Font size
S
M
L
XL
WorksheetsDesarrollador prueba1
Total questions: 65
Worksheet time: 2hrs 10mins
Name
Class
Date
1.
A developer is designing an application that requires the client IP address for processing. After moving the application behind an Application Load Balancer (ALB), all client IP addresses appear identical. Which solution meets this requirement in the most cost‑effective manner?
a)
Remove the application from the ALB, delete the ALB, and use Route 53 to direct traffic directly to the instance.
b)
Use a Classic Load Balancer instead of an ALB.
c)
Modify the application code to inspect the X‑Forwarded‑For header and process the list of IP addresses.
d)
Modify the application code to inspect a custom header where the client sends its IP address.
2.
A company needs to distribute firmware updates worldwide. Which service allows for easy and secure control of download access at the lowest cost?
a)
Use Amazon CloudFront with signed URLs for S3 content.
b)
Create a dedicated CloudFront distribution for each customer.
c)
Use CloudFront with LambdaEdge
d)
Use API Gateway and Lambda to control access to S3.
3.
A company uses AWS Lambda functions triggered by S3 events to process images stored in an S3 bucket. After a production deployment, the development S3 buckets inadvertently invoke production Lambda functions, causing development files to be processed by production code. Which solution meets these requirements while following security best practices?
a)
Update the production Lambda function’s execution role to add a policy that allows reading only from the production S3 bucket.
b)
Move development and production environments into separate AWS accounts and add a resource policy to each Lambda function to allow only S3 buckets in the same account to invoke the function.
c)
Add a resource policy to the production Lambda function to allow only the production S3 bucket to invoke it.
d)
Move development and production environments into separate AWS accounts and update each Lambda function’s execution role to allow reading only from the S3 bucket in the same account.
4.
A developer needs to launch a new EC2 instance using the AWS CLI. Which command should be used?
a)
aws ec2 bundle-instance.
b)
aws ec2 start-instances.
c)
aws ec2 confirm-product-instance.
d)
aws ec2 run-instances.
5.
A developer wants to accelerate the deployment workflow for a serverless application so that only incremental changes are deployed without re‑deploy all the environment for each commit.
a)
Use AWS SAM and deploy incremental changes using the “sam sync” command.
b)
Use AWS SAM with the “sam init” command for incremental deployments.
c)
Use AWS CDK with “cdk synth” to deploy changes.
d)
Use AWS CDK with “cdk bootstrap” for incremental deployments.
6.
A serverless application processes customer orders using a Lambda function that calls an external payment API, which sometimes times out. The company wants the support team to be notified via an existing SNS topic when the external API's error rate exceeds 5% of transactions in an hour. Which approach meets these requirements?
a)
Log payment API call results to CloudWatch and use CloudWatch Logs Insights with a scheduled Lambda function to query logs and notify SNS.
b)
Publish custom CloudWatch metrics for payment API failures and set up a CloudWatch alarm to alert SNS when error rates exceed 5%.
c)
Publish API call results to a new SNS topic and subscribe the support team to it.
d)
Store API call results in S3 and use scheduled Athena queries to detect high error rates and trigger SNS notifications.
7.
A developer is building an application for IoT devices that sends data to a RESTful API (implemented via AWS Lambda) with each request assigned a unique identifier. Since request volumes can spike and duplicates may occur during throttling, the API must handle duplicate requests without inconsistencies. Which solution meets these requirements?
a)
Use an Amazon RDS MySQL instance to store each request's unique identifier and have the Lambda function check this database before processing.
b)
Use an Amazon DynamoDB table to store unique request identifiers and have the Lambda function verify the identifier before processing.
c)
Use an Amazon DynamoDB table to store unique identifiers and have the Lambda function return an error for duplicate requests.
d)
Use an Amazon ElastiCache for Memcached instance to store unique identifiers and check the cache in the Lambda function before processing.
8.
A developer is building an application that retrieves and groups data from several public API endpoints using a Lambda function. Which deployment strategy minimizes performance impact?
a)
Deploy the Lambda function in a container image.
b)
Use a scheduled Lambda function triggered by CloudWatch Events.
c)
Use the AWS Lambda local invoke command with simulated events for testing.
d)
Implement a caching layer using AWS Lambda layers.
9.
A developer is creating an application on EC2 that opens connections to an RDS for SQL Server database. The application must not hardcode database credentials, and the credentials must be automatically rotated. Which solution meets these requirements?
a)
Create an IAM role with database access and attach it to the EC2 instances.
b)
Store credentials in AWS Secrets Manager with automatic rotation enabled and retrieve them at runtime.
c)
Store credentials in an encrypted file in S3 and download them at instance launch.
d)
Store credentials in a DynamoDB table and use a scheduled Lambda function to update them.
10.
A development team uses a single CloudFormation template to deploy a web application and an RDS database across various environments. After a mistaken deployment dropped and recreated the development database causing data loss, which solutions can prevent accidental deletion of the database in the future? (Choose two)
a)
Add a CloudFormation DeletionPolicy attribute with the Retain value to the database resource.
b)
Update the CloudFormation stack policy to prevent updates that could delete the database.
c)
Modify the database to use a Multi‑AZ deployment.
d)
Create a CloudFormation stack set for deploying the web application and database.
e)
Add a CloudFormation DeletionPolicy attribute with the Retain value to the entire stack.
11.
A developer is working on an application that uses CodePipeline triggered by changes to the main branch in CodeCommit, with CodeBuild for testing and CodeDeploy for deployment. After a recent source code change, the updated application was not deployed. Which two possible causes can explain this issue?
a)
The change was not committed to the main branch.
b)
An earlier stage in the pipeline failed, terminating the process.
c)
One of the EC2 instances in the pipeline cluster is inactive.
d)
CodePipeline is misconfigured and does not invoke CodeDeploy.
e)
CodePipeline lacks permissions to access CodeCommit.
12.
A developer needs to perform an upsert operation on a DynamoDB table (update if exists, insert if not) using a Lambda function.
a)
Use dynamodb:DeleteItem, dynamodb:GetItem, and dynamodb:PutItem.
b)
Use dynamodb:UpdateItem, dynamodb:GetItem, and dynamodb:DescribeTable.
c)
Use dynamodb:GetRecords, dynamodb:PutItem, and dynamodb:UpdateTable.
d)
Use dynamodb:UpdateItem, dynamodb:GetItem, and dynamodb:PutItem.
13.
A developer is processing operating data from IoT devices. Each device uploads a file to an S3 bucket once per hour. The developer wants to process each file immediately upon upload using a Lambda function. Which solution meets these requirements?
a)
Add an asynchronous invocation to the Lambda function; select the S3 bucket as the source.
b)
Add an EventBridge event to trigger the Lambda function; select the S3 bucket as the source.
c)
Add a trigger to the Lambda function with the S3 bucket as the source.
d)
Create a Lambda function that polls the S3 bucket.
14.
A developer creates a CloudFormation stack that includes IAM resources with custom names, but the deployment fails with an InsufficientCapabilities error. What change is needed to resolve this issue?
a)
Specify CAPABILITY_AUTO_EXPAND.
b)
Use an administrator role to deploy the stack.
c)
Specify CAPABILITY_IAM.
d)
Specify CAPABILITY_NAMED_IAM.
15.
A company provides public APIs via API Gateway and AWS Lambda for daily‑updated statistical data with unauthenticated read access. With rising demand, the company seeks to improve API responsiveness. Which action will help achieve this?
a)
Enable caching in API Gateway.
b)
Configure API Gateway to use an interface VPC endpoint.
c)
Enable CORS for the APIs.
d)
Configure usage plans and API keys in API Gateway.
16.
A team of developers is using an AWS CodePipeline for CI/CD of a web application. A developer has written unit tests that produce a test report showing individual check results. The developer now wants these tests to run automatically during the CI/CD process with the least operational effort. Which solution will meet this requirement?
a)
Write a Git pre‑commit hook that runs the tests before every commit and resolve issues before pushing to CodeCommit.
b)
Add a new stage after deployment to the test environment using AWS CodeBuild with a buildspec that fails the stage if any test fails and integrates test reports.
c)
Add a new stage before deployment to the test environment using AWS CodeBuild with a buildspec that fails if any test fails and integrates test reports.
d)
Add a new stage using Jenkins to run unit tests and integrate test reports.
17.
A developer is using DynamoDB streams to trigger a Lambda function whenever items in a DynamoDB table are updated. However, the function is not being invoked. What is the most likely cause?
a)
The StreamViewType is misconfigured.
b)
An event source mapping for the Lambda function has not been configured.
c)
The Lambda function’s timeout is set too low.
d)
The DynamoDB table’s capacity is insufficient.
18.
A company migrated an application to EC2 instances. While the UI scales well, the process to deliver shipping requests is problematic: duplicate, lost, and out‑of‑order requests occur. Each request is <250 KB and takes 5–10 minutes to process. The solution must guarantee that each request is processed exactly once and in the order received, without modifying the legacy system.
a)
Use a Kinesis Data Firehose delivery stream and a Kinesis data stream; modify the application to write requests to the stream.
b)
Use separate Lambda functions for each partner and notify each partner’s endpoint directly.
c)
Use a Lambda function triggered by an SNS topic; modify the application to write requests to SNS.
d)
Use a Lambda function triggered by an SQS FIFO queue; modify the application to write requests to the FIFO queue.
19.
A developer's Lambda function needs credentials to connect to an Amazon RDS for MySQL database, and the existing solution (storing credentials in S3) must be improved to include secure storage and automatic rotation with minimal management overhead. Which solution should be used?
a)
Store credentials in AWS Systems Manager Parameter Store as SecureString with automatic rotation enabled, and have the Lambda function retrieve the parameter.
b)
Encrypt credentials with AWS KMS and store them as Lambda environment variables, using a secondary Lambda function with EventBridge for rotation.
c)
Store credentials in AWS Secrets Manager with the RDS credentials secret type, enable automatic rotation, and have the Lambda function retrieve the secret.
d)
Encrypt credentials with AWS KMS and store them in an Amazon DynamoDB table, using a secondary Lambda function with EventBridge for rotation.
20.
A developer is building an application using API Gateway with caching enabled. Customers need the ability to invalidate the cache during testing. Which solution meets this requirement with minimal overhead?
a)
Instruct customers to include the header Cache-Control:max-age=0 in their requests to bypass the cache.
b)
Ask customers to use AWS credentials to call the InvalidateCache API operation.
c)
Programmatically invoke the InvalidateCache operation using the AWS SDK.
d)
Require customers to add an INVALIDATE_CACHE query parameter to their requests.
21.
A company is migrating an on‑premises database to Amazon RDS for MySQL and has heavy read workloads. To optimize read performance with minimal code changes, which solution should be implemented?
a)
Deploy a multi‑AZ RDS instance and increase the number of connections or the connection pool size.
b)
Deploy a multi‑AZ RDS instance and modify the code to direct queries to the secondary instance.
c)
Deploy Amazon RDS with one or more read replicas and update the application to use the read replica endpoints.
d)
Use open source replication software to create a copy of the database on an EC2 instance and modify the application to query that instance.
22.
A developer is planning to migrate on‑premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation using AWS KMS. Which type of key should be used?
a)
Amazon S3 managed keys.
b)
Symmetric customer managed keys with key material generated by AWS.
c)
Asymmetric customer managed keys with key material generated by AWS.
d)
Symmetric customer managed keys with imported key material.
23.
A developer deploys an application using a CloudFormation stack that includes SSM Parameter Store SecureString parameters. After an update, the parameter values are reset, causing issues in the application. Which solution prevents the parameter values from being reset during stack updates?
a)
Modify the CloudFormation template to set a DeletionPolicy of Retain for the SSM parameters.
b)
Migrate the configuration data to a DynamoDB table.
c)
Migrate the configuration data to an RDS database table.
d)
Modify the CloudFormation stack policy to deny updates to the SSM parameters.
24.
A developer is designing a serverless application using AWS SAM that will be deployed to multiple environments. The deployment process must support environment-specific configurations with minimal effort. Which solution meets these requirements?
a)
Add a configuration file in TOML format with separate tables for each environment; deploy using “sam deploy --config-env”.
b)
Create separate SAM templates for each environment and deploy with custom scripts.
c)
Use a single SAM template with default parameters and override values using “--parameter-overrides”.
d)
Use the same SAM template with additional parameters for each environment and deploy without further changes.
25.
A developer is deploying an AWS Lambda function and wants to quickly revert to previous versions with minimal operational effort. Which method achieves this with the least overhead?
a)
Utilize AWS OpsWorks to perform blue/green deployments.
b)
Use Lambda function aliases to manage multiple versions.
c)
Maintain deployment packages for older versions in Amazon S3 for manual rollback.
d)
Use AWS CodePipeline for automated deployments and rollbacks.
26.
A developer has implemented a Python AWS Lambda function that retrieves data from Amazon S3 objects and writes it to a DynamoDB table. Although the function is triggered successfully by an S3 event when an object is created, it fails during the write operation to DynamoDB. What is the most probable cause of this failure?
a)
The Lambda function might have exceeded its concurrency limit.
b)
The DynamoDB table may require a global secondary index (GSI) to support write operations.
c)
The Lambda function likely lacks the necessary IAM permissions to write to DynamoDB.
d)
The DynamoDB table might not be in the same Availability Zone as the Lambda function.
27.
A developer creates a Lambda function that requires read access to an S3 bucket and read/write access to a DynamoDB table. The correct IAM policy already exists. What is the most secure way to grant the Lambda function access?
a)
Attach the IAM policy directly to the Lambda function.
b)
Create an IAM role for the Lambda function, attach the IAM policy to the role, and assign the role to the Lambda function.
c)
Create an IAM user with programmatic access, attach the IAM policy, and store credentials in environment variables.
d)
Store the root user’s access keys as encrypted environment variables in the Lambda function.
28.
A company stores credentials for connecting to an external SaaS vendor in a plaintext configuration file. The developer must secure these credentials and enforce quarterly rotation.
a)
Use AWS KMS to encrypt the configuration file; decrypt it during API calls; enable rotation.
b)
Retrieve temporary credentials from AWS STS every 15 minutes.
c)
Store the credentials in AWS Secrets Manager and enable rotation.
d)
Store the credentials in AWS Systems Manager Parameter Store and enable rotation.
29.
A company is building a compute-intensive application on EC2 that uses attached EBS volumes for data storage. The application process sensitive data which must be encrypted without performance impact.
a)
Configure the EC2 instances to use encrypted EBS volumes.
b)
Configure the application to write data to an encrypted S3 bucket.
c)
Implement a custom encryption algorithm in the application.
d)
Configure an AMI with an encrypted root volume and use ephemeral disks for data storage.
30.
A company wants to automate part of its deployment process by checking for and deleting unused resources from previously deployed CloudFormation stacks managed with AWS CDK across multiple accounts. Which solution meets these requirements with the least configuration?
a)
Write a handler function using AWS SDK calls, attach it to a Lambda function via a CloudFormation template, and invoke it during deployment.
b)
Write a handler function using AWS SDK calls in the CDK; create a custom resource that attaches the function to a Lambda function and invokes it during stack deployment.
c)
Write a script using AWS SDK calls and deploy it on an EC2 instance in each account.
d)
Write a Lambda function in the Lambda console, import it into the CDK stack via a custom resource, and invoke it during deployment.
31.
A developer is building an application that uses API Gateway and Lambda. The application calls a POST API to process orders asynchronously. In rare cases, orders are not processed and Lambda logs show no errors. Which solution should be implemented to address this problem?
a)
Inspect frontend logs and manually invoke the API using requests from the logs.
b)
Create and inspect a Lambda dead‑letter queue (DLQ); troubleshoot and reprocess failed events.
c)
Inspect Lambda logs in CloudWatch for errors.
d)
Ensure that caching is disabled for the POST API in API Gateway.
32.
A developer is migrating an application to Amazon EKS. Container images are stored in Amazon ECR. As part of the migration, a new AWS account is created and configuration changes are made to point to new backend resources. Despite a successful deployment, the application still connects to the old backend.
a)
The new AWS account was not created successfully.
b)
A new tag was added to the Docker image.
c)
The Docker image tag was not updated to a new version.
d)
The changes were pushed to a new Docker image tag.
33.
A developer is designing an AWS CloudFormation template to launch EC2 instances across multiple AWS accounts. The instances must be selected from a predefined list of approved instance types. How can the developer incorporate this list into the CloudFormation template?
a)
Develop individual CloudFormation templates for each approved EC2 instance type.
b)
Define separate resources in the template’s Resources section for each EC2 instance type.
c)
Set up a distinct parameter for every approved EC2 instance type within the template.
d)
Define a single parameter in the template with the approved instance types listed as AllowedValues.
34.
A company has an Amazon Aurora database in a private subnet within VPC1 and needs an AWS Lambda function to securely retrieve relational data. Which solution meets these requirements?
a)
Create the Lambda function with VPC1 access and attach a security group (SG1) to both the Lambda function and the database, configuring inbound and outbound rules for TCP traffic on port 3306.
b)
Launch a Lambda function in a new public subnet in a separate VPC (VPC2) and set up a peering connection with VPC1.
c)
Create the Lambda function with VPC1 access, assign one security group (SG1) to the function and a different security group (SG2) to the database, with an inbound rule on SG1 for TCP port 3306.
d)
Export data from Aurora to S3 and create a Lambda function in VPC1 to query the data from S3.
35.
A developer is creating a DynamoDB table using the AWS CLI. The table must use server‑side encryption with an AWS owned encryption key.
a)
Create a customer managed key and specify its ARN with KMSMasterKeyId.
b)
Create an AWS managed key and specify its ARN with KMSMasterKeyId.
c)
Create an AWS owned key and specify its ARN with KMSMasterKeyId.
d)
Create the DynamoDB table with default encryption options.
36.
A company is migrating its PostgreSQL database to AWS. The company requires that database credentials are stored securely and rotated automatically without additional programming overhead.
a)
Use Aurora PostgreSQL; store credentials in SSM Parameter Store with rotation enabled.
b)
Use Aurora PostgreSQL; store credentials in AWS Secrets Manager with automatic rotation enabled.
c)
Use DynamoDB; store credentials in SSM Parameter Store with rotation enabled.
d)
Use DynamoDB; store credentials in AWS Secrets Manager with rotation enabled.
37.
A developer is preparing to deploy fixes to the production version of an application while developing a new version. The code is stored in CodeCommit. Which solution meets these requirements with minimal interference between the two lines of development?
a)
From the main branch, create one feature branch for production fixes and another for new development.
b)
Create Git tags for the production and new versions and work solely with tags.
c)
Create a branch from production and restrict pushes to it.
d)
Create a new CodeCommit repository for the new version.
38.
A developer creates a Lambda function that processes messages from an SQS standard queue but notices some messages are processed multiple times. Which solution is the most cost-effective to resolve this issue?
a)
Change the SQS standard queue to a FIFO queue using the message deduplication ID.
b)
Set up a dead‑letter queue.
c)
Limit the Lambda function’s concurrency to 1.
d)
Switch message processing to use Amazon Kinesis Data Streams instead of SQS.
39.
A developer is designing an application that uses Amazon OpenSearch Service for audit monitoring. The developer needs to create a CloudFormation custom resource, backed by a Lambda function, to configure the OpenSearch domain. The Lambda function must access the domain using internal master user credentials. What is the most secure way to pass these credentials to the Lambda function?
a)
Use a CloudFormation parameter with NoEcho set to true.
b)
Use a CloudFormation parameter and create a Parameter Store entry; assign a role with ssm:GetParameter permission.
c)
Use a CloudFormation parameter and encrypt the value using KMS.
d)
Create a Secrets Manager secret and use a CloudFormation dynamic reference; assign a role with secretsmanager:GetSecretValue; pass the secret’s name as an environment variable.
40.
A developer manages three AWS accounts, each with an RDS DB instance in a private subnet. The developer needs to ensure that the same database users are created and updated consistently in the 3 accounts with the LEAST overhead
a)
Use a CloudFormation template that declares the users; deploy in each account.
b)
Use a CloudFormation template with a custom resource that creates the users; deploy in each account.
c)
Write a script to create the users and run it on an EC2 instance in each account.
d)
Implement a Lambda function that creates the users and run it with details for all accounts.
41.
An application employs Amazon Cognito user pools and identity pools to manage secure access. A developer needs to integrate user-specific file upload and download functionality with Amazon S3. The solution must ensure that files (ranging from 3 KB to 300 MB) are stored and retrieved securely, and that users can access only their own files.
a)
Utilize S3 Event Notifications to monitor and validate file upload and download actions, then update the user interface accordingly.
b)
Record metadata of the uploaded files in a separate Amazon DynamoDB table and filter the UI’s file list by matching the current user’s ID with the stored user ID.
c)
Deploy Amazon API Gateway along with an AWS Lambda function to handle file transfers, validating every request within the Lambda before proceeding.
d)
Implement an IAM policy scoped to the Amazon Cognito identity pool that limits each user to accessing only their designated folder in Amazon S3.
42.
A company is modernizing its legacy internal applications on AWS, and leadership has decided to reimplement the employee directory using native AWS services. A developer must design a solution to store employee contact details along with high-resolution photos. Which solution best supports searching and retrieving each employee’s details and photos via AWS APIs?
a)
Encode each employee’s contact information and photos using Base64, then store the data in an Amazon DynamoDB table using a sort key.
b)
Maintain employee contact information in a DynamoDB table alongside S3 object keys that reference the high-resolution photos stored in Amazon S3.
c)
Utilize Amazon Cognito user pools to implement a fully managed SaaS-based employee directory.
d)
Store employee contact details in an Amazon RDS database with the corresponding photos kept in Amazon EFS.
43.
A company stores sensitive data in an Amazon S3 bucket, encrypting it with an AWS KMS key. To ensure that all S3 GetObject requests from other AWS accounts use encryption in transit, how can the developer enforce this requirement?
a)
Set a resource‑based policy on the S3 bucket to deny access when "aws:SecureTransport" is false.
b)
Set a resource‑based policy on the S3 bucket to allow access when "aws:SecureTransport" is false.
c)
Set a role‑based policy on the other accounts' roles to deny access when "aws:SecureTransport" is false.
d)
Set a resource‑based policy on the KMS key to deny access when "aws:SecureTransport" is false.
44.
A developer is building an application that stores personal health information (PHI) in an encrypted Amazon RDS for MySQL instance. To improve performance, the developer needs to cache frequently accessed data while supporting sorting or ranking of cached datasets. Which solution meets these requirements?
a)
Use Amazon ElastiCache for Redis with encryption enabled for data in transit and at rest, storing frequently accessed data in the cache.
b)
Use Amazon ElastiCache for Memcached with encryption enabled.
c)
Create a read replica of the RDS instance for caching.
d)
Use DynamoDB Accelerator (DAX) for caching.
45.
A developer needs to perform geographic load testing for an API by deploying resources in multiple AWS Regions without modifying the application code. Which solution meets these requirements?
a)
Deploy a Lambda function in each region that creates a CloudFormation stack from a template when invoked.
b)
Create a CloudFormation template defining the load test resources and use the AWS CLI create‑stack‑set command to deploy the stack set across regions.
c)
Create an AWS Systems Manager document that defines the resources and use it to provision them in the target regions.
d)
Create a CloudFormation template and use the AWS CLI deploy command to create a stack in each region.
46.
A developer is building an application with an API Gateway REST API in the us‑east‑2 Region and wants to use Amazon CloudFront with a custom domain. The SSL/TLS certificate was obtained from a third‑party provider. How should the custom domain be configured?
a)
Import the SSL/TLS certificate into ACM in us‑east‑2 and create a DNS A record for the custom domain.
b)
Import the SSL/TLS certificate into CloudFront and create a DNS CNAME record for the custom domain.
c)
Import the SSL/TLS certificate into ACM in us‑east‑2 and create a DNS CNAME record for the custom domain.
d)
Import the SSL/TLS certificate into ACM in us‑east‑1 and create a DNS CNAME record for the custom domain.
47.
A developer is building an ecommerce application using API Gateway and Lambda. The application has three distinct environments (development, test, production). To minimize resource management, how should the application be deployed?
a)
Create separate API Gateway and Lambda functions for each environment.
b)
Use different AWS Regions for each environment.
c)
Create one API Gateway with multiple stages and one Lambda function with multiple aliases.
d)
Create one API Gateway and one Lambda function and use a REST parameter to indicate the environment.
48.
A social media application uses the AWS SDK for JavaScript on the frontend to obtain user credentials from AWS STS. The application stores assets in an S3 bucket and serves them through a CloudFront distribution. The credentials for the assumed role are stored in plaintext in a JSON file within the application code. Which solution will allow the application to retrieve user credentials without hardcoding them?
a)
Add a LambdaEdge function to the distribution; invoke it on viewer request; grant its role permission to access AWS STS; move all SDK calls into the function.
b)
Add a CloudFront function to the distribution; invoke it on viewer request; grant its role permission to access AWS STS; move all SDK calls into the function.
c)
Add a LambdaEdge function to the distribution; invoke it on viewer request; move credentials from the JSON file into the function; move all SDK calls into the function.
d)
Add a CloudFront function to the distribution; invoke it on viewer request; move credentials from the JSON file into the function; move all SDK calls into the function.
49.
A developer is creating a Lambda function that retrieves data from a third‑party system, formats it into a PDF, and encrypts the file using AWS KMS. The PDF file can exceed 1 MB. Which step must be taken to ensure that the encryption can be reversed later?
a)
Store the encrypted data key from GenerateDataKey along with the encrypted file.
b)
Store the plaintext key from GenerateDataKey on disk.
c)
Use the plaintext key with the KMS Encrypt API to encrypt the file.
d)
Use the encrypted key with the KMS Encrypt API to encrypt the file.
50.
A developer wants to reduce risk when deploying a new version of a Lambda function by splitting traffic between the existing version and the new version.
a)
Configure a weighted routing policy in Route 53 to split traffic between the versions.
b)
Create a Lambda function alias that splits traffic between the two versions.
c)
Create an Application Load Balancer (ALB) that splits traffic between the two versions.
d)
Create a new Lambda function that filters requests and invokes the appropriate version based on content.
51.
A developer is designing a serverless multi‑tier application for a game. The application must allow users to register and log in via a web browser and make requests to Lambda functions behind an API Gateway HTTP API. Which solution meets these requirements with minimal operational overhead?
a)
Create Amazon Cognito user pools to integrate with external social identity providers and configure IAM roles for identity pools.
b)
Program the sign‑in page to create IAM groups and assign roles.
c)
Create an RDS for SQL Server database to store user credentials and manage access.
d)
Configure the sign‑in page to store users in a DynamoDB table with an attached IAM policy.
52.
A developer is building a cloud‑based photo storage application for mobile users that supports tens of thousands of users. The application uses an Amazon API Gateway REST API integrated with AWS Lambda functions to process photos and stores photo metadata in Amazon DynamoDB. Users must sign up, upload photos (300 KB to 5 MB), and retrieve previously uploaded images. Which solution minimizes operational overhead?
a)
Use Amazon Cognito user pools for user account management, set up an API Gateway Cognito authorizer, and have the Lambda function store both photos and metadata in DynamoDB, retrieving photos directly from DynamoDB.
b)
Use Amazon Cognito user pools for user management, configure an API Gateway Cognito authorizer, and have the Lambda function store photos in Amazon S3 while saving the S3 object key in DynamoDB for metadata; retrieve photos by querying DynamoDB for the key.
c)
Create an IAM user for each application user during sign‑up, use IAM authentication with API Gateway, and use the Lambda function to store photos in Amazon S3 while saving the S3 key in DynamoDB; retrieve photos by querying DynamoDB.
d)
Create a DynamoDB table for user accounts, implement a Lambda authorizer to validate credentials against it, integrate it with API Gateway, and have the Lambda function store photos in Amazon S3 while saving the S3 key in DynamoDB; retrieve photos by querying DynamoDB.
53.
A developer supports an application that uses a DynamoDB table. The table stores customer orders, and the application must perform an operation to retrieve multiple items with a minimum impact in database. Which DynamoDB API call is most efficient for this purpose?
a)
BatchGetItem.
b)
GetItem.
c)
Scan.
d)
Query.
54.
A developer is creating an application that stores sensitive data in a DynamoDB table. The table is configured to send change events to a DynamoDB stream, which triggers a Lambda function to process incoming orders. An operational review reveals that some orders have a quantity of 0. The developer needs to create a dashboard showing the number of unique customers affected per day. Which solution meets these requirements?
a)
Grant the Lambda function permission to send logs to CloudWatch Logs; implement a CloudWatch Logs Insights query that counts unique customers for orders with quantity 0, grouped by day; add the query to a CloudWatch dashboard.
b)
Use Amazon Athena to query CloudTrail logs for API calls and build a dashboard.
c)
Configure the Lambda function to send events to EventBridge; create a rule to group unique customers and output to a dashboard.
d)
Enable custom CloudWatch metrics for the DynamoDB stream; create an alarm that groups unique customers; add the alarm to a dashboard.
55.
A developer's AWS Lambda function generates temporary files (less than 10 MB) that are accessed and modified during execution and do not need to be stored permanently. Where should these temporary files be stored?
a)
In the /tmp directory of the Lambda execution environment.
b)
On Amazon Elastic File System (EFS).
c)
On Amazon Elastic Block Store (EBS).
d)
On Amazon S3.
56.
A company uses Amazon Cognito user pools with MFA to secure user records and requires that an email notification be sent for every login. Which solution is the most operationally efficient?
a)
Develop a Lambda function using Amazon SES to send email notifications, invoked via an API Gateway endpoint triggered by the client upon login confirmation.
b)
Develop a Lambda function using Amazon SES and attach it as a Cognito post‑authentication trigger to send email notifications.
c)
Develop a Lambda function using Amazon SES and set up a CloudWatch Logs subscription filter to trigger it based on login events.
d)
Configure Cognito to stream logs to Kinesis Data Firehose and use a Lambda function to process the logs and send email notifications.
57.
A company migrated its application to EC2 instances. Although the UI scales well, the shipping request process is encountering duplicate, lost, and out‑of‑order requests. Each shipping request is <250 KB and takes 5–10 minutes to process. The solution must ensure that each request is processed exactly once and in order, without modifying the legacy system.
a)
Use a Kinesis Data Firehose delivery stream and a Kinesis data stream; modify the application to write to the stream.
b)
Use a Lambda function triggered by an SNS topic to process requests.
c)
Use a Lambda function triggered by an SQS standard queue; modify the application to write to the queue.
d)
Use a Lambda function triggered by an SQS FIFO queue; modify the application to write to the FIFO queue.
58.
A developer is building an application that runs on EC2 and stores data in DynamoDB. After heavy usage, performance degrades and users report increased latency. What solution will meet the requirements to improve performance with minimal changes?
a)
Increase the provisioned capacity of the DynamoDB table.
b)
Implement a caching layer using Amazon ElastiCache for Redis.
c)
Modify the application code to add exponential backoff.
d)
Re-architect the application to use DynamoDB on‑demand capacity mode.
59.
A business operates Amazon EC2 instances across several AWS accounts. A developer is tasked with creating an application that aggregates lifecycle events from these instances. These events must be consolidated into a single Amazon SQS queue in the primary AWS account for further processing.
a)
Set up Amazon EC2 to forward lifecycle events from every account to the primary account’s EventBridge event bus. Then, create an EventBridge rule in that bus to capture all lifecycle events, using the SQS queue as the designated target.
b)
Apply resource policies on the main account’s SQS queue to grant write permissions to each account. In each account’s EventBridge event bus, set up a rule that filters for EC2 lifecycle events and directs them to the SQS queue in the primary account.
c)
Develop an AWS Lambda function that periodically reviews all EC2 instances across accounts to detect lifecycle changes, sending a notification to the SQS queue in the main account whenever a change is found. A scheduled EventBridge rule triggers this function every minute.
d)
Adjust the primary account’s event bus permissions to accept events from other accounts. In every account, establish an EventBridge rule to forward all EC2 lifecycle events to the main account’s event bus. Finally, in the main account, create an EventBridge rule that filters these events and designates the SQS queue as its target.
60.
A developer modifies an application that previously used IAM user access keys in environment variables to access DynamoDB via boto. After replacing them with an IAM role attached to the EC2 instance, the application logs AccessDeniedException errors.
a)
IAM policies might take time to propagate.
b)
The application is still using the old environment variable credentials.
c)
The AWS SDK does not support instance role credentials.
d)
The instance’s security group blocks access to the metadata endpoint.
61.
A developer is building a market application using a DynamoDB table that stores pricing data. Sellers report that after updating an item’s price, the product listing does not reflect the new price. What is the most likely cause?
a)
The cache is not invalidated when the price is updated.
b)
The price is being retrieved using a write‑through cache.
c)
The DynamoDB table’s read capacity is insufficient.
d)
The DynamoDB table’s write capacity is insufficient.
62.
In an AWS CodeDeploy in‑place deployment, what is the correct order of lifecycle hooks?
a)
BeforeInstall -> ApplicationStop -> ApplicationStart -> AfterInstall.
b)
ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart.
c)
BeforeInstall -> ApplicationStop -> ValidateService -> ApplicationStart.
d)
ApplicationStop -> BeforeInstall -> ValidateService -> ApplicationStart.
63.
A developer is creating a machine learning (ML) pipeline in AWS Step Functions that contains Lambda functions. An SQS queue delivers ML model parameters to the pipeline, and trained models are uploaded to an S3 bucket. The developer needs to test the ML pipeline locally without making integration calls to SQS and S3. Which solution meets these requirements?
a)
Use Amazon CodeGuru Profiler to analyze the Lambda functions.
b)
Use the AWS Step Functions Local Docker image to run and test the Lambda functions.
c)
Use the AWS SAM CLI to run and test the Lambda functions locally.
d)
Use AWS Step Functions Local with mocked service integrations.
64.
A developer is creating a Lambda function that processes video files received from an SQS queue. The function requires temporary storage of up to 100 MB during processing. Which solution is most efficient for handling these temporary files?
a)
Store files in an EBS volume and delete them after processing.
b)
Copy files to an EFS file system and delete them afterward.
c)
Use the /tmp directory in the Lambda execution environment and delete files after processing.
d)
Upload files to an S3 bucket with a lifecycle policy for deletion.
65.
A developer maintains an API Gateway REST API secured with Amazon Cognito. With a new API version that includes new endpoints and backward‑incompatible changes, beta access must be provided to team developers without impacting current customers. Which solution achieves this with minimal operational overhead?
a)
Create a development stage in the existing API Gateway and instruct developers to use this stage.
b)
Deploy a separate API Gateway instance that points to the new API version and have developers use its endpoints.
c)
Implement a query parameter in the API code to switch between versions.
d)
Define new API Gateway endpoints for the additional features.
Reset
