Font size
S
M
L
XL
WorksheetsDesarrollador prueba extendida
Total questions: 105
Worksheet time: 4hrs 30mins
Name
Class
Date
1.
A social media application uses the AWS SDK for JavaScript on the frontend to obtain user credentials from AWS STS. The application stores assets in an S3 bucket and serves them through a CloudFront distribution. The credentials for the assumed role are stored in plaintext in a JSON file within the application code. Which solution will allow the application to retrieve user credentials without hardcoding them?
a)
Add a LambdaEdge function to the distribution; invoke it on viewer request; grant its role permission to access AWS STS; move all SDK calls into the function.
b)
Add a CloudFront function to the distribution; invoke it on viewer request; grant its role permission to access AWS STS; move all SDK calls into the function.
c)
Add a LambdaEdge function to the distribution; invoke it on viewer request; move credentials from the JSON file into the function; move all SDK calls into the function.
d)
Add a CloudFront function to the distribution; invoke it on viewer request; move credentials from the JSON file into the function; move all SDK calls into the function.
2.
A developer is creating a Lambda function that retrieves data from a third‑party system, formats it into a PDF, and encrypts the file using AWS KMS. The PDF file can exceed 1 MB. Which step must be taken to ensure that the encryption can be reversed later?
a)
Store the encrypted data key from GenerateDataKey along with the encrypted file.
b)
Store the plaintext key from GenerateDataKey on disk.
c)
Use the plaintext key with the KMS Encrypt API to encrypt the file.
d)
Use the encrypted key with the KMS Encrypt API to encrypt the file.
3.
A developer wants to reduce risk when deploying a new version of a Lambda function by splitting traffic between the existing version and the new version.
a)
Configure a weighted routing policy in Route 53 to split traffic between the versions.
b)
Create a Lambda function alias that splits traffic between the two versions.
c)
Create an Application Load Balancer (ALB) that splits traffic between the two versions.
d)
Create a new Lambda function that filters requests and invokes the appropriate version based on content.
4.
A developer is designing a serverless multi‑tier application for a game. The application must allow users to register and log in via a web browser and make requests to Lambda functions behind an API Gateway HTTP API. Which solution meets these requirements with minimal operational overhead?
a)
Create Amazon Cognito user pools to integrate with external social identity providers and configure IAM roles for identity pools.
b)
Program the sign‑in page to create IAM groups and assign roles.
c)
Create an RDS for SQL Server database to store user credentials and manage access.
d)
Configure the sign‑in page to store users in a DynamoDB table with an attached IAM policy.
5.
A developer is building a cloud‑based photo storage application for mobile users that supports tens of thousands of users. The application uses an Amazon API Gateway REST API integrated with AWS Lambda functions to process photos and stores photo metadata in Amazon DynamoDB. Users must sign up, upload photos (300 KB to 5 MB), and retrieve previously uploaded images. Which solution minimizes operational overhead?
a)
Use Amazon Cognito user pools for user account management, set up an API Gateway Cognito authorizer, and have the Lambda function store both photos and metadata in DynamoDB, retrieving photos directly from DynamoDB.
b)
Use Amazon Cognito user pools for user management, configure an API Gateway Cognito authorizer, and have the Lambda function store photos in Amazon S3 while saving the S3 object key in DynamoDB for metadata; retrieve photos by querying DynamoDB for the key.
c)
Create an IAM user for each application user during sign‑up, use IAM authentication with API Gateway, and use the Lambda function to store photos in Amazon S3 while saving the S3 key in DynamoDB; retrieve photos by querying DynamoDB.
d)
Create a DynamoDB table for user accounts, implement a Lambda authorizer to validate credentials against it, integrate it with API Gateway, and have the Lambda function store photos in Amazon S3 while saving the S3 key in DynamoDB; retrieve photos by querying DynamoDB.
6.
A developer supports an application that uses a DynamoDB table. The table stores customer orders, and the application must perform an operation to retrieve multiple items with a minimum impact in database. Which DynamoDB API call is most efficient for this purpose?
a)
BatchGetItem.
b)
GetItem.
c)
Scan.
d)
Query.
7.
A developer is creating an application that stores sensitive data in a DynamoDB table. The table is configured to send change events to a DynamoDB stream, which triggers a Lambda function to process incoming orders. An operational review reveals that some orders have a quantity of 0. The developer needs to create a dashboard showing the number of unique customers affected per day. Which solution meets these requirements?
a)
Grant the Lambda function permission to send logs to CloudWatch Logs; implement a CloudWatch Logs Insights query that counts unique customers for orders with quantity 0, grouped by day; add the query to a CloudWatch dashboard.
b)
Use Amazon Athena to query CloudTrail logs for API calls and build a dashboard.
c)
Configure the Lambda function to send events to EventBridge; create a rule to group unique customers and output to a dashboard.
d)
Enable custom CloudWatch metrics for the DynamoDB stream; create an alarm that groups unique customers; add the alarm to a dashboard.
8.
A developer's AWS Lambda function generates temporary files (less than 10 MB) that are accessed and modified during execution and do not need to be stored permanently. Where should these temporary files be stored?
a)
In the /tmp directory of the Lambda execution environment.
b)
On Amazon Elastic File System (EFS).
c)
On Amazon Elastic Block Store (EBS).
d)
On Amazon S3.
9.
A company uses Amazon Cognito user pools with MFA to secure user records and requires that an email notification be sent for every login. Which solution is the most operationally efficient?
a)
Develop a Lambda function using Amazon SES to send email notifications, invoked via an API Gateway endpoint triggered by the client upon login confirmation.
b)
Develop a Lambda function using Amazon SES and attach it as a Cognito post‑authentication trigger to send email notifications.
c)
Develop a Lambda function using Amazon SES and set up a CloudWatch Logs subscription filter to trigger it based on login events.
d)
Configure Cognito to stream logs to Kinesis Data Firehose and use a Lambda function to process the logs and send email notifications.
10.
A company migrated its application to EC2 instances. Although the UI scales well, the shipping request process is encountering duplicate, lost, and out‑of‑order requests. Each shipping request is <250 KB and takes 5–10 minutes to process. The solution must ensure that each request is processed exactly once and in order, without modifying the legacy system.
a)
Use a Kinesis Data Firehose delivery stream and a Kinesis data stream; modify the application to write to the stream.
b)
Use a Lambda function triggered by an SNS topic to process requests.
c)
Use a Lambda function triggered by an SQS standard queue; modify the application to write to the queue.
d)
Use a Lambda function triggered by an SQS FIFO queue; modify the application to write to the FIFO queue.
11.
A developer is building an application that runs on EC2 and stores data in DynamoDB. After heavy usage, performance degrades and users report increased latency. What solution will meet the requirements to improve performance with minimal changes?
a)
Increase the provisioned capacity of the DynamoDB table.
b)
Implement a caching layer using Amazon ElastiCache for Redis.
c)
Modify the application code to add exponential backoff.
d)
Re-architect the application to use DynamoDB on‑demand capacity mode.
12.
A business operates Amazon EC2 instances across several AWS accounts. A developer is tasked with creating an application that aggregates lifecycle events from these instances. These events must be consolidated into a single Amazon SQS queue in the primary AWS account for further processing.
a)
Set up Amazon EC2 to forward lifecycle events from every account to the primary account’s EventBridge event bus. Then, create an EventBridge rule in that bus to capture all lifecycle events, using the SQS queue as the designated target.
b)
Apply resource policies on the main account’s SQS queue to grant write permissions to each account. In each account’s EventBridge event bus, set up a rule that filters for EC2 lifecycle events and directs them to the SQS queue in the primary account.
c)
Develop an AWS Lambda function that periodically reviews all EC2 instances across accounts to detect lifecycle changes, sending a notification to the SQS queue in the main account whenever a change is found. A scheduled EventBridge rule triggers this function every minute.
d)
Adjust the primary account’s event bus permissions to accept events from other accounts. In every account, establish an EventBridge rule to forward all EC2 lifecycle events to the main account’s event bus. Finally, in the main account, create an EventBridge rule that filters these events and designates the SQS queue as its target.
13.
A developer modifies an application that previously used IAM user access keys in environment variables to access DynamoDB via boto. After replacing them with an IAM role attached to the EC2 instance, the application logs AccessDeniedException errors.
a)
IAM policies might take time to propagate.
b)
The application is still using the old environment variable credentials.
c)
The AWS SDK does not support instance role credentials.
d)
The instance’s security group blocks access to the metadata endpoint.
14.
A developer is building a market application using a DynamoDB table that stores pricing data. Sellers report that after updating an item’s price, the product listing does not reflect the new price. What is the most likely cause?
a)
The cache is not invalidated when the price is updated.
b)
The price is being retrieved using a write‑through cache.
c)
The DynamoDB table’s read capacity is insufficient.
d)
The DynamoDB table’s write capacity is insufficient.
15.
In an AWS CodeDeploy in‑place deployment, what is the correct order of lifecycle hooks?
a)
BeforeInstall -> ApplicationStop -> ApplicationStart -> AfterInstall.
b)
ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart.
c)
BeforeInstall -> ApplicationStop -> ValidateService -> ApplicationStart.
d)
ApplicationStop -> BeforeInstall -> ValidateService -> ApplicationStart.
16.
A developer is creating a machine learning (ML) pipeline in AWS Step Functions that contains Lambda functions. An SQS queue delivers ML model parameters to the pipeline, and trained models are uploaded to an S3 bucket. The developer needs to test the ML pipeline locally without making integration calls to SQS and S3. Which solution meets these requirements?
a)
Use Amazon CodeGuru Profiler to analyze the Lambda functions.
b)
Use the AWS Step Functions Local Docker image to run and test the Lambda functions.
c)
Use the AWS SAM CLI to run and test the Lambda functions locally.
d)
Use AWS Step Functions Local with mocked service integrations.
17.
A developer is creating a Lambda function that processes video files received from an SQS queue. The function requires temporary storage of up to 100 MB during processing. Which solution is most efficient for handling these temporary files?
a)
Store files in an EBS volume and delete them after processing.
b)
Copy files to an EFS file system and delete them afterward.
c)
Use the /tmp directory in the Lambda execution environment and delete files after processing.
d)
Upload files to an S3 bucket with a lifecycle policy for deletion.
18.
A developer maintains an API Gateway REST API secured with Amazon Cognito. With a new API version that includes new endpoints and backward‑incompatible changes, beta access must be provided to team developers without impacting current customers. Which solution achieves this with minimal operational overhead?
a)
Create a development stage in the existing API Gateway and instruct developers to use this stage.
b)
Deploy a separate API Gateway instance that points to the new API version and have developers use its endpoints.
c)
Implement a query parameter in the API code to switch between versions.
d)
Define new API Gateway endpoints for the additional features.
19.
A financial company must retain original customer records containing PII for 10 years, while ensuring that only authorized personnel can access the PII and third parties receive statistical data without it. A developer has stored the immutable record in Amazon S3 and written a Lambda function named removePii to strip PII when needed. How should the solution be configured to meet these requirements with a single copy of the document?
a)
Configure an S3 event notification to trigger the removePii function on each GET request, returning the object without PII.
b)
Configure an S3 event notification to trigger the removePii function on each PUT request, and use PUT requests to access the sanitized object.
c)
Create an S3 Object Lambda access point, associate it with the removePii function, and use this access point to retrieve the object without PII.
d)
Create a standard S3 access point and use the GetObjectLegalHold API with the removePii function to access the object without PII.
20.
A developer has created a Lambda function that queries an Aurora MySQL DB instance. The function fails with “too many connections” errors. Which solution meets these requirements with the least operational effort?
a)
Create a read replica for the DB instance and query the replica.
b)
Migrate the data to Amazon DynamoDB.
c)
Configure Aurora for Multi‑AZ deployment.
d)
Create an RDS Proxy and have the Lambda function query the proxy.
21.
A company uses AWS CloudFormation to deploy an application that uses an Amazon API Gateway REST API with AWS Lambda function integration and Amazon DynamoDB for data persistence. The application has three stages (development, testing, production), each with its own DynamoDB table. When promoting changes to production, unexpected issues occur. A developer needs to route 20% of production traffic to the new API version while routing 80% to the existing production API, minimizing errors per customer.
a)
Incrementally update 20% of the changes and deploy repeatedly.
b)
Update the Amazon Route 53 DNS record with a weighted routing policy (80% to production, 20% to testing stage alias).
c)
Deploy an Application Load Balancer in front of the API, registering production and testing stages as targets with weights 80% and 20%.
d)
Configure canary settings for the production stage API to direct 20% of traffic to the new deployment and deploy the changes.
22.
A developer is designing an application that uses Amazon S3 to store objects. The company must ensure that all data transferred to S3 is encrypted in transit. Which solution meets this requirement?
a)
Require all clients to use HTTPS when accessing S3 by configuring a bucket policy that denies non‑secure requests.
b)
Enable server‑side encryption on S3.
c)
Encrypt data on the client side before uploading to S3.
d)
Use Amazon CloudFront to deliver content over HTTPS.
23.
A developer is building a web API that receives requests through an internet‑facing Application Load Balancer (ALB) with an HTTPS listener. The developer configures an Amazon Cognito user pool for authentication and must ensure every request is authenticated via Cognito.
a)
Add a listener rule to return a fixed 401 Unauthorized response if the Authorization header is missing.
b)
Create an authentication action for the ALB listener rules with type authenticate-cognito and set OnUnauthenticatedRequest to “deny.”
c)
Create an API Gateway API with a Cognito authorizer and forward requests to the ALB.
d)
Create a new target group with a Lambda function to validate the Authorization header.
24.
A developer writing an AWS Lambda function needs to log key events with a unique identifier for each invocation. Which solution best meets this requirement?
a)
Retrieve the request identifier from the AWS request ID in the context object and log to standard output.
b)
Retrieve the request identifier from the event object and log to a file.
c)
Retrieve the request identifier from the event object and log to standard output.
d)
Retrieve the request identifier from the context object and log to a file.
25.
A developer needs to insert a record into an Amazon DynamoDB table immediately after a new file is added to an Amazon S3 bucket. Which set of steps should be taken to achieve this?
a)
Set up an EventBridge event to monitor the S3 bucket and insert records into DynamoDB.
b)
Configure an S3 event to trigger a Lambda function that inserts records into DynamoDB.
c)
Create a Lambda function that polls the S3 bucket and then inserts records into DynamoDB.
d)
Establish a scheduled cron job to insert records into DynamoDB.
26.
A developer is building an application using AWS CloudFormation and AWS CodeCommit to manage infrastructure as code. The developer must write unit tests for the generated CDK templates and validate that critical security configurations are enabled. Which two actions will meet these requirements with minimal development overhead?
a)
Use a unit testing framework to write custom tests against the generated cdk.out file and run them in a CI/CD pipeline.
b)
Use the CDK assertions module to write unit tests for the constructs and run them in a CI/CD pipeline.
c)
Use the CDK runtime context to set key-value pairs and fail synthesis if violations occur.
d)
Write a script that searches the code for specific configuration strings and reports violations.
e)
Use the CDK Aspects class to create custom rules to validate security configurations and fail synthesis if violations occur.
27.
A developer is building an ecommerce application that stores product reviews in a DynamoDB table. Each record includes a Review ID, Product ID, User ID, Product Rating (1–5), and an optional comment. The table’s partition key is Review ID, but the most frequent query is to retrieve the top 10 reviews with the highest rating for a given product.
a)
A global secondary index (GSI) with Product ID as the partition key and Product Rating as the sort key.
b)
A GSI with Product ID as the partition key and Review ID as the sort key.
c)
A local secondary index (LSI) with Product ID as the partition key and Product Rating as the sort key.
d)
A local secondary index (LSI) with Review ID as the partition key and Product ID as the sort key.
28.
A development team building a CI/CD pipeline with AWS CodePipeline needs a service to store the program source code. Which AWS service should be used for this purpose?
a)
AWS CodeDeploy.
b)
AWS CodeArtifact.
c)
AWS CodeCommit.
d)
Amazon CodeGuru.
29.
A developer wants to create a Lambda function that is invoked every 10 minutes in a fully serverless and automated manner. Which solution meets these requirements?
a)
Deploy an EC2 instance with a cron job.
b)
Configure an environment variable named PERIOD with value 600.
c)
Create an EventBridge rule with a rate expression to invoke the Lambda function every 10 minutes.
d)
Create an SNS topic with a 600‑second timer subscription to the Lambda function.
30.
A company’s ecommerce website uses a Lambda function and an RDS for MySQL database for order fulfillment, which must return order confirmations immediately. During a high-traffic marketing campaign, “too many connections” errors occur despite healthy DB metrics. What should a developer do to resolve these errors?
a)
Initialize the DB connection outside the handler; increase the max_user_connections setting and restart the DB cluster.
b)
Initialize the DB connection outside the handler and use RDS Proxy instead of connecting directly to the DB cluster.
c)
Use SQS FIFO queues to queue orders; adjust Lambda concurrency to the number of available connections.
d)
Use SQS FIFO queues and limit Lambda concurrency to a value lower than available DB connections.
31.
A developer has built a data collection application where users upload files and await a validation status on a dashboard. Since validating large files takes time, the developer must refactor the app so that the validation result is pushed immediately to the user’s dashboard without reloading the page.
a)
Integrate the client with an API Gateway WebSocket API; store the file with the connection ID and push the status when processing is complete.
b)
Set up a WebSocket server on an EC2 micro instance to push updates.
c)
Email the user when validation is complete.
d)
Use DynamoDB Streams with SNS to trigger dashboard updates.
32.
A developer manages three AWS accounts. Each account contains an RDS DB instance in a private subnet. The developer needs to ensure that the same users are created and updated consistently across all accounts.
a)
Create a CloudFormation template that declares the users; deploy it in each account.
b)
Create a CloudFormation template with a custom resource to create the users; deploy it in each account.
c)
Write a script to create the users and run it on an EC2 instance in each account.
d)
Implement a Lambda function that creates the users in the databases; provide details for all accounts.
33.
A developer is creating a Lambda function that processes video files from an SQS queue. The function times out on longer videos despite having the maximum allowed timeout configured. Which solution will address this issue with minimal operational changes?
a)
Increase the memory allocation of the Lambda function.
b)
Increase the SQS queue’s visibility timeout.
c)
Decrease the batch size of messages from SQS.
d)
Use multi‑threading in the Lambda function to process videos concurrently.
34.
An application running in an EC2 Auto Scaling group experiences long instance startup times due to a slow‑running UserData script. The solution must ensure that instances become available quickly, always run the latest validated application version with all security patches, and minimize the number of images created. Which two steps should be taken?
a)
Use EC2 Image Builder to create an AMI with all required patches and agents, and update the Auto Scaling launch configuration to use this AMI.
b)
Use EC2 Image Builder to create an AMI with the latest application version and patches, and update the Auto Scaling launch configuration to use this AMI.
c)
Set up AWS CodeDeploy to deploy the latest application version at runtime.
d)
Set up AWS CodePipeline to deploy the latest application version at runtime.
e)
Remove OS patching commands from the UserData script.
35.
A developer is optimizing a Lambda function and wants to test changes in production on a small percentage of traffic without changing the API Gateway URL. Which solution meets these requirements?
a)
Create a new function version, update API Gateway to reference it, and configure a canary release to direct 10% of traffic to the new version.
b)
Create a new function version, update API Gateway, and deploy a new stage.
c)
Create an alias on the $LATEST version, update API Gateway to reference the alias, and configure a canary release to direct 10% of traffic to the new version.
d)
Create a new function version and deploy it fully to production.
36.
A developer is creating a static website that uses Amazon CloudFront to deliver content from a private S3 bucket. Users can access pages like /products/index.html but receive errors when accessing directories (e.g., /products/) without specifying a file name. Which solution meets these requirements without exposing the S3 bucket publicly?
a)
Update the CloudFront distribution’s default root object to index.html.
b)
Enable S3 static website hosting and change the CloudFront origin to the S3 website endpoint.
c)
Create a CloudFront function that appends "index.html" to requests for directories.
d)
Configure a custom error response in CloudFront to redirect 404 errors to /index.html.
37.
A company hosts a client‑side web application on Amazon S3 delivered via CloudFront. To support additional subsidiaries, common JavaScript files and web fonts were moved to a central S3 bucket, but browsers block these resources. What should the developer do to prevent this issue?
a)
Create four S3 access points for the central bucket, assigning one per web application.
b)
Create and attach a bucket policy to the central S3 bucket to allow access.
c)
Configure a CORS policy on the central S3 bucket to permit cross‑origin access for the web applications.
d)
Implement a Content‑MD5 header for each request to the central S3 bucket to ensure message integrity.
38.
A company is migrating a multi‑node Windows legacy application to Amazon EC2. The application uses a network shared folder to store XML configuration files. To ensure high availability for the configuration repository cost‑effectively, which solution should be implemented?
a)
Attach an EBS volume to an EC2 instance, set up a file system, share a folder via the OS, and modify the application to use the shared folder.
b)
Deploy a micro EC2 instance with an instance store volume, share a folder via the OS, and update the application accordingly.
c)
Use an Amazon S3 bucket to host the repository, migrate the XML files, and update the application to access the files using the AWS SDK.
d)
Use an Amazon S3 bucket, migrate the XML files, and mount the S3 bucket as a local volume on the EC2 instances.
39.
A developer is creating a mobile application that does not require user login. Which method provides the most efficient and secure way to grant users access to AWS resources without managing credentials manually?
A- Use an external identity provider to authenticate users.
B- Create a Lambda function to generate IAM users on demand.
C- Generate static credentials using AWS KMS and distribute them.
D- Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access.
a)
Use an external identity provider to authenticate users.
b)
Create a Lambda function to generate IAM users on demand.
c)
Generate static credentials using AWS KMS and distribute them.
d)
Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access.
40.
A developer is troubleshooting an application on EC2 that writes logs to CloudWatch Logs. The company needs to receive SNS notifications when the number of error messages exceeds a defined threshold in a 5‑minute period. Which solution meets these requirements?
A- Rewrite the application to stream logs directly to SNS.
B- Configure a subscription filter on the CloudWatch Logs group to trigger SNS notifications.
C- Install Amazon Inspector on the EC2 instances and configure it to send SNS notifications.
D- Create a CloudWatch metric filter to detect error patterns; set up a CloudWatch alarm on the metric; configure the alarm to send an SNS notification.
a)
Rewrite the application to stream logs directly to SNS.
b)
Configure a subscription filter on the CloudWatch Logs group to trigger SNS notifications.
c)
Install Amazon Inspector on the EC2 instances and configure it to send SNS notifications.
d)
Create a CloudWatch metric filter to detect error patterns; set up a CloudWatch alarm on the metric; configure the alarm to send an SNS notification.
41.
A developer registers a Lambda function as a target for an Application Load Balancer (ALB) using the CLI, but the function is not invoked when requests are sent through the ALB.
A- Lambda functions cannot be registered as ALB targets.
B- Lambda functions can only be registered via the AWS Console.
C- The permissions to invoke the Lambda function are missing.
D- Cross‑zone load balancing is not enabled on the ALB.
a)
Lambda functions cannot be registered as ALB targets.
b)
Lambda functions can only be registered via the AWS Console.
c)
The permissions to invoke the Lambda function are missing.
d)
Cross‑zone load balancing is not enabled on the ALB.
42.
A company wants to deploy static websites on AWS with phased releases (development, staging, UAT, production) triggered by code merges from various version control systems (CodeCommit, Bitbucket, GitHub), ensuring HTTPS sin servidores en ejecución continua. Which solution meets these requirements with minimal operational overhead?
A- Use AWS Amplify with a serverless backend, connecting repository branches to the respective environments, and trigger deployments via code merges.
B- Deploy each website using AWS Elastic Beanstalk with multiple environments linked via the EB CLI and automate deployments using CodePipeline.
C- Host each website in separate Amazon S3 buckets for each environment, with deployments managed by CodePipeline and CodeBuild.
D- Deploy each website on individual Amazon EC2 instances using custom deployment scripts triggered by code merges.
a)
Use AWS Amplify with a serverless backend, connecting repository branches to the respective environments, and trigger deployments via code merges.
b)
Deploy each website using AWS Elastic Beanstalk with multiple environments linked via the EB CLI and automate deployments using CodePipeline.
c)
Host each website in separate Amazon S3 buckets for each environment, with deployments managed by CodePipeline and CodeBuild.
d)
Deploy each website on individual Amazon EC2 instances using custom deployment scripts triggered by code merges.
43.
A company is building a web application that generates reports on demand. Reports are available within one hour, remain accessible for 8 hours, and are deleted after 2 days. Which solution meets these requirements with minimal operational overhead?
A- Generate reports and store them as items in DynamoDB with TTL; generate a URL for retrieval.
B- Generate reports and store them in an S3 bucket with server‑side encryption; generate presigned URLs; add S3 Lifecycle rules to delete reports older than 2 days.
C- Generate reports and store them in an RDS database; generate a URL for retrieval; schedule a Lambda function to delete old records.
D- Generate reports and store them in an RDS database; attach reports to SNS messages and notify customers.
a)
Generate reports and store them as items in DynamoDB with TTL; generate a URL for retrieval.
b)
Generate reports and store them in an S3 bucket with server‑side encryption; generate presigned URLs; add S3 Lifecycle rules to delete reports older than 2 days.
c)
Generate reports and store them in an RDS database; generate a URL for retrieval; schedule a Lambda function to delete old records.
d)
Generate reports and store them in an RDS database; attach reports to SNS messages and notify customers.
44.
A developer is creating an application that processes transaction data asynchronously with a Lambda function. The application sometimes fails, and the developer wants a second Lambda function to be invoked automatically to handle errors and log details when a failure occurs.
A- Configure a Lambda function destination for failures; specify the error-handling Lambda function’s ARN.
B- Enable AWS X‑Ray tracing and have the function send stack traces to a second Lambda function.
C- Configure a Lambda function trigger with a failure condition; specify the error-handling function’s ARN.
D- Create a CloudWatch alarm that triggers the error-handling Lambda function when failures occur.
a)
Configure a Lambda function destination for failures; specify the error-handling Lambda function’s ARN.
b)
Enable AWS X‑Ray tracing and have the function send stack traces to a second Lambda function.
c)
Configure a Lambda function trigger with a failure condition; specify the error-handling function’s ARN.
d)
Create a CloudWatch alarm that triggers the error-handling Lambda function when failures occur.
45.
A company receives food orders from various partners through a microservices architecture using API Gateway and AWS Lambda. Each partner calls a customized API that triggers a shared Lambda function to process orders. Partners must be notified only for their own orders, and the solution should allow easy addition of new partners with minimal code changes. Which approach is the most scalable?
A- Create separate SNS topics for each partner and have the Lambda function publish order updates to the respective SNS topic.
B- Develop distinct Lambda functions for each partner to send notifications directly to their service endpoints.
C- Create a single SNS topic, have the Lambda function publish messages with partner‑specific attributes, and subscribe each partner with an SNS filter policy to receive only their messages.
D- Use a single SNS topic and subscribe all partners to it without filtering.
a)
Create separate SNS topics for each partner and have the Lambda function publish order updates to the respective SNS topic.
b)
Develop distinct Lambda functions for each partner to send notifications directly to their service endpoints.
c)
Create a single SNS topic, have the Lambda function publish messages with partner‑specific attributes, and subscribe each partner with an SNS filter policy to receive only their messages.
d)
Use a single SNS topic and subscribe all partners to it without filtering.
46.
A developer is processing clickstream data using Amazon Kinesis Data Streams. The data experiences periodic spikes, and PutRecords API calls sometimes fail with capacity errors. Which techniques will help mitigate these exceptions? (Choose two.)
A- Implement retries with exponential backoff.
B- Use a PutRecord API instead of PutRecords.
C- Reduce the frequency and/or size of the requests.
D- Use Amazon SNS instead of Kinesis.
E- Reduce the number of KCL consumers.
a)
Implement retries with exponential backoff.
b)
Use a PutRecord API instead of PutRecords.
c)
Reduce the frequency and/or size of the requests.
d)
Use Amazon SNS instead of Kinesis.
e)
Reduce the number of KCL consumers.
47.
A company is migrating its legacy database to Amazon Aurora PostgreSQL. The company requires that database credentials be stored securely and rotated automatically without extra programming overhead. Which solution meets these requirements?
A- Use IAM database authentication for token-based access.
B- Store the credentials in AWS Secrets Manager and enable automatic rotation.
C- Store the credentials in AWS Systems Manager Parameter Store and manually rotate them.
D- Use an on‑premises HSM to generate and manage credentials.
a)
Use IAM database authentication for token-based access.
b)
Store the credentials in AWS Secrets Manager and enable automatic rotation.
c)
Store the credentials in AWS Systems Manager Parameter Store and manually rotate them.
d)
Use an on‑premises HSM to generate and manage credentials.
48.
A developer is designing a Lambda function that creates temporary files (<10 MB) during invocation. The files are modified multiple times during execution and do not need to be stored afterward. Where should the temporary files be stored?
A- The /tmp directory.
B- Amazon EFS.
C- Amazon EBS.
D- Amazon S3.
a)
The /tmp directory.
b)
Amazon EFS.
c)
Amazon EBS.
d)
Amazon S3.
49.
An application processing clickstream data using Amazon Kinesis experiences occasional PutRecords API failures during traffic spikes. Which two techniques can help mitigate these exceptions?
A- Implement retries with exponential backoff.
B- Use the PutRecord API instead of PutRecords.
C- Reduce the frequency and/or size of the requests.
D- Use Amazon SNS instead of Kinesis.
E- Reduce the number of KCL consumers.
a)
Implement retries with exponential backoff.
b)
Use the PutRecord API instead of PutRecords.
c)
Reduce the frequency and/or size of the requests.
d)
Use Amazon SNS instead of Kinesis.
e)
Reduce the number of KCL consumers.
50.
A developer is writing a CloudFormation template in YAML to deploy a serverless application that uses API Gateway, DynamoDB, and Lambda. Which AWS service or tool should be used to define the serverless resources?
A- Use CloudFormation serverless intrinsic functions.
B- Use AWS Elastic Beanstalk.
C- Use AWS Serverless Application Model (AWS SAM).
D- Use AWS Cloud Development Kit (AWS CDK).
a)
Use CloudFormation serverless intrinsic functions.
b)
Use AWS Elastic Beanstalk.
c)
Use AWS Serverless Application Model (AWS SAM).
d)
Use AWS Cloud Development Kit (AWS CDK).
51.
An application storing personal health information (PHI) in an encrypted Amazon RDS for MySQL instance needs improved performance by caching frequently accessed data, with capabilities to sort or rank the cached datasets. Which solution meets these requirements?
A- Deploy an Amazon ElastiCache for Redis instance with encryption enabled in transit and at rest to store frequently accessed data.
B- Deploy an Amazon ElastiCache for Memcached instance with encryption enabled in transit and at rest to cache data.
C- Set up an Amazon RDS MySQL read replica with SSL and use it for caching frequently accessed data.
D- Use an Amazon DynamoDB table with a DynamoDB Accelerator (DAX) cluster to cache frequently accessed data.
a)
Deploy an Amazon ElastiCache for Redis instance with encryption enabled in transit and at rest to store frequently accessed data.
b)
Deploy an Amazon ElastiCache for Memcached instance with encryption enabled in transit and at rest to cache data.
c)
Set up an Amazon RDS MySQL read replica with SSL and use it for caching frequently accessed data.
d)
Use an Amazon DynamoDB table with a DynamoDB Accelerator (DAX) cluster to cache frequently accessed data.
52.
A developer is creating an application that processes changes in a DynamoDB table using a Lambda function. How should the developer configure the Lambda function to detect these changes?
A- Create a Kinesis data stream, attach it to the table, and create a trigger.
B- Create an EventBridge rule to invoke the Lambda function on a schedule.
C- Enable DynamoDB Streams on the table and create a trigger to connect the stream to the Lambda function.
D- Create a Kinesis Data Firehose delivery stream, attach it to the table, and set the Lambda function as the destination.
a)
Create a Kinesis data stream, attach it to the table, and create a trigger.
b)
Create an EventBridge rule to invoke the Lambda function on a schedule.
c)
Enable DynamoDB Streams on the table and create a trigger to connect the stream to the Lambda function.
d)
Create a Kinesis Data Firehose delivery stream, attach it to the table, and set the Lambda function as the destination.
53.
A developer is planning to migrate on‑premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS KMS to encrypt the data. Which type of key should the developer use?
A-Amazon S3 managed keys.
B-Symmetric customer managed keys with key material that is generated by AWS.
C-Asymmetric customer managed keys with key material that is generated by AWS.
D-Symmetric customer managed keys with imported key material.
a)
Amazon S3 managed keys.
b)
Symmetric customer managed keys with key material that is generated by AWS.
c)
Asymmetric customer managed keys with key material that is generated by AWS.
d)
Symmetric customer managed keys with imported key material.
54.
A developer is creating a new REST API using API Gateway and Lambda. The API has been tested in a staging environment, and the developer wants to make it available for local testing using API Gateway.
A- sam local invoke.
B- sam local generate-event.
C- sam local start-lambda.
D- sam local start-api.
a)
sam local invoke.
b)
sam local generate-event.
c)
sam local start-lambda.
d)
sam local start-api.
55.
A developer is creating a social media application that stores reviews in a DynamoDB table. Each review includes a Review ID, Product ID, User ID, a Product Rating (1–5), and an optional comment. The table’s partition key is Review ID, but the most common query retrieves the top 10 reviews with the highest rating for a given product. Which index will provide the fastest response?
A- Create a global secondary index (GSI) with Product ID as the partition key and Product Rating as the sort key.
B- Create a GSI with Product ID as the partition key and Review ID as the sort key.
C- Create a local secondary index (LSI) with Product ID as the partition key and Product Rating as the sort key.
D- Create an LSI with Review ID as the partition key and Product ID as the sort key.
a)
Create a global secondary index (GSI) with Product ID as the partition key and Product Rating as the sort key.
b)
Create a GSI with Product ID as the partition key and Review ID as the sort key.
c)
Create a local secondary index (LSI) with Product ID as the partition key and Product Rating as the sort key.
d)
Create an LSI with Review ID as the partition key and Product ID as the sort key.
56.
A company’s application runs on EC2 and stores objects in an S3 bucket. After enabling S3 Block Public Access, users cannot download objects. The developer must implement a solution so that only signed‑in users can access S3 objects securely.
A- Create an EC2 instance profile with an appropriate IAM role and associate it with the instances.
B- Create an IAM user with the necessary policy and store the access keys on the instance.
C- Modify the application to use S3 GeneratePresignedUrl API calls.
D- Modify the application to use S3 GetObject and return the object handle.
a)
Create an EC2 instance profile with an appropriate IAM role and associate it with the instances.
b)
Create an IAM user with the necessary policy and store the access keys on the instance.
c)
Modify the application to use S3 GeneratePresignedUrl API calls.
d)
Modify the application to use S3 GetObject and return the object handle.
57.
A developer is creating an application that stores files in an S3 bucket and must provide secure access to mobile users without requiring them to log in. Which solution meets these requirements?
A- Create an IAM user for each mobile user and store credentials locally.
B- Create a bucket policy that allows public read access.
C- Store files encrypted and require a password prompt for access.
D- Use Amazon Cognito to assign unauthenticated users an IAM role with limited permissions.
a)
Create an IAM user for each mobile user and store credentials locally.
b)
Create a bucket policy that allows public read access.
c)
Store files encrypted and require a password prompt for access.
d)
Use Amazon Cognito to assign unauthenticated users an IAM role with limited permissions.
58.
A developer is maintaining a web application deployed via a CloudFormation template that includes web servers and an RDS database. A recent deployment caused the primary development database to be dropped and recreated, resulting in data loss. Which solution(s) will prevent accidental database deletion in future deployments? (Choose two.)
A- Add a CloudFormation DeletionPolicy attribute with Retain to the database resource.
B- Update the CloudFormation stack policy to prevent updates to the database.
C- Modify the database to use Multi‑AZ deployment.
D- Create a CloudFormation stack set for deployments.
E- Add a DeletionPolicy attribute with Retain to the entire stack.
a)
Add a CloudFormation DeletionPolicy attribute with Retain to the database resource.
b)
Update the CloudFormation stack policy to prevent updates to the database.
c)
Modify the database to use Multi‑AZ deployment.
d)
Create a CloudFormation stack set for deployments.
e)
Add a DeletionPolicy attribute with Retain to the entire stack.
59.
A developer is creating an application that reads and writes to multiple S3 buckets from an EC2 instance. To securely make API requests without managing credentials manually and following the principle of least privilege, what should be done?
A- Create an IAM user, generate access keys, and attach a policy granting s3:* on the buckets.
B- Associate the EC2 instance with an IAM role that grants s3:ListBucket and s3:*Object permissions for specific buckets.
C- Associate the EC2 instance with an IAM role using the AmazonS3FullAccess managed policy.
D- Create a bucket policy that allows access for the EC2 instance.
a)
Create an IAM user, generate access keys, and attach a policy granting s3:* on the buckets.
b)
Associate the EC2 instance with an IAM role that grants s3:ListBucket and s3:*Object permissions for specific buckets.
c)
Associate the EC2 instance with an IAM role using the AmazonS3FullAccess managed policy.
d)
Create a bucket policy that allows access for the EC2 instance.
60.
A developer is creating an application that stores customer orders in a DynamoDB table. The company requires that all customer data be encrypted at rest using a key that the company generates. Which solution meets these requirements most securely?
A- Create the DynamoDB table with encryption disabled and implement client‑side encryption.
B- Store the key using AWS KMS by choosing a customer managed key during table creation and providing its ARN.
C- Use default encryption and specify the kms:Encrypt parameter when using the SDK.
D- Use an AWS managed KMS key during table creation and provide its ARN.
a)
Create the DynamoDB table with encryption disabled and implement client‑side encryption.
b)
Store the key using AWS KMS by choosing a customer managed key during table creation and providing its ARN.
c)
Use default encryption and specify the kms:Encrypt parameter when using the SDK.
d)
Use an AWS managed KMS key during table creation and provide its ARN.
61.
A developer is designing an application that retrieves data from a third‑party system and encrypts it before storing on disk using AWS KMS with a symmetric customer managed key. The developer uses GenerateDataKey to obtain a plaintext key and its encrypted copy. Which solution ensures that the file can be decrypted later?
A- Write the encrypted key from GenerateDataKey to disk for later use; use the plaintext key to encrypt the file.
B- Write the plaintext key to disk; use the encrypted key to encrypt the file.
C- Write the encrypted key to disk; then use the plaintext key with the KMS Encrypt API.
D- Write the plaintext key to disk; then use the encrypted key with the KMS Encrypt API.
a)
Write the encrypted key from GenerateDataKey to disk for later use; use the plaintext key to encrypt the file.
b)
Write the plaintext key to disk; use the encrypted key to encrypt the file.
c)
Write the encrypted key to disk; then use the plaintext key with the KMS Encrypt API.
d)
Write the plaintext key to disk; then use the encrypted key with the KMS Encrypt API.
62.
A company is developing a scalable data management system using AWS services to accelerate development and increase agility. The system must ingest large volumes of data from diverse sources and process it through sequential business rules and transformations, with the ability to reprocess data if errors occur. The goal is to achieve scalability with minimal maintenance overhead.
A- Utilize AWS Batch to process tasks in batches.
B- Employ AWS Step Functions to orchestrate and sequence business rules and transformations, with built-in error handling and retry capabilities.
C- Leverage AWS Glue for data ingestion and transformation tasks.
D- Rely on AWS Lambda functions triggered by events to execute processing tasks.
a)
Utilize AWS Batch to process tasks in batches.
b)
Employ AWS Step Functions to orchestrate and sequence business rules and transformations, with built-in error handling and retry capabilities.
c)
Leverage AWS Glue for data ingestion and transformation tasks.
d)
Rely on AWS Lambda functions triggered by events to execute processing tasks.
63.
A developer is deploying a new version of an AWS Lambda function that processes orders. The developer wants to roll out the update gradually so that initially only 10% of production traffic is directed to the new version. Which solution meets this requirement with minimal operational overhead?
A- Update the function code and deploy without traffic splitting.
B- Create a separate Lambda function and use API Gateway to split traffic.
C- Use the AWS Lambda console to update the function’s alias without traffic control.
D- Configure a Lambda alias with weighted routing to direct 10% of traffic to the new version.
a)
Update the function code and deploy without traffic splitting.
b)
Create a separate Lambda function and use API Gateway to split traffic.
c)
Use the AWS Lambda console to update the function’s alias without traffic control.
d)
Configure a Lambda alias with weighted routing to direct 10% of traffic to the new version.
64.
A developer is configuring a Lambda function to be triggered by DynamoDB Streams when items in a DynamoDB table are updated. However, the function is not being invoked. What is the most likely cause?
A- The DynamoDB table’s StreamViewType is set incorrectly.
B- An event source mapping between the DynamoDB stream and the Lambda function has not been configured.
C- The Lambda function's timeout is set too low.
D- The DynamoDB table’s provisioned capacity is insufficient.
a)
The DynamoDB table’s StreamViewType is set incorrectly.
b)
An event source mapping between the DynamoDB stream and the Lambda function has not been configured.
c)
The Lambda function's timeout is set too low.
d)
The DynamoDB table’s provisioned capacity is insufficient.
65.
A developer is building an application using API Gateway and a Lambda backend. The frontend team needs endpoints that return predefined HTTP status codes and JSON responses to facilitate UI development.
A- Set integration type to AWS_PROXY and provision Lambda functions returning hardcoded JSON.
B- Set integration type to MOCK; configure integration requests/responses to return predefined HTTP statuses and JSON responses.
C- Set integration type to HTTP_PROXY and forward requests to an external placeholder API.
D- Set integration type to MOCK and use method request to define HTTP statuses.
a)
Set integration type to AWS_PROXY and provision Lambda functions returning hardcoded JSON.
b)
Set integration type to MOCK; configure integration requests/responses to return predefined HTTP statuses and JSON responses.
c)
Set integration type to HTTP_PROXY and forward requests to an external placeholder API.
d)
Set integration type to MOCK and use method request to define HTTP statuses.
66.
A developer is creating an application that processes messages from an SQS queue and delivers them to a legacy system that requires messages to be processed exactly once and in order. Which solution meets these requirements?
A- Use an SQS FIFO queue with message deduplication enabled.
B- Use an SQS standard queue with a dead‑letter queue for duplicates.
C- Limit the Lambda function’s concurrency to 1.
D- Switch to Amazon Kinesis Data Streams.
a)
Use an SQS FIFO queue with message deduplication enabled.
b)
Use an SQS standard queue with a dead‑letter queue for duplicates.
c)
Limit the Lambda function’s concurrency to 1.
d)
Switch to Amazon Kinesis Data Streams.
67.
A company operates a custom application on on-premises Linux servers accessed via Amazon API Gateway, with AWS X-Ray tracing enabled on the API test stage. What is the simplest method to enable X-Ray tracing on these on-premises servers?
A- Install and run the X-Ray SDK on the servers to capture and send trace data to X-Ray.
B- Deploy and run the X-Ray daemon on the servers to collect and forward trace data to the X-Ray service.
C- Intercept incoming requests on-premises and set up an AWS Lambda function to extract, process, and forward trace segments using the PutTraceSegments API.
D- Intercept incoming requests on-premises and configure an AWS Lambda function to extract, process, and forward telemetry records using the PutTelemetryRecords API.
a)
Install and run the X-Ray SDK on the servers to capture and send trace data to X-Ray.
b)
Deploy and run the X-Ray daemon on the servers to collect and forward trace data to the X-Ray service.
c)
Intercept incoming requests on-premises and set up an AWS Lambda function to extract, process, and forward trace segments using the PutTraceSegments API.
d)
Intercept incoming requests on-premises and configure an AWS Lambda function to extract, process, and forward telemetry records using the PutTelemetryRecords API.
68.
A developer has implemented an IAM policy to grant access to an Amazon S3 bucket (as depicted in an image). What level of access does the policy provide for the s3:GetObject and s3:PutObject actions?
A- Access on all buckets except the "DOC-EXAMPLE-BUCKET" bucket.
B- Access on all buckets that start with "DOC-EXAMPLE-BUCKET" except the "DOC-EXAMPLE-BUCKET/secrets" bucket.
C- Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket along with full S3 actions for objects starting with "secrets" in that bucket.
D- Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket except those that start with "secrets".
a)
Access on all buckets except the "DOC-EXAMPLE-BUCKET" bucket.
b)
Access on all buckets that start with "DOC-EXAMPLE-BUCKET" except the "DOC-EXAMPLE-BUCKET/secrets" bucket.
c)
Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket along with full S3 actions for objects starting with "secrets" in that bucket.
d)
Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket except those that start with "secrets".
69.
A developer is building a serverless application using AWS SAM that must be deployed to multiple environments (development, testing, production) with environment‑specific configurations. Which solution minimizes development effort and avoids duplicating templates?
A- Use a configuration file in TOML format with separate sections for each environment and deploy using “sam deploy --config-env”.
B- Create separate SAM templates for each environment and deploy with custom scripts.
C- Use a single SAM template with default parameters and override them using “--parameter-overrides”.
D- Use one SAM template with additional parameters for each environment without separation.
a)
Use a configuration file in TOML format with separate sections for each environment and deploy using “sam deploy --config-env”.
b)
Create separate SAM templates for each environment and deploy with custom scripts.
c)
Use a single SAM template with default parameters and override them using “--parameter-overrides”.
d)
Use one SAM template with additional parameters for each environment without separation.
70.
A developer is building a serverless photo processing application with two Lambda functions that both use the same Python library for complex computations, resulting in large deployment packages. What should be done to reduce the deployment package size with minimal operational overhead?
A- Package the Python library separately for each Lambda function, including a copy in each deployment package.
B- Create a Lambda layer containing the required Python library and use this layer in both functions.
C- Merge the two Lambda functions into one and deploy as a single package.
D- Store the Python library in an S3 bucket and reference it via object URLs in the Lambda functions.
a)
Package the Python library separately for each Lambda function, including a copy in each deployment package.
b)
Create a Lambda layer containing the required Python library and use this layer in both functions.
c)
Merge the two Lambda functions into one and deploy as a single package.
d)
Store the Python library in an S3 bucket and reference it via object URLs in the Lambda functions.
71.
A company needs to securely manage one‑time fixed license keys in AWS that must be accessed by automation scripts on EC2 instances and in CloudFormation stacks. Which solution is the most cost‑effective?
A- Store encrypted files in Amazon S3 with a "config" prefix.
B- Use AWS Secrets Manager to store secrets tagged with "SecretString".
C- Use AWS Systems Manager Parameter Store SecureString parameters to store the license keys.
D- Use CloudFormation NoEcho parameters to store the keys.
a)
Store encrypted files in Amazon S3 with a "config" prefix.
b)
Use AWS Secrets Manager to store secrets tagged with "SecretString".
c)
Use AWS Systems Manager Parameter Store SecureString parameters to store the license keys.
d)
Use CloudFormation NoEcho parameters to store the keys.
72.
A developer creates a DynamoDB table using the AWS CLI. The table must use server‑side encryption with an AWS-owned key.
A- Create a customer managed key and specify its ARN.
B- Create a KMS AWS managed key and specify its ARN.
C- Create an AWS owned key and specify its ARN.
D- Create the table with default encryption options.
a)
Create a customer managed key and specify its ARN.
b)
Create a KMS AWS managed key and specify its ARN.
c)
Create an AWS owned key and specify its ARN.
d)
Create the table with default encryption options.
73.
A developer is designing a Lambda function that logs key events during its execution. The developer wants to include a unique identifier to associate events with a specific invocation. Given a code snippet that obtains the AWS request ID from the context object, which solution meets this requirement?
A- Obtain the request ID from the context object's AWS request ID field; write logs to standard output.
B- Obtain the request ID from the event object; write logs to a file.
C- Obtain the request ID from the event object; write logs to standard output.
D- Obtain the request ID from the context object; write logs to a file.
a)
Obtain the request ID from the context object's AWS request ID field; write logs to standard output.
b)
Obtain the request ID from the event object; write logs to a file.
c)
Obtain the request ID from the event object; write logs to standard output.
d)
Obtain the request ID from the context object; write logs to a file.
74.
A developer created a Lambda function that is triggered by DynamoDB Streams when items in a DynamoDB table are updated. However, the function is not being invoked. What must be done to enable invocations from the DynamoDB table updates?
A- Change the StreamViewType to NEW_AND_OLD_IMAGES.
B- Configure an event source mapping for the Lambda function.
C- Map an SNS topic to the DynamoDB stream.
D- Increase the Lambda function’s timeout.
a)
Change the StreamViewType to NEW_AND_OLD_IMAGES.
b)
Configure an event source mapping for the Lambda function.
c)
Map an SNS topic to the DynamoDB stream.
d)
Increase the Lambda function’s timeout.
75.
A developer is troubleshooting an API Gateway API that returns HTTP 400 errors. Which solution provides detailed information to diagnose the issue?
A- Use a Kinesis Data Firehose stream to send API logs to CloudWatch Logs.
B- Enable CloudTrail Insights for the API stage.
C- Enable AWS X‑Ray tracing for the API stage.
D- Enable execution and access logging in CloudWatch Logs for the API stage.
a)
Use a Kinesis Data Firehose stream to send API logs to CloudWatch Logs.
b)
Enable CloudTrail Insights for the API stage.
c)
Enable AWS X‑Ray tracing for the API stage.
d)
Enable execution and access logging in CloudWatch Logs for the API stage.
76.
A developer is troubleshooting an application that invokes a Lambda function asynchronously. The function fails after two retries without producing error logs. Which solution will help troubleshoot these failures?
A- Configure CloudTrail logging to capture API calls.
B- Configure a dead‑letter queue (DLQ) for the Lambda function to capture failed events.
C- Use Amazon Simple Workflow Service (SWF) to process unhandled events.
D- Configure AWS Config to track function invocations.
a)
Configure CloudTrail logging to capture API calls.
b)
Configure a dead‑letter queue (DLQ) for the Lambda function to capture failed events.
c)
Use Amazon Simple Workflow Service (SWF) to process unhandled events.
d)
Configure AWS Config to track function invocations.
77.
A developer is building an ML pipeline using AWS Step Functions with Lambda functions. An SQS queue delivers ML model parameters and trained models are uploaded to S3. The developer needs to test the pipeline locally without making real calls to SQS and S3.
A-Use Amazon CodeGuru Profiler to analyze the Lambda functions.
B-Use the AWS Step Functions Local Docker image to test the Lambda functions.
C-Use the AWS SAM CLI to test the Lambda functions locally.
D-Use AWS Step Functions Local with mocked service integrations.
a)
Use Amazon CodeGuru Profiler to analyze the Lambda functions.
b)
Use the AWS Step Functions Local Docker image to test the Lambda functions.
c)
Use the AWS SAM CLI to test the Lambda functions locally.
d)
Use AWS Step Functions Local with mocked service integrations.
78.
A developer is building a serverless application that needs to process changes in a DynamoDB table using an AWS Lambda function. How should the Lambda function be configured to detect changes?
A- Create a Kinesis data stream, attach it to the DynamoDB table, and trigger the Lambda function from the stream.
B- Set up an EventBridge rule to invoke the Lambda on a regular schedule and poll the DynamoDB table.
C- Enable DynamoDB Streams on the table and create a trigger to connect the stream to the Lambda function.
D- Create a Kinesis Data Firehose delivery stream attached to the DynamoDB table and configure it to invoke the Lambda function.
a)
Create a Kinesis data stream, attach it to the DynamoDB table, and trigger the Lambda function from the stream.
b)
Set up an EventBridge rule to invoke the Lambda on a regular schedule and poll the DynamoDB table.
c)
Enable DynamoDB Streams on the table and create a trigger to connect the stream to the Lambda function.
d)
Create a Kinesis Data Firehose delivery stream attached to the DynamoDB table and configure it to invoke the Lambda function.
79.
A developer is using API Gateway with caching enabled, and customers need the ability to invalidate the cache during testing. Which solution meets this requirement with minimal operational overhead?
A- Ask customers to use AWS credentials to call the InvalidateCache API.
B- Configure API Gateway stage variables and instruct customers to include the header Cache-Control:max-age=0 in their requests.
C- Use the AWS SDK to programmatically invoke the InvalidateCache operation.
D- Require customers to add an INVALIDATE_CACHE query parameter to their requests.
a)
Ask customers to use AWS credentials to call the InvalidateCache API.
b)
Configure API Gateway stage variables and instruct customers to include the header Cache-Control:max-age=0 in their requests.
c)
Use the AWS SDK to programmatically invoke the InvalidateCache operation.
d)
Require customers to add an INVALIDATE_CACHE query parameter to their requests.
80.
A developer is launching a new application on Amazon ECS and must manage various configuration variables, including remote API authentication details, the API URL, and credentials. The authentication details and API URL should be available across all current and future deployments in development, testing, and production. Which method allows the developer to retrieve these variables with minimal application changes?
A- Modify the application to fetch variables from AWS Systems Manager Parameter Store using unique paths for each variable per environment, while storing credentials in AWS Secrets Manager for each environment.
B- Adjust the application to obtain variables from AWS KMS by storing the API URL and credentials as distinct keys for each environment.
C- Change the application to load variables from an encrypted file packaged with the application, with separate files for each environment.
D- Configure the application to pull variables from the deployment environment, defining the authentication details and API URL as unique identifiers in the ECS task definition during deployment.
a)
Modify the application to fetch variables from AWS Systems Manager Parameter Store using unique paths for each variable per environment, while storing credentials in AWS Secrets Manager for each environment.
b)
Adjust the application to obtain variables from AWS KMS by storing the API URL and credentials as distinct keys for each environment.
c)
Change the application to load variables from an encrypted file packaged with the application, with separate files for each environment.
d)
Configure the application to pull variables from the deployment environment, defining the authentication details and API URL as unique identifiers in the ECS task definition during deployment.
81.
An application hosted on an EC2 instance needs to list and display files from an S3 bucket, but testing shows that no objects are listed. What is the most secure way to resolve this issue?
A- Update the IAM instance profile attached to the EC2 instance to include S3:* permissions for the S3 bucket.
B- Update the IAM instance profile attached to the EC2 instance to include only the S3:ListBucket permission for the S3 bucket.
C- Update the developer's user permissions to include S3:ListBucket for the S3 bucket.
D- Update the S3 bucket policy to include S3:ListBucket permission with the EC2 instance's account specified as the principal.
a)
Update the IAM instance profile attached to the EC2 instance to include S3:* permissions for the S3 bucket.
b)
Update the IAM instance profile attached to the EC2 instance to include only the S3:ListBucket permission for the S3 bucket.
c)
Update the developer's user permissions to include S3:ListBucket for the S3 bucket.
d)
Update the S3 bucket policy to include S3:ListBucket permission with the EC2 instance's account specified as the principal.
82.
A developer's AWS Lambda function is CPU‑bound and must return results faster. How can its performance be enhanced with minimal changes?
A- Increase the number of CPU cores for the function.
B- Increase the function's memory allocation.
C- Increase the function's reserved concurrency.
D- Increase the function's timeout duration.
a)
Increase the number of CPU cores for the function.
b)
Increase the function's memory allocation.
c)
Increase the function's reserved concurrency.
d)
Increase the function's timeout duration.
83.
A company intends to share data with a third party that provides an HTTP API endpoint, and it possesses the necessary API key. The company needs to manage this API key via code without affecting application performance. Which solution is the most secure?
A- Store the API credentials in AWS Secrets Manager and retrieve them at runtime using the AWS SDK to make the API call.
B- Embed the API credentials directly in a local code variable, commit the code to a secure Git repository, and use the variable at runtime.
C- Save the API credentials as an object in a private Amazon S3 bucket secured by IAM policies, retrieving them at runtime via the AWS SDK.
D- Store the API credentials in an Amazon DynamoDB table with resource-based policies, and retrieve them at runtime using the AWS SDK.
a)
Store the API credentials in AWS Secrets Manager and retrieve them at runtime using the AWS SDK to make the API call.
b)
Embed the API credentials directly in a local code variable, commit the code to a secure Git repository, and use the variable at runtime.
c)
Save the API credentials as an object in a private Amazon S3 bucket secured by IAM policies, retrieving them at runtime via the AWS SDK.
d)
Store the API credentials in an Amazon DynamoDB table with resource-based policies, and retrieve them at runtime using the AWS SDK.
84.
A developer is creating a mobile application that does not require user login. What is the most efficient method to grant users access to AWS resources?
A- Use an identity provider for secure authentication.
B- Create a Lambda function to generate IAM users upon access.
C- Create credentials using AWS KMS and assign them to users.
D- Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access.
a)
Use an identity provider for secure authentication.
b)
Create a Lambda function to generate IAM users upon access.
c)
Create credentials using AWS KMS and assign them to users.
d)
Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access.
85.
A developer creates a Lambda function that writes logs to CloudWatch Logs. The log group is defined in a CloudFormation template. The developer needs to make the log group’s name available to the function at runtime.
A- Use the AWS::Include transform to provide the log group’s name.
B- Pass the log group’s name in the user data section.
C- Use the Mappings section to specify the log group’s name.
D- Pass the log group’s ARN as an environment variable to the Lambda function.
a)
Use the AWS::Include transform to provide the log group’s name.
b)
Pass the log group’s name in the user data section.
c)
Use the Mappings section to specify the log group’s name.
d)
Pass the log group’s ARN as an environment variable to the Lambda function.
86.
A developer is creating an application where users authenticate via federated credentials from a third‑party IdP through Amazon Cognito. The application uses a custom Lambda authorizer that maps a “Department” attribute from the IdP. However, when testing, even after updating the department to Sales, the access token still shows Engineering.
A- Authorization caching is enabled in the custom Lambda authorizer.
B- Authorization caching is enabled on the Cognito user pool.
C- The IAM role for the Lambda authorizer lacks a Department tag.
D- The IAM role for the Cognito user pool lacks a Department tag.
a)
Authorization caching is enabled in the custom Lambda authorizer.
b)
Authorization caching is enabled on the Cognito user pool.
c)
The IAM role for the Lambda authorizer lacks a Department tag.
d)
The IAM role for the Cognito user pool lacks a Department tag.
87.
A company has built a new application on AWS using CloudFormation templates to bootstrap resources with an Auto Scaling group. The bootstrap scripts contain sensitive data. Which solution, integrated with CloudFormation, will manage the sensitive data most securely?
A- Place sensitive data in a CloudFormation parameter and encrypt the templates with a KMS key.
B- Place sensitive data in an S3 bucket and update the template to download the object during bootstrap.
C- Place sensitive data in AWS Systems Manager Parameter Store as a SecureString parameter and use dynamic references in CloudFormation.
D- Place sensitive data in Amazon EFS and retrieve it during bootstrap.
a)
Place sensitive data in a CloudFormation parameter and encrypt the templates with a KMS key.
b)
Place sensitive data in an S3 bucket and update the template to download the object during bootstrap.
c)
Place sensitive data in AWS Systems Manager Parameter Store as a SecureString parameter and use dynamic references in CloudFormation.
d)
Place sensitive data in Amazon EFS and retrieve it during bootstrap.
88.
A developer has created a data collection application using Amazon API Gateway, AWS Lambda, and Amazon S3. Users periodically upload data files and wait for a validation status on a processing dashboard. For large files, validation is complex and time‑consuming, causing users to refresh the dashboard repeatedly. Which solution will immediately update the validation result on the user’s dashboard without reloading the full page, with minimal operational effort?
A-Integrate the client with an API Gateway WebSocket API; store files with the WebSocket connection ID and push validation status to that connection when processing completes.
B-Launch an EC2 micro instance to host a WebSocket server that sends updates after file processing.
C-Save the user’s email with the file and, upon validation completion, send an email notification via Amazon SNS.
D-Store file and user details in DynamoDB; use DynamoDB Streams with SNS to push updates to the browser.
a)
Integrate the client with an API Gateway WebSocket API; store files with the WebSocket connection ID and push validation status to that connection when processing completes.
b)
Launch an EC2 micro instance to host a WebSocket server that sends updates after file processing.
c)
Save the user’s email with the file and, upon validation completion, send an email notification via Amazon SNS.
d)
Store file and user details in DynamoDB; use DynamoDB Streams with SNS to push updates to the browser.
89.
A developer is building an application using Amazon API Gateway. The company wants to restrict usage to only users in the Sales department. Users authenticate via federated credentials from a third‑party IdP through Amazon Cognito, with an attribute mapping that passes the “Department” attribute to a custom Lambda authorizer. However, even after updating the department in the IdP, the access token still shows “Engineering.” Which of the following is a possible reason for this behavior?
A-Authorization caching is enabled in the custom Lambda authorizer.
B-Authorization caching is enabled on the Amazon Cognito user pool.
C-The IAM role for the custom Lambda authorizer does not have a Department tag.
D-The IAM role for the Amazon Cognito user pool does not have a Department tag.
a)
Authorization caching is enabled in the custom Lambda authorizer.
b)
Authorization caching is enabled on the Amazon Cognito user pool.
c)
The IAM role for the custom Lambda authorizer does not have a Department tag.
d)
The IAM role for the Amazon Cognito user pool does not have a Department tag.
90.
A developer is building an application that allows new users to create accounts using federated credentials from a third‑party identity provider via Amazon Cognito. Which service should be used to manage user registration and authentication?
A-IAM roles
B-Amazon Cognito identity pools
C-Amazon Cognito user pools
D-AWS Directory Service
a)
IAM roles
b)
Amazon Cognito identity pools
c)
Amazon Cognito user pools
d)
AWS Directory Service
91.
A developer tests a Lambda function that is invoked asynchronously. When the function fails, it does not process events after two retries. How can the developer troubleshoot these failures?
A- Enable CloudTrail logging and inspect the logs.
B- Configure a dead‑letter queue (DLQ) for the Lambda function to capture failed events.
C- Use Amazon SWF to process unhandled events.
D- Configure AWS Config to monitor function invocations.
a)
Enable CloudTrail logging and inspect the logs.
b)
Configure a dead‑letter queue (DLQ) for the Lambda function to capture failed events.
c)
Use Amazon SWF to process unhandled events.
d)
Configure AWS Config to monitor function invocations.
92.
A company deploys an API Gateway REST API integrated with Lambda and DynamoDB across three stages. Due to issues promoting changes to production, a developer needs to shift 20% of production traffic to a new deployment while keeping 80% on the current production API to minimize customer errors.
A- Incrementally update 20% of the changes and deploy repeatedly.
B- Update the Route 53 DNS record with weighted routing between production and testing stage.
C- Deploy an Application Load Balancer (ALB) in front of the API with 80% traffic to production and 20% to testing.
D- Configure canary settings for the production stage API to route 20% of traffic to the new version.
a)
Incrementally update 20% of the changes and deploy repeatedly.
b)
Update the Route 53 DNS record with weighted routing between production and testing stage.
c)
Deploy an Application Load Balancer (ALB) in front of the API with 80% traffic to production and 20% to testing.
d)
Configure canary settings for the production stage API to route 20% of traffic to the new version.
93.
A developer is using AWS Step Functions to automate a workflow composed of Lambda function tasks. The workflow fails in the GetResource task with either an IllegalArgumentException or a TooManyRequestsException. The developer wants the state machine to stop when an IllegalArgumentException is encountered and to retry GetResource one additional time after a 10‑second delay if a TooManyRequestsException occurs; if the retry fails, the state machine should stop.
A- Add a Delay task after GetResource and add a catcher for TooManyRequestsException to route to the Delay, then back to GetResource.
B- Add a catcher to GetResource for TooManyRequestsException with a 10‑second interval and maxAttempts=1, then route back to GetResource.
C- Add a retrier to GetResource configured for TooManyRequestsException with an interval of 10 seconds and maxAttempts=1.
D- Duplicate the GetResource task as TryAgain and add a catcher to route TooManyRequestsException to TryAgain.
a)
Add a Delay task after GetResource and add a catcher for TooManyRequestsException to route to the Delay, then back to GetResource.
b)
Add a catcher to GetResource for TooManyRequestsException with a 10‑second interval and maxAttempts=1, then route back to GetResource.
c)
Add a retrier to GetResource configured for TooManyRequestsException with an interval of 10 seconds and maxAttempts=1.
d)
Duplicate the GetResource task as TryAgain and add a catcher to route TooManyRequestsException to TryAgain.
94.
A developer is creating a serverless application using AWS CDK and needs to deploy multiple identical copies of the infrastructure with versioning and rollback capabilities. Which approach meets these requirements?
A- Use AWS OpsWorks and cost allocation reports.
B- Use CloudWatch metrics and resource tagging.
C- Use Elastic Beanstalk and CodeCommit.
D- Use AWS CloudFormation with CodeCommit.
a)
Use AWS OpsWorks and cost allocation reports.
b)
Use CloudWatch metrics and resource tagging.
c)
Use Elastic Beanstalk and CodeCommit.
d)
Use AWS CloudFormation with CodeCommit.
95.
A developer is building a REST API using API Gateway with Lambda integration. The frontend team needs endpoints that return predefined HTTP status codes and JSON responses for integration testing without requiring a backend. Which solution meets these requirements?
A- Use AWS_PROXY integration with Lambda functions returning hardcoded responses.
B- Use MOCK integration in API Gateway with configured integration responses for fixed HTTP status codes and JSON.
C- Use HTTP_PROXY integration to forward requests to an external mock service.
D- Use a custom Lambda authorizer to simulate responses.
a)
Use AWS_PROXY integration with Lambda functions returning hardcoded responses.
b)
Use MOCK integration in API Gateway with configured integration responses for fixed HTTP status codes and JSON.
c)
Use HTTP_PROXY integration to forward requests to an external mock service.
d)
Use a custom Lambda authorizer to simulate responses.
96.
A developer is creating a Lambda function that processes files uploaded to S3 and generates metadata stored in DynamoDB. Occasionally, the function fails and no errors are logged. The developer wants to troubleshoot these asynchronous failures.
A- Add a trigger to the Lambda function via the S3 bucket.
B- Configure an EventBridge event to invoke the Lambda function on a schedule.
C- Configure a dead‑letter queue (DLQ) for the Lambda function.
D- Create a custom logging mechanism in the function.
a)
Add a trigger to the Lambda function via the S3 bucket.
b)
Configure an EventBridge event to invoke the Lambda function on a schedule.
c)
Configure a dead‑letter queue (DLQ) for the Lambda function.
d)
Create a custom logging mechanism in the function.
97.
A developer is designing a solution to encrypt data at rest in an Amazon DynamoDB table with minimal management overhead.
A- Use server-side encryption with AWS KMS managed keys.
B- Implement client-side encryption before sending data.
C- Use server-side encryption with customer managed keys.
D- Use server-side encryption with customer provided keys.
a)
Use server-side encryption with AWS KMS managed keys.
b)
Implement client-side encryption before sending data.
c)
Use server-side encryption with customer managed keys.
d)
Use server-side encryption with customer provided keys.
98.
A developer needs to store movie information—including title, release year, genre, and various additional details with inconsistent attributes—and support queries for a movie by title and year, all movies by title, and all movies by genre. Which data store configuration meets these requirements?
A- Use an Amazon DynamoDB table with a composite primary key (title as partition key and release year as sort key) and a global secondary index with genre as partition key and title as sort key.
B- Use an Amazon DynamoDB table with genre as the partition key and release year as the sort key, along with a global secondary index using title as the partition key.
C- Use an Amazon RDS instance with a table containing columns for title, release year, and genre, with title as the primary key.
D- Use an Amazon RDS instance with a table where the primary key is title and all additional data is stored in a JSON column.
a)
Use an Amazon DynamoDB table with a composite primary key (title as partition key and release year as sort key) and a global secondary index with genre as partition key and title as sort key.
b)
Use an Amazon DynamoDB table with genre as the partition key and release year as the sort key, along with a global secondary index using title as the partition key.
c)
Use an Amazon RDS instance with a table containing columns for title, release year, and genre, with title as the primary key.
d)
Use an Amazon RDS instance with a table where the primary key is title and all additional data is stored in a JSON column.
99.
A developer is building a serverless application using AWS SAM. The application uses Lambda functions behind API Gateway and is deployed via SAM CLI. Which step must be completed before deployment?
A- Compress the application into a .zip file and upload it to Lambda.
B- Test the new Lambda function with AWS X‑Ray.
C- Bundle the serverless application using the sam package command.
D- Create the application environment with “eb create.”
a)
Compress the application into a .zip file and upload it to Lambda.
b)
Test the new Lambda function with AWS X‑Ray.
c)
Bundle the serverless application using the sam package command.
d)
Create the application environment with “eb create.”
100.
A developer needs to expand an application to multiple AWS Regions by copying AMIs with the latest changes. All AMIs must be encrypted in every Region, but some current AMIs are unencrypted. How can the developer meet the encryption requirement during expansion?
A- Create new AMIs with specified encryption parameters, copy the encrypted AMIs to the destination Region, and delete the unencrypted versions.
B- Use AWS KMS to enable encryption on the unencrypted AMIs and then copy them to the destination Region.
C- Use AWS Certificate Manager to enable encryption on the unencrypted AMIs and copy them to the destination Region.
D- Copy the unencrypted AMIs to the destination Region and enable encryption by default in that Region.
a)
Create new AMIs with specified encryption parameters, copy the encrypted AMIs to the destination Region, and delete the unencrypted versions.
b)
Use AWS KMS to enable encryption on the unencrypted AMIs and then copy them to the destination Region.
c)
Use AWS Certificate Manager to enable encryption on the unencrypted AMIs and copy them to the destination Region.
d)
Copy the unencrypted AMIs to the destination Region and enable encryption by default in that Region.
101.
A developer is using AWS SAM to deploy a serverless application and wants to accelerate the deployment process by deploying only incremental changes rather than redeploying the entire application for every commit. Which command meets this requirement?
A- sam deploy --force-upload.
B- sam deploy --no-execute-changeset.
C- sam package.
D- sam sync --watch.
a)
sam deploy --force-upload.
b)
sam deploy --no-execute-changeset.
c)
sam package.
d)
sam sync --watch.
102.
A developer builds a web application using API Gateway to expose a Lambda function, but experiences API Gateway timeouts despite the Lambda completing in time. Which two CloudWatch metrics can assist in troubleshooting this issue?
A- CacheHitCount.
B- IntegrationLatency.
C- CacheMissCount.
D- Latency.
E- Count.
a)
CacheHitCount.
b)
IntegrationLatency.
c)
CacheMissCount.
d)
Latency.
e)
Count.
103.
An application stores data in an Amazon S3 bucket via an HTTP API. When objects are added using PutObject, they must be encrypted at rest with SSE‑S3. Which solution meets this requirement?
A- Create a KMS key and assign it to the S3 bucket.
B- Set the x‑amz‑server‑side‑encryption header in the PutObject API request.
C- Include the encryption key in the HTTP header for each request.
D- Use TLS to encrypt traffic to the S3 bucket.
a)
Create a KMS key and assign it to the S3 bucket.
b)
Set the x‑amz‑server‑side‑encryption header in the PutObject API request.
c)
Include the encryption key in the HTTP header for each request.
d)
Use TLS to encrypt traffic to the S3 bucket.
104.
An application running on a burstable nano EC2 instance writes data to a DynamoDB table using provisioned capacity and occasionally fails with ProvisionedThroughputExceededException errors.
A- Move the application to a larger EC2 instance.
B- Increase the provisioned read capacity units of the table.
C- Implement exponential backoff in the application to reduce request frequency.
D- Decrease the retry delay to increase the number of requests.
E- Change the table’s capacity mode to on‑demand.
a)
Move the application to a larger EC2 instance.
b)
Increase the provisioned read capacity units of the table.
c)
Implement exponential backoff in the application to reduce request frequency.
d)
Decrease the retry delay to increase the number of requests.
e)
Change the table’s capacity mode to on‑demand.
105.
A company is building a new application using API Gateway to expose APIs. Different development teams work on separate components in parallel, and the company wants to publish an API without an integrated backend so that teams can continue development until the backend is complete.
A- Create API Gateway resources with integration type MOCK; configure integration requests/responses with fixed HTTP statuses and JSON responses; deploy the API.
B- Create a Lambda function that returns mocked responses and use AWS_PROXY integration.
C- Create an EC2 application that returns mocked responses and integrate it with API Gateway.
D- Create API Gateway resources with integration type HTTP_PROXY and use a Lambda layer to return status codes.
a)
Create API Gateway resources with integration type MOCK; configure integration requests/responses with fixed HTTP statuses and JSON responses; deploy the API.
b)
Create a Lambda function that returns mocked responses and use AWS_PROXY integration.
c)
Create an EC2 application that returns mocked responses and integrate it with API Gateway.
d)
Create API Gateway resources with integration type HTTP_PROXY and use a Lambda layer to return status codes.
Reset
