A company is deploying an application on Amazon EC2 instances. The application must process incoming transactions. When the application detects an invalid transaction, it must send a chat message to the company's support team. To send the message, the application must retrieve an access token to authenticate with the chat API. Developers must implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts. Which solution meets these requirements with the least management overhead?

C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer-managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the chat message.

A. Use an AWS Systems Manager Parameter Store SecureString parameter encrypted with an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Parameter Store. Retrieve the token from Parameter Store using the decrypt flag enabled. Use the decrypted access token to send the chat message.

B. Encrypt the access token using an AWS Key Management Service (AWS KMS) customer-managed key. Store the access token in an Amazon DynamoDB table. Update the EC2 instance's IAM role to have permissions to access DynamoDB and AWS KMS. Retrieve and decrypt the token using AWS KMS on the EC2 instance. Use the decrypted access token to send the chat message.

C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer-managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the chat message.

D. Encrypt the access token using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token using AWS KMS on the EC2 instance. Use the decrypted access token to send the chat message.

A company is building a web application on AWS. When customers submit requests, the application generates reports and then delivers them to customers within a specified time window. Customers must be able to access reports for up to 8 hours. Some reports exceed 1 MB. Each report is unique per customer. The application must delete all reports older than 2 days. Which solution meets these requirements with the lowest operational overhead?

C. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Generate a presigned URL with an expiration time of 8 hours. Provide the URL to customers through the web application. Configure an S3 Lifecycle policy rule to delete old reports.

A. Generate the report and store it as an Amazon DynamoDB item with a specified TTL. Generate a URL to retrieve the report from DynamoDB. Provide the URL to customers through the web application.

B. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Attach the report to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe customers to email notifications from Amazon SNS.

C. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Generate a presigned URL with an expiration time of 8 hours. Provide the URL to customers through the web application. Configure an S3 Lifecycle policy rule to delete old reports.

D. Generate the report and store it in an Amazon RDS database with a timestamp. Generate a URL to retrieve the report from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records with expired timestamps.

A developer must build and deploy a serverless application with an API intended for mobile clients. The API will use Amazon DynamoDB and Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) as data sources. Responses sent to clients will contain aggregated data from both data sources. The developer must minimize the number of API endpoints and reduce the number of API calls required to retrieve necessary data. Which solution should the developer use to meet these requirements?

B. REST API on Amazon API Gateway

C. GraphQL API on Amazon EC2 instances

D. REST API on AWS Elastic Beanstalk

A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item, update certain attributes, or create the item if it does not exist. The Lambda function has access to the primary key. Which IAM permissions should the developer grant to the Lambda function to achieve this functionality?

D. dynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem

A. dynamodb:DeleteItem dynamodb:GetItem dynamodb:PutItem

B. dynamodb:UpdateItem dynamodb:GetItem dynamodb:DescribeTable

C. dynamodb:GetRecords dynamodb:PutItem dynamodb:UpdateTable

D. dynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem

A company has deployed smart meters at all customer locations. Smart meters measure electricity usage every minute and send usage readings to an endpoint for collection. The company needs to create an endpoint to receive smart meter readings and store them in a database. The company wants to store location ID and timestamp information. The company requires low-latency access to both current and historical usage data for customers. The company expects demand to increase significantly. The solution must not impact availability or include downtime during scaling. Which solution meets these requirements most cost-effectively?

B. Store smart meter readings in an Amazon DynamoDB table. Create a composite key using location ID as the partition key and timestamp as the sort key. Use these keys to filter customer data.

A. Store smart meter readings in an Amazon RDS database. Create indexes on the location ID and timestamp columns. Use these columns to filter customer data.

B. Store smart meter readings in an Amazon DynamoDB table. Create a composite key using location ID as the partition key and timestamp as the sort key. Use these keys to filter customer data.

C. Store smart meter readings in Amazon ElastiCache for Redis. Create a SortedSet key using location ID and timestamp. Use these keys to filter customer data.

D. Store smart meter readings in Amazon S3. Partition data by location ID and timestamp. Use Amazon Athena to filter customer data.

A developer is implementing unit tests for a new application to be deployed on AWS. The developer wants unit tests to validate all pull requests and only merge code into the main branch when all tests pass. The developer stores code in AWS CodeCommit and configures AWS CodeBuild to run unit tests. The developer created an AWS Lambda function to trigger CodeBuild jobs. The developer needs to identify the appropriate CodeCommit event in Amazon EventBridge so the Lambda function is invoked when a pull request is created or updated. Which CodeCommit event meets these requirements?

C. {"source": ["aws.codecommit"],"detail":{"event": ["pullRequestSourceBranchUpdated","pullRequestCreated"]}}

A. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestMergeStatusUpdated"]}}

B. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestApprovalRuleCreated"]}}

C. {"source": ["aws.codecommit"],"detail":{"event": ["pullRequestSourceBranchUpdated","pullRequestCreated"]}}

D. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestUpdated","pullRequestSourceBranchCreated"]}}

A company grants different customers read access to objects in an Amazon S3 bucket. The company uses IAM permissions to restrict access to the S3 bucket. Customers can only access their own files. Due to regulatory requirements, the company must enforce encryption in transit for all interactions with Amazon S3. Which solution meets these requirements?

A. Add a bucket policy to the S3 bucket that denies S3 operations when the aws:SecureTransport condition equals false.

B. Add a bucket policy to the S3 bucket that denies S3 operations when the s3:x-amz-acl condition equals public-read.

C. Add an IAM policy to IAM users to enforce use of the AWS SDK.

D. Add an IAM policy to IAM users that allows S3 operations when the s3:x-amz-acl condition equals bucket-owner-read.

A company caches web application session data in an Amazon DynamoDB table. The company wants an automated method to delete old items from the table. What is the simplest solution?

B. Add an expiration timestamp attribute; enable Time-to-Live (TTL) based on that attribute.

A. Write a script to delete old records; schedule the script as a cron job on an Amazon EC2 instance.

B. Add an expiration timestamp attribute; enable Time-to-Live (TTL) based on that attribute.

C. Create a new table daily to store session data; delete the previous day's table.

D. Add an attribute with an expiration timestamp; name the attribute ItemExpiration.

A developer needs to launch a new Amazon EC2 instance using the AWS CLI. Which AWS CLI command should the developer use to meet this requirement?

C. aws ec2 confirm-product-instance

AWS DVA-C02 Chapter 1 Free Practice Test 2025 — Developer Associate Exam Questions

AWS DVA-C02 Chapter 1 Practice Questions (100 Questions)

Practice questions for the AWS DVA-C02 (Developer Associate) exam, Chapter 1.

Q1. A company is deploying an application on Amazon EC2 instances. The application must process incoming transactions. When the application detects an invalid transaction, it must send a chat message to the company's support team. To send the message, the application must retrieve an access token to authenticate with the chat API. Developers must implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts. Which solution meets these requirements with the least management overhead?
- A. Use an AWS Systems Manager Parameter Store SecureString parameter encrypted with an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Parameter Store. Retrieve the token from Parameter Store using the decrypt flag enabled. Use the decrypted access token to send the chat message.
- B. Encrypt the access token using an AWS Key Management Service (AWS KMS) customer-managed key. Store the access token in an Amazon DynamoDB table. Update the EC2 instance's IAM role to have permissions to access DynamoDB and AWS KMS. Retrieve and decrypt the token using AWS KMS on the EC2 instance. Use the decrypted access token to send the chat message.
- C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer-managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the chat message.
- D. Encrypt the access token using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to allow access from other accounts. Update the EC2 instance's IAM role to have permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token using AWS KMS on the EC2 instance. Use the decrypted access token to send the chat message.
View question →
Q2. A company is building a web application on AWS. When customers submit requests, the application generates reports and then delivers them to customers within a specified time window. Customers must be able to access reports for up to 8 hours. Some reports exceed 1 MB. Each report is unique per customer. The application must delete all reports older than 2 days. Which solution meets these requirements with the lowest operational overhead?
- A. Generate the report and store it as an Amazon DynamoDB item with a specified TTL. Generate a URL to retrieve the report from DynamoDB. Provide the URL to customers through the web application.
- B. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Attach the report to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe customers to email notifications from Amazon SNS.
- C. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Generate a presigned URL with an expiration time of 8 hours. Provide the URL to customers through the web application. Configure an S3 Lifecycle policy rule to delete old reports.
- D. Generate the report and store it in an Amazon RDS database with a timestamp. Generate a URL to retrieve the report from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records with expired timestamps.
View question →
Q3. A developer must build and deploy a serverless application with an API intended for mobile clients. The API will use Amazon DynamoDB and Amazon OpenSearch Service (formerly Amazon Elasticsearch Service) as data sources. Responses sent to clients will contain aggregated data from both data sources. The developer must minimize the number of API endpoints and reduce the number of API calls required to retrieve necessary data. Which solution should the developer use to meet these requirements?
- A. GraphQL API on AWS AppSync
- B. REST API on Amazon API Gateway
- C. GraphQL API on Amazon EC2 instances
- D. REST API on AWS Elastic Beanstalk
View question →
Q4. A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item, update certain attributes, or create the item if it does not exist. The Lambda function has access to the primary key. Which IAM permissions should the developer grant to the Lambda function to achieve this functionality?
- A. dynamodb:DeleteItem dynamodb:GetItem dynamodb:PutItem
- B. dynamodb:UpdateItem dynamodb:GetItem dynamodb:DescribeTable
- C. dynamodb:GetRecords dynamodb:PutItem dynamodb:UpdateTable
- D. dynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem
View question →
Q5. A company has deployed smart meters at all customer locations. Smart meters measure electricity usage every minute and send usage readings to an endpoint for collection. The company needs to create an endpoint to receive smart meter readings and store them in a database. The company wants to store location ID and timestamp information. The company requires low-latency access to both current and historical usage data for customers. The company expects demand to increase significantly. The solution must not impact availability or include downtime during scaling. Which solution meets these requirements most cost-effectively?
- A. Store smart meter readings in an Amazon RDS database. Create indexes on the location ID and timestamp columns. Use these columns to filter customer data.
- B. Store smart meter readings in an Amazon DynamoDB table. Create a composite key using location ID as the partition key and timestamp as the sort key. Use these keys to filter customer data.
- C. Store smart meter readings in Amazon ElastiCache for Redis. Create a SortedSet key using location ID and timestamp. Use these keys to filter customer data.
- D. Store smart meter readings in Amazon S3. Partition data by location ID and timestamp. Use Amazon Athena to filter customer data.
View question →
Q6. A developer is implementing unit tests for a new application to be deployed on AWS. The developer wants unit tests to validate all pull requests and only merge code into the main branch when all tests pass. The developer stores code in AWS CodeCommit and configures AWS CodeBuild to run unit tests. The developer created an AWS Lambda function to trigger CodeBuild jobs. The developer needs to identify the appropriate CodeCommit event in Amazon EventBridge so the Lambda function is invoked when a pull request is created or updated. Which CodeCommit event meets these requirements?
- A. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestMergeStatusUpdated"]}}
- B. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestApprovalRuleCreated"]}}
- C. {"source": ["aws.codecommit"],"detail":{"event": ["pullRequestSourceBranchUpdated","pullRequestCreated"]}}
- D. {"source": ["aws.codecommit"],"detail":{"event":["pullRequestUpdated","pullRequestSourceBranchCreated"]}}
View question →
Q7. A company grants different customers read access to objects in an Amazon S3 bucket. The company uses IAM permissions to restrict access to the S3 bucket. Customers can only access their own files. Due to regulatory requirements, the company must enforce encryption in transit for all interactions with Amazon S3. Which solution meets these requirements?
- A. Add a bucket policy to the S3 bucket that denies S3 operations when the aws:SecureTransport condition equals false.
- B. Add a bucket policy to the S3 bucket that denies S3 operations when the s3:x-amz-acl condition equals public-read.
- C. Add an IAM policy to IAM users to enforce use of the AWS SDK.
- D. Add an IAM policy to IAM users that allows S3 operations when the s3:x-amz-acl condition equals bucket-owner-read.
View question →
Q8. A developer is creating a new REST API using Amazon API Gateway and AWS Lambda. Before deploying the API to production, the development team tests the API and validates responses for known use cases. The developer wants to test the REST API locally using API Gateway. Which AWS Serverless Application Model Command Line Interface (AWS SAM CLI) command meets these requirements?
- A. sam local invoke
- B. sam local generate-event
- C. sam local start-lambda
- D. sam local start-api
View question →
Q9. A company caches web application session data in an Amazon DynamoDB table. The company wants an automated method to delete old items from the table. What is the simplest solution?
- A. Write a script to delete old records; schedule the script as a cron job on an Amazon EC2 instance.
- B. Add an expiration timestamp attribute; enable Time-to-Live (TTL) based on that attribute.
- C. Create a new table daily to store session data; delete the previous day's table.
- D. Add an attribute with an expiration timestamp; name the attribute ItemExpiration.
View question →
Q10. A developer needs to launch a new Amazon EC2 instance using the AWS CLI. Which AWS CLI command should the developer use to meet this requirement?
- A. aws ec2 bundle-instance
- B. aws ec2 start-instances
- C. aws ec2 confirm-product-instance
- D. aws ec2 run-instances
View question →
Q11. A developer created a web API exposed via an internet-facing Application Load Balancer (ALB) with an HTTPS listener. The developer configured an Amazon Cognito user pool and requires that every request to the API be authenticated through Amazon Cognito. To meet this requirement, what should the developer do?
- A. Add a rule on the listener to return a fixed 401 Unauthorized response if the Authorization header is missing.
- B. Create an authentication action for the ALB listener rule. Set the rule action type to authenticate-cognito. Set the OnUnauthenticatedRequest field to 'deny'.
- C. Create an Amazon API Gateway API. Configure all API methods to forward to the ALB endpoint. Create a COGNITO_USER_POOLS authorizer. Configure each API method to use that authorizer.
- D. Create a new target group containing an AWS Lambda function target that validates the Authorization header using Amazon Cognito. Associate the target group with the listener.
View question →
Q12. A company has an AWS Lambda function that processes incoming requests from an Amazon API Gateway API. The API invokes the Lambda function using a Lambda alias. A developer updated the Lambda function code to handle more detailed information related to incoming requests. The developer wants to deploy the new Lambda function for testing by other developers without impacting customers using the API. Which solution meets these requirements with the lowest operational overhead?
- A. Create a new version of the Lambda function. Create a new stage in API Gateway and integrate it with the new Lambda version. Use the new API Gateway stage to test the Lambda function.
- B. Update the existing Lambda alias used by API Gateway to a weighted alias. Add the new Lambda version as an additional Lambda function with a weight of 10%. Use the existing API Gateway stage for testing.
- C. Create a new version of the Lambda function. Create and deploy a second Lambda function to filter incoming requests from API Gateway. If the filter Lambda detects a test request, it invokes the new Lambda version; otherwise, it invokes the old version. Update the API Gateway API to use the filter Lambda function.
- D. Create a new version of the Lambda function. Create a new API Gateway API for testing purposes. Update the new API to integrate with the new Lambda version. Use the new API for testing.
View question →
Q13. A company plans to deploy an application on AWS using a load balancer. The application uses HTTP/HTTPS listeners and must preserve client IP addresses. Which load balancing solution meets these requirements?
- A. Use an Application Load Balancer (ALB) with the X-Forwarded-For header.
- B. Use a Network Load Balancer (NLB). Enable proxy protocol support on both the NLB and the target application.
- C. Use an Application Load Balancer (ALB). Register targets by instance ID.
- D. Use a Network Load Balancer (NLB) with the X-Forwarded-For header.
View question →
Q14. A company is building a serverless application on AWS. The application uses an AWS Lambda function to process customer orders 24/7. The Lambda function calls an external payment processing system’s HTTP API. During load testing, developers observed occasional timeouts and errors returned by the external API. The company expects some payment API calls to fail. The company wants the support team to receive near real-time notifications only when the external payment API error rate exceeds 5% of total transactions per hour. Developers must use an existing Amazon Simple Notification Service (Amazon SNS) topic configured to notify the support team. Which solution meets these requirements?
- A. Write payment API call results to Amazon CloudWatch Logs. Use Amazon CloudWatch Logs Insights to query logs. Schedule a Lambda function to check logs and notify the existing SNS topic.
- B. Publish custom metrics to CloudWatch to record failures of external payment API calls. Configure a CloudWatch alarm to notify the existing SNS topic when the error rate exceeds the threshold.
- C. Publish external payment API call results to a new Amazon SNS topic. Subscribe support team members to the new SNS topic.
- D. Write external payment API call results to Amazon S3. Schedule periodic Amazon Athena queries. Configure Athena to send notifications to the existing SNS topic when the error rate exceeds the threshold.
View question →
Q15. A developer has written application code and wants to share it with other developers on the team to gather feedback. The shared application code must be stored long-term, support multiple versions, and track bulk changes. Which AWS service should the developer use?
- A. AWS CodeBuild
- B. Amazon S3
- C. AWS CodeCommit
- D. AWS Cloud9
View question →
Q16. A developer’s code is stored in an Amazon S3 bucket. The code must be deployed as an AWS Lambda function in the same AWS Region but in a different account. Each account will execute an AWS CloudFormation template to deploy the Lambda function. What is the most secure way to allow CloudFormation to access the Lambda code in the S3 bucket?
- A. Grant the CloudFormation service role S3 ListBucket and GetObject permissions. Add a bucket policy in Amazon S3 with principal 'AWS' containing the account number.
- B. Grant the CloudFormation service role S3 GetObject permission. Add a bucket policy in Amazon S3 with principal '*'.
- C. Use a service-linked role, explicitly specifying the S3 bucket’s account number in the resource, granting S3 ListBucket and GetObject permissions to the Lambda function.
- D. Use a service-linked role, granting S3 GetObject permission to the Lambda function. Add a resource of '*' to allow access to the S3 bucket.
View question →
Q17. An application vendor needs to use the client's IP address in its processing logic. The application has been migrated to AWS and is placed behind an Application Load Balancer (ALB). However, all client IP addresses now appear identical. The application must retain its ability to scale horizontally. Given this scenario, what is the most cost-effective solution?
- A. Remove the application from the ALB. Remove the ALB and change Amazon Route 53 to route traffic directly to the instances running the application.
- B. Remove the application from the ALB. Create a Classic Load Balancer in its place. Route traffic to the application using the HTTP protocol.
- C. Modify the application code to inspect the X-Forwarded-For header. Ensure the code handles cases where an IP address list is passed in the header.
- D. Modify the application code to inspect a custom header. Modify the client code to pass the IP address in a custom header.
View question →
Q18. A developer is designing a serverless application for a game in which users register and log in via a web browser. The application invokes AWS Lambda functions behind an Amazon API Gateway HTTP API on behalf of users. The developer needs to implement a solution that enables user registration and login on the application’s login page. The solution must minimize operational overhead and reduce ongoing management of user identities. Which solution meets these requirements?
- A. Create an Amazon Cognito user pool for external social identity providers. Configure IAM roles for the identity pool.
- B. Write the login page to create IAM groups for users and attach IAM roles to those groups.
- C. Create an Amazon RDS for SQL Server DB instance to store users and manage permissions for AWS backend resources.
- D. Configure the login page to register and store users and their passwords in an Amazon DynamoDB table with an attached IAM policy.
View question →
Q19. A company must use AWS CloudFormation templates to deploy all its Amazon RDS database instances as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) automation. The database instance master password must be automatically generated during deployment. Which solution satisfies these requirements with minimal development effort?
- A. Create a Lambda-backed CloudFormation custom resource. Write Lambda code to generate a secure string. Return the secure string value in the custom resource response object’s Data field. Use the CloudFormation Fn::GetAtt intrinsic function to retrieve the secure string value. Use that value to create the database instance.
- B. Use an AWS CodeBuild action in CodePipeline to generate a secure string via the following AWS CLI command: `aws secretsmanager get-random-password`. Pass the generated secure string as a CloudFormation parameter with the NoEcho property set to true. Reference the parameter when creating the database instance.
- C. Create a Lambda-backed CloudFormation custom resource. Write Lambda code to generate a secure string. Return the secure string value in the custom resource response object’s Data field. Use the CloudFormation Fn::GetAtt intrinsic function to retrieve the secure string value. Create a secret in AWS Secrets Manager. Use a Secrets Manager dynamic reference to retrieve the stored value when creating the database instance.
- D. Use the AWS::SecretsManager::Secret resource to generate a secure string. Store the secure string as a secret in AWS Secrets Manager. Use a Secrets Manager dynamic reference to retrieve the stored value when creating the database instance.
View question →
Q20. A developer tests an application locally before deploying it to AWS Lambda. During local testing, the Lambda function fails and displays an 'Access Denied' message. How should this issue be resolved?
- A. Update the Lambda function’s execution role to include the missing permissions.
- B. Update the Lambda function’s resource-based policy to include the missing permissions.
- C. Include an IAM policy document in the root directory of the deployment package and redeploy the Lambda function.
- D. Redeploy the Lambda function using an account with the AdministratorAccess policy.
View question →
Q21. A developer is building an application that processes 10 MB documents containing highly sensitive data. The application will perform client-side encryption using AWS KMS. Which steps must be followed?
- A. Call the Encrypt API, passing the plaintext data to encrypt, and reference the customer-managed key ARN in the KeyId parameter.
- B. Call the GenerateRandom API to obtain a data encryption key, then use that key to encrypt the data.
- C. Call the GenerateDataKey API to obtain an encrypted version of the data encryption key to encrypt the data.
- D. Call the GenerateDataKey API to obtain the plaintext version of the data encryption key to encrypt the data.
View question →
Q22. A developer has an application that asynchronously invokes an AWS Lambda function. The developer wants to store messages that cause Lambda function invocation failures so the application can retry them later. What should the developer do to achieve this with minimal operational overhead?
- A. Configure an Amazon CloudWatch Logs log group to filter and store messages in an Amazon S3 bucket. Import messages in Lambda and re-invoke the Lambda function.
- B. Configure Amazon EventBridge to send messages to Amazon Simple Notification Service (Amazon SNS) to restart the Lambda function.
- C. Implement a dead-letter queue (DLQ). Configure the DLQ as the event source for the Lambda function.
- D. Send Amazon EventBridge events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to poll messages from the SQS queue and re-invoke itself.
View question →
Q23. A developer manages a legacy application hosted on-premises. Other applications hosted on AWS depend on this on-premises application to operate correctly. If any application errors occur, the developer wants to use Amazon CloudWatch to monitor all applications centrally and troubleshoot issues. How can the developer achieve this goal?
- A. Install the AWS SDK on the on-premises server to automatically send logs to CloudWatch.
- B. Download and install the CloudWatch agent on the on-premises server. Configure the agent with IAM user credentials that have CloudWatch permissions.
- C. Upload log files from the on-premises server to Amazon S3 and configure CloudWatch to read those files.
- D. Upload log files from the on-premises server to an Amazon EC2 instance and configure that instance to forward logs to CloudWatch.
View question →
Q24. A developer manages an application that inserts customer orders into an Amazon DynamoDB table. Orders use `customer_id` as the partition key, `order_id` as the sort key, and `order_date` as an attribute. A new access pattern requires querying by `order_date` and `order_id`. The developer needs to implement a new AWS Lambda function to support this access pattern. How should the developer support the new access pattern in the most operationally efficient way?
- A. Add a new local secondary index (LSI) to the DynamoDB table, specifying `order_date` as the partition key and `order_id` as the sort key. Write a new Lambda function to query the new LSI.
- B. Write a new Lambda function to scan the DynamoDB table. Within the Lambda function, implement logic to filter and aggregate results by `order_date` and `order_id`.
- C. Add a new global secondary index (GSI) to the DynamoDB table, specifying `order_date` as the partition key and `order_id` as the sort key. Write a new Lambda function to query the new GSI.
- D. Enable DynamoDB Streams on the table. Configure stream record settings to include both old and new images. Write a new Lambda function to query the DynamoDB stream.
View question →
Q25. A company has an Amazon S3 bucket containing premium content. The company intends to deliver this premium content exclusively to its paid subscribers. The S3 bucket currently has default private permissions on all objects to prevent accidental exposure of premium content to non-subscribers.
- A. Apply a bucket policy that allows anonymous users to download content from the S3 bucket.
- B. Generate presigned object URLs for premium content files when a paid subscriber requests a download.
- C. Add a bucket policy requiring multi-factor authentication (MFA) for requests accessing S3 bucket objects.
- D. Enable server-side encryption on the S3 bucket to protect data from non-paying website visitors.
View question →
Q26. A developer needs to freeze changes to an AWS CodeCommit repository before a production release. During QA team testing of the release, the developer will continue developing new features. QA testing and all bug fixes must be isolated from the main branch. After the release, the developer must integrate all bug fixes into the main branch. Which solution meets these requirements?
- A. Create a release branch from the latest Git commit to be released. Apply fixes on the release branch. Continue developing new features and merge them into the main branch. After release, merge the release branch into the main branch.
- B. Create a Git tag on the latest Git commit to be released. Continue developing new features and merge them into the main branch. Apply fixes on the main branch. Update the Git tag to point to the latest commit on the main branch.
- C. Create a release branch from the latest Git commit to be released. Apply fixes on the release branch. Continue developing new features and merge them into the main branch. After release, rebase the main branch onto the release branch.
- D. Create a Git tag on the latest Git commit to be released. Continue developing new features and merge them into the main branch. Apply the fix commits directly to the released Git tag.
View question →
Q27. A company runs a web application on an Amazon EC2 instance backed by a custom Amazon Machine Image (AMI). The company uses AWS CloudFormation to provision the application. The application runs in the us-east-1 Region, and the company wants to deploy it to the us-west-1 Region. Attempting to create the AWS CloudFormation stack in us-west-1 fails with an error indicating the AMI ID does not exist. The developer must resolve this error using the solution with the lowest operational overhead. Which solution meets these requirements?
- A. Modify the AWS CloudFormation templates for both us-east-1 and us-west-1 to use an AWS-provided AMI. Recreate the stacks in both regions.
- B. Copy the custom AMI from us-east-1 to us-west-1. Update the us-west-1 AWS CloudFormation template to reference the AMI ID of the copied AMI. Recreate the stack.
- C. Build a new custom AMI in us-west-1. Create a new AWS CloudFormation template to use the new AMI ID and launch the stack in us-west-1.
- D. Manually deploy the application outside of AWS CloudFormation in us-west-1.
View question →
Q28. A developer is building a web application that must share confidential documents with end users. These documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents upon request, and access must expire after no more than 15 minutes.
- A. Copy the documents to a separate S3 bucket with a lifecycle policy that deletes objects after 15 minutes.
- B. Use the AWS SDK to generate a presigned S3 URL with an expiration time of 15 minutes.
- C. Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download documents over HTTPS.
- D. Modify the S3 bucket policy to allow downloads only by specific users, then revert the change after 15 minutes.
View question →
Q29. A company runs its website on AWS. The company publishes polls daily and releases poll results the following day. The website stores user responses in an Amazon DynamoDB table. After releasing poll results, the company no longer needs to retain user responses. A developer must implement a solution that automatically deletes old user responses from the DynamoDB table. The developer has added a new expiration_date attribute to the DynamoDB table and plans to use it for automation. Which solution meets these requirements with the least development effort?
- A. Create an AWS Lambda function that deletes old user responses based on the expiration_date attribute. Create an Amazon EventBridge schedule to invoke the Lambda function daily.
- B. Create an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) that deletes old user responses based on the expiration_date attribute. Create an Amazon EventBridge schedule to run the Fargate task daily.
- C. Create an AWS Glue job that deletes old user responses based on the expiration_date attribute. Create an AWS Glue trigger schedule to run the job daily.
- D. Enable Time-to-Live (TTL) on the DynamoDB table and specify the expiration_date attribute. Use DynamoDB TTL to expire and delete old user responses.
View question →
Q30. A developer is building a payment service platform that communicates with several third-party payment processing APIs. The third-party services do not provide test environments. The developer must verify integration between the payment service platform and the third-party payment processing APIs. The developer must test the API integration code without invoking the actual third-party payment processing APIs. Which solution meets these requirements?
- A. Set up an Amazon API Gateway REST API and configure a gateway response with status code 200. Add a response template containing sample responses captured from the real third-party API.
- B. Set up an AWS AppSync GraphQL API and configure a data source for each third-party API. Specify the integration type as Mock. Configure the integration response using sample responses captured from the real third-party API.
- C. Create an AWS Lambda function for each third-party API. Embed sample responses captured from the real third-party API. Configure inbound endpoints in Amazon Route 53 Resolver for each Lambda function’s ARN.
- D. Set up an Amazon API Gateway REST API for each third-party API. Specify the integration request type as Mock. Configure the integration response using sample responses captured from the real third-party API.
View question →
Q31. A developer is investigating an issue in an integration environment where an application consumes messages from an Amazon Simple Queue Service (Amazon SQS) queue and an AWS Lambda function processes those messages. The Lambda function invokes a third-party service’s API. Application usage has increased significantly. The third-party API frequently returns HTTP 429 Too Many Requests errors. These errors prevent successful processing of many messages. How should the developer resolve this issue?
- A. Increase the batch size setting for the SQS event source.
- B. Configure provisioned concurrency for the Lambda function based on the third-party API’s documented rate limits.
- C. Increase retry attempts and maximum event age in the Lambda function’s asynchronous invocation configuration.
- D. Configure maximum concurrency on the SQS event source based on the third-party service’s documented rate limits.
View question →
Q32. A development team is evaluating a solution to process and review medical claims. Users log in to access information related to their medical and financial status. As part of the application, sensitive files—including medical records, medical images, bank statements, and receipts—are uploaded to Amazon S3. All files must be encrypted in transit and at rest. All access to the files must be logged for auditing.
- A. Use S3 default encryption with Advanced Encryption Standard 256 (AES-256) on the target bucket.
- B. Use Amazon Cognito for authorization and authentication to secure the application and documents.
- C. Use AWS Lambda to encrypt and decrypt objects as they are placed into the S3 bucket.
- D. Use client-side encryption/decryption with Amazon S3 and AWS KMS.
View question →
Q33. A developer designed an application that stores incoming data as JSON files in Amazon S3 objects. Subsequently, custom business logic in an AWS Lambda function processes these objects and loads the data into an Amazon DynamoDB table. Recently, the workload experienced sudden and significant traffic fluctuations. The rate at which data flows into the DynamoDB table has hit a throttling limit. The developer needs to implement a solution to eliminate the throttling and load data into the DynamoDB table more consistently. Which solution meets these requirements?
- A. Refactor the Lambda function into two functions. Configure one function to transform the data and another to load the data into the DynamoDB table. Create an Amazon Simple Queue Service (Amazon SQS) queue between the two functions to store items as messages and invoke the second function.
- B. Enable auto scaling for the DynamoDB table. Use Amazon CloudWatch to monitor the table's read and write capacity metrics and track consumed capacity.
- C. Create an alias for the Lambda function. Configure provisioned concurrency for the application.
- D. Refactor the Lambda function into two functions. Configure one function to store data in the DynamoDB table. Configure a second function to process the data and update items after data is stored in DynamoDB. Create a DynamoDB stream to invoke the second function after data is stored.
View question →
Q34. A developer is creating a Ruby application and wants to automate deployment, scaling, and environment management without needing to understand the underlying infrastructure. Which service is best suited for this task?
- A. AWS CodeDeploy
- B. AWS CloudFormation
- C. AWS OpsWorks
- D. AWS Elastic Beanstalk
View question →
Q35. An application adds a processing date to each transaction it receives. The application uses the PutItem operation to write each transaction into an Amazon DynamoDB table. Each transaction has a unique ID (transactionID). Occasionally, the application receives duplicate transactions. A developer notices that duplicate transactions in DynamoDB have the latest processing date instead of the date when the transaction was first received. Duplicate records occur infrequently, and the majority of transactions are unique. What is the most cost-effective solution the developer can implement to ensure PutItem does not overwrite existing records?
- A. First call the GetItem operation to confirm the record does not exist, then call PutItem.
- B. Enable TTL (Time-to-Live) attribute on the DynamoDB table.
- C. Implement a conditional put using the attribute_exists(transactionID) condition expression.
- D. Implement a conditional put using the attribute_not_exists(transactionID) condition expression.
View question →
Q36. A developer is creating an application with an Amazon API Gateway REST API in the us-east-2 Region. The developer wants to use Amazon CloudFront with a custom domain name for the API. The developer has already obtained an SSL/TLS certificate for the domain through a third-party certificate authority. How should the developer configure the custom domain for the application?
- A. Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API (us-east-2). Create a DNS A record for the custom domain.
- B. Import the SSL/TLS certificate into CloudFront. Create a DNS CNAME record for the custom domain.
- C. Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API (us-east-2). Create a DNS CNAME record for the custom domain.
- D. Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the us-east-1 Region. Create a DNS CNAME record for the custom domain.
View question →
Q37. A developer is using AWS CloudFormation to deploy an application in the AWS cloud. The application connects to an existing Amazon RDS database. The RDS database hostname is stored as plaintext in AWS Systems Manager Parameter Store. The developer wants to incorporate the database hostname into the CloudFormation template to initialize the application when the stack is created. How should the developer reference the parameter containing the database hostname?
- A. Use an ssm dynamic reference.
- B. Use the Ref intrinsic function.
- C. Use the Fn::ImportValue intrinsic function.
- D. Use an ssm-secure dynamic reference.
View question →
Q38. A developer created an AWS Lambda function written in Python. The Lambda function reads data from objects in Amazon S3 and writes the data to an Amazon DynamoDB table. The function is successfully triggered by S3 event notifications when objects are created. However, the function fails when attempting to write to the DynamoDB table. What is the most likely cause of this issue?
- A. The Lambda function’s concurrency limit has been exceeded.
- B. The DynamoDB table requires a Global Secondary Index (GSI) to support write operations.
- C. The Lambda function lacks IAM permissions to write to DynamoDB.
- D. The DynamoDB table is not running in the same Availability Zone as the Lambda function.
View question →
Q39. A developer is building a serverless application and needs to use an AWS Lambda function to process any changes to an Amazon DynamoDB table. How should the developer configure the Lambda function to detect changes to the DynamoDB table?
- A. Create an Amazon Kinesis data stream and attach it to the DynamoDB table. Create a trigger to connect the data stream to the Lambda function.
- B. Create an Amazon EventBridge rule to invoke the Lambda function periodically. Connect the Lambda function to the DynamoDB table to poll for changes.
- C. Enable DynamoDB Streams on the table. Create a trigger to connect the DynamoDB stream to the Lambda function.
- D. Create an Amazon Kinesis Data Firehose delivery stream and attach it to the DynamoDB table. Configure the delivery stream destination as the Lambda function.
View question →
Q40. A developer needs temporary access to resources in a second AWS account. What is the most secure approach?
- A. Use an Amazon Cognito user pool to obtain short-term credentials for the second account.
- B. Create a dedicated IAM access key for the second account and email it.
- C. Create a cross-account access role and use the sts:AssumeRole API to obtain short-term credentials.
- D. Establish a trust relationship and add the second account’s SSH key to the IAM user.
View question →
Q41. A company is developing a serverless application using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS database instance. The database instance resides in a private subnet within a VPC. The company created an IAM role with permissions to access the database instance and attached that role to the Lambda function. Developers must take additional steps to enable the Lambda function to access the database instance. To meet these requirements, what should the developers do?
- A. Assign a public IP address to the database instance. Modify the database instance's security group to allow inbound traffic from the Lambda function's IP address.
- B. Establish an AWS Direct Connect connection between the Lambda function and the database instance.
- C. Configure an Amazon CloudFront distribution to create a secure connection between the Lambda function and the database instance.
- D. Configure the Lambda function to connect to a private subnet in the VPC. Add security group rules to allow traffic from the Lambda function to the database instance.
View question →
Q42. An application uses Amazon Kinesis Data Streams to ingest and process large volumes of data record streams in real time. Amazon EC2 instances consume and process data from Kinesis data stream shards using the Amazon Kinesis Client Library (KCL). The application handles failure scenarios gracefully and does not require standby workers. The application reports that a specific shard is receiving data at a higher-than-expected rate. To accommodate changes in the data stream rate, the 'hot' shard is resharded. Assuming the initial number of shards in the Kinesis data stream is 4, and after resharding the number increases to 6, what is the maximum number of EC2 instances that can be deployed to process data from all shards?
- A. 12
- B. 6
- C. 4
- D. 1
View question →
Q43. A developer needs to use a code template to create a solution that automatically deploys an application to Amazon EC2 instances. The template must be configured to repeatedly execute deployment, installation, and application updates. The template must support creating identical environments and rolling back to previous versions. Which solution meets these requirements?
- A. Use AWS Amplify for automated deployment templates. Use traffic-split deployments to replicate any deployment. If needed, modify any resources created by Amplify.
- B. Use AWS CodeBuild for automated deployment. Upload the required AppSpec file template. Save the appspec.yml file in the root directory folder of the revision. Specify a deployment group containing EC2 instances for deployment.
- C. Use AWS CloudFormation to create a JSON-formatted infrastructure template to deploy EC2 instances. Use CloudFormation helper scripts to install necessary software and start the application. Invoke these scripts directly from the template.
- D. Use AWS AppSync to deploy the application. Upload the template as a GraphQL schema. Specify EC2 instances for application deployment. Use resolvers as a version control mechanism and update deployments accordingly.
View question →
Q44. A developer occasionally receives an HTTP 400: ThrottlingException error when calling Amazon CloudWatch APIs. When the call fails, no data is retrieved. To resolve this issue, which best practice should be applied first?
- A. Contact AWS Support to increase the limit.
- B. Use the AWS CLI to retrieve metrics.
- C. Analyze the application and remove API calls.
- D. Use exponential backoff to retry the call.
View question →
Q45. A research company has a web application that runs once daily, performing scientific computations based on user-submitted web form inputs. The computations are CPU-intensive. An AWS Lambda function executes the computation daily. Due to Lambda function timeouts, users occasionally receive errors. Which change would most effectively reduce the Lambda function’s execution time?
- A. Configure the Lambda function to run on Amazon EC2 burstable instance types.
- B. Configure the Lambda function to run on Amazon EC2 instance types recommended for high-performance computing (HPC) workloads.
- C. Configure the Lambda function to run with a higher reserved concurrency value.
- D. Configure the Lambda function to run with a higher memory value.
View question →
Q46. A company is building a stock trading application. The application requires sub-millisecond latency for processing trade requests. The company uses Amazon DynamoDB to store all trade data required for processing each trade request. A development team conducted load testing and found data retrieval times exceeded expectations. The team needs a solution that reduces data retrieval time with minimal engineering effort. Which solution meets these requirements?
- A. Add a Local Secondary Index (LSI) to the trade data.
- B. Store trade data in Amazon S3 and use S3 Transfer Acceleration.
- C. Add exponential backoff retries to DynamoDB queries.
- D. Use DynamoDB Accelerator (DAX) to cache trade data.
View question →
Q47. A company has an AWS Lambda function that runs hourly to read log files stored in Amazon S3 and then sends alerts to an Amazon Simple Notification Service (Amazon SNS) topic based on defined criteria. A developer wants to add custom metrics to the Lambda function to track the count of each alert type per hourly execution. The developer needs to log this information in Amazon CloudWatch under a metric named 'Lambda/AlertCounts'. How should the developer modify the Lambda function to meet this requirement with minimal operational overhead?
- A. Add a print statement to standard output for each alert type and occurrence count.
- B. Add a call to the PutMetricData API operation. Pass the alert array along with occurrence counts in the Value and Count fields, using the namespace 'Lambda/AlertCounts'.
- C. Add a call to the PutMetricAlarm API operation. Pass a set of alerts in the MetricName field of a metric with namespace 'Lambda/AlertCounts'.
- D. Add a call to the PutDashboard API operation. Pass a set of alerts in the MetricName field of a metric with namespace 'Lambda/AlertCounts'.
View question →
Q48. A developer created an AWS Lambda function that accesses resources in a VPC. The Lambda function polls an Amazon Simple Queue Service (Amazon SQS) queue via a VPC endpoint to retrieve new messages. Then, the function computes the rolling average of numeric values contained in the messages. After initial testing of the Lambda function, the developer finds the returned rolling average is inaccurate. How can the developer ensure the function computes an accurate rolling average?
- A. Set the function’s reserved concurrency to 1. Compute the rolling average in the function. Store the computed rolling average in Amazon ElastiCache.
- B. Modify the function to store values in Amazon ElastiCache. On function initialization, compute the rolling average using prior values from the cache.
- C. Set the function’s reserved concurrency to 1. Compute the rolling average in the function. Store the computed rolling average in Amazon ElastiCache.
- D. Modify the function to store values in the function’s layer. On function initialization, compute the rolling average using previously stored values.
View question →
Q49. Where should the appspec.yml file be placed for AWS CodeDeploy to function?
- A. In the root of the application's source code directory structure
- B. In the bin folder along with all compiled code
- C. In an Amazon S3 bucket
- D. In the same folder as the application configuration files
View question →
Q50. A developer created a static website and deployed its static assets to an Amazon S3 bucket, using Amazon CloudFront to serve those assets. The developer configured an Origin Access Control (OAC) on the CloudFront distribution to access the S3 bucket. The developer observes that users can access the root URL and specific pages, but cannot access directories without specifying a filename—for example, /products/index.html works, but /products/ returns an error. The developer wants to enable directory access without specifying filenames while keeping the S3 bucket private. Which solution meets these requirements?
- A. Update the CloudFront distribution settings to set index.html as the default root object.
- B. Update the Amazon S3 bucket settings and enable static website hosting. Specify index.html as the index document. Update the S3 bucket policy to allow access. Update the CloudFront distribution origin to use the S3 website endpoint.
- C. Create a CloudFront Function that checks the request URL and appends index.html when accessing a directory. Attach this function as a viewer request CloudFront Function to the CloudFront distribution behavior.
- D. Create a custom error response on the CloudFront distribution, setting the HTTP error code to HTTP 404 Not Found response code, the response page path to /index.html, and the HTTP response code to HTTP 200 OK.
View question →
Q51. A developer plans to migrate corporate data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS Key Management Service (AWS KMS) to encrypt the data. To meet these requirements, which type of key should the developer use?
- A. Amazon S3 managed keys
- B. Symmetric customer-managed keys with key material generated by AWS
- C. Asymmetric customer-managed keys with key material generated by AWS
- D. Symmetric customer-managed keys with imported key material
View question →
Q52. A developer needs to use AWS X-Ray to monitor an application running on Amazon EC2 instances. The developer has instrumented the application using the X-Ray SDK. How should monitoring be implemented?
- A. Configure X-Ray SDK sampling rules and targets. Activate the X-Ray daemon via the modify-instance-attribute command from the EC2 console or AWS CLI to set the XRayEnabled flag.
- B. Install the X-Ray daemon. Assign an IAM role with a policy permitting write access to X-Ray to the EC2 instance.
- C. Install the X-Ray daemon. Configure it to forward data to Amazon EventBridge (Amazon CloudWatch Events). Grant the EC2 instance permissions to write to EventBridge (CloudWatch Events).
- D. Deploy the X-Ray SDK with the application and instrument the application code. Use the SDK logger to capture and send events.
View question →
Q53. A company has a legacy Windows application running on-premises. The application uses a network-shared folder as a centralized configuration repository, storing configuration files in XML format. The company is migrating the application to Amazon EC2 instances. As part of the migration to AWS, the developer must identify a highly available solution for the repository. Which solution most cost-effectively meets this requirement?
- A. Attach an Amazon Elastic Block Store (Amazon EBS) volume to one of the EC2 instances. Deploy a file system on the EBS volume. Share the folder using the host operating system. Update the application code to read from and write to the shared folder.
- B. Deploy a micro-sized EC2 instance with instance store volumes. Share the folder using the host operating system. Update the application code to read from and write to the shared folder.
- C. Create an Amazon S3 bucket to host the repository. Migrate the existing XML files to the S3 bucket. Update the application code to read from and write to Amazon S3 using the AWS SDK.
- D. Create an Amazon S3 bucket to host the repository. Migrate the existing XML files to the S3 bucket. Mount the S3 bucket as a local volume on the EC2 instance. Update the application code to read from and write to the disk.
View question →
Q54. A company plans to centrally manage a fixed license key in AWS. The development team needs to access the license key in automated scripts running on Amazon EC2 instances and AWS CloudFormation stacks. Which solution is most cost-effective while meeting these requirements?
- A. Amazon S3 with encrypted files prefixed with 'config'
- B. AWS Secrets Manager secret tagged with 'SecretString'
- C. AWS Systems Manager Parameter Store SecureString parameter
- D. CloudFormation NoEcho parameter
View question →
Q55. For an in-place deployment using AWS CodeDeploy, what is the execution order of deployment lifecycle hooks?
- A. BeforeInstall > ApplicationStop > ApplicationStart > AfterInstall
- B. ApplicationStop > BeforeInstall > AfterInstall > ApplicationStart
- C. BeforeInstall > ApplicationStop > ValidateService > ApplicationStart
- D. ApplicationStop > BeforeInstall > ValidateService > ApplicationStart
View question →
Q56. A company operates an image storage web application on AWS. The application runs on Amazon EC2 instances in an Auto Scaling group, which serves as the target group for an Application Load Balancer (ALB). The company uses an Amazon S3 bucket to store images for sale. The company wants to develop a feature to test system requests, routing them to a separate target group hosting a new beta version of the application. Which solution meets this requirement with minimal effort?
- A. Create a new Auto Scaling group and target group for the beta version. Update the ALB routing rules with a condition to look for a cookie named 'version' with value 'beta'. Update the test system code to send this cookie to test the beta version.
- B. Create a new ALB, Auto Scaling group, and target group for the beta version. Configure an alternate Amazon Route 53 record for the new ALB endpoint. Use the alternate Route 53 endpoint in test system requests to test the beta version.
- C. Create a new ALB, Auto Scaling group, and target group for the beta version. Use Amazon CloudFront with Lambda@Edge to determine which specific requests should be routed to the new ALB. Send test system requests through the CloudFront endpoint to test the beta version.
- D. Create a new Auto Scaling group and target group for the beta version. Update the ALB routing rules with a condition to look for a cookie named 'version' with value 'beta'. Use Amazon CloudFront with Lambda@Edge to inject the required cookie into test system requests before they reach the ALB.
View question →
Q57. A developer is building a serverless application that requires invoking an AWS Lambda function every 10 minutes. What is the automated, serverless approach to invoke the function?
- A. Deploy a Linux-based Amazon EC2 instance, edit the /etc/crontab file, and add a command to invoke the Lambda function on a schedule.
- B. Configure an environment variable named PERIOD for the Lambda function and set its value to 600.
- C. Create a scheduled Amazon EventBridge (Amazon CloudWatch Events) rule to invoke the Lambda function.
- D. Create an Amazon Simple Notification Service (Amazon SNS) topic subscribed by the Lambda function with a 600-second timer.
View question →
Q58. A company uses AWS CloudFormation templates as part of its AWS CodePipeline–based CI/CD automation to deploy all Amazon RDS DB instances. The DB instance master password must be automatically generated during deployment. Which solution satisfies these requirements with minimal development effort?
- A. Create a CloudFormation custom resource backed by AWS Lambda. Write Lambda code to generate a secure string. Return the secure string value in the custom resource response object's Data field. Retrieve the value using the CloudFormation Fn::GetAtt intrinsic function and use it to create the DB instance.
- B. Use an AWS CodeBuild action in CodePipeline to generate a secure string via the AWS CLI command: aws secretsmanager get-random-password. Pass the generated secure string as a CloudFormation parameter with the NoEcho property set to true. Reference the parameter when creating the DB instance.
- C. Create a CloudFormation custom resource backed by AWS Lambda. Write Lambda code to generate a secure string. Return the secure string value in the custom resource response object's Data field. Retrieve the value using the CloudFormation Fn::GetAtt intrinsic function. Store the secure string in AWS Secrets Manager. Use a secretsmanager dynamic reference to retrieve the stored value when creating the DB instance.
- D. Use an AWS::SecretsManager::Secret resource to generate a secure string. Store the secure string as a secret in AWS Secrets Manager. Use a secretsmanager dynamic reference to retrieve the stored value when creating the DB instance.
View question →
Q59. A company runs a software-as-a-service (SaaS) application in its on-premises data center. The application architecture uses a front-end Apache web server to support multiple customer-specific websites. The Apache web server routes traffic to different backend services based on the domain name specified in the Host header of the initial request. The company plans to migrate this architecture to AWS. Developers are moving customer-specific backend services to Amazon EC2 instances. Developers must configure EC2 instances for each customer in Auto Scaling groups and register them in separate target groups. Developers also want to replace the front-end Apache web server with an Elastic Load Balancing (ELB) load balancer and route queries for specific domains to the appropriate target group. Which AWS configuration satisfies these requirements?
- A. Use a Network Load Balancer with host-based routing to respective backend target groups.
- B. Use a Network Load Balancer with path-based routing to respective backend target groups.
- C. Use an Application Load Balancer with host-based routing to respective backend target groups.
- D. Use an Application Load Balancer with path-based routing to respective backend target groups.
View question →
Q60. A developer is building web and mobile applications for two types of users: regular users and guest users. Regular users must log in, but guest users do not. Users should only see their own data regardless of authentication status. Users require AWS credentials to access AWS resources. What is the most secure solution the developer can implement to allow guest users access?
- A. Use the Amazon Cognito Credentials Provider to issue temporary credentials linked to an unauthenticated role authorized to access required resources.
- B. Set up an IAM user authorized to access required resources. Hardcode IAM credentials in the web and mobile applications.
- C. Generate temporary keys stored in AWS Key Management Service (AWS KMS). Use the temporary keys to access required resources.
- D. Generate temporary credentials and store them in AWS Secrets Manager. Use the temporary credentials to access required resources.
View question →
Q61. A developer wants to search and filter log data to debug an application. Application logs are stored in Amazon CloudWatch Logs. The developer created a new metric filter to count exceptions in application logs. However, no results are returned from the filter. What is the reason no filter results are returned?
- A. An Amazon CloudWatch interface VPC endpoint must be configured to filter CloudWatch Logs within a VPC.
- B. CloudWatch Logs only publishes metric data for events occurring after the filter is created.
- C. The log group must first stream logs to Amazon OpenSearch Service before metric filtering can return results.
- D. Metric data points from the log group can only be filtered after exporting logs to an Amazon S3 bucket.
View question →
Q62. A company deployed an application on AWS Elastic Beanstalk. The company configured the Auto Scaling group associated with the Elastic Beanstalk environment to maintain four Amazon EC2 instances. If fewer than four EC2 instances are available during deployment, the application may experience degradation. The company is using a rolling deployment policy. What is the most cost-effective solution to address this deployment issue?
- A. Change the Auto Scaling group to require six instances.
- B. Change the deployment policy to traffic splitting and specify a 1-hour evaluation period.
- C. Change the deployment policy to rolling with additional batches and specify a batch size of 1.
- D. Change the deployment policy to rolling and specify a batch size of 2.
View question →
Q63. A developer needs to perform geographic load testing on an API. The developer must deploy resources across multiple AWS Regions to support the API load test. How can the developer meet these requirements without adding extra application code?
- A. Create and deploy an AWS Lambda function in each required Region. Configure the Lambda function to create a stack from an AWS CloudFormation template upon invocation.
- B. Create an AWS CloudFormation template defining the load-testing resources. Use the AWS CLI create-stack-set command to create stack sets across the required Regions.
- C. Create an AWS Systems Manager document defining the resources. Use the document to create resources in the required Regions.
- D. Create an AWS CloudFormation template defining the load-testing resources. Use the AWS CLI deploy command to create a stack in each Region.
View question →
Q64. A company uses AWS CloudFormation templates to manage infrastructure for its applications across development, pre-production, and production environments. The company needs to scale to meet growing customer demand. A developer must upgrade an Amazon RDS DB instance type to a larger instance. The developer deployed a CloudFormation stack update in the pre-production environment to change the instance size. The developer notices the stack is in UPDATE_ROLLBACK_FAILED state. What is the cause of this issue?
- A. The new instance type specified in the CloudFormation template is invalid.
- B. The database was manually deleted or modified outside of the CloudFormation stack.
- C. The CloudFormation template contains a syntax error.
- D. The developer lacks sufficient IAM permissions to provision the specified instance type.
View question →
Q65. Business demand has increased, and the application is experiencing performance issues. This increased demand involves retrieving read-only historical records from an Amazon RDS–hosted database that features custom views and queries. Developers must resolve the performance issue without modifying the database schema. Which solution minimizes performance impact and reduces management overhead?
- A. Deploy Amazon DynamoDB, migrate all data, and point the application to DynamoDB.
- B. Deploy Amazon ElastiCache for Redis and cache application data.
- C. Deploy Memcached on Amazon EC2 and cache application data.
- D. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve caching performance.
View question →
Q66. Two containerized microservices are hosted on Amazon EC2 using Amazon ECS. The first microservice reads from an Amazon RDS Aurora database instance; the second microservice reads from an Amazon DynamoDB table. How should least-privilege permissions be granted to each microservice?
- A. Set ECS_ENABLE_TASK_IAM_ROLE to false in the ECS agent configuration file at EC2 instance launch. Run the first microservice as an ECS task with an IAM role granting read-only access to the Aurora database. Run the second microservice as an ECS task with an IAM role granting read-only access to DynamoDB.
- B. Set ECS_ENABLE_TASK_IAM_ROLE to false in the ECS agent configuration file at EC2 instance launch. Grant the EC2 instance profile role read-only access to both the Aurora database and DynamoDB.
- C. Set ECS_ENABLE_TASK_IAM_ROLE to true in the ECS agent configuration file at EC2 instance launch. Run the first microservice as an ECS task with an IAM role granting read-only access to the Aurora database. Run the second microservice as an ECS task with an IAM role granting read-only access to DynamoDB.
- D. Set ECS_ENABLE_TASK_IAM_ROLE to true in the ECS agent configuration file at EC2 instance launch. Grant the EC2 instance profile role read-only access to both the Aurora database and DynamoDB.
View question →
Q67. A developer is implementing an AWS Cloud Development Kit (AWS CDK) serverless application. During AWS CloudFormation stack creation, the developer provisions an AWS Lambda function and an Amazon API Gateway API. The developer works locally using both AWS Serverless Application Model (AWS SAM) and AWS CDK. How can the developer locally test a specific Lambda function?
- A. Run sam package and sam deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
- B. Run cdk synth and cdk deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
- C. Run cdk synth and sam local invoke commands, specifying the function construct identifier and the path to the synthesized CloudFormation template.
- D. Run cdk synth and sam local start-lambda commands, specifying the function construct identifier and the path to the synthesized CloudFormation template.
View question →
Q68. A company uses Amazon RDS as the backend database for its application. A recent marketing campaign caused a surge in read requests, increasing latency for database queries. The company plans to implement a caching layer in front of the database. The cache must be encrypted and highly available. Which solution meets these requirements?
- A. Amazon CloudFront
- B. Amazon ElastiCache for Memcached
- C. Amazon ElastiCache for Redis (Cluster Mode)
- D. Amazon DynamoDB Accelerator (DAX)
View question →
Q69. A developer uses AWS CodePipeline to provide continuous integration and continuous delivery (CI/CD) for a Java application. The developer needs to update the pipeline to support ingestion of new application dependency JAR files. The pipeline must trigger a build whenever a new version of a JAR file becomes available. Which solution satisfies these requirements?
- A. Create an Amazon S3 bucket to store dependency JAR files. Publish dependency JAR files to the S3 bucket. Use Amazon Simple Notification Service (Amazon SNS) to notify and trigger the CodePipeline build.
- B. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish dependency JAR files to the repository. Use an ECR source action to trigger the CodePipeline build.
- C. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish dependency JAR files to the repository. Use Amazon Simple Notification Service (Amazon SNS) to notify and trigger the CodePipeline build.
- D. Create an AWS CodeArtifact repository. Publish dependency JAR files to the repository. Use an Amazon EventBridge (Amazon CloudWatch Events) rule to trigger the CodePipeline build.
View question →
Q70. A developer receives the following error during an AWS CloudFormation stack deletion: DELETE_FAILED (Failed to delete resource: [ASGInstanceRole12345678].). What action should the developer take to resolve this error?
- A. Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
- B. Add a DependsOn attribute for the ASGInstanceRole12345678 resource in the CloudFormation template, then delete the stack.
- C. Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource, then manually delete it after stack deletion completes.
- D. Add a force parameter when calling CloudFormation and specify the role-arn for ASGInstanceRole12345678.
View question →
Q71. A company wants to use AWS CloudFormation templates to deploy all cloud resources. A developer must create an Amazon Simple Notification Service (Amazon SNS) notification to enforce this policy. The developer creates an SNS topic and subscribes the company’s security team’s corporate email address to it. The security team must receive immediate notifications when IAM roles are created without using CloudFormation. Which solution satisfies this requirement?
- A. Create an AWS Lambda function to filter CloudTrail events and publish to the SNS topic if an IAM role is created without CloudFormation. Configure the Lambda function to trigger every 15 minutes using an Amazon EventBridge schedule.
- B. Create an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to filter CloudTrail events and publish to the SNS topic if an IAM role is created without CloudFormation. Configure the Fargate task to run every 15 minutes using an Amazon EventBridge schedule.
- C. Launch an Amazon EC2 instance with a script to filter CloudTrail events and publish to the SNS topic if an IAM role is created without CloudFormation. Configure the script to run every 15 minutes via cron on the EC2 instance.
- D. Create an Amazon EventBridge rule to filter CloudTrail events and specify the SNS topic as the target of the EventBridge rule.
View question →
Q72. A developer is deploying an application that stores files in an Amazon S3 bucket. These files must be encrypted at rest. The developer wants to replicate files to an S3 bucket in a different AWS Region for disaster recovery. What is the minimal configuration required to accomplish this task?
- A. Use server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt files. Enable S3 Cross-Region Replication.
- B. Use server-side encryption (SSE) with AWS Key Management Service (AWS KMS) customer master keys (CMKs) to encrypt files. Enable S3 Cross-Region Replication.
- C. Use the s3 sync command to synchronize files to an S3 bucket in another Region.
- D. Configure S3 Lifecycle rules to automatically transition files to an S3 bucket in another Region.
View question →
Q73. A developer is using AWS CloudFormation and an AWS Lambda function to create a proof-of-concept demonstration. The demonstration will deploy an existing Lambda function using a CloudFormation template. The Lambda function uses a deployment package and dependencies stored in Amazon S3. The developer has defined an AWS::Lambda::Function resource in the CloudFormation template. The developer needs to add the S3 bucket to the CloudFormation template. What action should the developer take to meet these requirements with the least development effort?
- A. Inline the function code into the CloudFormation template as the Code property.
- B. Add the function code as the ZipFile property in the CloudFormation template.
- C. Locate the S3 key for the Lambda function and add the S3 key as the ZipFile property in the CloudFormation template.
- D. Add the relevant bucket and key in the S3Bucket and S3Key properties in the CloudFormation template.
View question →
Q74. A company has an Amazon S3 bucket containing sensitive data. The data must be encrypted both in transit and at rest. The company uses an AWS Key Management Service (AWS KMS) key to encrypt data in the S3 bucket. Developers need to grant several other AWS accounts permission to retrieve data from the S3 bucket using the s3:GetObject operation. How can developers enforce that all requests retrieving data use secure transport (HTTPS)?
- A. Define a resource-based policy on the S3 bucket that denies access when the condition 'aws:SecureTransport' equals 'false'.
- B. Define a resource-based policy on the S3 bucket that allows access when the condition 'aws:SecureTransport' equals 'false'.
- C. Define a role-based policy for the other accounts’ roles that denies access when the condition 'aws:SecureTransport' equals 'false'.
- D. Define a resource-based policy on the KMS key that denies access when the condition 'aws:SecureTransport' equals 'false'.
View question →
Q75. A company stores its data in tables within a series of Amazon S3 buckets. The company received an alert indicating that customer credit card information may have been exposed in a data table of one of its public applications. Developers need to identify all potential risks across the application environment. Which solution meets these requirements?
- A. Run a job using Amazon Athena on the S3 bucket containing the affected data, filtering results using the SensitiveData:S3Object/Personal discovery type.
- B. Run a job using Amazon Macie on the S3 bucket containing the affected data, filtering results using the SensitiveData:S3Object/Financial discovery type.
- C. Run a job using Amazon Macie on the S3 bucket containing the affected data, filtering results using the SensitiveData:S3Object/Personal discovery type.
- D. Run a job using Amazon Athena on the S3 bucket containing the affected data, filtering results using the SensitiveData:S3Object/Financial discovery type.
View question →
Q76. A company hosts its application on AWS. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster using AWS Fargate. The cluster runs behind an Application Load Balancer. The application stores data in an Amazon Aurora database. Developers manage and encrypt the database credentials in the application. The company wants a more secure credential storage mechanism with automated, periodic credential rotation. Which solution meets these requirements with the lowest operational overhead?
- A. Migrate secrets to an Amazon RDS parameter group. Encrypt parameters using an AWS Key Management Service (AWS KMS) key. Enable credential rotation. Grant AWS KMS permissions to Amazon RDS using IAM policies and roles.
- B. Migrate credentials to AWS Systems Manager Parameter Store. Encrypt parameters using an AWS Key Management Service (AWS KMS) key. Enable credential rotation. Grant Amazon ECS Fargate permissions to access AWS Secrets Manager using IAM policies and roles.
- C. Migrate credentials to ECS Fargate environment variables. Encrypt credentials using an AWS Key Management Service (AWS KMS) key. Enable credential rotation. Grant Amazon ECS Fargate permissions to access AWS Secrets Manager using IAM policies and roles.
- D. Migrate credentials to AWS Secrets Manager. Encrypt credentials using an AWS Key Management Service (AWS KMS) key. Enable credential rotation. Grant Amazon ECS Fargate permissions to access AWS Secrets Manager using IAM policies and roles.
View question →
Q77. A developer is building a serverless application using the AWS Serverless Application Model (AWS SAM). The developer is currently testing the application in a development environment. As the application nears completion, the developer needs to set up additional test and pre-production environments for quality assurance. The developer wants to use an AWS SAM feature to deploy to each environment. Which solution meets these requirements with the least development effort?
- A. Add a TOML-formatted configuration file grouping configuration entries per environment. Add a table for each test and pre-production environment. Deploy updates to each environment using the sam deploy command with the --config-env flag corresponding to that environment.
- B. Create additional AWS SAM templates for each test and pre-production environment. Write a custom shell script using the sam deploy command with the --template-file flag to deploy updates to each environment.
- C. Create an AWS SAM configuration file with default parameters. Use the --parameter-overrides flag in the AWS SAM CLI to override parameters for test and pre-production environments.
- D. Use the existing AWS SAM template. Add extra parameters to configure environment-specific attributes for serverless functions and database table resources. Deploy updates to test and pre-production environments using the sam deploy command.
View question →
Q78. A developer plans to build a REST API using Amazon API Gateway and AWS Lambda. The developer needs to manage multiple environments: development, testing, and production. How should the application be deployed to minimize the number of managed resources?
- A. Create separate API Gateways and separate Lambda functions for each environment in the same Region.
- B. Assign a separate Region to each environment and deploy API Gateway and Lambda to each Region.
- C. Create one API Gateway with multiple stages and one Lambda function with multiple aliases.
- D. Create one API Gateway and one Lambda function, and use a single REST parameter to identify the environment.
View question →
Q79. A company runs an application on AWS. The company deploys the application on Amazon EC2 instances and stores data in Amazon Aurora. The application recently logged a custom application-specific DECRYPT_ERROR error in Amazon CloudWatch Logs. The company discovered this issue only after automated tests—run every 30 minutes—failed. Developers need to implement a solution to monitor these custom errors and send real-time notifications to the development team when they occur in production. Which solution meets these requirements with the lowest operational overhead?
- A. Configure the application to publish a custom metric to CloudWatch. Create an AWS CloudTrail alarm. Configure the CloudTrail alarm to send notifications via Amazon Simple Notification Service (Amazon SNS).
- B. Create an AWS Lambda function that runs every 5 minutes to scan CloudWatch Logs for the keyword DECRYPT_ERROR. Configure the Lambda function to send notifications via Amazon Simple Notification Service (Amazon SNS).
- C. Use Amazon CloudWatch Logs to create a metric filter for the DECRYPT_ERROR pattern. Create a CloudWatch alarm for this metric with a threshold >= 1. Configure the alarm to send notifications via Amazon Simple Notification Service (Amazon SNS).
- D. Install the CloudWatch unified agent on the EC2 instances. Configure the application to emit a metric for errors containing the keyword DECRYPT_ERROR. Configure the agent to send notifications via Amazon Simple Notification Service (Amazon SNS).
View question →
Q80. A developer is using a Border Gateway Protocol (BGP)-based AWS VPN connection to connect on-premises networks to Amazon EC2 instances in their AWS account. The developer can access EC2 instances in subnet A but cannot access EC2 instances in subnet B within the same VPC. Which logs can the developer use to verify whether traffic reaches subnet B?
- A. VPN logs
- B. BGP logs
- C. VPC flow logs
- D. AWS CloudTrail logs
View question →
Q81. A company has an AWS Lambda function that processes incoming requests from an Amazon API Gateway API. The API uses a Lambda alias to invoke the Lambda function. Developers updated the Lambda function code to handle more detailed information related to incoming requests. Developers want to deploy the new Lambda function for testing without impacting customers using the API. Which solution meets these requirements with the least operational overhead?
- A. Create a new version of the Lambda function. Create a new stage in API Gateway integrated with the new Lambda version. Test the Lambda function using the new API Gateway stage.
- B. Update the existing Lambda alias used by API Gateway to a weighted alias. Add the new Lambda version as an additional Lambda function with a weight of 10%. Test in the existing API Gateway stage.
- C. Create a new version of the Lambda function. Create and deploy a second Lambda function to filter incoming requests from API Gateway. If the filtering Lambda function detects a test request, it invokes the new Lambda version; otherwise, it invokes the old Lambda version. Update the API Gateway API to use the filtering Lambda function.
- D. Create a new version of the Lambda function. Create a new API Gateway API for testing purposes. Update the new API to integrate with the new Lambda version. Use the new API for testing.
View question →
Q82. A company plans to deploy an application behind an Elastic Load Balancer on AWS. The application uses HTTP/HTTPS listeners and must access client IP addresses. Which load balancing solution meets these requirements?
- A. Use an Application Load Balancer and the X-Forwarded-For header.
- B. Use a Network Load Balancer (NLB). Enable proxy protocol support on both the NLB and the target application.
- C. Use an Application Load Balancer. Register targets by instance ID.
- D. Use a Network Load Balancer and the X-Forwarded-For header.
View question →
Q83. A developer is building an application on AWS. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function occasionally fails or times out. The developer wants to understand why certain messages are not processed successfully. Which solution meets these requirements with the least operational overhead?
- A. Increase the Lambda function’s maximum timeout to 15 minutes. Check AWS CloudTrail event history for error details.
- B. Increase the SQS queue’s visibility timeout. Check logs in Amazon CloudWatch Logs for error details.
- C. Create a dead-letter queue. Configure the Lambda function to send failed messages to the dead-letter queue.
- D. Create an Amazon DynamoDB table. Update the Lambda function to send failed messages to the DynamoDB table.
View question →
Q84. A developer created an AWS Lambda function that retrieves and processes data from several public APIs. The Lambda function was updated to connect to a VPC’s private subnet. An Internet Gateway is attached to the VPC. The VPC uses default network ACLs and security group configurations. The developer finds that the Lambda function can no longer access the public APIs. The developer confirmed the public APIs are reachable, but the Lambda function cannot connect to them. How should the developer fix the connectivity issue?
- A. Ensure the network ACL allows outbound traffic to the public internet.
- B. Ensure the security group allows outbound traffic to the public internet.
- C. Ensure outbound traffic from the private subnet is routed to a public NAT gateway.
- D. Ensure outbound traffic from the private subnet is routed to a new Internet Gateway.
View question →
Q85. A developer is using AWS CodePipeline as the CI/CD mechanism for a web application. The developer added unit tests to programmatically verify application code functionality. Unit tests generate a test report showing results for each individual check. The developer now wants to automatically execute these tests within the CI/CD pipeline. Which solution meets this requirement with the least operational effort?
- A. Write a Git pre-commit hook to run tests before each commit. Ensure every developer working on the project installs the pre-commit hook locally. Review the test report and resolve issues before pushing changes to AWS CodeCommit.
- B. Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage after the stage that deploys code revisions to the test environment. Write a build specification that fails the CodeBuild stage if any test fails. Use CodeBuild’s test reporting feature to integrate reports with the CodeBuild console. View test results in CodeBuild and resolve issues.
- C. Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a build specification that fails the CodeBuild stage if any test fails. Use CodeBuild’s test reporting feature to integrate reports with the CodeBuild console. View test results in CodeBuild and resolve issues.
- D. Add a new stage to the pipeline. Use Jenkins as the provider. Configure CodePipeline to use Jenkins to run unit tests. Write a Jenkinsfile that fails the stage if any test fails. Use Jenkins’ test reporting plugin to integrate reports with the Jenkins dashboard. View test results in Jenkins and resolve issues.
View question →
Q86. A company is moving sensitive files into a private Amazon S3 bucket with no public access permissions. The company wants to develop a serverless application that allows employees to log in and securely share files with other users. Which AWS feature should the company use to securely share and access files?
- A. Amazon Cognito User Pools
- B. S3 presigned URLs
- C. S3 bucket policies
- D. Amazon Cognito Identity Pools
View question →
Q87. A company is hosting an Amazon API Gateway REST API that invokes a single AWS Lambda function. The function is invoked by many clients simultaneously. Code initialization takes time, but the company wants to minimize the function’s startup latency. What can the developer do to optimize function initialization?
- A. Enable API Gateway caching for the REST API.
- B. Configure provisioned concurrency for the Lambda function.
- C. Use Lambda proxy integration for the REST API.
- D. Configure AWS Global Accelerator for the Lambda function.
View question →
Q88. A developer is using AWS Amplify Hosting to build and deploy an application. The developer received numerous bug reports from users. The developer wants to add end-to-end tests to eliminate these bugs as early as possible before they reach production. Which solution should the developer implement to meet these requirements?
- A. Run the 'amplify add test' command in the Amplify CLI.
- B. Create unit tests in the application. Deploy the unit tests using the 'amplify push' command in the Amplify CLI.
- C. Add a test stage in the application’s amplify.yml build settings.
- D. Add a test stage in the application’s aws-exports.js file.
View question →
Q89. A developer is developing an AWS Lambda function. The developer wants to log critical events that occur while the Lambda function executes. The developer wants to include a unique identifier to associate these events with a specific function invocation. The developer added the following code to the Lambda function: Function handler (event, context) {}. Which solution meets this requirement?
- A. Retrieve the request identifier from the AWS Request ID field of the context object. Configure the application to write logs to standard output.
- B. Retrieve the request identifier from the AWS Request ID field of the event object. Configure the application to write logs to a file.
- C. Retrieve the request identifier from the AWS Request ID field of the event object. Configure the application to write logs to standard output.
- D. Retrieve the request identifier from the AWS Request ID field of the context object. Configure the application to write logs to a file.
View question →
Q90. A developer deployed an AWS Lambda function that executes each time a new Amazon S3 bucket is created. The Lambda function should attach an S3 Lifecycle policy to each new S3 bucket. The developer found that newly created S3 buckets do not have an S3 Lifecycle policy attached. Which AWS service should the developer use to troubleshoot potential errors in the Lambda function?
- A. AWS CloudTrail
- B. Amazon S3
- C. AWS CloudFormation
- D. Amazon CloudWatch
View question →
Q91. A company configured an Amazon S3 bucket to send S3 object events to Amazon EventBridge (Amazon CloudWatch Events). An EventBridge rule invokes an AWS Lambda function for each object event received from the S3 bucket. A developer is building a new version of the Lambda function. To ensure the new Lambda function behaves as expected, the developer must perform repeatable tests using real S3 object events. The developer must minimize the amount of code and infrastructure required to support testing. Which solution meets these requirements?
- A. Create another S3 bucket that sends object events to EventBridge. Add another EventBridge rule to route data events from the new S3 bucket to the new Lambda function. Develop a tool to update objects in the new S3 bucket to generate test S3 object events.
- B. Add the new Lambda function as an additional target to the existing EventBridge rule. Route S3 object events to both the existing and new Lambda functions simultaneously.
- C. Use EventBridge archive and replay production S3 object events. Configure a new EventBridge rule to deliver the replayed S3 object events to the new Lambda function.
- D. Develop a tool that uses the EventBridge PutEvents API operation to publish aws.s3 data events. Add a new EventBridge rule to route aws.s3 events to the new Lambda function.
View question →
Q92. A developer has an application that stores data in an Amazon S3 bucket. The application uses HTTP APIs to store and retrieve objects. When the PutObject API operation adds an object to the S3 bucket, the developer must use server-side encryption with Amazon S3-managed keys (SSE-S3) to encrypt these objects at rest. Which solution meets this requirement?
- A. Create an AWS Key Management Service (AWS KMS) key. Assign the KMS key to the S3 bucket.
- B. Set the x-amz-server-side-encryption header when calling the PutObject API operation.
- C. Provide the encryption key in the HTTP header of each request.
- D. Apply TLS encryption to traffic flowing to the S3 bucket.
View question →
Q93. A company has an application that uses Amazon Cognito user pools as its identity system. The company must protect access to user records. The company has enabled multi-factor authentication (MFA). The company also wants to send login activity notifications via email each time a user logs in. What is the most efficient solution to meet these requirements?
- A. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Add an Amazon API Gateway API to invoke the function. Call the API from the client after receiving login confirmation.
- B. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Add an Amazon Cognito Post Authentication Lambda trigger to the function.
- C. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Create an Amazon CloudWatch Logs subscription filter to invoke the function based on login status.
- D. Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and send email notifications based on each user's login status.
View question →
Q94. A company is developing a serverless application composed of various AWS Lambda functions behind an Amazon API Gateway API. Developers want to automate deployment of Lambda function code. They will use AWS CodeDeploy to deploy updated Lambda functions. The deployment must minimize potential errors experienced by end users. While the application is in production, it must not experience downtime outside of scheduled maintenance windows. Which deployment configuration meets these requirements with the shortest deployment time?
- A. Use AWS CodeDeploy in-place deployment configuration for the Lambda function. Immediately shift all traffic after deployment.
- B. Use AWS CodeDeploy linear deployment configuration to shift 10% of traffic per minute.
- C. Use AWS CodeDeploy all-at-once deployment configuration to immediately shift all traffic to the updated version.
- D. Use AWS CodeDeploy predefined Canary deployment configuration to immediately shift 10% of traffic, then shift the remaining traffic after 5 minutes.
View question →
Q95. To harden container images before they run in production, the company’s application uses Amazon Elastic Container Registry (Amazon ECR) as the image registry, Amazon Elastic Kubernetes Service (Amazon EKS) as the compute platform, and an AWS CodePipeline pipeline to orchestrate container integration and delivery (CI/CD) workflows. Static application security testing currently occurs in the final stage of the pipeline—after the new image is deployed to the development namespace in the EKS cluster. Developers want to perform container image analysis earlier in the CI/CD pipeline, before deployment. Which solution is operationally most efficient and meets these requirements?
- A. Build the container image and run the docker scan command locally. Resolve any issues before pushing changes to the source code repository. Write a pre-commit hook to enforce this workflow before commits.
- B. Create a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan images upon push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check scan results and fail the pipeline if issues are found.
- C. Create a new CodePipeline stage that occurs after retrieving source code from its repository. Run security scans on the latest version of source code. Fail the pipeline if issues are found.
- D. Add an action in the pipeline’s deploy stage that occurs before deployment to the EKS cluster. Configure ECR basic image scanning to scan images upon push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check scan results and fail the pipeline if issues are found.
View question →
Q96. A company is building a microservices-based consumer-facing application. Each consumer can connect to one or more services. This has resulted in a complex architecture that is difficult to manage and scale effectively. The company needs a single interface to manage these consumer-facing services. Which AWS service should be used to refactor this architecture?
- A. AWS Lambda
- B. AWS X-Ray
- C. Amazon SQS
- D. Amazon API Gateway
View question →
Q97. A company is running a Docker application on Amazon ECS. The application must scale based on user load over the past 15 seconds. How should the developer instrument the code to meet this requirement?
- A. Create a high-resolution custom Amazon CloudWatch metric for user activity data and publish data every 30 seconds.
- B. Create a high-resolution custom Amazon CloudWatch metric for user activity data and publish data every 5 seconds.
- C. Create a standard-resolution custom Amazon CloudWatch metric for user activity data and publish data every 30 seconds.
- D. Create a standard-resolution custom Amazon CloudWatch metric for user activity data and publish data every 5 seconds.
View question →
Q98. A stateful web application that shares session state locally is being migrated to AWS. The application must be fault-tolerant, highly scalable, and any service interruption must not impact the user experience. What is the best option for storing session state?
- A. Store session state in Amazon ElastiCache.
- B. Store session state in Amazon CloudFront.
- C. Store session state in Amazon S3.
- D. Enable session stickiness using an Elastic Load Balancer.
View question →
Q99. A company runs an application on Amazon EC2 instances behind an Application Load Balancer. The EC2 instances run in an Auto Scaling group across multiple Availability Zones. The application requires retrieving application secrets during startup and exporting them as environment variables. These secrets must be encrypted at rest and rotated monthly. Which solution meets these requirements with the least development effort?
- A. Store secrets in a text file and store the file in Amazon S3. Provide a custom managed key. Use that key to encrypt the secrets in Amazon S3. Read the file contents and export them as environment variables. Configure S3 Object Lambda to rotate the text file monthly.
- B. Store secrets as strings in AWS Systems Manager Parameter Store using the default AWS Key Management Service (AWS KMS) key. Configure an Amazon EC2 user data script to retrieve the secrets during launch and export them as environment variables. Configure an AWS Lambda function to rotate the secrets in Parameter Store monthly.
- C. Store secrets as Base64-encoded environment variables in the application properties. Retrieve the secrets during application startup. Reference these secrets in the application code. Write a script to rotate the environment-variable-stored secrets.
- D. Store secrets in AWS Secrets Manager. Provide a new customer master key. Use that key to encrypt the secrets. Enable automatic rotation. Configure an Amazon EC2 user data script to programmatically retrieve the secrets during launch and export them as environment variables.
View question →
Q100. A developer has a containerized integration and delivery (CI/CD) pipeline using AWS CodeArtifact and AWS CodeBuild. Build artifacts range between 0.5 GB and 1.5 GB. Builds occur frequently, and each build retrieves numerous dependencies from CodeArtifact. Due to the time required to download dependencies, build speed has slowed. The developer needs to reduce the number of dependencies retrieved per build to improve build performance. Which solution meets this requirement?
- A. Specify an Amazon S3 cache in CodeBuild. Add the S3 cache folder path to the buildspec.yaml file.
- B. Specify a local cache in CodeBuild. Add the CodeArtifact repository name to the buildspec.yaml file.
- C. Specify a local cache in CodeBuild. Add the cache folder path to the buildspec.yaml file.
- D. Retrieve the buildspec.yaml file directly from CodeArtifact. Add the CodeArtifact repository name to the buildspec.yaml file.
View question →