution meets these requirements?
Show answer and explanation
Correct answer: A. Use an Application Load Balancer and the X-Forwarded-For headers.
Application Load Balancers automatically insert the X-Forwarded-For header containing the original client IP address in HTTP/HTTPS requests. This allows the application to retrieve the client IP from this standard header. ALB is the appropriate choice for HTTP/HTTPS traffic and supports this requirement natively.
Why the other options are wrong
- B. While NLB can use proxy protocol, it is more complex than necessary and NLB is optimized for extreme performance and ultra-high throughput, not HTTP/HTTPS application-level headers.
- C. Registering targets by instance ID rather than IP address does not address the requirement of accessing the client IP addresses within the application.
- D. Network Load Balancers do not use X-Forwarded-For headers; they operate at Layer 4 and would require proxy protocol configuration instead.
Question 33
A developer wants to use AWS Elastic Beanstalk to test a new version of an application in a test environment. Which deployment method offers the FASTEST deployment?
Show answer and explanation
Correct answer: D. All at once
All at once deployment is the fastest method because it deploys the new version to all instances simultaneously without waiting for instances to become healthy between batches. While it offers no downtime protection during deployment, it completes in the minimum time. The other methods (Immutable, Rolling, Rolling with additional batch) all involve phased deployments that take longer to complete.
Why the other options are wrong
- A. Immutable creates entirely new instances before switching, which is slower than all at once.
- B. Rolling replaces instances one at a time, requiring multiple health checks and being slower.
- C. Rolling with additional batch launches extra instances incrementally, making it slower than deploying to all at once.
Question 34
A developer is implementing an AWS Cloud Development Kit (AWS CDK) serverless application. The developer will provision several AWS Lambda functions and Amazon API Gateway APIs during AWS CloudFormation stack creation. The developer's workstation has the AWS Serverless Application Model (AWS SAM) and the AWS CDK installed locally. How can the developer test a specific Lambda function locally?
Show answer and explanation
Correct answer: C. Run the cdk synth and sam local invoke commands with the function construct identifier and the path to the synthesized CloudFormation template.
Option C is correct because 'cdk synth' generates a CloudFormation template from CDK code, and 'sam local invoke' is the SAM tool for testing a specific Lambda function locally. The function construct identifier and the path to the synthesized template are the required parameters to invoke a Lambda function locally in a CDK project.
Why the other options are wrong
- A. sam package and sam deploy deploy to AWS rather than testing locally, and this approach doesn't integrate with CDK-synthesized templates.
- B. cdk deploy actually deploys to AWS CloudFormation; 'cdk synth' alone doesn't support direct local testing without additional tools.
- D. sam local start-lambda starts a local Lambda endpoint for integration testing, not for invoking a specific function directly; 'sam local invoke' is the correct command for testing a specific function.
Question 35
A developer is building a serverless application by using the AWS Serverless Application Model (AWS SAM). The developer is currently testing the application in a development environment. When the application is nearly finished, the developer will need to set up additional testing and staging environments for a quality assurance team. The developer wants to use a feature of the AWS SAM to set up deployments to multiple environments. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: A. Add a configuration file in TOML format to group configuration entries to every environment. Add a table for each testing and staging environment. Deploy updates to the environments by using the sam deploy command and the --config-env flag that corresponds to each environment.
AWS SAM's native configuration file feature in TOML format with the --config-env flag is specifically designed to manage multiple environment deployments with minimal effort. This built-in feature allows defining environment-specific configurations in a single metadata format and deploying to different environments with a simple flag, requiring no custom scripts or template duplication.
Why the other options are wrong
- B. Creating multiple SAM templates and custom shell scripts duplicates infrastructure-as-code and increases maintenance burden.
- C. Using parameter-overrides for each deployment is manual and error-prone, lacking the organization of dedicated configuration files.
- D. Adding parameters to a single template without dedicated environment configuration files is less organized and doesn't leverage SAM's built-in multi-environment support.
Question 36
A company is planning to use AWS CodeDeploy to deploy an application to Amazon Elastic Container Service (Amazon ECS). During the deployment of a new version of the application, the company initially must expose only 10% of live traffic to the new version of the deployed application. Then, after 15 minutes elapse, the company must route all the remaining live traffic to the new version of the deployed application. Which CodeDeploy predefined configuration will meet these requirements?
Show answer and explanation
Correct answer: A. CodeDeployDefault.ECSCanary10Percent15Minutes
CodeDeployDefault.ECSCanary10Percent15Minutes is the predefined traffic shifting configuration that first routes 10% of traffic to the new version, waits 15 minutes, then routes the remaining 90% to the new version. The naming convention clearly indicates the traffic percentage (10Percent) and the time interval (15Minutes) for ECS deployments.
Why the other options are wrong
- B. This is a Lambda canary configuration with a 5-minute interval, not ECS, and has the wrong time period.
- C. This is a Lambda canary configuration, not for ECS deployments as required.
- D. This is an ECS Linear configuration that gradually shifts traffic evenly every 1 minute, not a canary strategy that shifts 10% then waits 15 minutes.
Question 37
A developer is writing an application to encrypt files outside of AWS before uploading the files to an Amazon S3 bucket. The encryption must be symmetric and must be performed inside the application. How can the developer implement the encryption in the application to meet these requirements?
Show answer and explanation
Correct answer: A. Create a data key in AWS Key Management Service (AWS KMS). Use the AWS Encryption SDK to encrypt the files.
The requirement is symmetric encryption performed inside the application before uploading to S3. Creating a data key in AWS KMS and using the AWS Encryption SDK is the correct approach. The AWS Encryption SDK handles symmetric encryption using the data key and includes envelope encryption best practices. A data key is symmetric and suitable for encrypting data, whereas data key pairs are for asymmetric encryption.
Why the other options are wrong
- B. HMAC keys are for message authentication, not encryption; they cannot be used for symmetric encryption of file contents.
- C. Data key pairs are for asymmetric encryption, not symmetric encryption as required.
- D. While a data key is correct, the AWS CLI is not used for encrypting data with KMS keys; the AWS Encryption SDK is the appropriate tool for client-side encryption.
Question 38
A developer accesses AWS CodeCommit over SSH. The SSH keys configured to access AWS CodeCommit are tied to a user with the following permissions: The developer needs to create/delete branches. Which specific IAM permissions need to be added, based on the principle of least privilege?
Show answer and explanation
Correct answer: A. "codecommit:CreateBranch" "codecommit:DeleteBranch"
Following the principle of least privilege, a developer who needs to create and delete branches in AWS CodeCommit requires only the specific permissions necessary for those operations: codecommit:CreateBranch and codecommit:DeleteBranch. These two granular permissions grant exactly what is needed without providing broader access to other CodeCommit actions. The developer already has permissions for BatchGetRepositories, Get*, List*, and GitPull based on the exhibit, so only the branch management permissions are missing.
Why the other options are wrong
- B. codecommit:Put* grants broad wildcard permissions to all Put actions, violating the principle of least privilege by allowing more access than necessary.
- C. codecommit:Update* grants broad wildcard permissions to all Update actions, which is unnecessary and violates least privilege principles.
- D. codecommit:* grants full unrestricted access to all CodeCommit actions, which is excessive for a developer who only needs to create and delete branches.
Question 39
A developer is using an AWS Lambda function to generate avatars for profile pictures that are uploaded to an Amazon S3 bucket. The Lambda function is automatically invoked for profile pictures that are saved under the /original/ S3 prefix. The developer notices that some pictures cause the Lambda function to time out. The developer wants to implement a fallback mechanism by using another Lambda function that resizes the profile picture. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: A. Set the image resize Lambda function as a destination of the avatar generator Lambda function for the events that fail processing.
Lambda destinations with on-failure conditions is the simplest and most direct solution. When the avatar generator Lambda times out, the destination automatically invokes the resize Lambda function as a fallback. This requires minimal setup, just configuring the destination on the avatar generator function, with no additional services or polling logic needed, making it the least development effort.
Why the other options are wrong
- B. Using SQS requires creating a queue, configuring the function to poll it, and managing the polling logic, adding unnecessary complexity compared to automatic Lambda destinations.
- C. Step Functions requires defining a state machine and EventBridge rules, which is significantly more development effort than using built-in Lambda destinations.
- D. SNS requires creating a topic, managing subscriptions, and handling asynchronous processing, which is more complex than the direct destination approach.
Question 40
A company has hundreds of AWS Lambda functions that the company's QA team needs to test by using the Lambda function URLs. A developer needs to configure the authentication of the Lambda functions to allow access so that the QA IAM group can invoke the Lambda functions by using the public URLs. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create a CLI script that loops on the Lambda functions to add a Lambda function URL with the AWS_IAM auth type. Run another script to create an IAM identity-based policy that allows the lambda:InvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). Attach the policy to the QA IAM group.
Using AWS_IAM auth type with a Lambda function URL requires the caller to have IAM credentials, allowing the QA group to invoke the public URLs through their IAM permissions. Creating an identity-based policy on the QA IAM group that grants lambda:InvokeFunctionUrl on all Lambda ARNs provides centralized permission management without needing to update resource-based policies on each function.
Why the other options are wrong
- B. NONE auth type removes authentication entirely, bypassing the requirement to authenticate the QA group, which is a security violation.
- C. Creating identity-based policies looped per function is less efficient than a single policy attached to the group and requires more maintenance.
- D. NONE auth type removes authentication, and resource-based policies per function are less efficient than a single identity-based policy on the group.
Question 41
A developer wants to deploy a new version of an AWS Elastic Beanstalk application. During deployment, the application must maintain full capacity and avoid service interruption. Additionally, the developer must minimize the cost of additional resources that support the deployment. Which deployment method should the developer use to meet these requirements?
Show answer and explanation
Correct answer: B. Rolling with additional batch
Rolling with additional batch is the optimal choice for meeting all requirements. It temporarily launches additional instances (a batch) to handle traffic while old instances are updated, maintaining full capacity throughout deployment. Once the new batch is healthy, old instances are terminated. This approach avoids service interruption while minimizing additional resource costs compared to blue/green (which runs two full environments) or immutable (which launches entirely new instances).
Why the other options are wrong
- A. All at once stops the application during deployment, causing service interruption, which violates the requirement.
- C. Blue/green requires running two complete environments simultaneously, significantly increasing costs beyond the minimal additional resources requirement.
- D. Immutable launches new instances for the entire environment before terminating old ones, resulting in higher costs than rolling with additional batch.
Question 42
A developer is working on an application that is deployed on an Amazon EC2 instance. The developer needs a solution that will securely transfer files from the application to an Amazon S3 bucket. What should the developer do to meet these requirements in the MOST secure way?
Show answer and explanation
Correct answer: C. Create an IAM role. Configure the IAM role to access the specific Amazon S3 API calls the application requires. Associate the IAM role with the EC2 instance.
Creating an IAM role, configuring it with least-privilege permissions for the specific S3 API calls needed, and associating it with the EC2 instance is the most secure approach. This leverages temporary credentials managed by the AWS STS and avoids storing long-lived access keys. The EC2 instance can assume the role automatically without credential management in application code.
Why the other options are wrong
- A. Storing IAM user access keys in environment variables is insecure; it exposes long-lived credentials in the application environment.
- B. IAM roles cannot have access keys created for them; access keys are only for IAM users, not roles.
- D. S3 bucket policies based on EC2 instance IDs are not reliable since instance IDs can change; IAM role-based access is the proper solution.
Question 43
A developer is building a web application that uses Amazon API Gateway to expose an AWS Lambda function to process requests from clients. During testing, the developer notices that the API Gateway times out even though the Lambda function finishes under the set time limit. Which of the following API Gateway metrics in Amazon CloudWatch can help the developer troubleshoot the issue? (Choose two.)
Show answer and explanation
Correct answer: B, D. IntegrationLatency; Latency
IntegrationLatency measures the time between when API Gateway sends a request to the Lambda function and when it receives a response, revealing if the Lambda is slow. Latency measures the total time from when API Gateway receives a request until it returns a response to the client, showing the overall performance. Together, these metrics help distinguish between Lambda execution issues and other API Gateway delays.
Why the other options are wrong
- A. CacheHitCount measures successful cache retrievals and is not relevant to Lambda integration timeout issues.
- C. CacheMissCount measures cache misses and is not relevant to diagnosing Lambda timeout problems.
- E. Count is the total number of requests and does not provide latency or performance data needed for timeout troubleshooting.
Question 44
An application that runs on AWS receives messages from an Amazon Simple Queue Service (Amazon SQS) queue and processes the messages in batches. The application sends the data to another SQS queue to be consumed by another legacy application. The legacy system can take up to 5 minutes to process some transaction data. A developer wants to ensure that there are no out-of-order updates in the legacy system. The developer cannot alter the behavior of the legacy system. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Use an SQS FIFO queue. Configure the visibility timeout value.
To ensure no out-of-order updates in a legacy system that cannot be modified, an SQS FIFO (First-In-First-Out) queue must be used. FIFO queues guarantee message ordering and exactly-once processing. The visibility timeout should be configured to at least 5 minutes to account for the legacy system's maximum processing time, ensuring messages aren't redelivered before processing completes.
Why the other options are wrong
- B. Standard queues do not guarantee message ordering; DelaySeconds only adds initial delays and doesn't prevent out-of-order processing.
- C. Standard queues do not guarantee ordering regardless of visibility timeout configuration; FIFO queues are required for ordering guarantees.
- D. While FIFO queues are correct, DelaySeconds is not the appropriate configuration; visibility timeout must be set to at least 5 minutes to match processing time.
Question 45
A developer has written code for an application and wants to share it with other developers on the team to receive feedback. The shared application code needs to be stored long-term with multiple versions and batch change tracking. Which AWS service should the developer use?
Show answer and explanation
Correct answer: C. AWS CodeCommit
AWS CodeCommit is a fully managed Git-based source control service designed for team collaboration, version control, and long-term storage of code. It supports multiple versions, branching, pull requests for feedback, and batch change tracking through commits, making it ideal for sharing code with team members for review.
Why the other options are wrong
- A. CodeBuild is a build service, not a source control repository.
- B. S3 is object storage lacking version control, collaborative features, and proper change tracking mechanisms.
- D. Cloud9 is an IDE for development, not a version control or repository service for storing and sharing code long-term.
Question 46
A company needs to develop a proof of concept for a web service application. The application will show the weather forecast for one of the company's office locations. The application will provide a REST endpoint that clients can call. Where possible, the application should use caching features provided by AWS to limit the number of requests to the backend service. The application backend will receive a small amount of traffic only during testing. Which approach should the developer take to provide the REST endpoint MOST cost-effectively?
Show answer and explanation
Correct answer: B. Create an AWS Lambda function by using the AWS Serverless Application Model (AWS SAM). Expose the Lambda functionality by using Amazon API Gateway.
Option B is correct because Lambda with API Gateway is the most cost-effective for proof-of-concept applications with light traffic. Lambda charges only for execution time, API Gateway caching reduces backend requests, and AWS SAM simplifies deployment. Containers (EKS/ECS) require provisioning and managing infrastructure even during idle periods, making them unnecessarily expensive for POC testing.
Why the other options are wrong
- A. Amazon EKS requires managed cluster infrastructure with ongoing costs even during low traffic periods, making it uneconomical for a POC.
- C. Amazon ECS with containers has similar infrastructure overhead issues as EKS; it's overkill for a simple proof-of-concept weather service.
- D. Elastic Beanstalk requires managing application server infrastructure; it's more expensive and complex than serverless Lambda for POC applications.
Question 47
A developer is building a serverless application that runs on AWS. The developer wants to create an accelerated development workflow that deploys incremental changes to AWS for testing. The developer wants to deploy the incremental changes but does not want to fully deploy the entire application to AWS for every code commit. What should the developer do to meet these requirements?
Show answer and explanation
Correct answer: A. Use the AWS Serverless Application Model (AWS SAM) to build the application. Use the sam sync command to deploy the incremental changes.
The AWS SAM `sam sync` command enables accelerated development by deploying only incremental changes rather than performing full CloudFormation stack deployments for every change. This provides faster feedback loops during development while maintaining infrastructure-as-code principles.
Why the other options are wrong
- B. The `sam init` command initializes a new SAM project; it does not deploy incremental changes.
- C. The `cdk synth` command generates CloudFormation templates but does not deploy changes to AWS.
- D. The `cdk bootstrap` command prepares the AWS environment for CDK deployments but does not deploy application changes.
Question 48
A company wants to deploy and maintain static websites on AWS. Each website's source code is hosted in one of several version control systems, including AWS CodeCommit, Bitbucket, and GitHub. The company wants to implement phased releases by using development, staging, user acceptance testing, and production environments in the AWS Cloud. Deployments to each environment must be started by code merges on the relevant Git branch. The company wants to use HTTPS for all data exchange. The company needs a solution that does not require servers to run continuously. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Host each website by using AWS Amplify with a serverless backend. Conned the repository branches that correspond to each of the desired environments. Start deployments by merging code changes to a desired branch.
AWS Amplify is purpose-built for hosting static websites and integrates directly with multiple Git repositories (CodeCommit, GitHub, Bitbucket). It automatically triggers deployments on branch merges, supports multiple environments, provides HTTPS by default, and requires no server management, all with minimal operational overhead.
Why the other options are wrong
- B. Elastic Beanstalk is designed for application servers, not static websites, and requires continuous server instances, adding unnecessary cost and operational complexity.
- C. While CodePipeline with S3 can work, it requires manual pipeline configuration and CodeBuild setup, adding operational overhead compared to Amplify's integrated approach.
- D. Running static websites on EC2 instances with custom deployment scripts is the most operationally intensive option and contradicts the serverless requirement.
Question 49
A company deploys a photo-processing application to an Amazon EC2 instance. The application needs to process each photo in less than 5 seconds. If processing takes longer than 5 seconds, the company’s development team must receive a notification. How can a developer implement the required time measurement and notification with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Create an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that is based on a static threshold of 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.
CloudWatch custom metrics paired with a static threshold alarm provides the simplest and most operational-overhead-free solution. Publishing processing time as a metric value and creating an alarm that triggers when any individual photo exceeds 5 seconds allows direct threshold comparison. SNS provides automatic notification delivery. This requires minimal code and no additional infrastructure. Option B adds unnecessary SQS complexity. Option C uses average instead of individual measurements, missing threshold breaches. Option D requires Kinesis setup unnecessarily.
Why the other options are wrong
- B. SQS adds unnecessary message queue complexity when CloudWatch handles metrics natively.
- C. Using average threshold will miss individual photos exceeding 5 seconds; SES is also less standard than SNS.
- D. Kinesis adds unnecessary complexity; CloudWatch alarms handle individual value thresholds directly.
Question 50
A developer has designed an application to store incoming data as JSON files in Amazon S3 objects. Custom business logic in an AWS Lambda function then transforms the objects, and the Lambda function loads the data into an Amazon DynamoDB table. Recently, the workload has experienced sudden and significant changes in traffic. The flow of data to the DynamoDB table is becoming throttled. The developer needs to implement a solution to eliminate the throttling and load the data into the DynamoDB table more consistently. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Refactor the Lambda function into two functions. Configure one function to transform the data and one function to load the data into the DynamoDB table. Create an Amazon Simple Queue Service (Amazon SQS) queue in between the functions to hold the items as messages and to invoke the second function.
Option A solves the throttling issue by decoupling the transformation and loading operations with an SQS queue in between. This allows the transformation function to complete quickly while the loading function can process writes to DynamoDB at a consistent rate, preventing spikes that cause throttling. Option B only monitors without solving the problem, Option C increases Lambda concurrency which doesn't address write throttling to DynamoDB, and Option D adds complexity without solving the core issue of inconsistent write traffic.
Why the other options are wrong
- B. Auto scaling and monitoring help but do not prevent throttling from sudden traffic spikes.
- C. Lambda provisioned concurrency increases function availability but does not prevent DynamoDB write throttling.
- D. Splitting into two functions with a stream adds complexity but does not decouple the write rate to DynamoDB.
Question 51
A company has an application that runs as a series of AWS Lambda functions. Each Lambda function receives data from an Amazon Simple Notification Service (Amazon SNS) topic and writes the data to an Amazon Aurora DB instance. To comply with an information security policy, the company must ensure that the Lambda functions all use a single securely encrypted database connection string to access Aurora. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Store the credentials in AWS Systems Manager Parameter Store as a secure string parameter.
AWS Systems Manager Parameter Store is the recommended service for storing sensitive database connection strings securely. It supports encryption using AWS KMS and provides fine-grained access control through IAM policies. Multiple Lambda functions can reference the same secure string parameter, meeting the requirement for a single centrally managed, encrypted database connection string that all functions can access securely.
Why the other options are wrong
- A. IAM database authentication generates temporary credentials but does not provide a single shared connection string as required by the policy.
- B. Storing credentials in an RDS instance is unnecessarily complex and not a recommended practice for application secrets management.
- D. Lambda environment variables, while encrypted with KMS, are visible in the Lambda console and logs, making them less secure than Parameter Store for sensitive credentials.
Question 52
An ecommerce company is using an AWS Lambda function behind Amazon API Gateway as its application tier. To process orders during checkout, the application calls a POST API from the frontend. The POST API invokes the Lambda function asynchronously. In rare situations, the application has not processed orders. The Lambda application logs show no errors or failures. What should a developer do to solve this problem?
Show answer and explanation
Correct answer: B. Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events.
When Lambda is invoked asynchronously through API Gateway and no errors appear in CloudWatch Logs, failed invocations are sent to a dead-letter queue (DLQ). The DLQ contains events that failed processing after all retries were exhausted. Inspecting the DLQ reveals why orders weren't processed despite no visible errors in standard logs, allowing developers to troubleshoot and reprocess failed events.
Why the other options are wrong
- A. Frontend logs and manual API calls won't reveal asynchronous invocation failures that occurred after the API returned successfully to the client.
- C. The problem states Lambda logs show no errors or failures, so inspecting CloudWatch logs further won't help identify asynchronous processing failures.
- D. Caching configuration is irrelevant to asynchronous Lambda invocation failures and order processing issues.
Question 53
A company has installed smart meters in all its customer locations. The smart meters measure power usage at 1-minute intervals and send the usage readings to a remote endpoint for collection. The company needs to create an endpoint that will receive the smart meter readings and store the readings in a database. The company wants to store the location ID and timestamp information. The company wants to give its customers low-latency access to their current usage and historical usage on demand. The company expects demand to increase significantly. The solution must not impact performance or include downtime while scaling. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: B. Store the smart meter readings in an Amazon DynamoDB table. Create a composite key by using the location ID and timestamp columns. Use the columns to filter on the customers' data.
Amazon DynamoDB with a composite key of location ID and timestamp is ideal for this time-series use case. It provides on-demand scaling without performance impact, low-latency access for both current and historical data, and cost-effectiveness for the write-heavy smart meter workload. The composite key naturally supports efficient querying by location and time range, and DynamoDB's on-demand billing scales seamlessly with unpredictable demand.
Why the other options are wrong
- A. RDS requires capacity planning and has scaling limitations; indexes on composite columns don't provide the same query flexibility or cost efficiency as DynamoDB for time-series data.
- C. ElastiCache is an in-memory cache, not a persistent data store; it's not suitable as a primary database for historical data retention.
- D. S3 with Athena adds latency to queries and is more expensive for frequent on-demand access patterns; it's better suited for analytical workloads rather than real-time low-latency access.
Question 54
A company is building a microservices application that consists of many AWS Lambda functions. The development team wants to use AWS Serverless Application Model (AWS SAM) templates to automatically test the Lambda functions. The development team plans to test a small percentage of traffic that is directed to new updates before the team commits to a full deployment of the application. Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose two.)
Show answer and explanation
Correct answer: C, D. Enable gradual deployments through AWS SAM templates; Set the deployment preference type to Canary10Percent30Minutes. Use hooks to test the deployment.
To test a small percentage of traffic on new Lambda function updates before full deployment using AWS SAM, the solution requires enabling gradual deployments through AWS SAM templates (C) and setting a deployment preference type like Canary10Percent30Minutes (D) with hooks for testing. This combination allows SAM to gradually shift traffic to the new version while running validation tests via hooks, which is the operationally efficient approach for canary deployments of Lambda functions.
Why the other options are wrong
- A. AWS CodeDeploy integration with SAM CLI is not the mechanism for testing Lambda deployments; SAM has native deployment preference support.
- B. EventInvokeConfig with OnSuccess/OnFailure is for handling Lambda invocation outcomes after deployment, not for testing gradual deployments.
- E. Linear10PercentEvery10Minutes is a valid deployment type but Canary10Percent30Minutes (option D) is more appropriate for initial testing before full rollout.
Question 55
A developer is creating a Ruby application and needs to automate the deployment, scaling, and management of an environment without requiring knowledge of the underlying infrastructure. Which service would best accomplish this task?
Show answer and explanation
Correct answer: D. AWS Elastic Beanstalk
AWS Elastic Beanstalk is a fully managed Platform as a Service (PaaS) that automates deployment, scaling, and environment management without requiring knowledge of underlying infrastructure. It supports Ruby applications and abstracts away infrastructure complexity, making it the ideal choice for developers who want to focus on code rather than infrastructure management.
Why the other options are wrong
- A. CodeDeploy is a deployment service that requires managing instances and deployment configurations; it does not automate scaling or infrastructure management.
- B. CloudFormation is an Infrastructure as Code service requiring manual infrastructure architecture design; it does not abstract away infrastructure complexity.
- C. OpsWorks requires more operational knowledge and is typically used for more complex infrastructure scenarios with Chef or Puppet configuration management.
Question 56
An application under development is required to store hundreds of video files. The data must be encrypted within the application prior to storage, with a unique key for each video file. How should the developer code the application?
Show answer and explanation
Correct answer: C. Use the KMS GenerateDataKey API to get a data key. Encrypt the data with the data key. Store the encrypted data key and data.
The correct approach for encrypting individual items with unique keys is to use KMS GenerateDataKey API, which returns a plaintext key and an encrypted key. The application encrypts the data with the plaintext key, then stores both the encrypted data and the encrypted data key together. This ensures each video file has a unique key while leveraging KMS for key management and security.
Why the other options are wrong
- A. KMS Encrypt API is meant for encrypting small amounts of data directly, not for encrypting large files like videos, and doesn't provide the unique key per file that GenerateDataKey does.
- B. Generating encryption keys locally in the application defeats the purpose of using KMS and creates key management vulnerabilities without proper key rotation and security controls.
- D. S3 server-side encryption uses a single KMS key for the bucket, not unique keys for each video file as required.
Question 57
A company uses Amazon DynamoDB as a data store for its order management system. The company frontend application stores orders in a DynamoDB table. The DynamoDB table is configured to send change events to a DynamoDB stream. The company uses an AWS Lambda function to log and process the incoming orders based on data from the DynamoDB stream. An operational review reveals that the order quantity of incoming orders is sometimes set to 0. A developer needs to create a dashboard that will show how many unique customers this problem affects each day. What should the developer do to implement the dashboard?
Show answer and explanation
Correct answer: A. Grant the Lambda function’s execution role permissions to upload logs to Amazon CloudWatch Logs. Implement a CloudWatch Logs Insights query that selects the number of unique customers for orders with order quantity equal to 0 and groups the results in 1-day periods. Add the CloudWatch Logs Insights query to a CloudWatch dashboard.
The Lambda function processing DynamoDB stream events should log filtered data (orders with quantity 0 and customer IDs) to CloudWatch Logs. CloudWatch Logs Insights can then query these logs to count unique customers grouped by day, and the results can be displayed in a CloudWatch dashboard. This approach integrates logging, querying, and visualization seamlessly within CloudWatch. Option B uses CloudTrail which tracks API calls, not application data. Option C uses EventBridge for routing but doesn't aggregate data effectively. Option D attempts to use CloudWatch metrics which aren't designed for complex aggregations like unique customer counts.
Why the other options are wrong
- B. CloudTrail logs API calls, not application business logic; it won't contain the order data needed for this analysis.
- C. EventBridge is an event routing service, not a data aggregation tool; it can't effectively group and count unique customers across time periods.
- D. CloudWatch custom metrics are designed for numeric values, not for complex aggregations like counting unique customers; CloudWatch Logs Insights is the appropriate tool.
Question 58
A company is using Amazon RDS as the backend database for its application. After a recent marketing campaign, a surge of read requests to the database increased the latency of data retrieval from the database. The company has decided to implement a caching layer in front of the database. The cached content must be encrypted and must be highly available. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Amazon ElastiCache for Redis in cluster mode
Amazon ElastiCache for Redis in cluster mode supports encryption at rest and in transit, and provides high availability through automatic failover and multi-AZ deployment. Redis cluster mode specifically addresses high availability requirements better than Memcached, which does not support encryption. DAX is optimized for DynamoDB, not RDS, and CloudFront is a CDN not suitable for database caching.
Why the other options are wrong
- A. CloudFront is a content delivery network for static content and HTTP responses, not a general-purpose database caching layer.
- B. Memcached does not support encryption, which is a stated requirement.
- D. DAX is specifically designed for DynamoDB acceleration, not RDS.
Question 59
A company must deploy all its Amazon RDS DB instances by using AWS CloudFormation templates as part of AWS CodePipeline continuous integration and continuous delivery (CI/CD) automation. The primary password for the DB instance must be automatically generated as part of the deployment process. Which solution will meet these requirements with the LEAST development effort?
Show answer and explanation
Correct answer: D. Use the AWS::SecretsManager::Secret resource to generate a secure string. Store the secure string as a secret in AWS Secrets Manager. Use the secretsmanager dynamic reference to use the value stored in the secret to create the DB instance.
The AWS::SecretsManager::Secret CloudFormation resource can generate a secure random password automatically during deployment and store it in Secrets Manager. Using the secretsmanager dynamic reference in CloudFormation templates allows the DB instance to retrieve the generated secret with minimal effort, no custom Lambda, no CodeBuild scripts, and no manual parameter passing required.
Why the other options are wrong
- A. Custom Lambda resources require additional development effort to write, test, and maintain code beyond using built-in CloudFormation resources.
- B. Using CodeBuild to generate a password and pass it as a parameter requires additional pipeline configuration and parameter management complexity.
- C. While this approach works, it involves unnecessary complexity by creating a custom Lambda resource when CloudFormation has native secret generation support.
Question 60
A developer is creating an application that will store personal health information (PHI). The PHI needs to be encrypted at all times. An encrypted Amazon RDS for MySQL DB instance is storing the data. The developer wants to increase the performance of the application by caching frequently accessed data while adding the ability to sort or rank the cached datasets. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon ElastiCache for Redis instance. Enable encryption of data in transit and at rest. Store frequently accessed data in the cache.
ElastiCache for Redis supports encryption both in transit and at rest, protecting PHI as required. Redis also provides advanced data structures and native support for sorting and ranking operations, making it ideal for caching while maintaining compliance with encryption requirements.
Why the other options are wrong
- B. Memcached does not support encryption at rest, which is a critical requirement for storing PHI.
- C. RDS read replicas are for high-availability database replication, not caching, and do not provide the sorting/ranking capabilities needed.
- D. DynamoDB and DAX are not purpose-built for caching frequently accessed data from an existing database, and this architecture adds unnecessary complexity.
Question 61
A developer is configuring an application's deployment environment in AWS CodePipeline. The application code is stored in a GitHub repository. The developer wants to ensure that the repository package's unit tests run in the new deployment environment. The developer has already set the pipeline's source provider to GitHub and has specified the repository and branch to use in the deployment. Which combination of steps should the developer take next to meet these requirements with the LEAST overhead? (Choose two.)
Show answer and explanation
Correct answer: B, E. Create an AWS CodeBuild project. Add the repository package's build and test commands to the project's buildspec; Add a new stage to the pipeline after the source stage. Add an action to the new stage. Specify the newly created project as the action provider. Specify the source artifact as the action's input artifact.
To run unit tests in a CodePipeline, the developer must create an AWS CodeBuild project (not CodeCommit or CodeDeploy) where build and test commands are defined in the buildspec. Then, a new stage must be added after the source stage with an action that references the CodeBuild project and uses the source artifact as input. This ensures tests run as part of the pipeline workflow.
Why the other options are wrong
- A. CodeCommit is a version control service, not a build/test execution service; buildspec files are used by CodeBuild.
- C. CodeDeploy is for deployment operations, not for running builds and tests; it does not use buildspec files.
- D. Adding an action to the source stage is incorrect; a new stage must be created after the source stage so that the source artifact is available as input to the build action.
Question 62
A company runs an application on Amazon EC2 instances. The EC2 instances open connections to an Amazon RDS for SQL Server database. A developer needs to store and access the credentials and wants to automatically rotate the credentials. The developer does not want to store the credentials for the database in the code. Which solution will meet these requirements in the MOST secure way?
Show answer and explanation
Correct answer: B. Store the credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database. Retrieve the credentials from Secrets Manager as needed.
AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating credentials. It provides secure storage with encryption at rest, audit trails, and native integration with RDS for automatic rotation. A Lambda function can be configured to automatically rotate the database credentials and update both Secrets Manager and the database without storing credentials in application code.
Why the other options are wrong
- A. IAM roles work for services with native IAM support, but SQL Server RDS requires database user credentials that cannot be assumed via IAM.
- C. Storing credentials in S3 and downloading to instances at launch is less secure than Secrets Manager and doesn't provide automatic rotation or audit capabilities.
- D. DynamoDB is not designed for secrets storage, lacks encryption at rest by default for sensitive data, and doesn't provide the rotation and audit features of Secrets Manager.
Question 63
A company runs an application on AWS. The company deployed the application on Amazon EC2 instances. The application stores data on Amazon Aurora. The application recently logged multiple application-specific custom DECRYP_ERROR errors to Amazon CloudWatch logs. The company did not detect the issue until the automated tests that run every 30 minutes failed. A developer must implement a solution that will monitor for the custom errors and alert a development team in real time when these errors occur in the production environment. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: C. Use Amazon CloudWatch Logs to create a metric filter that has a filter pattern for DECRYP_ERROR. Create a CloudWatch alarm on this metric for a threshold >=1. Configure the alarm to send Amazon Simple Notification Service (Amazon SNS) notifications.
CloudWatch Logs Metric Filters are designed specifically for this use case. A metric filter with the pattern 'DECRYP_ERROR' will automatically scan incoming logs in real time and create a metric when matches are found. A CloudWatch alarm on this metric with a threshold of >=1 will trigger immediately when the error occurs, sending SNS notifications to the development team. This solution requires minimal operational overhead and no custom code.
Why the other options are wrong
- A. CloudTrail is for AWS API monitoring, not application logs; custom metrics require application code changes which adds overhead.
- B. A Lambda function scanning every 5 minutes introduces latency (up to 5 minutes) and requires custom code maintenance; this is slower than real-time metric filters.
- D. Installing and configuring the CloudWatch unified agent adds operational overhead and complexity compared to using native CloudWatch Logs Metric Filters.
Question 64
A developer is creating an AWS Serverless Application Model (AWS SAM) template. The AWS SAM template contains the definition of multiple AWS Lambda functions, an Amazon S3 bucket, and an Amazon CloudFront distribution. One of the Lambda functions runs on Lambda@Edge in the CloudFront distribution. The S3 bucket is configured as an origin for the CloudFront distribution. When the developer deploys the AWS SAM template in the eu-west-1 Region, the creation of the stack fails. Which of the following could be the reason for this issue?
Show answer and explanation
Correct answer: B. Lambda@Edge functions can be created only in the us-east-1 Region.
Lambda@Edge functions must be created in the us-east-1 Region, regardless of where the CloudFront distribution is deployed. When a developer attempts to deploy a SAM template containing a Lambda@Edge function in eu-west-1, the stack creation fails because Lambda@Edge has this regional requirement. CloudFront distributions themselves can be created in any region, and the template can contain multiple Lambda functions without issue.
Why the other options are wrong
- A. CloudFront distributions can be created in any region, not just us-east-1.
- C. A single AWS SAM template can contain multiple Lambda functions without limitation.
- D. CloudFront distributions and S3 buckets can be in the same region with no restrictions.
Question 65
A development team maintains a web application by using a single AWS CloudFormation template. The template defines web servers and an Amazon RDS database. The team uses the Cloud Formation template to deploy the Cloud Formation stack to different environments. During a recent application deployment, a developer caused the primary development database to be dropped and recreated. The result of this incident was a loss of data. The team needs to avoid accidental database deletion in the future. Which solutions will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, B. Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource; Update the CloudFormation stack policy to prevent updates to the database.
Option A is correct: adding a DeletionPolicy attribute with Retain value prevents the resource from being deleted when the stack is deleted, preserving the database. Option B is correct: a CloudFormation stack policy can explicitly deny update actions on the database resource, preventing accidental modifications or deletion during stack updates. Together, these protect against both stack deletion and unintended updates.
Why the other options are wrong
- C. Multi-AZ deployment improves availability and disaster recovery but does not prevent accidental deletion of the database resource.
- D. CloudFormation stack sets manage multiple stacks across regions and accounts but do not provide deletion protection for resources.
- E. DeletionPolicy is applied at the resource level, not the stack level; there is no stack-level DeletionPolicy attribute.
Question 66
A developer is creating a mobile application that will not require users to log in. What is the MOST efficient method to grant users access to AWS resources?
Show answer and explanation
Correct answer: D. Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access to resources.
Amazon Cognito with unauthenticated identity pools is the most efficient method for granting AWS resource access to users who don't require login. Cognito automatically associates unauthenticated users with temporary IAM credentials scoped to a specific IAM role with limited permissions. This approach requires no additional authentication logic and is the AWS-recommended pattern for mobile applications without user authentication.
Why the other options are wrong
- A. Identity providers require user authentication, which conflicts with the requirement that users not log in.
- B. Creating IAM users dynamically is inefficient, insecure, and violates AWS best practices; Cognito identity pools are the proper solution.
- C. KMS is a key management service, not a credential provisioning service, and does not provide the temporary credential mechanism needed.
Question 67
A company has a web application that runs on Amazon EC2 instances with a custom Amazon Machine Image (AMI). The company uses AWS CloudFormation to provision the application. The application runs in the us-east-1 Region, and the company needs to deploy the application to the us-west-1 Region. An attempt to create the AWS CloudFormation stack in us-west-1 fails. An error message states that the AMI ID does not exist. A developer must resolve this error with a solution that uses the least amount of operational overhead. Which solution meets these requirements?
Show answer and explanation
Correct answer: B. Copy the custom AMI from us-east-1 to us-west-1. Update the AWS CloudFormation template for us-west-1 to refer to AMI ID for the copied AMI. Relaunch the stack.
The most operationally efficient solution is to copy the custom AMI from us-east-1 to us-west-1 and update the CloudFormation template to reference the new AMI ID. This approach reuses the existing AMI configuration, requires minimal operational overhead, and avoids rebuilding the image. It leverages CloudFormation's existing infrastructure while solving the region-specific AMI availability issue.
Why the other options are wrong
- A. Switching to AWS AMIs requires application reconfiguration and loses the benefits of the custom image.
- C. Rebuilding the AMI in us-west-1 duplicates effort and creates maintenance challenges across regions.
- D. Manual deployment bypasses infrastructure-as-code practices and increases operational overhead significantly.
Question 68
An organization is storing large files in Amazon S3, and is writing a web application to display meta-data about the files to end-users. Based on the metadata a user selects an object to download. The organization needs a mechanism to index the files and provide single-digit millisecond latency retrieval for the metadata. What AWS service should be used to accomplish this?
Show answer and explanation
Correct answer: A. Amazon DynamoDB
Amazon DynamoDB is purpose-built for single-digit millisecond latency retrieval at scale. It provides native indexing through primary keys and Global Secondary Indexes, making it ideal for indexing S3 object metadata and enabling fast lookups when users select objects to download.
Why the other options are wrong
- B. EC2 instances require manual database setup, scaling, and administration; they are not optimized for metadata indexing out-of-the-box.
- C. Lambda is a compute service for running functions, not a database for indexing and retrieving metadata with consistent low latency.
- D. RDS (SQL databases) typically have higher query latency compared to DynamoDB and require more overhead for simple metadata retrieval at scale.
Question 69
A developer is building a serverless application that is based on AWS Lambda. The developer initializes the AWS software development kit (SDK) outside of the Lambda handler function. What is the PRIMARY benefit of this action?
Show answer and explanation
Correct answer: B. Takes advantage of runtime environment reuse
Initializing the AWS SDK outside the Lambda handler function allows the SDK instance to be reused across multiple invocations because Lambda reuses the runtime environment between invocations. This improves performance and reduces initialization overhead, which is a primary optimization technique in Lambda development.
Why the other options are wrong
- A. While this may follow conventions, improving code legibility is not the primary benefit of SDK initialization outside the handler.
- C. Error handling can be done regardless of where the SDK is initialized.
- D. Creating a new instance for each invocation would be inefficient and contradicts the purpose of initializing outside the handler.
Question 70
A developer is designing a serverless application with two AWS Lambda functions to process photos. One Lambda function stores objects in an Amazon S3 bucket and stores the associated metadata in an Amazon DynamoDB table. The other Lambda function fetches the objects from the S3 bucket by using the metadata from the DynamoDB table. Both Lambda functions use the same Python library to perform complex computations and are approaching the quota for the maximum size of zipped deployment packages. What should the developer do to reduce the size of the Lambda deployment packages with the LEAST operational overhead?
Show answer and explanation
Correct answer: B. Create a Lambda layer with the required Python library. Use the Lambda layer in both Lambda functions.
Lambda layers allow developers to package libraries and code that can be used by multiple Lambda functions without duplicating the code in each deployment package. By creating a single Lambda layer with the shared Python library, both functions can reference it, reducing the size of each function's deployment package with minimal operational overhead and no code duplication.
Why the other options are wrong
- A. Packaging the library separately for each function still requires duplication and does not reduce the overall package sizes.
- C. Combining two separate functions defeats the purpose of having distinct Lambda functions and reduces modularity.
- D. Storing the library in S3 and referencing it at runtime adds complexity and operational overhead compared to the built-in Lambda layers feature.
Question 71
Users are reporting errors in an application. The application consists of several microservices that are deployed on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate. Which combination of steps should a developer take to fix the errors? (Choose two.)
Show answer and explanation
Correct answer: A, D. Deploy AWS X-Ray as a sidecar container to the microservices. Update the task role policy to allow access to the X-Ray API; Instrument the application by using the AWS X-Ray SDK. Update the application to communicate with the X-Ray daemon.
To debug microservices on ECS Fargate with X-Ray, developers must: (A) deploy X-Ray as a sidecar container and update the task role policy to access X-Ray APIs, and (D) instrument the application with the X-Ray SDK to communicate with the X-Ray daemon. Daemonsets are for Kubernetes, not Fargate. CloudWatch Logs uses PushLogs, not PullLogs. The PutXrayTrace API is not the correct integration pattern.
Why the other options are wrong
- B. Daemonsets are Kubernetes constructs; Fargate uses sidecar containers instead.
- C. Applications use the X-Ray daemon for communication, not the PutXrayTrace API directly.
- E. CloudWatch Logs requires PushLogs action (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents), not PullLogs, which is not a valid action.
Question 72
A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle. After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account. Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)
Show answer and explanation
Correct answer: A, D. Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret; Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store inside the Lambda function handler.
AWS Secrets Manager (option A) provides centralized, secure storage for the Root CA Cert and allows updating it in one place for all Lambda functions across environments without redeployment. Refactoring Lambda code to load the cert from the secret location outside the handler (option D) ensures the cert is loaded once per container lifecycle, improving efficiency. Together, these allow updates without rebuilding Lambda functions while maintaining security and avoiding downtime.
Why the other options are wrong
- B. Systems Manager Parameter Store is less suitable than Secrets Manager for sensitive credentials like CA certificates; resource-based policies on Parameter Store are also not the standard approach.
- C. S3 requires more operational overhead for managing access policies and doesn't provide the same security features as Secrets Manager for sensitive credentials.
- E. Loading the cert inside the handler is inefficient as it reloads on every invocation, wasting resources and increasing latency.
Question 73
A company is using AWS CodePipeline to deliver one of its applications. The delivery pipeline is triggered by changes to the main branch of an AWS CodeCommit repository and uses AWS CodeBuild to implement the test and build stages of the process and AWS CodeDeploy to deploy the application. The pipeline has been operating successfully for several months and there have been no modifications. Following a recent change to the application’s source code, AWS CodeDeploy has not deployed the updated application as expected. What are the possible causes? (Choose two.)
Show answer and explanation
Correct answer: A, B. The change was not made in the main branch of the AWS CodeCommit repository; One of the earlier stages in the pipeline failed and the pipeline has terminated.
For CodeDeploy to execute in a CodePipeline, two critical conditions must be met: the source code change must be in the monitored branch (main), and all preceding pipeline stages must complete successfully. If the change was made to a different branch, the pipeline won't trigger. If CodeBuild or an earlier stage fails, the pipeline terminates before reaching CodeDeploy. Options C, D, and E are incorrect because CodePipeline doesn't require EC2 clusters, has been working for months without configuration changes, and permission issues would have prevented previous successful deployments.
Why the other options are wrong
- C. CodePipeline doesn't use a cluster; it orchestrates services, so EC2 instance status is irrelevant.
- D. Configuration issues would have prevented the pipeline from working successfully for months.
- E. Permission problems would have caused failures from the start, not after months of success.
Question 74
A company is creating an application that processes .csv files from Amazon S3. A developer has created an S3 bucket. The developer has also created an AWS Lambda function to process the .csv files from the S3 bucket. Which combination of steps will invoke the Lambda function when a .csv file is uploaded to Amazon S3? (Choose two.)
Show answer and explanation
Correct answer: A, C. Create an Amazon EventBridge rule. Configure the rule with a pattern to match the S3 object created event; Add a trigger to the existing Lambda function. Set the trigger type to EventBridge. Select the Amazon EventBridge rule.
To invoke a Lambda function when a .csv file is uploaded to S3, create an EventBridge rule with a pattern matching S3 object creation events (option A), then add that EventBridge rule as a trigger to the Lambda function (option C). This combination sets up the event-driven architecture needed to automatically process uploaded CSV files.
Why the other options are wrong
- B. Scheduling an EventBridge rule runs on a fixed schedule, not when files are uploaded; this does not respond to S3 uploads.
- D. Creating a separate Lambda function to scan S3 is less efficient than event-driven invocation and requires additional resources.
- E. S3 Lifecycle rules manage object transitions and deletions, not Lambda invocation.
Question 75
A company is planning to securely manage one-time fixed license keys in AWS. The company's development team needs to access the license keys in automaton scripts that run in Amazon EC2 instances and in AWS CloudFormation stacks. Which solution will meet these requirements MOST cost-effectively?
Show answer and explanation
Correct answer: C. AWS Systems Manager Parameter Store SecureString parameters
AWS Systems Manager Parameter Store SecureString parameters is the most cost-effective solution for managing fixed license keys. It provides encryption at rest, is free for standard parameters, and integrates seamlessly with EC2 instances and CloudFormation. It's specifically designed for configuration and secrets management at scale without additional costs.
Why the other options are wrong
- A. Amazon S3 with encrypted files is possible but less convenient for automation scripts and less purpose-built for secrets management.
- B. AWS Secrets Manager is more expensive than Parameter Store and better suited for managing rotating secrets and database credentials rather than static license keys.
- D. CloudFormation NoEcho parameters are only useful during stack creation/updates; they don't provide persistent secret storage for runtime access.
Question 76
A company hosts a client-side web application for one of its subsidiaries on Amazon S3. The web application can be accessed through Amazon CloudFront from https://www.example.com. After a successful rollout, the company wants to host three more client-side web applications for its remaining subsidiaries on three separate S3 buckets. To achieve this goal, a developer moves all the common JavaScript files and web fonts to a central S3 bucket that serves the web applications. However, during testing, the developer notices that the browser blocks the JavaScript files and web fonts. What should the developer do to prevent the browser from blocking the JavaScript files and web fonts?
Show answer and explanation
Correct answer: C. Create a cross-origin resource sharing (CORS) configuration that allows access to the central S3 bucket. Add the CORS configuration to the central S3 bucket.
The browser is blocking the JavaScript files and web fonts due to CORS (Cross-Origin Resource Sharing) policy. When web applications served from one S3 bucket access resources (JavaScript and fonts) from a different S3 bucket, the browser requires explicit CORS configuration on the central bucket to allow these cross-origin requests. Adding a CORS configuration to the central S3 bucket that permits requests from the application domains solves this issue.
Why the other options are wrong
- A. S3 Access Points are not related to CORS and do not resolve cross-origin resource blocking issues.
- B. A bucket policy controls who can access the bucket, but does not address browser CORS restrictions on cross-origin requests.
- D. Content-MD5 headers provide integrity verification, not cross-origin resource access permissions; they do not affect browser CORS policies.
Question 77
A developer created a web API that receives requests by using an internet-facing Application Load Balancer (ALB) with an HTTPS listener. The developer configures an Amazon Cognito user pool and wants to ensure that every request to the API is authenticated through Amazon Cognito. What should the developer do to meet this requirement?
Show answer and explanation
Correct answer: B. Create an authentication action for the listener rules of the ALB. Set the rule action type to authenticate-cognito. Set the OnUnauthenticatedRequest field to “deny.”
API Gateway Application Load Balancers natively support authentication actions for listener rules. Creating an authenticate-cognito action and setting OnUnauthenticatedRequest to 'deny' ensures all requests are authenticated through Cognito before reaching the API. This is built into ALB functionality and is the most direct solution.
Why the other options are wrong
- A. Checking for an Authorization header and returning 401 is a manual workaround that does not actually authenticate through Cognito.
- C. Adding API Gateway as a layer in front of the ALB adds unnecessary complexity; ALBs have native Cognito authentication support.
- D. Creating a custom Lambda function for authentication is more complex and less efficient than using the built-in ALB authentication action.
Question 78
A developer is building a serverless application by using AWS Serverless Application Model (AWS SAM) on multiple AWS Lambda functions. When the application is deployed, the developer wants to shift 10% of the traffic to the new deployment of the application for the first 10 minutes after deployment. If there are no issues, all traffic must switch over to the new version. Which change to the AWS SAM template will meet these requirements?
Show answer and explanation
Correct answer: A. Set the Deployment Preference Type to Canary10Percent10Minutes. Set the AutoPublishAlias property to the Lambda alias.
Canary10Percent10Minutes is the correct deployment preference type that shifts 10% of traffic for 10 minutes before completing the switch. The AutoPublishAlias property is required in SAM to enable traffic shifting with Lambda aliases. This configuration automatically publishes new versions and manages the gradual traffic shift. Linear deployment spreads traffic shifts gradually over a longer period, not in a single canary phase. PreTraffic and PostTraffic hooks are used for validation but are not required for basic canary deployments.
Why the other options are wrong
- B. Linear10PercentEvery10Minutes gradually shifts traffic over multiple intervals, not a single 10-minute canary phase.
- C. Canary is correct but PreTraffic/PostTraffic properties are not the right mechanism for traffic shifting configuration.
- D. Linear is incorrect, and PreTraffic/PostTraffic are validation hooks, not traffic shifting configuration.
Question 79
A developer maintains an Amazon API Gateway REST API. Customers use the API through a frontend UI and Amazon Cognito authentication. The developer has a new version of the API that contains new endpoints and backward-incompatible interface changes. The developer needs to provide beta access to other developers on the team without affecting customers. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Define a development stage on the API Gateway API. Instruct the other developers to point the endpoints to the development stage.
API Gateway stages allow multiple versions of the same API to coexist with different configurations and backends. Creating a development stage for the new API version enables beta testing without affecting production customers. This requires minimal operational overhead, just a stage configuration and endpoint routing, and uses existing AWS infrastructure.
Why the other options are wrong
- B. Creating a separate API Gateway instance duplicates infrastructure and increases operational overhead compared to using stages.
- C. Implementing query parameter logic in application code adds complexity, requires code changes, and is harder to manage than using API Gateway stages.
- D. Specifying new endpoints without a stage strategy does not provide version isolation or the ability to manage development and production separately.
Question 80
A developer is working on a web application that uses Amazon DynamoDB as its data store. The application has two DynamoDB tables: one table that is named artists and one table that is named songs. The artists table has artistName as the partition key. The songs table has songName as the partition key and artistName as the sort key. The table usage patterns include the retrieval of multiple songs and artists in a single database operation from the webpage. The developer needs a way to retrieve this information with minimal network traffic and optimal application performance. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Perform a BatchGetltem operation that returns items from the two tables. Use the list of songName/artistName keys for the songs table and the list of artistName key for the artists table.
BatchGetItem is designed to retrieve multiple items from one or more tables in a single operation, minimizing network round trips. This solution retrieves multiple songs using songName/artistName composite keys from the songs table and multiple artists using artistName keys from the artists table in one batch operation, meeting the requirement for minimal network traffic and optimal performance.
Why the other options are wrong
- B. Creating an LSI with artistName as partition key is invalid because artistName is already the sort key; also, multiple query operations increase network overhead.
- C. Performing separate BatchGetItem operations on each table requires two API calls instead of one, increasing network traffic.
- D. Scan operations are inefficient, require filtering, and generate significant network traffic compared to the targeted BatchGetItem approach.
Question 81
A company developed an API application on AWS by using Amazon CloudFront, Amazon API Gateway, and AWS Lambda. The API has a minimum of four requests every second. A developer notices that many API users run the same query by using the POST method. The developer wants to cache the POST request to optimize the API resources. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Override the cache method in the selected stage of API Gateway. Select the POST method.
API Gateway allows caching of POST requests by overriding the cache method settings at the stage level. By selecting the POST method and configuring appropriate cache keys based on request parameters, the same POST requests can be served from cache. This is the proper AWS mechanism for caching POST requests, as CloudFront by default does not cache POST requests, but API Gateway stage-level caching can be configured to do so.
Why the other options are wrong
- A. CloudFront by default does not cache POST requests; the default behavior cannot be overridden at the CloudFront level to cache based on method.
- C. Using Lambda /tmp directory for caching is not a robust solution and would not persist across Lambda invocations if the container is recycled.
- D. Parameter Store is a configuration service, not designed for caching API response data; it would add unnecessary latency and complexity.
Question 82
A company has an application that stores data in Amazon RDS instances. The application periodically experiences surges of high traffic that cause performance problems. During periods of peak traffic, a developer notices a reduction in query speed in all database queries. The team’s technical lead determines that a multi-threaded and scalable caching solution should be used to offload the heavy read traffic. The solution needs to improve performance. Which solution will meet these requirements with the LEAST complexity?
Show answer and explanation
Correct answer: A. Use Amazon ElastiCache for Memcached to offload read requests from the main database.
Amazon ElastiCache for Memcached is specifically designed as a multi-threaded, distributed caching solution that reduces database load with minimal complexity. It's ideal for offloading read-heavy traffic from RDS and requires no schema changes. Memcached's simplicity and direct integration with RDS make it the least complex solution compared to alternatives that require data replication or architectural changes.
Why the other options are wrong
- B. Replicating data to DynamoDB adds significant complexity and requires application code changes to support multiple data stores.
- C. Multi-AZ with standby replicas doesn't solve the underlying performance issue caused by high query load; queries still hit the same database resources.
- D. While Redis is also viable, Memcached is simpler for pure caching use cases without additional features like persistence or data structures that Redis provides.
Question 83
A company has a three-tier application that is deployed in Amazon Elastic Container Service (Amazon ECS). The application is using an Amazon RDS for MySQL DB instance. The application performs more database reads than writes. During times of peak usage, the application’s performance degrades. When this performance degradation occurs, the DB instance’s ReadLatency metric in Amazon CloudWatch increases suddenly. How should a developer modify the application to improve performance?
Show answer and explanation
Correct answer: A. Use Amazon ElastiCache to cache query results.
The application performs more reads than writes and experiences sudden ReadLatency spikes during peak usage. Amazon ElastiCache is purpose-built for caching frequently accessed query results, which significantly reduces the load on the RDS database and improves read performance. This is a standard solution for read-heavy workloads experiencing database latency issues.
Why the other options are wrong
- B. Scaling the ECS cluster addresses compute capacity, not database read latency.
- C. RDS for MySQL does not use RCUs; that concept applies to DynamoDB. For relational databases, read optimization typically involves caching rather than capacity adjustments.
- D. Increasing task memory does not resolve database latency; the bottleneck is at the database layer, not the application layer.
Question 84
A company recently deployed an AWS Lambda function. A developer notices an increase in the function throttle metrics in Amazon CloudWatch. What are the MOST operationally efficient solutions to reduce the function throttling? (Choose two.)
Show answer and explanation
Correct answer: C, E. Increase the function’s reserved concurrency; Request a service quota change for increased concurrency.
Lambda throttling occurs when concurrent invocations exceed available concurrency. Increasing reserved concurrency (option C) directly allocates more concurrent execution capacity to the function. Requesting a service quota increase (option E) raises the account-level concurrency limit, providing more capacity across all functions. Both are direct solutions to the throttling problem.
Why the other options are wrong
- A. Migrating to EKS is operationally inefficient for addressing Lambda throttling and introduces unnecessary complexity.
- B. Maximum event age affects retry behavior in asynchronous invocations but does not increase concurrency capacity.
- D. GetFunctionConcurrency is a read-only action for checking concurrency metrics; it does not increase capacity.
Question 85
A developer is building a new application on AWS. The application uses an AWS Lambda function that retrieves information from an Amazon DynamoDB table. The developer hard coded the DynamoDB table name into the Lambda function code. The table name might change over time. The developer does not want to modify the Lambda code if the table name changes. Which solution will meet these requirements MOST efficiently?
Show answer and explanation
Correct answer: A. Create a Lambda environment variable to store the table name. Use the standard method for the programming language to retrieve the variable.
Lambda environment variables are the standard, most efficient mechanism for managing configuration values that may change without modifying code. They are easily updated through the AWS Console, CLI, or Infrastructure as Code tools, and can be retrieved using language-standard environment variable access methods. This is the AWS-recommended approach for non-sensitive configuration data.
Why the other options are wrong
- B. The /tmp folder is not persistent across Lambda executions and is intended for temporary runtime data, not configuration management.
- C. Lambda layers add unnecessary complexity and overhead for simple configuration management; they're designed for shared code libraries, not configuration.
- D. Global variables at the module level work during warm starts but persist values across invocations unpredictably and don't provide an external configuration mechanism for updates.
Question 86
A company has multiple Amazon VPC endpoints in the same VPC. A developer needs to configure an Amazon S3 bucket policy so users can access an S3 bucket only by using these VPC endpoints. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Create a single S3 bucket policy that has multiple aws:sourceVpce value in the StringNotEquals condition. Repeat for all the VPC endpoint IDs.
To restrict access to an S3 bucket only through specific VPC endpoints, the bucket policy must explicitly deny access when the source VPC endpoint is NOT one of the allowed endpoints. Using multiple aws:SourceVpce values in a StringNotEquals condition ensures that only requests from those specific VPC endpoints are allowed; all other access is denied.
Why the other options are wrong
- A. Multiple separate policies are unnecessary and harder to manage when a single policy with multiple conditions accomplishes the goal.
- B. aws:SourceVpc condition allows access from any resource in the VPC, not just through the specified endpoints, failing the requirement.
- C. Using vpce* as a wildcard pattern doesn't restrict to specific endpoints and defeats the security purpose of the policy.
Question 87
A company runs a batch processing application by using AWS Lambda functions and Amazon API Gateway APIs with deployment stages for development, user acceptance testing, and production. A development team needs to configure the APIs in the deployment stages to connect to third-party service endpoints. Which solution will meet this requirement?
Show answer and explanation
Correct answer: B. Store the third-party service endpoints in API Gateway stage variables that correspond to the stage.
API Gateway stage variables are specifically designed to store environment-specific configuration values that can differ between deployment stages. They can be referenced in Lambda functions, HTTP endpoints, and request/response mappings, making them ideal for managing different third-party service endpoints for development, testing, and production stages.
Why the other options are wrong
- A. Lambda layers are for sharing code and libraries, not for storing stage-specific configuration values.
- C. Hardcoding endpoints as query parameters couples configuration to request URLs and lacks proper environment separation.
- D. While AppConfig can store configuration, API Gateway stage variables are the native, simpler solution designed specifically for this use case.
Question 88
A developer has observed an increase in bugs in the AWS Lambda functions that a development team has deployed in its Node.js application. To minimize these bugs, the developer wants to implement automated testing of Lambda functions in an environment that closely simulates the Lambda environment. The developer needs to give other developers the ability to run the tests locally. The developer also needs to integrate the tests into the team’s continuous integration and continuous delivery (CI/CD) pipeline before the AWS Cloud Development Kit (AWS CDK) deployment. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Install the AWS Serverless Application Model (AWS SAM) CLI tool. Use the sam local generate-event command to generate sample events for the automated tests. Create automated test scripts that use the sam local invoke command to invoke the Lambda functions. Check the response. Document the test scripts for the other developers on the team. Update the CI/CD pipeline to run the test scripts.
AWS SAM CLI is purpose-built for local Lambda development and testing. The sam local generate-event command creates realistic sample events based on Lambda event sources, and sam local invoke runs Lambda functions in a Docker container that closely simulates the actual Lambda execution environment. This solution enables local testing by all developers, integrates seamlessly into CI/CD pipelines, and works with CDK-based projects.
Why the other options are wrong
- A. The cdk local invoke command does not exist; CDK does not provide built-in local Lambda invocation capabilities.
- B. While unit testing frameworks can test Lambda handlers, they don't simulate the actual Lambda execution environment or provide realistic event generation.
- D. Creating a custom Docker container from the Node.js base image is manual and error-prone; SAM CLI already provides an officially maintained Lambda simulation environment.
Question 89
An application uses Lambda functions to extract metadata from files uploaded to an S3 bucket; the metadata is stored in Amazon DynamoDB. The application starts behaving unexpectedly, and the developer wants to examine the logs of the Lambda function code for errors. Based on this system configuration, where would the developer find the logs?
Show answer and explanation
Correct answer: C. Amazon CloudWatch
AWS CloudWatch is the standard and native destination for Lambda function logs. CloudWatch Logs automatically captures all standard output and error streams from Lambda function execution, making it the primary location for examining function errors and debugging application behavior.
Why the other options are wrong
- A. S3 is a storage service and not the default logging destination for Lambda functions; logs would need manual export.
- B. CloudTrail logs API calls and management events, not application-level Lambda function output and errors.
- D. DynamoDB is a database service for storing application data, not Lambda function logs.
Question 90
An AWS Lambda function is running in a company’s shared AWS account. The function needs to perform an additional ec2:DescribeInstances action that is directed at the company’s development accounts. A developer must configure the required permissions across the accounts. How should the developer configure the permissions to adhere to the principle of least privilege?
Show answer and explanation
Correct answer: B. Create an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions.
To follow the principle of least privilege, the ec2:DescribeInstances permission should be created in the development accounts where the resources exist. The Lambda function's IAM role in the shared account only needs iam:AssumeRole permission to assume the role in development accounts. This creates a trust relationship allowing the shared account to assume the development account role. Option A incorrectly creates duplicate permissions. Options C and D either duplicate permissions or grant overly broad permissions to the shared account.
Why the other options are wrong
- A. Creates the permission in the shared account unnecessarily, duplicating permissions instead of following cross-account best practices.
- C. Duplicates ec2:DescribeInstances in the shared account when only iam:AssumeRole is needed there.
- D. Grants ec2:DescribeInstances to the shared account role instead of using assume role delegation.
Question 91
A company is updating an application to move the backend of the application from Amazon EC2 instances to a serverless model. The application uses an Amazon RDS for MySQL DB instance and runs in a single VPC on AWS. The application and the DB instance are deployed in a private subnet in the VPC. The company needs to connect AWS Lambda functions to the DB instance. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Create Lambda functions inside the VPC with the AWSLambdaVPCAccessExecutionRole policy attached to the Lambda execution role. Modify the RDS security group to allow inbound access from the Lambda security group.
Lambda functions must be placed inside the VPC to access the private RDS instance. The AWSLambdaVPCAccessExecutionRole provides the necessary permissions for Lambda to create and manage elastic network interfaces (ENIs) in the VPC. The RDS security group must then allow inbound connections from the Lambda security group. This is the standard approach for Lambda-to-RDS connectivity in private subnets.
Why the other options are wrong
- A. AWSLambdaBasicExecutionRole only provides CloudWatch Logs permissions and lacks VPC access capabilities.
- C. Lambda must be inside the VPC to access private RDS; VPC endpoints are for AWS service access, not database connections.
- D. VPC endpoints are not needed for Lambda-to-RDS connectivity when Lambda is already in the VPC.
Question 92
A developer has a legacy application that is hosted on-premises. Other applications hosted on AWS depend on the on-premises application for proper functioning. In case of any application errors, the developer wants to be able to use Amazon CloudWatch to monitor and troubleshoot all applications from one place. How can the developer accomplish this?
Show answer and explanation
Correct answer: B. Download the CloudWatch agent to the on-premises server. Configure the agent to use IAM user credentials with permissions for CloudWatch.
The CloudWatch agent is the standard AWS tool for collecting logs and metrics from on-premises servers and sending them to CloudWatch. By downloading the agent to the on-premises server and configuring it with IAM user credentials that have CloudWatch permissions, the developer can monitor both on-premises and AWS applications from a single CloudWatch console. This is the most straightforward and supported approach.
Why the other options are wrong
- A. The AWS SDK is for programmatic access to AWS services, not for automatic log streaming; it would require custom code to send logs to CloudWatch.
- C. Uploading logs to S3 and having CloudWatch read them adds unnecessary complexity and latency; it is not a supported CloudWatch log ingestion method.
- D. Forwarding logs through an EC2 instance adds an unnecessary intermediary and operational overhead when the CloudWatch agent can connect directly from on-premises servers.
Question 93
A developer is creating an application that includes an Amazon API Gateway REST API in the us-east-2 Region. The developer wants to use Amazon CloudFront and a custom domain name for the API. The developer has acquired an SSL/TLS certificate for the domain from a third-party provider. How should the developer configure the custom domain for the application?
Show answer and explanation
Correct answer: D. Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the us-east-1 Region. Create a DNS CNAME record for the custom domain.
When using CloudFront with a custom domain for an API Gateway REST API, SSL/TLS certificates must be imported into AWS Certificate Manager (ACM) in the us-east-1 Region, as CloudFront requires certificates to be in us-east-1 regardless of the API's Region. The custom domain then uses a DNS CNAME record pointing to the CloudFront distribution. This is a CloudFront-specific requirement for certificate placement.
Why the other options are wrong
- A. Importing the certificate in the same Region as the API (us-east-2) will not work for CloudFront, which requires certificates in us-east-1. Additionally, an A record is not used for custom domains with CloudFront.
- B. Certificates cannot be imported directly into CloudFront; they must be imported into ACM first, and CloudFront accesses them from there.
- C. While a CNAME record is correct, importing the certificate into ACM in us-east-2 (the same Region as the API) will not work for CloudFront, which specifically requires us-east-1.
Question 94
A company built a new application in the AWS Cloud. The company automated the bootstrapping of new resources with an Auto Scaling group by using AWS CloudFormation templates. The bootstrap scripts contain sensitive data. The company needs a solution that is integrated with CloudFormation to manage the sensitive data in the bootstrap scripts. Which solution will meet these requirements in the MOST secure way?
Show answer and explanation
Correct answer: C. Put the sensitive data into AWS Systems Manager Parameter Store as a secure string parameter. Update the CloudFormation templates to use dynamic references to specify template values.
AWS Systems Manager Parameter Store with SecureString parameters and dynamic references in CloudFormation templates is the most secure integrated solution. SecureString parameters are encrypted at rest using KMS, and CloudFormation's dynamic references automatically retrieve values during stack creation without exposing them in template files or logs. This approach integrates seamlessly with CloudFormation and requires no manual secret management.
Why the other options are wrong
- A. Storing sensitive data in CloudFormation parameters exposes secrets in template files and stack events, violating security best practices.
- B. S3 requires additional logic to retrieve secrets during bootstrap and doesn't provide the same level of CloudFormation integration as Parameter Store dynamic references.
- D. EFS is a file system service designed for persistent storage, not for managing transient secrets, and adds unnecessary complexity.
Question 95
A developer is creating an application that reads and writes to multiple Amazon S3 buckets. The application will be deployed to an Amazon EC2 instance. The developer wants to make secure API requests from the EC2 instances without the need to manage the security credentials for the application. The developer needs to apply the principle of least privilege. Which solution will meet these requirements?
Show answer and explanation
Correct answer: B. Associate the EC2 instance with an IAM role that has an IAM policy that allows s3:ListBucket and s3:*Object permissions for specific S3 buckets.
Option B uses an IAM role attached to the EC2 instance, which eliminates the need to manage security credentials in the application code. The policy grants s3:ListBucket and s3:*Object permissions for specific S3 buckets, adhering to the principle of least privilege by limiting permissions to only what is needed for the specific buckets rather than all S3 resources.
Why the other options are wrong
- A. IAM users with access keys require credential management in the application, which violates the 'without managing credentials' requirement and the s3:* permission is overly broad.
- C. AmazonS3FullAccess is an overly permissive AWS managed policy that violates the principle of least privilege.
- D. Bucket policies do not address the secure credential management requirement and are not the appropriate mechanism for EC2 instance permissions.
Question 96
A company is creating a REST service using an Amazon API Gateway with AWS Lambda integration. The service must run different versions for testing purposes. What would be the BEST way to accomplish this?
Show answer and explanation
Correct answer: D. Deploy the API versions as unique stages with unique endpoints and use stage variables to provide further context.
API Gateway stages are the standard mechanism for managing different versions of an API. Deploying versions as unique stages provides separate endpoints and allows stage variables to pass context to Lambda functions. This approach keeps versions isolated, maintains clean APIs, and is the AWS best practice for API versioning.
Why the other options are wrong
- A. Using custom headers for versioning lacks the operational structure and isolation that stages provide.
- B. Lambda authorizers are for authentication and authorization, not for routing to different API versions.
- C. Resource policies are for access control, not for versioning or routing logic.
Question 97
A developer is trying to get data from an Amazon DynamoDB table called demoman-table. The developer configured the AWS CLI to use a specific IAM user’s credentials and ran the following command: aws dynamodb get-item --table-name demoman-table --key '{"id": {"N":"1993"}}' The command returned errors and no rows were returned. What is the MOST likely cause of these issues?
Show answer and explanation
Correct answer: D. The IAM user needs an associated policy with read access to demoman-table.
The AWS CLI command syntax is correct and the table exists, but the command returned errors and no data. This indicates an authorization failure. The IAM user needs an associated policy granting read permissions (dynamodb:GetItem action) on the demoman-table resource to successfully execute the command.
Why the other options are wrong
- A. The command syntax is correct; get-item is the appropriate operation for retrieving a single item by key.
- B. AWS Support cannot enable access; access is controlled through IAM policies, which are the customer's responsibility.
- C. DynamoDB is fully accessible via AWS CLI, which uses the same APIs as direct SDK calls.
Question 98
A developer at a company recently created a serverless application to process and show data from business reports. The application’s user interface (UI) allows users to select and start processing the files. The UI displays a message when the result is available to view. The application uses AWS Step Functions with AWS Lambda functions to process the files. The developer used Amazon API Gateway and Lambda functions to create an API to support the UI. The company’s UI team reports that the request to process a file is often returning timeout errors because of the size or complexity of the files. The UI team wants the API to provide an immediate response so that the UI can display a message while the files are being processed. The backend process that is invoked by the API needs to send an email message when the report processing is complete. What should the developer do to configure the API to meet these requirements?
Show answer and explanation
Correct answer: A. Change the API Gateway route to add an X-Amz-Invocation-Type header with a static value of ‘Event’ in the integration request. Deploy the API Gateway stage to apply the changes.
Setting the X-Amz-Invocation-Type header to 'Event' in the API Gateway integration request invokes the Lambda function asynchronously, allowing API Gateway to return immediately without waiting for the Lambda function to complete. This enables the UI to display a message while the Step Functions process the file in the background, and the backend can send an email upon completion.
Why the other options are wrong
- B. Lambda functions do not have an 'event age' configuration parameter for asynchronous execution.
- C. Increasing the timeout value does not solve the problem; the request still needs to return immediately to avoid timeouts.
- D. X-Amz-Target is used for different AWS service operations, not for controlling Lambda invocation type.
Question 99
A company is preparing to migrate an application to the company's first AWS environment. Before this migration, a developer is creating a proof-of-concept application to validate a model for building and deploying container-based applications on AWS. Which combination of steps should the developer take to deploy the containerized proof-of-concept application with the LEAST operational effort? (Choose two.)
Show answer and explanation
Correct answer: B, E. Package the application into a container image by using the Docker CLI. Upload the image to Amazon Elastic Container Registry (Amazon ECR); Deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
For a proof-of-concept containerized application with least operational effort, option B (Docker container image to ECR) is the standard practice for containerized applications. Option E (ECS on Fargate) provides the simplest deployment path without managing EC2 instances or Kubernetes infrastructure, requiring minimal operational overhead. Together, they provide a streamlined container build-and-deploy workflow that AWS optimizes for ease of use.
Why the other options are wrong
- A. Packaging as .zip is for traditional applications, not containers; doesn't leverage container benefits.
- C. CodeDeploy with EC2 requires managing instances and is more operational overhead than Fargate.
- D. EKS requires Kubernetes expertise and cluster management, adding operational complexity inappropriate for a POC.
Question 100
A developer has written an application that runs on Amazon EC2 instances. The developer is adding functionality for the application to write objects to an Amazon S3 bucket. Which policy must the developer modify to allow the instances to write these objects?
Show answer and explanation
Correct answer: A. The IAM policy that is attached to the EC2 instance profile role
The IAM policy attached to the EC2 instance profile role is what grants permissions to the EC2 instance. To allow EC2 instances to write objects to S3, the developer must add a policy to the IAM role that is attached to the instance profile. This role defines what AWS resources the instance can access.
Why the other options are wrong
- B. Session policies are temporary credentials not used for EC2 instance permissions.
- C. KMS key policies are for encryption key access, not for S3 write permissions.
- D. VPC endpoint policies control traffic through endpoints but do not grant S3 write permissions.
Question 101
A company has an application that uses Amazon Cognito user pools as an identity provider. The company must secure access to user records. The company has set up multi-factor authentication (MFA). The company also wants to send a login activity notification by email every time a user logs in. What is the MOST operationally efficient solution that meets this requirement?
Show answer and explanation
Correct answer: B. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.
A Cognito post authentication Lambda trigger is the most operationally efficient solution. It automatically invokes a Lambda function immediately after a user successfully authenticates, eliminating the need for client-side API calls or external monitoring. The Lambda function can use Amazon SES to send the login notification email. This approach is fully integrated with Cognito's authentication flow and requires no additional infrastructure or polling mechanisms.
Why the other options are wrong
- A. Requiring client-side API calls adds implementation complexity and depends on client code execution, which is less reliable and operationally less efficient.
- C. CloudWatch Logs subscription filters require parsing log data and are less direct than native Cognito triggers for authentication events.
- D. Using Kinesis Data Firehose adds unnecessary complexity and operational overhead when a native Cognito trigger provides direct, simpler integration.
Question 102
A software company is launching a multimedia application. The application will allow guest users to access sample content before the users decide if they want to create an account to gain full access. The company wants to implement an authentication process that can identify users who have already created an account. The company also needs to keep track of the number of guest users who eventually create an account. Which combination of steps will meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: B, D. Create an Amazon Cognito identity pool. Configure the identity pool to allow unauthenticated users. Exchange unique identity for temporary credentials that allow all users to assume a role; Create a role for authenticated users that allows access to all content. Create a role for unauthenticated users that allows access to only the sample content.
Option B (identity pool for unauthenticated users with temporary credentials) enables guest access to sample content without authentication. Option D (separate roles for authenticated and unauthenticated users) allows fine-grained access control where guests see only samples while authenticated users see full content. Together, these enable tracking of user progression from guest to authenticated, as the system can identify when an unauthenticated identity becomes associated with an authenticated user account.
Why the other options are wrong
- A. User pools are for authentication management, not for handling unauthenticated guest access patterns.
- C. CloudFront distributions do not provide authentication or identity management capabilities.
- E. This approach lacks the authentication mechanism needed to identify when guest users create accounts and doesn't properly track user progression.
Question 103
A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution accesses the S3 bucket by using an origin access identity (OAI). The S3 bucket's permissions explicitly deny access to all other users. The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories. The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket. However, when the developer tries to navigate to the login page, the developer receives a 403 Forbidden error. The developer needs to implement a solution to allow unauthenticated access to the login page. The solution also must keep all private content secure. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior's settings unchanged.
Adding a second cache behavior with a specific path pattern for the login page and unrestricted viewer access allows unauthenticated users to reach the login page, while keeping the default cache behavior restricted for protected content. This leverages CloudFront's ability to apply different caching and authentication policies to different path patterns, elegantly solving the problem without compromising security.
Why the other options are wrong
- B. Setting the second behavior's path to * and making it restricted would leave all content protected, defeating the purpose; this doesn't correctly apply path-specific rules.
- C. Adding a failover origin doesn't address the authentication requirement; failover is for high availability, not access control based on authentication status.
- D. Modifying the bucket policy to allow public read access undermines the security model; CloudFront functions cannot reliably enforce authentication state for dynamic redirects.
Question 104
A developer maintains a critical business application that uses Amazon DynamoDB as the primary data store. The DynamoDB table contains millions of documents and receives 30-60 requests each minute. The developer needs to perform processing in near-real time on the documents when they are added or updated in the DynamoDB table. How can the developer implement this feature with the LEAST amount of change to the existing application code?
Show answer and explanation
Correct answer: B. Enable a DynamoDB stream on the table. Invoke an AWS Lambda function to process the documents.
DynamoDB Streams capture item-level modifications and can trigger Lambda functions in near-real time with minimal code changes. This approach requires no modification to existing application write logic, streams are enabled on the table and Lambda is automatically invoked when documents are added or updated. It provides the least invasive implementation compared to adding application code, cron jobs, or synchronous processing.
Why the other options are wrong
- A. EC2 cron jobs polling hourly are not near-real time and require significant infrastructure management.
- C. This requires updating application code to send events to EventBridge, adding unnecessary changes.
- D. Synchronous processing blocks the application and degrades performance under the given load of 30-60 requests per minute.
Question 105
A team of developers is using an AWS CodePipeline pipeline as a continuous integration and continuous delivery (CI/CD) mechanism for a web application. A developer has written unit tests to programmatically test the functionality of the application code. The unit tests produce a test report that shows the results of each individual check. The developer now wants to run these tests automatically during the CI/CD process. Which solution will meet this requirement with the LEAST operational effort?
Show answer and explanation
Correct answer: C. Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues.
Adding CodeBuild as a stage before deployment to the test environment ensures tests run and fail early in the pipeline, preventing broken code from reaching test environments. This is the least operationally effortful solution as it's fully automated within CodePipeline and doesn't require developers to install pre-commit hooks or external tools. CodeBuild's native test report integration provides visibility without additional configuration.
Why the other options are wrong
- A. Git pre-commit hooks require manual installation and maintenance on each developer's machine, creating operational overhead and no guarantee of compliance.
- B. Running tests after deployment to test environment defeats the purpose of early failure detection and wastes resources deploying broken code.
- D. Jenkins introduces external tool complexity and maintenance burden when CodeBuild is a native, simpler AWS solution.
Question 106
A company has an AWS Lambda function that processes incoming requests from an Amazon API Gateway API. The API calls the Lambda function by using a Lambda alias. A developer updated the Lambda function code to handle more details related to the incoming requests. The developer wants to deploy the new Lambda function for more testing by other developers with no impact to customers that use the API. Which solution will meet these requirements with the LEAST operational overhead?
Show answer and explanation
Correct answer: A. Create a new version of the Lambda function. Create a new stage on API Gateway with integration to the new Lambda version. Use the new API Gateway stage to test the Lambda function.
Option A provides the simplest solution with least operational overhead: create a new Lambda version, then create a new API Gateway stage pointing to that new version. Other developers can test using the new stage URL while production customers continue using the existing stage. Option B risks impacting production with weighted routing, Option C adds unnecessary filtering logic, and Option D requires managing a separate API which adds overhead.
Why the other options are wrong
- B. Weighted aliases risk sending production traffic to untested code even at low percentages.
- C. Adding a filtering Lambda function adds operational complexity and potential points of failure.
- D. Creating a separate API duplicates infrastructure and adds operational overhead.
Question 107
A company is developing an ecommerce application that uses Amazon API Gateway APIs. The application uses AWS Lambda as a backend. The company needs to test the code in a dedicated, monitored test environment before the company releases the code to the production environment. Which solution will meet these requirements?
Show answer and explanation
Correct answer: C. Use multiple stages in API Gateway. Create a Lambda function for each environment. Configure API Gateway stage variables to route traffic to the Lambda function in different environments.
Using multiple API Gateway stages with stage variables allows routing to different Lambda function versions or environments (dev, test, production) based on the stage being invoked. This is the AWS-recommended approach for managing multiple environments, providing isolation, separate monitoring, and clean separation of concerns without complex logic in the Lambda function.
Why the other options are wrong
- A. Using a single stage with query parameters to route to different functions is not scalable and requires logic outside the standard API Gateway configuration.
- B. Using a single Lambda function with environment variables and conditional code blocks creates coupling and makes the function difficult to maintain and test independently.
- D. A single stage with query parameters requires embedding environment routing logic in the application and Lambda function, violating separation of concerns.
Question 108
A developer is building a highly secure healthcare application using serverless components. This application requires writing temporary data to /tmp storage on an AWS Lambda function. How should the developer encrypt this data?
Show answer and explanation
Correct answer: B. Set up the Lambda function with a role and key policy to access an AWS KMS key. Use the key to generate a data key used to encrypt all data prior to writing to /tmp storage.
The secure approach is to set up an IAM role with permissions to access a KMS key, use GenerateDataKey API to obtain a data key, and use that key to encrypt data before writing to /tmp storage. This provides proper key management, encryption, audit trail, and secure key rotation through AWS KMS rather than relying on local key generation.
Why the other options are wrong
- A. Lambda does not support EBS volume encryption configuration; Lambda's ephemeral storage cannot be configured with EBS encryption settings.
- C. Generating encryption keys locally on Lambda startup is insecure, lacks key rotation, provides no audit trail, and violates security best practices for healthcare applications.
- D. Using an on-premises HSM is unnecessarily complex, increases latency, creates a hybrid security model, and defeats the purpose of using serverless AWS components.
Question 109
A company is using Amazon OpenSearch Service to implement an audit monitoring system. A developer needs to create an AWS CloudFormation custom resource that is associated with an AWS Lambda function to configure the OpenSearch Service domain. The Lambda function must access the OpenSearch Service domain by using OpenSearch Service internal master user credentials. What is the MOST secure way to pass these credentials to the Lambda function?
Show answer and explanation
Correct answer: D. Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the secretsmanager:GetSecretValue permission. Assign the role to the Lambda function. Store the secret’s name as the Lambda function’s environment variable. Resolve the secret’s value at runtime.
AWS Secrets Manager with CloudFormation dynamic references is the most secure approach: credentials are stored encrypted in Secrets Manager, the Lambda function retrieves them at runtime using an IAM role with minimal permissions, and credentials never appear in environment variables or CloudFormation templates. This follows the principle of least privilege and ensures credentials are kept secret throughout the deployment and runtime process.
Why the other options are wrong
- A. Passing credentials via environment variables, even with NoEcho, exposes them in the function configuration and is a security anti-pattern.
- B. Parameter Store is less suitable for sensitive credentials than Secrets Manager, which is purpose-built for credential management.
- C. KMS encryption of parameters doesn't provide the same security guarantees as Secrets Manager, and credentials still exist in environment variables.
Question 110
A developer is creating an AWS Lambda function that will generate and export a file. The function requires 100 MB of temporary storage for temporary files while running. These files will not be needed after the function is complete. How can the developer MOST efficiently handle the temporary files?
Show answer and explanation
Correct answer: C. Store the files in the /tmp directory and delete the files at the end of the Lambda function.
The /tmp directory is the built-in temporary storage available to Lambda functions with up to 10 GB capacity (depending on Lambda memory allocation). It's the most efficient and cost-effective option for temporary files that don't need to persist after function execution. Files stored here are automatically cleaned up when the function completes. EBS requires EC2 instances, EFS incurs additional costs and latency, and S3 with lifecycle policies is unnecessary for truly temporary files and incurs storage and API costs.
Why the other options are wrong
- A. EBS is attached to EC2 instances, not Lambda functions, making this approach incompatible.
- B. EFS requires mounting and incurs additional latency and cost; it's designed for persistent shared storage, not temporary files.
- D. S3 with lifecycle policies adds unnecessary cost and complexity for files that only exist during function execution.
Question 111
A company hosts a batch processing application on AWS Elastic Beanstalk with instances that run the most recent version of Amazon Linux. The application sorts and processes large datasets. In recent weeks, the application's performance has decreased significantly during a peak period for traffic. A developer suspects that the application issues are related to the memory usage. The developer checks the Elastic Beanstalk console and notices that memory usage is not being tracked. How should the developer gather more information about the application performance issues?
Show answer and explanation
Correct answer: C. Configure the Amazon CloudWatch agent to track the memory usage of the instances.
The CloudWatch agent is the proper tool to collect and track custom metrics like memory usage from EC2 instances. By configuring the CloudWatch agent on the Elastic Beanstalk instances, the developer can gather detailed memory utilization data and push it to CloudWatch for monitoring and analysis.
Why the other options are wrong
- A. While CloudWatch agent can push logs, the requirement is to track memory usage metrics, not logs, and port 443 is for HTTPS but doesn't address the core need.
- B. The .ebextensions directory is for configuration and customization but does not directly track memory; it would need to work with the CloudWatch agent to be effective.
- D. A CloudWatch dashboard displays existing metrics but does not gather or track new metrics; the data source must first be configured before dashboards can visualize it.
Question 112
A developer is integrating Amazon ElastiCache in an application. The cache will store data from a database. The cached data must populate real-time dashboards. Which caching strategy will meet these requirements?
Show answer and explanation
Correct answer: D. A write-through cache
A write-through cache ensures data is written to both the cache and the database simultaneously, guaranteeing that the cache always contains fresh, consistent data. This approach is ideal for populating realtime dashboards because the cached data is immediately available and synchronized with the authoritative data source, ensuring accurate realtime information without staleness issues.
Why the other options are wrong
- A. Read-through cache only updates when data is read, which may not keep the cache current for realtime dashboard requirements.
- B. Write-behind cache writes to cache first and database later asynchronously, risking data inconsistency for realtime dashboards.
- C. Lazy-loading cache only populates on cache misses, causing delays and potential gaps in realtime dashboard data availability.
Question 113
A developer must analyze performance issues with production-distributed applications written as AWS Lambda functions. These distributed Lambda applications invoke other components that make up the applications. How should the developer identify and troubleshoot the root cause of the performance issues in production?
Show answer and explanation
Correct answer: C. Use AWS X-Ray, then examine the segments and errors.
AWS X-Ray is purpose-built for analyzing performance issues in distributed applications, including Lambda functions. It provides end-to-end tracing of requests across service components, visualizes service maps, identifies latency bottlenecks, and traces errors through the entire call chain, making it ideal for troubleshooting performance issues in distributed Lambda applications.
Why the other options are wrong
- A. CloudWatch logging provides basic event logs but lacks the distributed tracing and service-map visualization needed to identify performance bottlenecks across components.
- B. CloudTrail logs AWS API calls for compliance and auditing, not application performance metrics or distributed trace data.
- D. Amazon Inspector analyzes security vulnerabilities and compliance, not application performance issues.
Question 114
A developer needs to troubleshoot an AWS Lambda function in a development environment. The Lambda function is configured in VPC mode and needs to connect to an existing Amazon RDS for SQL Server DB instance. The DB instance is deployed in a private subnet and accepts connections by using port 1433. When the developer tests the function, the function reports an error when it tries to connect to the database. Which combination of steps should the developer take to diagnose this issue? (Choose two.)
Show answer and explanation
Correct answer: A, E. Check that the function’s security group has outbound access on port 1433 to the DB instance’s security group. Check that the DB instance’s security group has inbound access on port 1433 from the function’s security group; Check that the function’s execution role permissions include ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, and ec2:DeleteNetworkInterface.
For a Lambda function in VPC mode to connect to an RDS instance, two security group configurations are essential: (A) the Lambda function's security group must allow outbound traffic on port 1433 to the database security group, and the database security group must allow inbound traffic on port 1433 from the Lambda security group. Additionally, (E) the Lambda execution role needs EC2 network interface permissions (ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DeleteNetworkInterface) to attach to the VPC. Option B reverses the traffic direction incorrectly, Option C applies to public internet access scenarios, and Option D covers database management permissions not needed for simple connections.
Why the other options are wrong
- B. The traffic direction is backwards; Lambda initiates outbound connections, so it needs outbound permissions, not inbound. The DB instance needs inbound, not outbound permissions.
- C. NAT gateways are for outbound internet access; a private RDS instance in the same VPC doesn't require one. Public access is irrelevant for same-VPC connections.
- D. These RDS permissions are for database management operations (describing and modifying instances), not for establishing network connections to the database.
Question 115
A developer is writing a serverless application that requires an AWS Lambda function to be invoked every 10 minutes. What is an automated and serverless way to invoke the function?
Show answer and explanation
Correct answer: C. Create an Amazon EventBridge rule that runs on a regular schedule to invoke the Lambda function.
Amazon EventBridge provides a fully serverless, managed way to schedule Lambda function invocations using cron or rate expressions. Creating an EventBridge rule with a 10-minute rate schedule (rate(10 minutes)) directly invokes the Lambda function on the specified interval without requiring any EC2 instances or external tools.
Why the other options are wrong
- A. EC2 instances introduce operational overhead and defeat the purpose of serverless architecture; crontab requires constant instance running.
- B. Environment variables don't trigger invocations; they're just configuration values with no scheduling capability.
- D. SNS topics with timers cannot reliably schedule repeated invocations at fixed intervals; this is not a valid use case for SNS.
Question 116
A developer is receiving HTTP 400: ThrottlingException errors intermittently when calling the Amazon CloudWatch API. When a call fails, no data is retrieved. What best practice should first be applied to address this issue?
Show answer and explanation
Correct answer: D. Retry the call with exponential backoff.
ThrottlingException errors indicate the application is hitting rate limits on the CloudWatch API. The standard best practice is to implement exponential backoff, which retries failed requests with increasing delays between attempts. This approach allows the application to recover gracefully from temporary throttling without requiring AWS limit increases or architectural changes.
Why the other options are wrong
- A. Requesting a limit increase is a last resort after implementing exponential backoff; it's not the first best practice and may not be necessary.
- B. Using the AWS CLI doesn't solve the underlying throttling issue in the application code; it's a workaround, not a solution.
- C. Removing API calls would lose functionality; the real solution is to handle throttling gracefully rather than avoid the API entirely.
Question 117
A developer is testing an application that invokes an AWS Lambda function asynchronously. During the testing phase, the Lambda function fails to process after two retries. How can the developer troubleshoot the failure?
Show answer and explanation
Correct answer: B. Configure Dead Letter Queues by sending events to Amazon SQS for investigation.
Dead Letter Queues (DLQs) configured with Amazon SQS capture events that fail processing after Lambda's retry attempts. This allows developers to investigate what went wrong by examining the failed event messages in the queue, making it the most direct troubleshooting tool for async Lambda failures.
Why the other options are wrong
- A. CloudTrail logs API calls but does not capture the actual failed event payloads or provide insight into Lambda execution failures.
- C. Simple Workflow Service is not the appropriate tool for capturing and analyzing Lambda invocation failures.
- D. AWS Config tracks resource configuration changes, not Lambda invocation failures or execution errors.
Question 118
A developer needs to deploy an application running on AWS Fargate using Amazon ECS. The application has environment variables that must be passed to a container for the application to initialize. How should the environment variables be passed to the container?
Show answer and explanation
Correct answer: B. Define an array that includes the environment variables under the environment parameter within the task definition.
Environment variables in ECS must be defined in the task definition, not the service definition. The task definition is where all container-level configurations, including the environment array parameter, are specified. The service definition references the task definition but does not contain environment variable configuration.
Why the other options are wrong
- A. Service definitions do not contain an environment parameter for container environment variables.
- C. The entryPoint parameter specifies the command to run in the container, not how to pass environment variables.
- D. The service definition does not contain an entryPoint parameter for this purpose.
Question 119
A company has an image storage web application that runs on AWS. The company hosts the application on Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group acts as the target group for an Application Load Balancer (ALB) and uses an Amazon S3 bucket to store the images for sale. The company wants to develop a feature to test system requests. The feature will direct requests to a separate target group that hosts a new beta version of the application. Which solution will meet this requirement with the LEAST effort?
Show answer and explanation
Correct answer: A. Create a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Update the test system code to use this cookie to test the beta version of the application.
Option A requires the least effort because it reuses the existing ALB by adding a new routing rule with a cookie-based condition. This approach leverages the infrastructure already in place (ALB, Auto Scaling) and only requires creating a new Auto Scaling group and target group for the beta version. The test system simply adds a cookie to route to the beta target group, requiring minimal changes.
Why the other options are wrong
- B. Creating a new ALB and Route 53 record adds unnecessary infrastructure complexity when the existing ALB can route based on conditions.
- C. Adding CloudFront and Lambda@Edge introduces significant complexity and additional services beyond what is needed.
- D. While similar to A, adding Lambda@Edge for cookie management is more complex than simply updating ALB routing rules.
Question 120
A developer has written an AWS Lambda function. The function is CPU-bound. The developer wants to ensure that the function returns responses quickly. How can the developer improve the function's performance?
Show answer and explanation
Correct answer: B. Increase the function's memory.
In AWS Lambda, memory allocation directly determines CPU allocation. Increasing memory increases the available CPU cores proportionally, which improves the execution speed of CPU-bound functions. This is the direct way to improve performance for computationally intensive workloads without other overhead.
Why the other options are wrong
- A. Lambda doesn't expose direct CPU core count configuration; CPU allocation is tied to memory selection.
- C. Reserved concurrency controls how many function instances can run simultaneously; it doesn't improve individual function execution speed or response time.
- D. Timeout controls how long a function can run before being terminated; it doesn't improve performance but rather allows longer execution, which is counterproductive for improving response time.
Question 121
A company is using an AWS Lambda function to process records from an Amazon Kinesis data stream. The company recently observed slow processing of the records. A developer notices that the iterator age metric for the function is increasing and that the Lambda run duration is constantly above normal. Which actions should the developer take to increase the processing speed? (Choose two.)
Show answer and explanation
Correct answer: A, C. Increase the number of shards of the Kinesis data stream; Increase the memory that is allocated to the Lambda function.
Increasing the number of shards (A) increases parallelism, allowing multiple Lambda executions to process records concurrently and reducing iterator age. Increasing Lambda memory (C) improves CPU allocation proportionally, speeding up individual record processing and reducing run duration. Both directly address the observed symptoms of high iterator age and slow processing.
Why the other options are wrong
- B. Decreasing timeout would cause more function failures, worsening performance rather than improving it.
- D. Decreasing shards reduces parallelism, exacerbating the iterator age and processing speed problems.
- E. Increasing timeout alone doesn't improve processing speed; it only allows slower processing to continue without failing, masking the underlying performance issue.
Question 122
A developer is preparing to begin development of a new version of an application. The previous version of the application is deployed in a production environment. The developer needs to deploy fixes and updates to the current version during the development of the new version of the application. The code for the new version of the application is stored in AWS CodeCommit. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. From the main branch, create a feature branch for production bug fixes. Create a second feature branch from the main branch for development of the new version.
Creating a feature branch from main for production bug fixes allows the team to deploy critical fixes to the current production version while simultaneously developing the new version on a separate feature branch. This branching strategy enables parallel development and maintenance of both versions. Option B uses tags incorrectly, tags are for marking points in history, not for ongoing development. Option C creates an isolated branch but doesn't address the need for a development branch for the new version. Option D unnecessarily creates a separate repository, complicating code management.
Why the other options are wrong
- B. Git tags mark specific points in history and are not suitable for ongoing development and merging of either the current or new version.
- C. While creating a protected branch for production fixes is good, this option doesn't provide a clear branching strategy for parallel development of the new version.
- D. Creating a separate repository complicates version control, increases maintenance burden, and makes it harder to manage shared code between versions.
Question 123
A developer needs to migrate an online retail application to AWS to handle an anticipated increase in traffic. The application currently runs on two servers: one server for the web application and another server for the database. The web server renders webpages and manages session state in memory. The database server hosts a MySQL database that contains order details. When traffic to the application is heavy, the memory usage for the web server approaches 100% and the application slows down considerably. The developer has found that most of the memory increase and performance decrease is related to the load of managing additional user sessions. For the web server migration, the developer will use Amazon EC2 instances with an Auto Scaling group behind an Application Load Balancer. Which additional set of changes should the developer make to the application to improve the application's performance?
Show answer and explanation
Correct answer: B. Use Amazon ElastiCache for Memcached to store and manage the session data. Use an Amazon RDS for MySQL DB instance to store the application data.
ElastiCache for Memcached is purpose-built for fast, in-memory session storage and perfectly addresses the identified bottleneck of session management consuming memory. RDS for MySQL provides a managed, scalable database solution for application data. This separation allows the web tier (via Auto Scaling) to remain stateless while offloading session overhead to a dedicated service, directly solving the 100% memory usage issue.
Why the other options are wrong
- A. Storing session data in MySQL defeats the purpose of scaling horizontally; sessions would still consume significant memory and database I/O, replicating the original performance problem.
- C. ElastiCache for Memcached is optimized for session management but not ideal for storing structured application data; RDS is the appropriate service for order details.
- D. EC2 instance store is ephemeral and lost on instance termination, making it unreliable for session data; it also doesn't solve the memory pressure issue on the web tier.
Question 124
A developer is building a new application that will be deployed on AWS. The developer has created an AWS CodeCommit repository for the application. The developer has initialized a new project for the application by invoking the AWS Cloud Development Kit (AWS CDK) cdk init command. The developer must write unit tests for the infrastructure as code (IaC) templates that the AWS CDK generates. The developer also must run a validation tool across all constructs in the CDK application to ensure that critical security configurations are activated. Which combination of actions will meet these requirements with the LEAST development overhead? (Choose two.)
Show answer and explanation
Correct answer: B, E. Use the CDK assertions module to integrate unit tests with the application. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository; Use the CDK Aspects class to create custom rules to apply to the CDK application. Fall the stack synthesis if any violations are present.
The CDK assertions module (option B) provides built-in testing utilities specifically designed for CDK unit tests, requiring minimal custom development. CDK Aspects (option E) enables creating reusable custom rules that automatically validate constructs during synthesis and fail if violations occur, providing policy-as-code enforcement without manual scripting. Together these provide comprehensive testing and validation with least overhead. Option A requires custom parsing of generated JSON. Option C uses runtime context inappropriately for security validation. Option D requires writing custom validation scripts.
Why the other options are wrong
- A. Parsing cdk.out JSON files manually is more complex than using built-in assertions.
- C. Runtime context is for configuration values, not security rule validation.
- D. String searching is fragile and doesn't scale well for comprehensive security validation.
Question 125
A developer is setting up a deployment pipeline. The pipeline includes an AWS CodeBuild build stage that requires access to a database to run integration tests. The developer is using a buildspec.yml file to configure the database connection. Company policy requires automatic rotation of all database credentials. Which solution will handle the database credentials MOST securely?
Show answer and explanation
Correct answer: C. Retrieve the credentials from an environment variable that is linked to an AWS Secrets Manager secret. Configure Secrets Manager for automatic rotation.
AWS Secrets Manager is the most secure solution for managing database credentials in CodeBuild. It supports automatic credential rotation natively, integrates with CodeBuild through environment variables, and keeps credentials encrypted and separate from buildspec.yml files. Parameter Store SecureString also works but Secrets Manager is purpose-built for credential rotation.
Why the other options are wrong
- A. Hardcoding credentials in buildspec.yml files is a critical security vulnerability and violates company policy.
- B. While Parameter Store works, it is not purpose-built for credential rotation; Secrets Manager is the recommended service.
- D. Plaintext connection strings in environment variables are a severe security risk and EventBridge is not suitable for credential management.
Question 126
A developer is creating an AWS Lambda function in VPC mode. An Amazon S3 event will invoke the Lambda function when an object is uploaded into an S3 bucket. The Lambda function will process the object and produce some analytic results that will be recorded into a file. Each processed object will also generate a log entry that will be recorded into a file. Other Lambda functions, AWS services, and on-premises resources must have access to the result files and log file. Each log entry must also be appended to the same shared log file. The developer needs a solution that can share files and append results into an existing file. Which solution should the developer use to meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in Lambda. Store the result files and log file in the mount point. Append the log entries to the log file.
Amazon EFS is the only solution that provides a shared file system that multiple Lambda functions, other AWS services, and on-premises resources can access simultaneously, with support for appending to files. EFS can be mounted in Lambda and accessed by other compute resources. EBS Multi-Attach doesn't work with Lambda, the /tmp directory is ephemeral and instance-specific, and /opt is read-only in Lambda.
Why the other options are wrong
- B. EBS Multi-Attach volumes cannot be directly mounted to Lambda functions.
- C. The /tmp directory is ephemeral and unique to each Lambda execution, not shared.
- D. The /opt directory in Lambda is read-only and used for Lambda layers, not for writing files.
Question 127
A developer is storing sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest. A company policy requires an audit trail of when the AWS Key Management Service (AWS KMS) key was used and by whom. Which encryption option will meet these requirements?
Show answer and explanation
Correct answer: B. Server-side encryption with AWS KMS managed keys (SSE-KMS)
AWS KMS managed keys (SSE-KMS) provide encryption at rest while integrating with CloudTrail to create an audit trail showing when the KMS key was used and by whom. This is the only S3 encryption option that meets the requirement for detailed audit logging of key usage and identity information.
Why the other options are wrong
- A. SSE-S3 uses Amazon-managed keys with no audit trail of key usage or access controls.
- C. SSE-C requires the customer to manage keys externally and provides no CloudTrail audit integration.
- D. Self-managed keys lack the integration with CloudTrail and AWS audit mechanisms that provide detailed audit trails.
Question 128
A developer is building an application that uses Amazon DynamoDB. The developer wants to retrieve multiple specific items from the database with a single API call. Which DynamoDB API call will meet these requirements with the MINIMUM impact on the database?
Show answer and explanation
Correct answer: A. BatchGetItem
BatchGetItem is the correct API call for retrieving multiple specific items from DynamoDB in a single request. It is designed specifically for this use case and has minimal impact on the database since it retrieves only the requested items. GetItem retrieves only one item, Scan reads all items in a table which is inefficient, and Query retrieves items based on key conditions but is not optimized for retrieving arbitrary specific items.
Why the other options are wrong
- B. GetItem only retrieves a single item, not multiple items.
- C. Scan reads all items in a table or index, consuming significantly more capacity than necessary.
- D. Query is designed for items matching key conditions, not for retrieving arbitrary specific items.
Question 129
A developer is working on a Python application that runs on Amazon EC2 instances. The developer wants to enable tracing of application requests to debug performance issues in the code. Which combination of actions should the developer take to achieve this goal? (Choose two.)
Show answer and explanation
Correct answer: B, E. Install the AWS X-Ray daemon on the EC2 instances; Install and configure the AWS X-Ray SDK for Python in the application.
To enable request tracing in a Python application on EC2, the developer must install the AWS X-Ray daemon on the EC2 instances (B) to collect trace data, and install and configure the AWS X-Ray SDK for Python in the application (E) to instrument the code and send trace data to the daemon. These two components work together to capture and forward application trace data to AWS X-Ray for visualization and analysis.
Why the other options are wrong
- A. CloudWatch agent is for collecting metrics and logs, not for application request tracing; X-Ray is the service for tracing.
- C. Writing JSON logs to CloudWatch is for log aggregation, not for distributed request tracing.
- D. There is no /var/log/xray directory convention; X-Ray trace data is sent to the X-Ray daemon via the SDK, not written to a log file.
Question 130
A company is developing a serverless application that consists of various AWS Lambda functions behind Amazon API Gateway APIs. A developer needs to automate the deployment of Lambda function code. The developer will deploy updated Lambda functions with AWS CodeDeploy. The deployment must minimize the exposure of potential errors to end users. When the application is in production, the application cannot experience downtime outside the specified maintenance window. Which deployment configuration will meet these requirements with the LEAST deployment time?
Show answer and explanation
Correct answer: D. Use the AWS CodeDeploy predefined canary deployment configuration to shift 10% of the traffic immediately and shift the remaining traffic after 5 minutes.
The canary deployment configuration shifts 10% traffic immediately and the remaining traffic after 5 minutes, providing rapid error detection while minimizing user exposure. This is faster than linear (10% per minute would take 10 minutes) and safer than all-at-once or in-place. The 5-minute verification window is suitable for production environments and stays within typical maintenance windows.
Why the other options are wrong
- A. In-place deployment with immediate traffic shift provides no gradual rollout and exposes all users to potential errors immediately.
- B. Linear deployment takes 10 minutes to shift all traffic (10% per minute × 10 iterations), which is slower than canary's 5-minute total time.
- C. All-at-once deployment shifts all traffic immediately, providing no gradual rollout and maximum exposure to errors.
Question 131
An Amazon Kinesis Data Firehose delivery stream is receiving customer data that contains personally identifiable information. A developer needs to remove pattern-based customer identifiers from the data and store the modified data in an Amazon S3 bucket. What should the developer do to meet these requirements?
Show answer and explanation
Correct answer: A. Implement Kinesis Data Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream.
AWS Lambda is the native, purpose-built mechanism for transforming data in Kinesis Data Firehose delivery streams. Lambda functions can process records before they reach the destination and return transformed data in the required format. This approach requires minimal infrastructure management and integrates seamlessly with Firehose's built-in transformation capability, making it the most efficient solution for pattern-based data redaction.
Why the other options are wrong
- B. Using an EC2 instance as a Firehose destination introduces unnecessary operational overhead and doesn't leverage Firehose's native transformation features.
- C. OpenSearch Service is a search and analytics platform, not designed for real-time data transformation in a Firehose pipeline and adds unnecessary complexity.
- D. Step Functions workflows cannot be directly set as Firehose destinations; this approach adds extra complexity without addressing the transformation requirement elegantly.
Question 132
A developer is updating the production version of an AWS Lambda function to fix a defect. The developer has tested the updated code in a test environment. The developer wants to slowly roll out the updates to a small subset of production users before rolling out the changes to all users. Only 10% of the users should be initially exposed to the new code in production. Which solution will meet these requirements?
Show answer and explanation
Correct answer: D. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function alias. Configure the traffic weights in the Lambda alias between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
Lambda aliases support traffic shifting between versions using weighted routing. By creating a new version of the Lambda function with the updated code and configuring an alias to route 90% of traffic to the production version and 10% to the new version, the developer can perform a gradual rollout. This is the native Lambda feature designed specifically for canary deployments and gradual traffic shifting.
Why the other options are wrong
- A. Lambda function triggers do not support traffic weight configuration between versions; triggers are mechanisms for invoking functions based on events.
- B. This approach references creating a new Lambda function instead of a new version, and aliases should point to versions, not directly split traffic between a production function and test function.
- C. Lambda proxy integrations are used for API Gateway integration patterns and do not provide native traffic splitting capabilities between Lambda versions.
Question 133
A developer is incorporating AWS X-Ray into an application that handles personal identifiable information (PII). The application is hosted on Amazon EC2 instances. The application trace messages include encrypted PII and go to Amazon CloudWatch. The developer needs to ensure that no PII goes outside of the EC2 instances. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Manually instrument the X-Ray SDK in the application code.
Manual instrumentation of the X-Ray SDK allows developers to explicitly control what data is captured and sanitized before sending traces. This enables selective filtering or redaction of PII data within the application code itself, ensuring sensitive information never leaves the EC2 instances. Manual instrumentation provides fine-grained control over trace content, preventing PII from reaching CloudWatch or X-Ray service.
Why the other options are wrong
- B. Auto-instrumentation agents automatically capture data without developer control over PII filtering, risking exposure of sensitive information.
- C. Amazon Macie detects PII but doesn't prevent it from being sent; using Lambda adds complexity and doesn't solve the core issue of preventing PII transmission from EC2.
- D. AWS Distro for Open Telemetry still sends telemetry data externally and doesn't inherently prevent PII transmission without additional manual controls.
Question 134
An application uses an Amazon EC2 Auto Scaling group. A developer notices that EC2 instances are taking a long time to become available during scale-out events. The UserData script is taking a long time to run. The developer must implement a solution to decrease the time that elapses before an EC2 instance becomes available. The solution must make the most recent version of the application available at all times and must apply all available security updates. The solution also must minimize the number of images that are created. The images must be validated. Which combination of steps should the developer take to meet these requirements? (Choose two.)
Show answer and explanation
Correct answer: A, C. Use EC2 Image Builder to create an Amazon Machine Image (AMI). Install all the patches and agents that are needed to manage and run the application. Update the Auto Scaling group launch configuration to use the AMI; Set up AWS CodeDeploy to deploy the most recent version of the application at runtime.
The best solution combines EC2 Image Builder to create pre-configured AMIs with patches and necessary agents (option A), and AWS CodeDeploy to deploy the latest application version at runtime (option C). This approach eliminates lengthy UserData scripts during scale-out, keeps images lean and validated, ensures the latest application version is always deployed, and applies security patches through both the AMI and deployment process. Option A provides the base infrastructure with patches; option C handles application updates without rebuilding images frequently.
Why the other options are wrong
- B. Including the latest application version in the AMI would require rebuilding and validating new images every time the application updates, contradicting the requirement to minimize image creation.
- D. CodePipeline is for automating release workflows, not for deploying applications to running instances.
- E. Removing OS patching commands without an alternative means security updates would not be applied, violating the requirement to apply all available security updates.
Question 135
A developer at a company needs to create a small application that makes the same API call once each day at a designated time. The company does not have infrastructure in the AWS Cloud yet, but the company wants to implement this functionality on AWS. Which solution meets these requirements in the MOST operationally efficient manner?
Show answer and explanation
Correct answer: C. Use an AWS Lambda function that is invoked by an Amazon EventBridge scheduled event.
AWS Lambda with EventBridge scheduled events is the most operationally efficient solution for serverless workloads with no existing AWS infrastructure. It requires no infrastructure management, automatically scales, and EventBridge provides cron-like scheduling capabilities. Lambda is cost-effective for small, infrequent tasks, and there is no need to manage containers, instances, or job queues.
Why the other options are wrong
- A. EKS requires managing a Kubernetes cluster, which adds operational overhead for a simple daily task.
- B. EC2 instances require ongoing management and patching, making this less operationally efficient than serverless alternatives.
- D. AWS Batch is designed for large-scale parallel computing workloads, not simple scheduled tasks.
Question 136
A developer needs to launch a new Amazon EC2 instance by using the AWS CLI. Which AWS CLI command should the developer use to meet this requirement?
Show answer and explanation
Correct answer: D. aws ec2 run-instances
The aws ec2 run-instances command is the correct AWS CLI command to launch new EC2 instances. It accepts parameters like image ID, instance type, security groups, and key pairs to create and start a new instance. Option A (bundle-instance) is for creating AMIs from running instances, Option B (start-instances) is for starting stopped instances, and Option C (confirm-product-instance) is for verifying product subscriptions.
Why the other options are wrong
- A. bundle-instance is used to create Amazon Machine Images (AMIs) from existing instances, not to launch new instances.
- B. start-instances is used to start an already-created but stopped instance, not to launch a new instance.
- C. confirm-product-instance is used for subscription and license verification, not for launching instances.
Question 137
A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item and update some of its attributes, or create the item if it does not exist. The Lambda function has access to the primary key. Which IAM permissions should the developer request for the Lambda function to achieve this functionality?
Show answer and explanation
Correct answer: D. dynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem
The Lambda function must retrieve an item (GetItem), update attributes if it exists (UpdateItem), or create it if it doesn't (PutItem). These three permissions are necessary to implement the conditional update-or-create pattern. UpdateItem can handle both updating existing items and creating new ones when combined with proper condition expressions.
Why the other options are wrong
- A. DeleteItem is not needed for this use case; the function only needs to read and write, not delete items.
- B. DescribeTable is not required for basic item operations; GetItem and UpdateItem are sufficient without needing table metadata.
- C. GetRecords is used for streams/iterators and UpdateTable is for modifying table structure, neither of which applies to item-level operations.
Question 138
A developer is creating a service that uses an Amazon S3 bucket for image uploads. The service will use an AWS Lambda function to create a thumbnail of each image. Each time an image is uploaded, the service needs to send an email notification and create the thumbnail. The developer needs to configure the image processing and email notifications setup. Which solution will meet these requirements?
Show answer and explanation
Correct answer: A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure S3 event notifications with a destination of the SNS topic. Subscribe the Lambda function to the SNS topic. Create an email notification subscription to the SNS topic.
Option A correctly uses SNS as a centralized hub for S3 events. S3 publishes events to the SNS topic, the Lambda function subscribes to process images into thumbnails, and an email subscription sends notifications. This is the simplest and most direct solution. Option B unnecessarily adds SQS, Option C tries to send email notifications through SQS which is not designed for this, and Option D unnecessarily involves EventBridge.
Why the other options are wrong
- B. Adding SQS between SNS and email notifications adds unnecessary complexity without benefit.
- C. SQS cannot natively send email notifications; it requires additional integration.
- D. EventBridge is unnecessary overhead when SNS can directly handle both Lambda and email subscriptions.
Question 139
A company has a front-end application that runs on four Amazon EC2 instances behind an Elastic Load Balancer (ELB) in a production environment that is provisioned by AWS Elastic Beanstalk. A developer needs to deploy and test new application code while updating the Elastic Beanstalk platform from the current version to a newer version of Node.js. The solution must result in zero downtime for the application. Which solution meets these requirements?
Show answer and explanation
Correct answer: C. Perform an immutable update to deploy the new application code to new EC2 instances. Serve traffic to the new instances after they pass health checks.
An immutable update launches new EC2 instances with the updated platform version and new code, tests them with health checks, and only routes traffic to them after they pass validation. This approach ensures zero downtime because the original instances remain running and serving traffic throughout the process, and the new instances are fully operational before any traffic switch occurs.
Why the other options are wrong
- A. Cloning and swapping environments may cause downtime during the swap process and doesn't guarantee seamless traffic transition.
- B. All-at-once deployment stops all instances and redeploys, causing downtime that violates the zero-downtime requirement.
- D. Rolling deployment updates instances incrementally but still causes temporary reduced capacity and potential service interruptions during the update.
That was 139 of 557.
The full AWS DVA-C02 pack has all 557 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 278 free as one PDF by email. Get the Half Pack →