Free DVA-C02 Exam Dumps PDF Preview

Question 1

Single choice

A developer accesses AWS CodeCommit over SSH. The SSH keys configured to access AWS CodeCommit are tied to a user with the following permissions:

The developer needs to create/delete branches.

Which specific IAM permissions need to be added, based on the principle of least privilege?

A
"codecommit:CreateBranch"
"codecommit:DeleteBranch"
B
"codecommit:Put*"
C
"codecommit:Update*"
D
"codecommit:*"

Reveal answer details Close answer details

Correct answerA

Question 2

Single choice

A developer runs an application that displays scores for sports games on Amazon EC2 instances. The application uses a Redis client to retrieve the scores from an Amazon ElastiCache (Redis OSS) cluster.

The developer observes increased latency during operations on the cache because of connection failures to the cluster. The developer needs to resolve the latency issues.

A
Configure the Redis client to use an exponential backoff retry strategy to establish cache connections.
B
Store the scores in the application's memory. Perform bulk set operations on the scores that are stored in memory.
C
Configure the Redis client in the application to persist connections to the cluster by implementing a connection pool.
D
Deploy more nodes in the ElastiCache cluster. Update the Redis client to discover the new nodes.

Reveal answer details Close answer details

Correct answerC

Explanation

Why Option C is Correct:Implementing a connection pool in the Redis client reduces connection overhead and avoids frequent connection establishment, which helps to reduce latency and connection failures.
Why Other Options are Incorrect: Option A: Exponential backoff retry strategies help with transient failures but do not resolve latency caused by frequent connection establishment.
Option B: Storing scores in application memory adds complexity and risks inconsistency.
Option D: Adding more nodes is unnecessary unless the cluster is under heavy load. Latency due to connection failures is better addressed at the application level.
References:
Amazon ElastiCache Best Practices

Question 3

Single choice

A developer is troubleshooting an application that uses Amazon DynamoDB in the us-west-2 Region. The application is deployed to an Amazon EC2 instance. The application requires read-only permissions to a table that is named Cars. The EC2 instance has an attached IAM role that contains the following IAM policy:

When the application tries to read from the Cars table, an Access Denied error occurs.

How can the developer resolve this error?

A
Modify the IAM policy resource to be "arn:aws:dynamodb:us-west-2:account-id:table/*".
B
Modify the IAM policy to include the dynamodb:* action.
C
Create a trust policy that specifies the EC2 service principal. Associate the role with the policy.
D
Create a trust relationship between the role and dynamodb.amazonaws.com.

Reveal answer details Close answer details

Correct answerC

Question 4

Multiple choice

A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company's cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle.

After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account.

Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)

A
Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret.
B
Store the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store.
Create a resource-based policy. Add IAM users to allow access to the policy.
C
Store the Root CA Cert in an Amazon S3 bucket. Create a resource-based policy to allow access to the bucket.
D
Refactor the Lambda code to load the Root CA Cert from the Root CA Cert's location. Modify the runtime trust store inside the Lambda function handler.
E
Refactor the Lambda code to load the Root CA Cert from the Root CA Cert's location. Modify the runtime trust store outside the Lambda function handler.

Reveal answer details Close answer details

Correct answersA, E

Question 5

Single choice

A developer is building a web and mobile application for two types of users regular users and guest users regular users are required to log in, but guest users do not log in Users should see only their data regardless of whether they authenticate Users need AWS credentials before they can access AWS resources.

What is the MOST secure solution that the developer can implement to allow access for guest users?

A
Use an Amazon Cognito credentials provider to issue temporary credentials that are linked to an unauthenticated role that has access to the required resources.
B
Set up an IAM user that has permissions to the required resources. Hardcode the 1AM credentials in the web and mobile application
C
Generate temporary keys that are stored in AWS Key Management Service (AWS KMS) Use the temporary keys to access the required resources
D
Generate temporary credentials. Store the temporary credentials in AWS Secrets Manager Use the temporary credentials to access the required resources

Reveal answer details Close answer details

Correct answerD

Question 6

Single choice

While developing an application that runs on Amazon EC2 in an Amazon VPC, a Developer identifies the need for centralized storage of application-level logs.

Which AWS service can be used to securely store these logs?

A
Amazon EC2 VPC Flow Logs
B
Amazon CloudWatch Logs
C
Amazon CloudSearch
D
AWS CloudTrail

Reveal answer details Close answer details

Correct answerB

Question 7

Single choice

A developer is writing unit tests for a new application that will be deployed on AWS. The developer wants to validate all pull requests with unit tests and merge the code with the main branch only when all tests pass.

The developer stores the code in AWS CodeCommit and sets up AWS CodeBuild to run the unit tests. The developer creates an AWS Lambda function to start the CodeBuild task. The developer needs to identify the CodeCommit events in an Amazon EventBridge event that can invoke the Lambda function when a pull request is created or updated.

Which CodeCommit event will meet these requirements?

A
Option A
B
Option B
C
Option C
D
Option D

Reveal answer details Close answer details

Correct answerC

Question 8

Single choice

A company has implemented a pipeline in AWS CodePipeline. The company is using a single AWS account and does not use AWS Organizations. The company needs to test its AWS CloudFormation templates in its primary AWS Region and a disaster recovery Region.

Which solution will meet these requirements with the MOST operational efficiency?

A
In the CodePipeline pipeline, implement an AWS CodeDeploy action for each Region to deploy and test the CloudFormation templates. Update CodePipeline and AWS CodeBuild with appropriate
permissions.
B
Configure CodePipeline to deploy and test the CloudFormation templates. Use CloudFormation StackSets to start deployment across both Regions.
C
Configure CodePipeline to invoke AWS CodeBuild to deploy and test the CloudFormation templates in each Region. Update CodeBuild and CloudFormation with appropriate permissions.
D
Use the Snyk action in CodePipeline to deploy and test the CloudFormation templates in each Region.

Reveal answer details Close answer details

Correct answerB

Question 9

Single choice

A developer built an application that calls an external API to obtain data, processes the data, and saves the result to Amazon S3. The developer built a container image with all of the necessary dependencies to run the application as a container.

The application runs locally and requires minimal CPU and RAM resources. The developer has created an Amazon ECS cluster. The developer needs to run the application hourly in Amazon Elastic Container Service (Amazon ECS).

Which solution will meet these requirements with the LEAST amount of infrastructure management overhead?

A
Add a capacity provider to manage instances.
B
Add an Amazon EC2 instance that runs the application.
C
Define a task definition with an AWS Fargate launch type.
D
Create an Amazon ECS cluster and add the managed node groups feature to run the application.

Reveal answer details Close answer details

Correct answerD

Question 10

Single choice

A developer creates a static website for their department. The developer deploys the static assets for the website to an Amazon S3 bucket and serves the assets with Amazon CloudFront. The developer uses origin access control (OAC) on the CloudFront distribution to access the S3 bucket.

The developer notices users can access the root URL and specific pages but cannot access directories without specifying a file name. For example, /products/index.html works, but /products/ returns an error.
The developer needs to enable accessing directories without specifying a file name without exposing the
S3 bucket publicly.

Which solution will meet these requirements?

A
Update the CloudFront distribution's settings to index.html as the default root object is set.
B
Update the Amazon S3 bucket settings and enable static website hosting. Specify index.html as the Index document. Update the S3 bucket policy to enable access. Update the CloudFront distribution's origin to use the S3 website endpoint.
C
Create a CloudFront function that examines the request URL and appends index.html when directories are being accessed. Add the function as a viewer request CloudFront function to the CloudFront distribution's behavior.
D
Create a custom error response on the CloudFront distribution with the HTTP error code set to the HTTP 404 Not Found response code and the response page path to /index.html. Set the HTTP response code to the HTTP 200 OK response code.

Reveal answer details Close answer details

Correct answerA

Explanation

The simplest and most efficient way to enable accessing directories without specifying a file name is to update the CloudFront distribution's settings to index.html as the default root object. This will instruct CloudFront to return the index.html object when a user requests the root URL or a directory URL for the distribution. This solution does not require enabling static website hosting on the S3 bucket, creating a CloudFront function, or creating a custom error response. References Specifying a default root object cloudfront-default-root-object-configured
How to setup CloudFront default root object?
Ensure a default root object is configured for AWS Cloudfront ...

Question 11

Multiple choice

A company is building a microservices application that consists of many AWS Lambda functions. The development team wants to use AWS Serverless Application Model (AWS SAM) templates to automatically test the Lambda functions. The development team plans to test a small percentage of traffic that is directed to new updates before the team commits to a full deployment of the application.

Which combination of steps will meet these requirements in the MOST operationally efficient way? (Choose two.)

A
Use AWS SAM CLI commands in AWS CodeDeploy to invoke the Lambda functions to test the deployment.
B
Declare the EventInvokeConfig on the Lambda functions in the AWS SAM templates with OnSuccess and OnFailure configurations.
C
Enable gradual deployments through AWS SAM templates.
D
Set the deployment preference type to Canary10Percent30Minutes. Use hooks to test the deployment.
E
Set the deployment preference type to Linear10PercentEvery10Minutes. Use hooks to test the deployment.

Reveal answer details Close answer details

Correct answersC, D

Question 12

Single choice

When using the AWS Encryption SDK, how does the developer keep track of the data encryption keys used to encrypt data?

A
The developer must manually keep track of the data encryption keys used for each data object.
B
The SDK encrypts the data encryption key and stores it (encrypted) as part of the returned ciphertext.
C
The SDK stores the data encryption keys automatically in Amazon S3.
D
The data encryption key is stored in the Userdata for the EC2 instance.

Reveal answer details Close answer details

Correct answerB

Question 13

Single choice

A developer needs to freeze changes to an AWS CodeCommit repository before a production release. The developer will work on new features while a quality assurance (QA) team tests the release.

The QA testing and all bug fixes must take place in isolation from the main branch. After the release, the developer must integrate all bug fixes into the main branch.

Which solution will meet these requirements?

A
Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Merge the release branch into the main branch after the release.
B
Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply fixes to the main branch. Update the Git tag for the release to be on the latest commit on the main branch.
C
Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Rebase the main branch onto the release branch after the release.
D
Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply the Git commits for fixes to the Git tag for the release.

Reveal answer details Close answer details

Correct answerA

Question 14

Multiple choice

A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website.

Which combination of steps will meet these requirements? (Choose two.)

A
Create a public Network Load Balancer.
B
Create a public Application Load Balancer.
C
Configure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration.
D
Configure a listener for the load balancer that listens on HTTP port 80. Add a default authenticate action providing the OIDC IdP configuration.
E
Configure a listener for the load balancer that listens on HTTPS port 443. Add a default AWS Lambda action providing an Amazon Resource Name (ARN) to a Lambda authentication function.

Reveal answer details Close answer details

Correct answersB, C

Question 15

Single choice

An AWS Lambda function requires read access to an Amazon S3 bucket and requires read/write access to

an Amazon DynamoDB table. The correct IAM policy already exists.

What is the MOST secure way to grant the Lambda function access to the S3 bucket and the DynamoDB table?

A
Attach the existing IAM policy to the Lambda function.
B
Create an IAM role for the Lambda function. Attach the existing IAM policy to the role. Attach the role to the Lambda function.
C
Create an IAM user with programmatic access. Attach the existing IAM policy to the user. Add the user access key ID and secret access key as environment variables in the Lambda function.
D
Add the AWS account root user access key ID and secret access key as encrypted environment variables in the Lambda function.

Reveal answer details Close answer details

Correct answerB

Explanation

The most secure way to grant the Lambda function access to the S3 bucket and the DynamoDB table is to create an IAM role for the Lambda function and attach the existing IAM policy to the role. This way, you can use the principle of least privilege and avoid exposing any credentials in your function code or environment variables. You can also leverage the temporary security credentials that AWS provides to the Lambda function when it assumes the role. This solution follows the best practices for working with AWS Lambda functions1 and designing and architecting with DynamoDB2. References Best practices for working with AWS Lambda functions Best practices for designing and architecting with DynamoDB

Question 16

Single choice

A developer is trying to get data from an Amazon DynamoDB table called demoman-table. The developer configured the AWS CLI to use a specific IAM user's credentials and ran the following command:

aws dynamodb get-item --table-name demoman-table --key '{"id": {"N":"1993"}}'

The command returned errors and no rows were returned.

What is the MOST likely cause of these issues?

A
The command is incorrect; it should be rewritten to use put-item with a string argument.
B
The developer needs to log a ticket with AWS Support to enable access to the demoman-table.
C
Amazon DynamoDB cannot be accessed from the AWS CLI and needs to be called via the REST API.
D
The IAM user needs an associated policy with read access to demoman-table.

Reveal answer details Close answer details

Correct answerD

Question 17

Single choice

A company is developing a serverless application that consists of various AWS Lambda functions behind Amazon API Gateway APIs. A developer needs to automate the deployment of Lambda function code. The developer will deploy updated Lambda functions with AWS CodeDeploy. The deployment must minimize the exposure of potential errors to end users. When the application is in production, the application cannot experience downtime outside the specified maintenance window.

Which deployment configuration will meet these requirements with the LEAST deployment time?

A
Use the AWS CodeDeploy in-place deployment configuration for the Lambda functions. Shift all traffic immediately after deployment.
B
Use the AWS CodeDeploy linear deployment configuration to shift 10% of the traffic every minute.
C
Use the AWS CodeDeploy all-at-once deployment configuration to shift all traffic to the updated versions immediately.
D
Use the AWS CodeDeploy predefined canary deployment configuration to shift 10% of the traffic immediately and shift the remaining traffic after 5 minutes.

Reveal answer details Close answer details

Correct answerD

Question 18

Single choice

A developer is creating an application that includes an Amazon API Gateway REST API in the us-east-2
Region. The developer wants to use Amazon CloudFront and a custom domain name for the API. The developer has acquired an SSL/ TLS certificate for the domain from a third-party provider.

How should the developer configure the custom domain for the application?

A
Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API.
Create a DNS A record for the custom domain.
B
Import the SSL/TLS certificate into CloudFront. Create a DNS CNAME record for the custom domain.
C
Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API.
Create a DNS CNAME record for the custom domain.
D
Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the us-east-1 Region. Create a DNS CNAME record for the custom domain.

Reveal answer details Close answer details

Correct answerD

Explanation

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html
https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html

Question 19

Single choice

A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions. When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API.

A developer needs to implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts.

Which solution will meet these requirements with the LEAST management overhead?

A
Use an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token.
Add a resource-based policy to the parameter to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with the decrypt flag enabled. Use the decrypted access token to send the message to the chat.
B
Encrypt the access token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS.
Retrieve the token from DynamoDB. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
C
Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instanceswith permissions to access Secrets Manager.
Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
D
Encrypt the access token by using an AWS Key Management Service (AWS KMS) AWS managed key.
Store the access token in an Amazon S3 bucket. Add a bucket policy to the S3 bucket to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the massage to the chat.

Reveal answer details Close answer details

Correct answerC

Explanation

https://aws.amazon.com/premiumsupport/knowledge-center/secrets-manager-share-between-accounts/
https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples_cross.html

Question 20

Single choice

A Company runs continuous integration/continuous delivery (CI/CD) pipelines for its application on AWS CodePipeline. A Developer must write unit tests and run them as part of the pipelines before staging the artifacts for testing.

How should the Developer incorporate unit tests as part of CI/CD pipelines?

A
Create a separate CodePipeline pipeline to run unit tests.
B
Update the AWS CodeBuild specification to include a phase for running unit tests
C
Install the AWS CodeDeploy agent on an Amazon EC2 instance to run unit tests
D
Create a testing branch in AWS CodeCommit to run unit tests

Reveal answer details Close answer details

Correct answerB

Question 21

Single choice

A company offers a business-to-business software service that runs on dedicated infrastructure deployed in each customer's AWS account. Before a feature release, the company needs to run integration tests on
real AWS test infrastructure.
The test infrastructure consists of Amazon EC2 instances and an Amazon RDS database.

A developer must set up a continuous delivery process that will provision the test infrastructure across the different AWS accounts. The developer then must run the integration tests.

Which solution will meet these requirements with the least administrative effort?

A
Use AWS CodeDeploy with AWS CloudFormation StackSets to deploy the infrastructure. Use Amazon CodeGuru to run the tests.
B
Use AWS CodePipeline with AWS CloudFormation StackSets to deploy the infrastructure. Use AWS CodeBuild to run the tests.
C
Use AWS CodePipeline with AWS CloudFormation change sets to deploy the infrastructure. Use a CloudFormation custom resource to run the tests.
D
Use AWS Serverless Application Model (AWS SAM) templates with AWS CloudFormation change sets to deploy the infrastructure. Use AWS CodeDeploy to run the tests.

Reveal answer details Close answer details

Correct answerB

Question 22

Single choice

A company uses an AWS Lambda function to perform natural language processing (NLP) tasks. The company has attached a Lambda layer to the function. The Lambda layer contains scientific libraries that the function uses during processing.

The company added a large, pre-trained text-classification model to the Lambda layer. This addition increased the size of the Lambda layer to 8.7 GB. After the addition and a recent deployment, the Lambda function returned a RequestEntityTooLargeException error.

The company needs to update the Lambda function with a high-performing and portable solution to decrease the initialization time for the function.

Which solution will meet these requirements?

A
Store the large pre-trained model in an Amazon S3 bucket. Use the AWS SDK to access the model.
B
Create an Amazon EFS file system to store the large pre-trained model. Mount the file system to an Amazon EC2 instance. Configure the Lambda function to use the EFS file system.
C
Split the components of the Lambda layer into five new Lambda layers. Zip the new layers and attach them to the Lambda function. Update the function code to use the new layers.
D
Create a Docker container that includes the scientific libraries and the pre-trained model. Update the Lambda function to use the container image.

Reveal answer details Close answer details

Correct answerD

Question 23

Single choice

An online food company provides an Amazon API Gateway HTTP API to receive orders for partners. The API is integrated with an AWS Lambda function. The Lambda function stores the orders in an Amazon DynamoDB table.

The company expects to onboard additional partners. Some of the partners require additional Lambda functions to receive orders. The company has created an Amazon S3 bucket. The company needs to store all orders and updates in the S3 bucket for future analysis.

How can the developer ensure that all orders and updates are stored to Amazon S3 with the LEAST development effort?

A
Create a new Lambda function and a new API Gateway API endpoint. Configure the new Lambda function to write to the S3 bucket. Modify the original Lambda function to post updates to the new API endpoint.
B
Use Amazon Kinesis Data Streams to create a new data stream. Modify the Lambda function to publish orders to the data stream. Configure the data stream to write to the S3 bucket.
C
Enable DynamoDB Streams on the DynamoDB table. Create a new Lambda function. Associate the stream's Amazon Resource Name (ARN) with the Lambda function. Configure the Lambda function to write to the S3 bucket as records appear in the table's stream.
D
Modify the Lambda function to publish to a new Amazon Simple Notification Service (Amazon SNS) topic as the Lambda function receives orders. Subscribe a new Lambda function to the topic. Configure the new Lambda function to write to the S3 bucket as updates come through the topic.

Reveal answer details Close answer details

Correct answerC

Question 24

Single choice

A company uses an AWS Lambda function that reads messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function makes an HTTP call to a third-party API for each message. The company wants to ensure that the Lambda function does not overwhelm the third-party API with more than two concurrent requests.

Which solution will meet these requirements?

A
Configure a provisioned concurrency of two on the Lambda function.
B
Configure a batch size of two on the Amazon SQS event source mapping for the Lambda function.
C
Configure Lambda event filtering to process two messages from Amazon SQS at every invocations.
D
Configure a maximum concurrency of two on the Amazon SQS event source mapping for the Lambda function.

Reveal answer details Close answer details

Correct answerB

Question 25

Single choice

A developer is building a serverless application that connects to an Amazon Aurora PostgreSQL database.
The serverless application consists of hundreds of AWS Lambda functions. During every Lambda function scale out, a new database connection is made that increases database resource consumption.

The developer needs to decrease the number of connections made to the database. The solution must not impact the scalability of the Lambda functions.

Which solution will meet these requirements?

A
Configure provisioned concurrency for each Lambda function by setting the ProvisionedConcurrentExecutions parameter to 10.
B
Enable cluster cache management for Aurora PostgreSQL. Change the connection string of each Lambda function to point to cluster cache management.
C
Use Amazon RDS Proxy to create a connection pool to manage the database connections. Change the connection string of each Lambda function to reference the proxy.
D
Configure reserved concurrency for each Lambda function by setting the ReservedConcurrentExecutions parameter to 10.

Reveal answer details Close answer details

Correct answerC

Question 26

Single choice

A banking company is building an application for users to create accounts, view balances, and review recent transactions. The company integrated an Amazon API Gateway REST API with AWS Lambda functions. The company wants to deploy a new version of a Lambda function that gives customers the ability to view their balances. The new version of the function displays customer transaction insights. The company wants to test the new version with a small group of users before deciding whether to make the feature available for all users.

Which solution will meet these requirements with the LEAST disruption to users?

A
Create a canary deployment for the REST API. Gradually increase traffic to the new version of the function. Revert traffic to the old version if issues are detected.
B
Redeploy the REST API stage to use the new version of the function. If issues are detected, update the REST API to point to the previous version of the function.
C
Deploy the new version of the function to a new stage in the REST API. Route traffic to the new stage.If the new version fails, route traffic to the original stage.
D
Create a new REST API stage for the new version of the function. Create a weighted alias record set in Amazon Route 53 to distribute traffic between the original stage and the new stage.

Reveal answer details Close answer details

Correct answerA

Explanation

API Gateway's canary deployments allow gradual traffic shifting to a new version of a function, minimizing disruption while testing.
Why Option A is Correct: Gradual Rollout: Reduces risk by incrementally increasing traffic.
Rollback Support: Canary deployments make it easy to revert to the previous version.
Why Not Other Options:
Option B: Redeploying the stage disrupts all users.
Option C & D: Managing new stages and weighted routing introduces unnecessary complexity.
References:
Canary Deployments in API Gateway

Question 27

Single choice

A developer needs to deploy an application in three AWS Regions by using AWS CloudFormation. Each Region will use an AWS Elastic Beanstalk environment with an Application Load Balancer (ALB). The developer wants to use AWS Certificate Manager (ACM) to deploy SSL certificates to each ALB.

Which solution will meet these requirements?

A
Create a certificate in ACM in any one of the Regions. Import the certificate into the ALB that is in each Region.
B
Create a global certificate in ACM. Update the CloudFormation template to deploy the global certificate to each ALB.
C
Create a certificate in ACM in each Region. Import the certificate into the ALB for each Region.
D
Create a certificate in ACM in the us-east-1 Region. Update the CloudFormation template to deploy the certificate to each ALB.

Reveal answer details Close answer details

Correct answerC

Question 28

Single choice

A company created four AWS Lambda functions that connect to a relational database server that runs on

an Amazon RDS instance. A security team requires the company to automatically change the database password every 30 days.

Which solution will meet these requirements MOST securely?

A
Store the database credentials in the environment variables of the Lambda function. Deploy the Lambda function with the new credentials every 30 days.
B
Store the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the credentials.
C
Store the database credentials in AWS Systems Manager Parameter Store secure strings. Configure a 30-day schedule for the secure strings.
D
Store the database credentials in an Amazon S3 bucket that uses server-side encryption with customer-provided encryption keys (SSE-C). Configure a 30-day key rotation schedule for the customer key.

Reveal answer details Close answer details

Correct answerB

Question 29

Single choice

A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities.

Which solution will meet these requirements?

A
Store the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
B
Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.
C
Store the API key in the code repository. Use an AWS managed key to encrypt the code repository.
D
Store the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the
API key.

Reveal answer details Close answer details

Correct answerB

Question 30

Single choice

A developer needs to store files in an Amazon S3 bucket for a company's application. Each S3 object can have multiple versions. The objects must be permanently removed 1 year after object creation.

The developer creates an S3 bucket that has versioning enabled.

What should the developer do next to meet the data retention requirements?

A
Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.
B
Create an event notification for all object creation events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
C
Create an event notification for all object removal events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
D
Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to delete expired object delete markers and permanently delete noncurrent versions 1 year after object creation.

Reveal answer details Close answer details

Correct answerA

Question 31

Single choice

A web application is using Amazon Kinesis Data Streams for clickstream data that may not be consumed for up to 12 hours.

How can the developer implement encryption at rest for data within the Kinesis Data Streams?

A
Enable SSL connections to Kinesis.
B
Use Amazon Kinesis Consumer Library.
C
Encrypt the data once it is at rest with a Lambda function.
D
Enable server-side encryption in Kinesis Data Streams.

Reveal answer details Close answer details

Correct answerD

Question 32

Single choice

A developer is creating an AWS Lambda function that consumes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function
processes some messages multiple times.

How should developer resolve this issue MOST cost-effectively?

A
Change the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.
B
Set up a dead-letter queue.
C
Set the maximum concurrency limit of the AWS Lambda function to 1
D
Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.

Reveal answer details Close answer details

Correct answerA

Explanation

Amazon Simple Queue Service (Amazon SQS) is a fully managed queue service that allows you to de-couple and scale for applications 1. Amazon SQS offers two types of queues: Standard and FIFO (First In First Out) queues 1. The FIFO queue uses the messageDeduplicationId property to treat messages with the same value as duplicate 2. Therefore, changing the Amazon SQS standard queue to an Amazon SQS FIFO queue using the Amazon SQS message deduplication ID can help resolve the issue of the Lambda function processing some messages multiple times. Therefore, option A is correct.

Question 33

Single choice

A developer built an application by using multiple AWS Lambda functions. The Lambda functions must access dynamic configuration data at runtime. The data is maintained as a 6 KB JSON document in AWS AppConfig. The configuration data needs to be updated without requiring the redeployment of the application.

The developer needs a solution that will give the Lambda functions access to the dynamic configuration data.

What should the developer do to meet these requirements with the LEAST development effort?

A
Migrate the document from AWS AppConfig to a Lambda environment variable. Read the document at the runtime.
B
Configure the AWS AppConfig Agent Lambda extension. Access the dynamic configuration data by calling the extension on a local host.
C
Use the AWS X-Ray SDK to call the AWS AppConfig APIs. Retrieve the configuration file at runtime.
D
Migrate the configuration file to a Lambda deployment package. Read the file from the file system at runtime.

Reveal answer details Close answer details

Correct answerB

Question 34

Single choice

A company has deployed infrastructure on AWS. A development team wants to create an AWS Lambda function that will retrieve data from an Amazon Aurora database. The Amazon Aurora database is in a private subnet in company's VPC.
The VPC is named VPC1. The data is relational in nature. The Lambda function needs to access the data securely.

Which solution will meet these requirements?

A
Create the Lambda function. Configure VPC1 access for the function. Attach a security group named SG1 to both the Lambda function and the database. Configure the security group inbound and outbound rules to allow TCP traffic on Port 3306.
B
Create and launch a Lambda function in a new public subnet that is in a new VPC named VPC2.
Create a peering connection between VPC1 and VPC2.
C
Create the Lambda function. Configure VPC1 access for the function. Assign a security group named SG1 to the Lambda function. Assign a second security group named SG2 to the database. Add an inbound rule to SG1 to allow TCP traffic from Port 3306.
D
Export the data from the Aurora database to Amazon S3. Create and launch a Lambda function in VPC1. Configure the Lambda function query the data from Amazon S3.

Reveal answer details Close answer details

Correct answerA

Explanation

https://repost.aws/en/knowledge-center/connect-lambda-to-an-rds-instance

Question 35

Multiple choice

A developer is creating an application that uses an AWS Lambda function to transform and load data from an Amazon S3 bucket. When the developer tests the application, they find that some invocations of the Lambda function are slower than others.

The developer needs to update the Lambda function to have predictable invocation durations with low latency. Any initialization activities, such as loading libraries and instantiating clients, must run during allocation time rather than during actual function invocations.

Which combination of steps will meet these requirements? (Select TWO.)

A
Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.
B
Configure provisioned concurrency for the Lambda function to ensure the necessary number of execution environments.
C
Use the $LATEST version of the Lambda function.
D
Configure reserved concurrency for the Lambda function to have the necessary number of execution environments.
E
Deploy changes and publish a new version of the Lambda function.

Reveal answer details Close answer details

Correct answersB, D

Question 36

Single choice

A developer wants to expand an application to run in multiple AWS Regions. The developer wants to copy Amazon Machine Images (AMIs) with the latest changes and create a new application stack in the destination Region. According to company requirements, all AMIs must be encrypted in all Regions.
However, not all the AMIs that the company uses are encrypted.

How can the developer expand the application to run in the destination Region while meeting the encryption requirement?

A
Create new AMIs, and specify encryption parameters. Copy the encrypted AMIs to the destination
Region. Delete the unencrypted AMIs.
B
Use AWS Key Management Service (AWS KMS) to enable encryption on the unencrypted AMIs. Copy the encrypted AMIs to the destination Region.
C
Use AWS Certificate Manager (ACM) to enable encryption on the unencrypted AMIs. Copy the encrypted AMIs to the destination Region.
D
Copy the unencrypted AMIs to the destination Region. Enable encryption by default in the destination Region.

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AMIEncryption.html
Encrypt an unencrypted image during copy
In this scenario, an AMI backed by an unencrypted root snapshot is copied to an AMI with an encrypted root snapshot. The CopyImage action is invoked with two encryption parameters, including a customer managed key.

Question 37

Single choice

A company hosts a client-side web application for one of its subsidiaries on Amazon S3. The web application can be accessed through Amazon CloudFront from https://www.example.com. After a successful rollout, the company wants to host three more client-side web applications for its remaining subsidiaries on three separate S3 buckets.

To achieve this goal, a developer moves all the common JavaScript files and web fonts to a central S3 bucket that serves the web applications. However, during testing, the developer notices that the browser blocks the JavaScript files and web fonts.

What should the developer do to prevent the browser from blocking the JavaScript files and web fonts?

A
Create four access points that allow access to the central S3 bucket. Assign an access point to each web application bucket.
B
Create a bucket policy that allows access to the central S3 bucket. Attach the bucket policy to the central S3 bucket.
C
Create a cross-origin resource sharing (CORS) configuration that allows access to the central S3 bucket. Add the CORS configuration to the central S3 bucket.
D
Create a Content-MD5 header that provides a message integrity check for the central S3 bucket. Insert the Content-MD5 header for each web application request.

Reveal answer details Close answer details

Correct answerC

Explanation

https://docs.aws.amazon.com/AmazonS3/latest/userguide/cors.html

Using cross-origin resource sharing (CORS):
Cross-origin resource sharing (CORS) defines a way for client web applications that are loaded in one domain to interact with resources in a different domain.

Question 38

Single choice

A company has an application that uses Amazon Cognito user pools as an identity provider. The company must secure access to user records. The company has set upmulti-factor authentication (MFA). The company also wants to send a login activity notification by email every time a user logs in.

What is the MOST operationally efficient solution that meets this requirement?

A
Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received.
B
Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.
C
Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the
email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status.
D
Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user.

Reveal answer details Close answer details

Correct answerB

Question 39

Multiple choice

A developer uses an AWS Lambda function in an application to edit users' uploaded photos. The developer needs to update the Lambda function code and needs to test the updates.

For testing, the developer must divide the user traffic between the original version of the Lambda function and the new version of the Lambda function.

Which combination of steps will meet these requirements? (Choose two.)

A
Publish a version of the original Lambda function. Make the necessary changes to the Lambda code.
Publish a new version of the Lambda function.
B
Use AWS CodeBuild to detect updates to the Lambda function. Configure CodeBuild to incrementally shift traffic from the original version of the Lambda function to the new version of the Lambda function.
C
Update the original version of the Lambda function to add a function URL. Make the necessary changes to the Lambda code. Publish another function URL for the updated Lambda code.
D
Create an alias that points to the original version of the Lambda function. Configure the alias to be a weighted alias that also includes the new version of the Lambda function. Divide traffic between the two versions.
E
Create an alias that points to the original function URL. Configure the alias to be a weighted alias that also includes the additional function URL. Divide traffic between the two function URLs.

Reveal answer details Close answer details

Correct answersA, D

Question 40

Single choice

A developer is building a serverless application on AWS for a workflow that processes high volumes of data. In the workflow, an AWS Step Functions state machine invokes several AWS Lambda functions.

One of the Lambda functions occasionally fails because of timeout errors during periods of high demand.
The developer must ensure that the workflow automatically retries the failed function invocation if a timeout error occurs.

Which solution will meet this requirement?

A
Add a Retry field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts and the timeout error type to retry on.
B
Add a Timeout field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts.
C
Add a Fail state to the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts.
D
Update the Step Functions state machine to pass the invocation request to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe a Lambda function to the SNS topic. Configure the Lambda function with the maximum number of retry attempts for a timeout error type.

Reveal answer details Close answer details

Correct answerA

Question 41

Single choice

A company is planning to securely manage one-time fixed license keys in AWS. The company's development team needs to access the license keys in automaton scripts that run in Amazon EC2 instances and in AWS CloudFormation stacks.

Which solution will meet these requirements MOST cost-effectively?

A
Amazon S3 with encrypted files prefixed with "config"
B
AWS Secrets Manager secrets with a tag that is named SecretString
C
AWS Systems Manager Parameter Store SecureString parameters
D
CloudFormation NoEcho parameters

Reveal answer details Close answer details

Correct answerC

Explanation

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

Question 42

Single choice

A company is building a serverless application on AWS. The application uses Amazon API Gateway and AWS Lambda. The company wants to deploy the application to its development, test, and production environments.

Which solution will meet these requirements with the LEAST development effort?

A
Use API Gateway stage variables and create Lambda aliases to reference environment-specific resources.
B
Use Amazon Elastic Container Service (Amazon ECS) to deploy the application to the environments.
C
Duplicate the code for each environment. Deploy the code to a separate API Gateway stage.
D
Use AWS Elastic Beanstalk to deploy the application to the environments.

Reveal answer details Close answer details

Correct answerB

Question 43

Single choice

A financial company must store original customer records for 10 years for legal reasons. A complete record contains personally identifiable information (PII). According to local regulations. PII is available to only certain people in the company and must not be shared with third parties. The company needs to make the records available to third-party organizations for statistical analysis without sharing the PII.

A developer wants to store the original immutable record in Amazon S3. Depending on who accesses the S3 document, the document should be returned as is or with all the PII removed. The developer has written an AWS Lambda function to remove the PII from the document. The function is named removePii.

What should the developer do so that the company can meet the PII requirements while maintaining only one copy of the document?

A
Set up an S3 event notification that invokes the removePii function when an S3 GET request is made.
Call Amazon S3 by using a GET request to access the object without PII.
B
Set up an S3 event notification that invokes the removePii function when an S3 PUT request is made.
Call Amazon S3 by using a PUT request to access the object without PII.
C
Create an S3 Object Lambda access point from the S3 console. Select the removePii function. Use S3
Access Points to access the object without PII.
D
Create an S3 access point from the S3 console. Use the access point name to call the GetObjectLegalHold S3 API function. Pass in the removePii function name to access the object without
PII.

Reveal answer details Close answer details

Correct answerC

Explanation

The best solution for the given requirements is to use an S3 Object Lambda function to remove the PII from the document. S3 Object Lambda is a new feature that allows the developer to add custom code to S3 GET requests. The developer can create an S3 Object Lambda function to remove the PII from the document and configure S3 to use the function whenever an object is requested from a specific access point. This way, depending on who accesses the document, the document will either be returned as is or with the PII removed, without having to store multiple copies of the document.

Therefore, option C is the correct answer. The developer should create an S3 Object Lambda access point from the S3 console, select the removePii function, and use S3 Access Points to access the object without PII. The S3 Object Lambda function will automatically remove the PII from the document whenever an object is requested from the access point.

Question 44

Single choice

A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS.

Which approach should the company take to allow the application to interact with Amazon S3?

A
Create an IAM role that has administrative access to AWS. Attach the role to the EC2 instance.
B
Create an IAM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
C
Create an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.
D
Create an IAM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.

Reveal answer details Close answer details

Correct answerC

Question 45

Multiple choice

A software company is launching a multimedia application. The application will allow guest users to access sample content before the users decide if they want to create an account to gain full access. The company wants to implement an authentication process that can identify users who have already created an account. The company also needs to keep track of the number of guest users who eventually create an account.

Which combination of steps will meet these requirements? (Choose two.)

A
Create an Amazon Cognito user pool. Configure the user pool to allow unauthenticated users.
Exchange user tokens for temporary credentials that allow authenticated users to assume a role.
B
Create an Amazon Cognito identity pool. Configure the identity pool to allow unauthenticated users.
Exchange unique identity for temporary credentials that allow all users to assume a role.
C
Create an Amazon CloudFront distribution. Configure the distribution to allow unauthenticated users.
Exchange user tokens for temporary credentials that allow all users to assume a role.
D
Create a role for authenticated users that allows access to all content. Create a role for unauthenticated users that allows access to only the sample content.
E
Allow all users to access the sample content by default. Create a role for authenticated users that allows access to the other content.

Reveal answer details Close answer details

Correct answersB, D

Question 46

Single choice

A developer is building a serverless application by using AWS Serverless Application Model (AWS SAM) on multiple AWS Lambda functions. When the application is deployed, the developer wants to shift 10% of the traffic to the new deployment of the application for the first 10 minutes after deployment. If there are no issues, all traffic must switch over to the new version.

Which change to the AWS SAM template will meet these requirements?

A
Set the Deployment Preference Type to Canaryl OPercent10Minutes. Set the AutoPublishAlias property to the Lambda alias.
B
Set the Deployment Preference Type to Linearl OPercentEveryIOMinutes. Set AutoPubIishAIias property to the Lambda alias.
C
Set the Deployment Preference Type to Canaryl OPercentIOMinutes. Set the PreTraffic and PostTraffic properties to the Lambda alias.
D
Set the Deployment Preference Type to Linearl OPercentEvery10Minutes. Set PreTraffic and PostTraffic properties to the Lambda alias.

Reveal answer details Close answer details

Correct answerA

Explanation

The Deployment Preference Type property specifies how traffic should be shifted between versions of a Lambda function 1. The Canary10Percent10Minutes option means that 10% of the traffic is immediately shifted to the new version, and after 10 minutes, the remaining 90% of the traffic is shifted 1. This matches the requirement of shifting 10% of the traffic for the first 10 minutes, and then switching all traffic to the new version.

The AutoPublishAlias property enables AWS SAM to automatically create and update a Lambda alias that points to the latest version of the function 1. This is required to use the Deployment Preference Type property 1. The alias name can be specified by the developer, and it can be used to invoke the function with the latest code.

Question 47

Single choice

A developer is building various microservices for an application that will run on Amazon EC2 instances.
The developer needs to monitor the end-to-end view of the requests between the microservices and debug any issues in the various microservices.

What should the developer do to accomplish these tasks?

A
Use Amazon CloudWatch to aggregate the microservices' logs and metrics, and build the monitoring dashboard.
B
Use AWS CloudTrail to aggregate the microservices' logs and metrics, and build the monitoring dashboard.
C
Use the AWS X-Ray SDK to add instrumentation in all the microservices, and monitor using the X-Ray service map.
D
Use AWS Health to monitor the health of all the microservices.

Reveal answer details Close answer details

Correct answerC

Question 48

Single choice

A developer is setting up the deployment of application stacks to new test environments by using the AWS Cloud Development Kit (AWS CDK). The application contains the code for several AWS Lambda functions that will be deployed as assets. Each Lambda function is defined by using the AWS CDK Lambda construct library.

The developer has already successfully deployed the application stacks to the alpha environment in the first account by using the AWS CDK CLI's cdk deploy command. The developer is preparing to deploy to

the beta environment in a second account for the first time. The developer makes no significant changes to the CDK code between deployments, but the initial deployment in the second account is unsuccessful and returns a NoSuchBucket error.

Which command should the developer run before redeployment to resolve this error?

A
cdk synth
B
cdk bootstrap
C
cdk init
D
cdk destroy

Reveal answer details Close answer details

Correct answerB

Question 49

Single choice

A developer is designing an AWS Lambda function that creates temporary files that are less than 10 MB during invocation. The temporary files will be accessed and modified multiple times during invocation. The developer has no need to save or retrieve these files in the future.

Where should the temporary files be stored?

A
the /tmp directory
B
Amazon Elastic File System (Amazon EFS)
C
Amazon Elastic Block Store (Amazon EBS)
D
Amazon S3

Reveal answer details Close answer details

Correct answerA

Explanation

A Lambda function has access to local storage in the /tmp directory. Each execution environment provides between 512 MB and 10,240 MB, in 1-MB increments, of disk space in the /tmp directory.
https://docs.aws.amazon.com/lambda/latest/dg/foundation-progmodel.html

Question 50

Single choice

When a developer tries to run an AWS CodeBuild project, it raises an error because the length of all environment variables exceeds the limit for the combined maximum of characters.

What is the recommended solution?

A
Add the export LC_ALL="en_US.utf8" command to the pre_build section to ensure POSIX localization.
B
Use Amazon Cognito to store key-value pairs for large numbers of environment variables.
C
Update the settings for the build project to use an Amazon S3 bucket for large numbers of environment variables.
D
Use AWS Systems Manager Parameter Store to store large numbers of environment variables.

Reveal answer details Close answer details

Correct answerD

Question 51

Single choice

A developer is writing an application, which stores data in an Amazon DynamoDB table. The developer wants to query the DynamoDB table by using the partition key and a different sort key value. The developer needs the latest data with all recent write operations.

How should the developer write the DynamoDB query?

A
Add a local secondary index (LSI) during table creation. Query the LSI by using eventually consistent reads.
B
Add a local secondary index (LSI) during table creation. Query the LSI by using strongly consistent reads.
C
Add a global secondary index (GSI) during table creation. Query the GSI by using eventually consistent reads.
D
Add a global secondary index (GSI) during table creation. Query the GSI by using strongly consistent reads.

Reveal answer details Close answer details

Correct answerB

Explanation

Local Secondary Index (LSI):
An LSI allows you to create an index with a different sort key for the same partition key as the base table.
This lets you query the table using the same partition key but with a different sort key.
LSIs are created at the same time as the table and cannot be added to an existing table.

Strongly consistent reads ensure that you always receive the most up-to-date data after all previous write operations are acknowledged.
This is important when the developer needs to ensure they are getting the latest data, as stated in the question.

Question 52

Single choice

A company has an application that uses an AWS Lambda function to consume messages from an Amazon Simple Queue Service (Amazon SQS) queue. The SQS queue is configured with a dead-letter queue. Due to a defect in the application, AWS Lambda failed to process some messages. A developer fixed the bug and wants to process the failed messages again.

How should the developer resolve this issue?

A
Use the SendMessageBatch API to send messages from the dead-letter queue to the original SQS queue.
B
Use the ChangeMessageVisibility API to configure messages in the dead-letter queue to be visible in the original SQS queue.
C
Use the StartMessageMoveTask API to move messages from the dead-letter queue to the original
SQS queue.
D
Use the PurgeQueue API to remove messages from the dead-letter queue and return the messages to the original SQS queue.

Reveal answer details Close answer details

Correct answerA

Question 53

Single choice

A company is planning to use AWS CodeDeploy to deploy an application to Amazon Elastic Container Service (Amazon ECS). During the deployment of a new version of the application, the company initially must expose only 10% of live traffic to the new version of the deployed application. Then, after 15 minutes elapse, the company must route all the remaining live traffic to the new version of the deployed application.

Which CodeDeploy predefined configuration will meet these requirements?

A
CodeDeployDefault.ECSCanary10Percent15Minutes
B
CodeDeployDefault.LambdaCanary10Percent5Minutes
C
CodeDeployDefault.LambdaCanary10Percentl15Minutes
D
CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.aws.amazon.com/codedeploy/latest/userguide/deployment-configurations.html

Question 54

Single choice

A company runs a payment application on Amazon EC2 instances behind an Application Load Balance.
The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application needs to retrieve application secrets during the application startup and export the secrets as environment variables. These secrets must be encrypted at rest and need to be rotated every month.

Which solution will meet these requirements with the LEAST development effort?

A
Save the secrets in a text file and store the text file in Amazon S3. Provision a customer managed key.
Use the key for secret encryption in Amazon S3. Read the contents of the text file and read the export as environment variables.
Configure S3 Object Lambda to rotate the text file every month.
B
Save the secrets as strings in AWS Systems Manager Parameter Store and use the default AWS Key Management Service (AWS KMS) key. Configure an Amazon EC2 user data script to retrieve the secrets during the startup and export as environment variables. Configure an AWS Lambda function to rotate the secrets in Parameter Store every month.
C
Save the secrets as base64 encoded environment variables in the application properties. Retrieve the secrets during the application startup. Reference the secrets in the application code. Write a script to rotate the secrets saved as environment variables.
D
Store the secrets in AWS Secrets Manager. Provision a new customer master key. Use the key to encrypt the secrets. Enable automatic rotation. Configure an Amazon EC2 user data script to programmatically retrieve the secrets during the startup and export as environment variables.

Reveal answer details Close answer details

Correct answerD

Explanation

AWS Secrets Manager is a service that enables the secure management and rotation of secrets, such as database credentials, API keys, or passwords. By using Secrets Manager, the company can avoid hardcoding secrets in the application code or properties files, and instead retrieve them programmatically during the application startup. Secrets Manager also supports automatic rotation of secrets by using AWS Lambda functions or built-in rotation templates. The company can provision a customer master key (CMK) to encrypt the secrets and use the AWS SDK or CLI to export the secrets as environment variables.
References:
What Is AWS Secrets Manager? - AWS Secrets Manager Rotating Your AWS Secrets Manager Secrets - AWS Secrets Manager Retrieving a Secret - AWS Secrets Manager

Question 55

Single choice

A developer has created an AWS Lambda function that makes queries to an Amazon Aurora MySQL DB instance. When the developer performs a test, the DB instance shows an error for too many connections.

Which solution will meet these requirements with the LEAST operational effort?

A
Create a read replica for the DB instance. Query the replica DB instance instead of the primary DB instance.
B
Migrate the data to an Amazon DynamoDB database.
C
Configure the Amazon Aurora MySQL DB instance for Multi-AZ deployment.
D
Create a proxy in Amazon RDS Proxy. Query the proxy instead of the DB instance.

Reveal answer details Close answer details

Correct answerD

Question 56

Single choice

A company uses AWS X-Ray to monitor a serverless application. The components of the application have different request rates. The user interactions and transactions are important to trace, but they are low in volume. The background processes such as application health checks, polling, and connection maintenance generate high volumes of read-only requests.

Currently, the default X-Ray sampling rules are universal for all requests. Only the first request per second and some additional requests are recorded. This setup is not helping the company review the requests based on service or request type.

A developer must configure rules to trace requests based on service or request properties. The developer must trace the user interactions and transactions without wasting effort recording minor background tasks.

Which solution will meet these requirements?

A
Disable sampling for high-volume read-only requests. Sample at a lower rate for all requests that handle user interactions or transactions.
B
Disable sampling and trace all requests for requests that handle user interactions or transactions.
Sample high-volume read-only requests at a higher rate.
C
Disable sampling and trace all requests for requests that handle user interactions or transactions.
Sample high-volume read-only requests at a lower rate.
D
Disable sampling for high-volume read-only requests. Sample at a higher rate for all requests that handle user interactions or transactions.

Reveal answer details Close answer details

Correct answerB

Question 57

Single choice

A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account.

Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?

A
AssumeRoleWithWebidentity
B
GetFederationToken
C
AssumeRoleWithSAML
D
AssumeRole

Reveal answer details Close answer details

Correct answerD

Explanation

The AssumeRole API operation returns a set of temporary security credentials that can be used to access resources in another AWS account. The developer can specify the MFA device serial number and the MFA token code in the request parameters. This option enables the developer to use MFA to access data in an S3 bucket that is in another AWS account. The other options are not relevant or effective for this scenario.
References AssumeRole Requesting Temporary Security Credentials

Question 58

Single choice

A developer is deploying an application in the AWS Cloud by using AWS CloudFormation. The application will connect to an existing Amazon RDS database. The hostname of the RDS database is stored in AWS Systems Manager Parameter Store as a plaintext value. The developer needs to incorporate the database hostname into the CloudFormation template to initialize the application when the stack is created.

How should the developer reference the parameter that contains the database hostname?

A
Use the ssm dynamic reference.
B
Use the Ref intrinsic function.
C
Use the Fn::ImportValue intrinsic function.
D
Use the ssm-secure dynamic reference.

Reveal answer details Close answer details

Correct answerA

Question 59

Single choice

A developer is building an application that will use an Amazon API Gateway API with an AWS Lambda backend. The team that will develop the frontend requires immediate access to the API endpoints to build the UI. To prepare the backend application for integration, the developer needs to set up endpoints. The endpoints need to return predefined HTTP status codes and JSON responses for the frontend team. The developer creates a method for an API resource.

Which solution will meet these requirements?

A
Set the integration type to AWS_PROXY. Provision Lambda functions to return hardcoded JSON data.
B
Set the integration type to MOCK. Configure the method's integration request and integration response to associate a JSON responses with specific HTTP status codes.
C
Set the integration type to HTTP_PROXY. Configure API Gateway to pass all requests to an external placeholder API. which the team will build.
D
Set the integration type to MOCK. Use a method request to define HTTP status codes. Use an integration request to define JSON responses.

Reveal answer details Close answer details

Correct answerB

Question 60

Single choice

A company's developer is building a static website to be deployed in Amazon S3 for a production

environment. The website integrates with an Amazon Aurora PostgreSQL database by using an AWS Lambda function. The website that is deployed to production will use a Lambda alias that points to a specific version of the Lambda function.

The company must rotate the database credentials every 2 weeks. Lambda functions that the company deployed previously must be able to use the most recent credentials.

Which solution will meet these requirements?

A
Store the database credentials in AWS Secrets Manager. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Secrets Manager.
B
Include the database credentials as part of the Lambda function code. Update the credentials periodically and deploy the new Lambda function.
C
Use Lambda environment variables. Update the environment variables when new credentials are available.
D
Store the database credentials in AWS Systems Manager Parameter Store. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Systems Manager Parameter Store.

Reveal answer details Close answer details

Correct answerA

Question 61

Single choice

A developer previously deployed an AWS Lambda function as a .zip package. The developer now needs to redeploy the Lambda function as a container image.

Which solution will meet this requirement?

A
Create an Amazon ECR repository in the same AWS Region as the Lambda function. Package the Lambda function into a container image. Build the image and upload it to the Amazon ECR repository.
Update the existing Lambda function configuration to specify the repository URI and container image tag.
B
Create an AWS SAM template that defines the Lambda function and its resources as code. Include a container image in the template, and store the container image in an Amazon S3 bucket. Deploy the AWS SAM template. Specify the S3 bucket URI.
C
Create an AWS CloudFormation template that defines the Lambda function and its resources as code.
Include a container image in the template, and store the image in an Amazon S3 bucket. Deploy the CloudFormation template. Specify the S3 bucket URI.
D
Create an Amazon ECR repository in the same AWS Region as the Lambda function. Build the image and upload it to the Amazon ECR repository. Update the existing Lambda function to use the new image by specifying the repository URI.

Reveal answer details Close answer details

Correct answerA

Explanation

AWS Lambda supports deployment using container images.
The container image must be stored in Amazon Elastic Container Registry (ECR).
The Lambda function configuration must be updated to reference the ECR repository URI and image tag.
This process ensures that the Lambda function runs from the new container image instead of the previous
.zip package.

Question 62

Single choice

A developer is creating a serverless application that uses an AWS Lambda function.
The developer will use AWS CloudFormation to deploy the application.
The application will write logs to Amazon CloudWatch Logs
The developer has created a log group in a CloudFormation template for the application to use The developer needs to modify the CloudFormation template to make the name of the log group available to the application at runtime

Which solution will meet this requirement?

A
Use the AWS:lnclude transform in CloudFormation to provide the log group's name to the application
B
Pass the log group's name to the application in the user data section of the CloudFormation template.
C
Use the CloudFormation template's Mappings section to specify the log group's name for the application.
D
Pass the log group's Amazon Resource Name (ARN) as an environment variable to the Lambda function

Reveal answer details Close answer details

Correct answerD

Explanation

FunctionName: MyLambdaFunction
Code:
S3Bucket: your-lambda-code-bucket
S3Key: lambda-code.zip
Runtime: nodejs14.x # Specify the desired runtime for your Lambda function Environment:
Variables:
LOG_GROUP_NAME: !Ref MyLogGroup
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-
loggroup.html

Question 63

Single choice

An IT department uses Amazon S3 to store sensitive images. After more than 1 year, the company moves the images into archival storage. The company rarely accesses the images, but the company wants a storage solution that maximizes resiliency. The IT department needs access to the images that have been moved to archival storage within 24 hours.

Which solution will meet these requirements MOST cost-effectively?

A
Use S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
B
Use S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.
C
Use S3 Intelligent-Tiering to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
D
Use S3 One Zone-Infrequent Access (S3 One Zone-IA) to store the images. Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.

Reveal answer details Close answer details

Correct answerA

Question 64

Single choice

A developer is creating an AWS CloudFormation stack. The stack contains IAM resources with custom names. When the developer tries to deploy the stack, they receive an InsufficientCapabilities error.

What should the developer do to resolve this issue?

A
Specify the CAPABILITY_AUTO_EXPAND capability in the CloudFormation stack.
B
Use an administrators role to deploy IAM resources with CloudFormation.
C
Specify the CAPABILITY_IAM capability in the CloudFormation stack.
D
Specify the CAPABILITY_NAMED_IAM capability in the CloudFormation stack.

Reveal answer details Close answer details

Correct answerD

Question 65

Multiple choice

A developer is building a containerized application on AWS. The application communicates with a third-party service by using API keys. The developer needs a secure way to store the API keys and pass the API keys to the containerized application.

Which solutions will meet these requirements? (Choose two.)

A
Store the API keys as a SecureString parameter in AWS Systems Manager Parameter Store. Grant the
application access to retrieve the value from Parameter Store.
B
Store the API keys in AWS CloudFormation templates by using base64 encoding. Pass the API keys to the application through container definition environment variables.
C
Add a new AWS CloudFormation parameter to the CloudFormation template. Pass the API keys to the application by using the container definition environment variables.
D
Embed the API keys in the application. Build the container image on-premises. Upload the container image to Amazon Elastic Container Registry (Amazon ECR).
E
Store the API keys as a SecretString parameter in AWS Secrets Manager. Grant the application access to retrieve the value from Secrets Manager.

Reveal answer details Close answer details

Correct answersA, C

Question 66

Single choice

A company is releasing a new feature. Users can request early access to the new feature by using an application form. The company expects a surge of requests when the application form becomes available.
Each request will be stored as an item in an Amazon DynamoDB table.

Each item will contain the user's username, the submission date, and a validation status of UNVALIDATED. VALID, or NOT VALID. Each item also will contain the user's rating of the process on a scale of 1 to 5.

Each user can submit one request. For the DynamoDB table, the developer must choose a partition key that will give the workload well-distributed records across partitions.

Which DynamoDB attribute will meet these requirements?

A
Username
B
Submission date
C
Validation status
D
Rating of the process on a scale of 1 to 5

Reveal answer details Close answer details

Correct answerD

Question 67

Single choice

A developer has an application that is composed of many different AWS Lambda functions. The Lambda functions all use some of the same dependencies. To avoid security issues, the developer is constantly updating the dependencies of all of the Lambda functions. The result is duplicated effort for each function.

How can the developer keep the dependencies of the Lambda functions up to date with the LEAST additional complexity?

A
Define a maintenance window for the Lambda functions to ensure that the functions get updated copies of the dependencies.
B
Upgrade the Lambda functions to the most recent runtime version.
C
Define a Lambda layer that contains all of the shared dependencies.
D
Use an AWS CodeCommit repository to host the dependencies in a centralized location.

Reveal answer details Close answer details

Correct answerC

Question 68

Single choice

A developer is creating an application that must transfer expired items from Amazon DynamoDB to Amazon S3. The developer sets up the DynamoDB table to automatically delete items after a specific TTL.
The application must process the items in DynamoDB and then must store the expired items in Amazon
S3. The entire process, including item processing and storage in Amazon S3, will take 5 minutes.

Which solution will meet these requirements with the LEAST operational overhead?

A
Configure DynamoDB Accelerator (DAX) to query for expired items based on the TTL. Save the results to Amazon S3.
B
Configure DynamoDB Streams to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
C
Deploy a custom application on an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2 instances. Program the custom application to process the items and to store the expired items in Amazon S3.
D
Create an Amazon EventBridge rule to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.

Reveal answer details Close answer details

Correct answerB

Question 69

Single choice

A developer has an application that asynchronously invokes an AWS Lambda function. The developer wants to store messages that resulted in failed invocations of the Lambda function so that the application can retry the call later.

What should the developer do to accomplish this goal with the LEAST operational overhead?

A
Set up Amazon CloudWatch Logs log groups to filter and store the messages in an Amazon S3 bucket.
Import the messages in Lambda. Run the Lambda function again.
B
Configure Amazon EventBridge to send the messages to Amazon Simple Notification Service (Amazon SNS) to initiate the Lambda function again.
C
Implement a dead-letter queue for discarded messages. Set the dead-letter queue as an event source for the Lambda function.
D
Send Amazon EventBridge events to an Amazon Simple Queue Service (Amazon SQS) queue.
Configure the Lambda function to pull messages from the SQS queue. Run the Lambda function again.

Reveal answer details Close answer details

Correct answerC

Question 70

Single choice

A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3
GetObject operation to retrieve the data from the S3 bucket.

How can the developer enforce that all requests to retrieve the data provide encryption in transit?

A
Define a resource-based policy on the S3 bucket to deny access when a request meets the condition
"aws:SecureTransport": "false".
B
Define a resource-based policy on the S3 bucket to allow access when a request meets the condition
"aws:SecureTransport": "false".
C
Define a role-based policy on the other accounts' roles to deny access when a request meets the condition of "aws:SecureTransport": "false".
D
Define a resource-based policy on the KMS key to deny access when a request meets the condition of
"aws:SecureTransport": "false".

Reveal answer details Close answer details

Correct answerA

Question 71

Single choice

A developer is setting up infrastructure by using AWS CloudFormation. If an error occurs when the resources described in the Cloud Formation template are provisioned, successfully provisioned resources must be preserved. The developer must provision and update the CloudFormation stack by using the AWS
CLI.

Which solution will meet these requirements?

A
Add an --enable-termination-protection command line option to the create-stack command and the update-stack command.
B
Add a --disable-rollback command line option to the create-stack command and the update-stack command.
C
Add a --parameters ParameterKey=PreserveResources,ParameterValue=True command line option to the create-stack command and the update-stack command.
D
Add a --tags Key=PreserveResources,Value=True command line option to the create-stack command and the update-stack command.

Reveal answer details Close answer details

Correct answerB

Question 72

Multiple choice

A company runs applications on Amazon EKS containers. The company sends application logs from the containers to an Amazon CloudWatch Logs log group. The company needs to process log data in real time based on a specific error in the application logs.

Which combination of steps will meet these requirements? (Select TWO.)

A
Create an Amazon SNS topic that has a subscription filter policy.
B
Create a subscription filter on the log group that has a filter pattern.
C
Set up an Amazon CloudWatch agent operator to manage the trace collection daemon in Amazon
EKS.
D
Create an AWS Lambda function to process the logs.
E
Create an Amazon EventBridge rule to invoke the AWS Lambda function on a schedule.

Reveal answer details Close answer details

Correct answersB, D

Question 73

Single choice

A developer is updating an Amazon API Gateway REST API to use a mock endpoint. The developer wants to modify the integration request mapping template so that the endpoint responds to mock integration requests with specific HTTP status codes based on different conditions.

Which of the following templates should the developer use to achieve this?

A
{ if( $input.params(`integration') == "mock" ) "statusCode": 404 else "statusCode": 500 end }
B
{ if( $input.params('scope') == "internal" ) "statusCode": 200 else "statusCode": 500 end }
C
{ if( $input.path("integration") ) "statusCode": 200 else "statusCode":404 end }
D
{ if( $context.integration.status ) "statusCode": 200 else "statusCode": 500 end }

Reveal answer details Close answer details

Correct answerD

Explanation

In this scenario, the developer is configuring a mock integration in API Gateway. The integration request mapping template allows the developer to map incoming request data to a format that the API expects. For mock integrations, it is common to return specific HTTP status codes based on various conditions.
Using $context.integration.status:
The $context.integration.status variable refers to the status of the API Gateway integration, which is useful for generating responses based on specific conditions. Option D correctly uses this variable to determine the HTTP status code, returning 200 for a successful mock request and 500 for a failure.

Question 74

Single choice

A company recently deployed a new serverless user portal. Users have reported that part of the portal is slow. The initial analysis found a single Amazon API Gateway endpoint that is responsible for the performance issues. The endpoint integrates with an AWS Lambda function. However, the Lambda function interacts with other APIs and AWS services.

How can a developer find the source of the increased response time by using operational best practices?

A
Update the Lambda function by adding logging statements with high-precision timestamps before and after each external request. Deploy the updated Lambda function. After accumulating enough usage data, examine the Amazon CloudWatch logs for the Lambda function to determine the likely sources for the increased response time.
B
Instrument the Lambda function with the AWS X-Ray SDK. Add HTTP and HTTPS interceptors and SDK client handlers. Deploy the updated Lambda function. Turn on X-Ray tracing. After accumulating enough usage data, use the X-Ray service map to examine the average response times to determine the likely sources.
C
Review the Lambda function's Amazon CloudWatch metrics by using the metrics explorer. Apply anomaly detection to the Duration metric and the Throttles metric. Review the anomalies to determine the likely sources.
D
Use Amazon CloudWatch Synthetics to create a new canary. Turn on AWS X-Ray tracing on the canary. Configure the canary to scan the user portal. After accumulating enough usage data, use the CloudWatch Synthetics canary dashboard to view the metrics from the canary.

Reveal answer details Close answer details

Correct answerB

Question 75

Single choice

A developer is creating an application for a company. The application needs to read the file doc.txt that is placed in the root folder of an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The company's security team requires the principle of least privilege to be applied to the application's IAM policy.

Which IAM policy statement will meet these security requirements?

A
Option A
B
Option B
C
Option C
D
Option D

Reveal answer details Close answer details

Correct answerA

Question 76

Single choice

What are the MINIMUM properties required in the resources section of the AppSpace file for CodeDeploy to deploy the ECS service successfully?

A
name, alias, currentversion, and targetversion
B
TaskDefinition, ContainerName, and PlartformVersion
C
TaskDefinitionContainerName, ContainerPort
D
name, Currentversion, NetworkConfiguration, and Platform Version

Reveal answer details Close answer details

Correct answerA

Question 77

Single choice

A developer needs to manage AWS infrastructure as code and must be able to deploy multiple identical copies of the infrastructure, stage changes, and revert to previous versions.

Which approach addresses these requirements?

A
Use cost allocation reports and AWS OpsWorks to deploy and manage the infrastructure.
B
Use Amazon CloudWatch metrics and alerts along with resource tagging to deploy and manage the infrastructure.
C
Use AWS Elastic Beanstalk and AWS CodeCommit to deploy and manage the infrastructure.
D
Use AWS CloudFormation and AWS CodeCommit to deploy and manage the infrastructure.

Reveal answer details Close answer details

Correct answerD

Question 78

Single choice

A developer is writing a serverless application that requires an AWS Lambda function to be invoked every
10 minutes.

What is an automated and serverless way to invoke the function?

A
Deploy an Amazon EC2 instance based on Linux, and edit its /etc/crontab file by adding a command to periodically invoke the Lambda function.
B
Configure an environment variable named PERIOD for the Lambda function. Set the value to 600.
C
Create an Amazon EventBridge rule that runs on a regular schedule to invoke the Lambda function.
D
Create an Amazon Simple Notification Service (Amazon SNS) topic that has a subscription to the Lambda function with a 600-second timer.

Reveal answer details Close answer details

Correct answerC

Question 79

Single choice

A developer is building an application that invokes AWS Lambda functions asynchronously to process events. The developer notices that a Lambda function fails to process some events at random times. The developer needs to investigate the failed events and capture the events that the Lambda function fails to process.

Which solution will meet these requirements?

A
Add an Amazon EventBridge rule for the Lambda function. Configure the EventBridge rule to react to failed events and to store the events in an Amazon DynamoDB table.
B
Configure the Lambda function with a dead-letter queue based in Amazon Kinesis. Update the Lambda function's execution role with the required permissions.
C
Configure the Lambda function with an Amazon Simple Queue Service (Amazon SQS) dead-letter queue. Update the Lambda function's execution role with the required permissions.
D
Configure the Lambda function with an Amazon Simple Queue Service (Amazon SQS) FIFO dead-letter queue. Update the Lambda function's execution role with the required permissions.

Reveal answer details Close answer details

Correct answerB

Question 80

Single choice

A developer is building a microservices-based application by using Python on AWS and several AWS services.
The developer must use AWS X-Ray The developer views the service map by using the console to view the service dependencies.
During testing, the developer notices that some services are missing from the service map

What can the developer do to ensure that all services appear in the X-Ray service map?

A
Modify the X-Ray Python agent configuration in each service to increase the sampling rate
B
Instrument the application by using the X-Ray SDK for Python. Install the X-Ray SDK for all the services that the application uses
C
Enable X-Ray data aggregation in Amazon CloudWatch Logs for all the services that the application uses
D
Increase the X-Ray service map timeout value in the X-Ray console

Reveal answer details Close answer details

Correct answerB

Explanation

The X-Ray SDK for Python provides libraries and tools for instrumenting Python applications that use AWS services and other AWS X-Ray integrations. By installing the X-Ray SDK for all the services that the application uses, the developer can ensure that all the service dependencies are captured and displayed in the X-Ray service map. The other options are not relevant or effective for this scenario.
References AWS X-Ray SDK for Python Instrumenting a Python Application

Question 81

Single choice

A software company must ensure that documents that are uploaded by users are securely stored in Amazon S3. The documents must be encrypted at rest in Amazon S3. The company wants to avoid client-side encryption and does not want to manage the security infrastructure. In addition, the company wants control over the keys that are used for encryption at rest.

Which solution for encryption keys should a developer use to meet these requirements?

A
Amazon S3 managed keys
B
Application-level encryption with customer-provided encryption keys that are stored in an on-premises
hardware security module (HSM)
C
AWS Key Management Service (AWS KMS) customer managed keys
D
IAM access keys

Reveal answer details Close answer details

Correct answerC

Question 82

Single choice

A company hosts a batch processing application on AWS Elastic Beanstalk with instances that run the most recent version of Amazon Linux. The application sorts and processes large datasets.

In recent weeks, the application's performance has decreased significantly during a peak period for traffic.
A developer suspects that the application issues are related to the memory usage. The developer checks the Elastic Beanstalk console and notices that memory usage is not being tracked.

How should the developer gather more information about the application performance issues?

A
Configure the Amazon CloudWatch agent to push logs to Amazon CloudWatch Logs by using port 443.
B
Configure the Elastic Beanstalk .ebextensions directory to track the memory usage of the instances.
C
Configure the Amazon CloudWatch agent to track the memory usage of the instances.
D
Configure an Amazon CloudWatch dashboard to track the memory usage of the instances.

Reveal answer details Close answer details

Correct answerC

Question 83

Single choice

A developer hosts a static website on Amazon S3 and connects the website to an Amazon CloudFront distribution. The website uses a custom domain name that points to the CloudFront URL.

The developer has set up a continuous integration and continuous delivery (CI/CD) pipeline. The pipeline automatically runs when changes occur in an AWS CodeCommit repository. The pipeline has a source stage and then a build stage. The build stage invokes an AWS CodeBuild project that references a buildspec.yml file. The buildspec.yml file builds the code and deploys the static files to the S3 bucket.

The pipeline runs successfully, and the latest website files are visible in the S3 bucket and at the S3 website URL. However, when the developer accesses the website through the CloudFront domain, the updates are not reflected on the website.

What should the developer configure the buildspec.yml file to do to resolve this issue?

A
Properly synchronize the objects in the S3 bucket with new files from the source stage.
B
Delete the previous website files in the S3 bucket and redeploy the website files.
C
Invalidate the file caches for the primary CloudFront distribution.
D
Modify the cross-origin resource sharing (CORS) policy of the S3 bucket and redeploy the website files.

Reveal answer details Close answer details

Correct answerC

Question 84

Single choice

A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution accesses the S3 bucket by using an origin access identity (OAI). The S3 bucket's permissions explicitly deny access to all other users.

The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories. The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket. However, when the developer tries to navigate to the login page, the developer receives a 403 Forbidden error.

The developer needs to implement a solution to allow unauthenticated access to the login page. The solution also must keep all private content secure.

Which solution will meet these requirements?

A
Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior's settings unchanged.
B
Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to *, and make viewer access restricted. Change the default cache behavior's path pattern to the path of the login page, and make viewer access unrestricted.
C
Add a second origin as a failover origin to the default cache behavior. Point the failover origin to the S3 bucket. Set the path pattern for the primary origin to *, and make viewer access restricted. Set the path pattern for the failover origin to the path of the login page, and make viewer access unrestricted.
D
Add a bucket policy to the S3 bucket to allow read access. Set the resource on the policy to the Amazon Resource Name (ARN) of the login page object in the S3 bucket. Add a CloudFront function to the default cache behavior to redirect unauthorized requests to the login page's S3 URL.

Reveal answer details Close answer details

Correct answerA

Question 85

Single choice

A developer received the following error message during an AWS CloudFormation deployment:

DELETE_FAILED (The following resource(s) failed to delete: [ASGInstanceRole12345678].

) Which action should the developer take to resolve this error?

A
Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
B
Add a DependsOn attribute to the ASGInstanceRole12345678 resource in the CloudFormation template. Then delete the stack.
C
Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource after deployment.
D
Add a force parameter when calling CloudFormation with the role-arn of ASGInstanceRole12345678.

Reveal answer details Close answer details

Correct answerC

Question 86

Single choice

A company has a mobile app. The app includes an Amazon API Gateway REST API that invokes AWS Lambda functions. The Lambda functions process data from the app.

The company needs to test updated Lambda functions that have new features. The company must conduct these tests with a subset of users before deployment. The tests must not affect other users of the app.

Which solution will meet these requirements with the LEAST amount of operational effort?

A
Create a new version of each Lambda function with a weighted alias. Configure a weight value for each version of the Lambda function. Update the new weighted alias Amazon Resource Name (ARN) in the REST API.
B
Create a new REST API in API Gateway. Set up a Lambda proxy integration to connect to multiple Lambda functions. Enable canary settings on the deployment stage. Specify a smaller percentage of API traffic to go to the new version of the Lambda function.
C
Create a new version of each Lambda function. Integrate a predefined canary deployment in AWS CodeDeploy to slowly shift the traffic to the new versions automatically.
D
Create a new REST API in API Gateway. Set up a Lambda non-proxy integration to connect to multiple Lambda functions. Specify the necessary parameters and properties in API Gateway. Enable canary settings on the deployment stage. Specify a smaller percentage of API traffic to go to the new version of the Lambda function.

Reveal answer details Close answer details

Correct answerC

Question 87

Single choice

A developer is building an application on AWS. The application has an Amazon API Gateway API that sends requests to an AWS Lambda function. The API is experiencing increased latency because the Lambda function has limited available CPU to fulfill the requests.

Before the developer deploys the API into production, the developer must configure the Lambda function to have more CPU.

Which solution will meet this requirement?

A
Increase the virtual CPU (vCPU) cores quota of the Lambda function.
B
Increase the amount of memory that is allocated to the Lambda function.
C
Increase the ephemeral storage size of the Lambda function.
D
Increase the timeout value of the Lambda function.

Reveal answer details Close answer details

Correct answerB

VOL	TYPE	QUESTIONS
1	Single choice	79
2	Multiple choice	8