AWS DVA-C02 Chapter 2 Practice Questions (100 Questions)

Practice questions for the AWS DVA-C02 (Developer Associate) exam, Chapter 2.

1. Q1. A developer is building an application that interacts with an AWS Lambda backend via an Amazon API Gateway API. The frontend team needs immediate access to the API endpoints to build the user interface. To prepare the backend for integration, the developer must configure endpoints that return predefined HTTP status codes and JSON responses to the frontend team. The developer has created a mock resource for the API. Which solution meets these requirements?

   • A. Set the integration type to AWS_PROXY. Prepare the Lambda function to return hardcoded JSON data.
   • B. Set the integration type to MOCK. Configure the method’s integration request and integration response to associate JSON responses with specific HTTP status codes.
   • C. Set the integration type to HTTP_PROXY. Configure API Gateway to forward all requests to an external placeholder API to be built by the team.
   • D. Set the integration type to MOCK. Define HTTP status codes using method request. Define JSON responses using integration request.

   View question →

2. Q2. A developer has built a serverless application on AWS using Amazon API Gateway, AWS Lambda functions, and Amazon Route 53. During testing, the developer identified errors but could not immediately determine root causes. To identify these errors, the developer needs to search and analyze logs from all application components. What should the developer do to meet this requirement with the lowest operational overhead?

   • A. Configure API Gateway health checks to monitor application availability. Use the Amazon CloudWatch PutMetricData API operation to publish logs to CloudWatch. Use Amazon Athena to search and query logs.
   • B. Configure Route 53 health checks to monitor application availability. Enable AWS CloudTrail to log all API calls made by the application’s AWS services. Send logs to a designated Amazon S3 bucket. Use Amazon Athena to directly query logs from Amazon S3.
   • C. Configure all application AWS services to push log events in real time to an Amazon Kinesis Data Firehose delivery stream. Configure the delivery stream to publish all logs to an Amazon S3 bucket. Use Amazon OpenSearch Service to search and analyze logs.
   • D. Configure Route 53 health checks to monitor application availability. Enable Amazon CloudWatch Logs to log API request JSON-formatted logs at the API Gateway stage. Use CloudWatch Logs Insights to search and analyze logs from AWS services.

   View question →

3. Q3. A company maintains copies of customer ID cards in its on-premises systems. The company wants its on-premises systems to upload ID card images directly to an Amazon S3 bucket. What is the most secure solution to meet this requirement?

   • A. Use the AWS SDK to upload images directly from the on-premises system to the S3 bucket. Create an IAM user. Attach a policy granting s3:PutObject permission to the user. Configure the on-premises system to authenticate to AWS using the generated access key and secret.
   • B. Use the AWS SDK to upload images directly from the on-premises system to the S3 bucket. Create an IAM role. Attach a policy granting s3:PutObject permission to the role. Configure the on-premises system to use the AssumeRole functionality in the AWS SDK to authenticate to AWS.
   • C. Use S3 presigned URLs to upload images directly from the on-premises system to the S3 bucket. Generate presigned URLs using an AWS Lambda function and a private REST API endpoint. Establish an AWS Site-to-Site VPN connection between the on-premises network and a VPC to allow the on-premises system to call the API and receive presigned URLs.
   • D. Use S3 presigned URLs to upload images directly from the on-premises system to the S3 bucket. Generate presigned URLs using an AWS Lambda function and a public REST API endpoint. Protect the API using an Amazon Cognito authorizer. Create a Cognito user for the on-premises system to authenticate and call the API to receive presigned URLs.

   View question →

4. Q4. A developer wants to test a new version of an application in a test environment using AWS Elastic Beanstalk. Which deployment policy results in the fastest deployment?

   • A. Immutable
   • B. Rolling
   • C. Rolling with additional batch
   • D. All at once

   View question →

5. Q5. A developer is building a serverless application that uses an AWS Lambda function. The developer will deploy the application using AWS CloudFormation. The application will log to Amazon CloudWatch Logs. The developer has already created a log group for the application in the CloudFormation template. The developer needs to modify the CloudFormation template to provide the log group name to the application at runtime. Which solution meets this requirement?

   • A. Use the AWS::Include transform in CloudFormation to provide the log group name to the application.
   • B. Pass the log group name to the application in the user data section of the CloudFormation template.
   • C. Specify the log group name for the application using the Mappings section of the CloudFormation template.
   • D. Pass the Amazon Resource Name (ARN) of the log group as an environment variable to the Lambda function.

   View question →

6. Q6. A developer is implementing a serverless application using the AWS Cloud Development Kit (AWS CDK). The developer will provision an AWS Lambda function and an Amazon API Gateway API during AWS CloudFormation stack creation. The developer has installed both the AWS Serverless Application Model (AWS SAM) and AWS CDK locally. How can the developer test a specific Lambda function locally?

   • A. Run the sam package and sam deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
   • B. Run the cdk synth and cdk deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
   • C. Run cdk synth and sam local invoke commands, specifying the function construct identifier and the path to the synthesized CloudFormation template.
   • D. Run cdk synth and samlocal start-lambda commands, specifying the function construct identifier and the path to the synthesized CloudFormation template.

   View question →

7. Q7. A developer has deployed an application that runs on an Amazon EC2 instance. The developer is adding functionality to the application to upload objects to an Amazon S3 bucket. Which policy must the developer modify to allow the instance to upload these objects?

   • A. The IAM policy attached to the EC2 instance profile role
   • B. The session policy applied to the EC2 instance role session
   • C. The AWS Key Management Service (AWS KMS) key policy attached to the EC2 instance profile role
   • D. The Amazon VPC endpoint policy

   View question →

8. Q8. A developer is building a serverless application that requires an AWS Lambda function to be invoked every 10 minutes. What is an automated and serverless way to invoke this function?

   • A. Deploy a Linux-based Amazon EC2 instance and edit its /etc/crontab file to add a command that periodically invokes the Lambda function.
   • B. Configure an environment variable named PERIOD for the Lambda function and set its value to 600.
   • C. Create an Amazon EventBridge rule that runs on a scheduled interval to invoke the Lambda function.
   • D. Create an Amazon Simple Notification Service (Amazon SNS) topic subscribed by the Lambda function with a 600-second timer.

   View question →

9. Q9. A company is hosting a workshop for external users and wants to share participation documents with them for a duration of 7 days. The company stores the participation documents in an Amazon S3 bucket owned by the company. What is the most secure method to share these documents with external users?

   • A. Use S3 pre-signed URLs to share the documents with external users. Set the expiration time to 7 days.
   • B. Move the documents to an Amazon WorkDocs folder. Share the WorkDocs folder link with external users.
   • C. Create a temporary IAM user with read-only access to the S3 bucket. Share the access keys with external users and expire the credentials after 7 days.
   • D. Create an IAM role with read-only access to the S3 bucket. Share the role’s Amazon Resource Name (ARN) with external users.

   View question →

10. Q10. A data visualization company wants to enhance security for its core applications, which are deployed on AWS across development, test, pre-production, and production environments. The company needs to encrypt all sensitive credentials at rest. Credentials must be automatically rotated. Each environment must store one version of the credentials. Which solution satisfies these requirements in the most efficient way?

    • A. Configure AWS Secrets Manager versions to store different copies of the same credential across multiple environments.
    • B. Create a new parameter version in AWS Systems Manager Parameter Store for each environment. Store environment-specific credentials in the parameter version.
    • C. Configure environment variables in the application code, using different names for each environment type.
    • D. Configure AWS Secrets Manager to create a new secret for each environment type. Store environment-specific credentials in the secret.

    View question →

11. Q11. A developer is running an application on an Amazon EC2 instance. When the application attempts to read from an Amazon S3 bucket, it fails. The developer notices that the associated IAM role lacks S3 read permissions. The developer needs to grant the application the ability to read from the S3 bucket. Which solution meets this requirement with minimal application interruption?

    • A. Add the required permissions to the role. Terminate the existing EC2 instance and launch a new one.
    • B. Add the permissions to the role so that the change takes effect immediately.
    • C. Add the permissions to the role. Stop and restart the existing EC2 instance.
    • D. Add permissions to the S3 bucket. Restart the EC2 instance.

    View question →

12. Q12. A developer wants to insert a record into an Amazon DynamoDB table immediately after a new file is added to an Amazon S3 bucket. What steps are required to achieve this goal?

    • A. Use Amazon EventBridge to create an event that monitors the S3 bucket and then inserts the record into DynamoDB.
    • B. Configure an S3 event to invoke an AWS Lambda function that inserts the record into DynamoDB.
    • C. Create an AWS Lambda function that polls the S3 bucket and then inserts the record into DynamoDB.
    • D. Create a cron job that runs on a schedule and inserts the record into DynamoDB.

    View question →

13. Q13. A company has deployed infrastructure on AWS. The development team wants to create an AWS Lambda function to retrieve data from an Amazon Aurora database. The Amazon Aurora database resides in a private subnet within the company's VPC, named VPC1. Data security is critical. The Lambda function must securely access the database. Which solution meets these requirements?

    • A. Create the Lambda function. Configure the function for VPC1 access. Attach a security group named SG1 to both the Lambda function and the database. Configure inbound and outbound rules on the security group to allow TCP traffic on port 3306.
    • B. Create and launch the Lambda function in a new public subnet within a new VPC named VPC2. Create a VPC peering connection between VPC1 and VPC2.
    • C. Create the Lambda function. Configure the function for VPC1 access. Assign a security group named SG1 to the Lambda function. Assign a second security group named SG2 to the database. Add an inbound rule to SG1 to allow TCP traffic from port 3306.
    • D. Export data from the Aurora database to Amazon S3. Create and launch the Lambda function in VPC1. Configure the Lambda function to query data from Amazon S3.

    View question →

14. Q14. A company has built a serverless application for its e-commerce workload. The application includes a REST API in Amazon API Gateway that invokes an AWS Lambda function. The Lambda function processes data and stores it in an Amazon DynamoDB table. The Lambda function also calls a third-party stock fulfillment application API to process orders. After order processing completes, the Lambda function returns an HTTP 200 status code to the client with no response body. During peak periods, when API calls exceed a defined threshold, the third-party stock fulfillment application sometimes fails to process requests and returns error messages. The company requires a solution that prevents overwhelming the third-party stock fulfillment application. Which solution meets these requirements?

    • A. Configure the REST API in Amazon API Gateway to write requests directly to DynamoDB. Configure a DynamoDB built-in function to perform transformations. Set up a DynamoDB stream to invoke the third-party stock fulfillment application API upon each new row insertion. Remove the Lambda function.
    • B. Configure the REST API in Amazon API Gateway to write requests directly to an Amazon Simple Queue Service (Amazon SQS) queue. Set the Lambda function's reserved concurrency to match the third-party stock fulfillment application's threshold. Configure the Lambda function to process messages from the SQS queue.
    • C. Configure the REST API in Amazon API Gateway to write requests directly to an Amazon Simple Notification Service (Amazon SNS) topic. Set the Lambda function's provisioned concurrency to match the third-party stock fulfillment application's threshold. Configure the Lambda function to process messages from the SNS topic.
    • D. Configure the REST API in Amazon API Gateway to write requests directly to Amazon Athena. Use SQL to configure data transformation and set multiple query result locations pointing to the DynamoDB table and the third-party stock fulfillment application API. Remove the Lambda function.

    View question →

15. Q15. A company has built a new application in the AWS Cloud. The company uses AWS CloudFormation templates to automate the provisioning of Auto Scaling resources. The provisioning scripts contain sensitive data. The company requires a solution integrated with CloudFormation to manage sensitive data in the provisioning scripts. Which solution satisfies these requirements in the most secure manner?

    • A. Store sensitive data in CloudFormation parameters. Encrypt the CloudFormation template using an AWS Key Management Service (AWS KMS) key.
    • B. Store sensitive data in an Amazon S3 bucket. Update the CloudFormation template to download the object from Amazon S3 during instance bootstrapping.
    • C. Store sensitive data in AWS Systems Manager Parameter Store as SecureString parameters. Update the CloudFormation template to use dynamic references to specify template values.
    • D. Store sensitive data in Amazon Elastic File System (Amazon EFS). Enforce EFS encryption after file system creation. Update the CloudFormation template to retrieve data from Amazon EFS.

    View question →

16. Q16. A company is building an application on AWS. The application’s backend includes a REST API in Amazon API Gateway. Frontend application developers need to continue working before the backend API is ready for integration. The company requires a solution enabling frontend developers to proceed with development. Which solution satisfies these requirements with maximum operational efficiency?

    • A. Configure mock integrations for the API Gateway API methods.
    • B. Integrate a Lambda function with API Gateway and return mock responses.
    • C. Add a new API endpoint to the API Gateway stage and return mock responses.
    • D. Configure proxy resources for the API Gateway API methods.

    View question →

17. Q17. A company is migrating its legacy human resources application to AWS. Leadership wants to rebuild the employee directory using native AWS services. A developer needs to design a solution to store employees’ contact information and high-resolution photos for use by the new application. Which solution supports searching and retrieving individual employee details and photos using AWS APIs?

    • A. Base64-encode each employee’s contact information and photo. Store the information in an Amazon DynamoDB table using a sort key.
    • B. Store each employee’s contact information in an Amazon DynamoDB table, along with the object key of the corresponding photo stored in Amazon S3.
    • C. Use Amazon Cognito user pools to implement the employee directory as a fully managed Software-as-a-Service (SaaS) solution.
    • D. Store employee contact information in an Amazon RDS DB instance and store photos in Amazon Elastic File System (Amazon EFS).

    View question →

18. Q18. A company stores documents in Amazon S3 using default settings. A new compliance requirement mandates encryption of static documents, annual rotation of encryption keys, and logging of key rotation timestamps. The company does not want to manage encryption keys outside AWS. Which solution satisfies these requirements?

    • A. Use server-side encryption with Amazon S3-managed encryption keys (SSE-S3).
    • B. Use server-side encryption with AWS KMS–managed encryption keys (SSE-KMS).
    • C. Use server-side encryption with customer-provided encryption keys (SSE-C).
    • D. Use client-side encryption before sending data to Amazon S3.

    View question →

19. Q19. A developer is building an application using Amazon DynamoDB. The developer wants to retrieve a specific item from the database using a single API call. Which DynamoDB API call minimizes impact on the database while meeting this requirement?

    • A. BatchGetItem
    • B. GetItem
    • C. Scan
    • D. Query

    View question →

20. Q20. A developer is building a microservices-based application on AWS using Python and several AWS services. The developer intends to use AWS X-Ray. Using the console, the developer views service dependencies and the service map. During testing, the developer notices some services are missing from the service map. What should the developer do to ensure all services appear in the X-Ray service map?

    • A. Modify the X-Ray Python daemon configuration in each service to increase the sampling rate.
    • B. Instrument the application using the X-Ray SDK for Python. Install the X-Ray SDK for all services used by the application.
    • C. Enable X-Ray data aggregation in Amazon CloudWatch Logs for all services used by the application.
    • D. Increase the X-Ray service map timeout value in the X-Ray console.

    View question →

21. Q21. A company needs to distribute firmware updates to its global customers. Which service will allow the company to control access to downloads in the most cost-effective, scalable, and secure manner?

    • A. Use Amazon CloudFront with Amazon S3 signed URLs.
    • B. Create a dedicated Amazon CloudFront distribution for each customer.
    • C. Use Amazon CloudFront with AWS Lambda@Edge.
    • D. Use Amazon API Gateway and AWS Lambda to control access to the S3 bucket.

    View question →

22. Q22. A company hosts a client-side web application in an Amazon S3 bucket. The web application is accessible via Amazon CloudFront at https://www.example.com. After a successful launch, the company wants to host additional client-side web applications for other customers in separate S3 buckets. To achieve this, developers moved shared JavaScript files and web fonts to a central S3 bucket to serve all web applications. However, during testing, developers noticed browsers blocking the JavaScript files and web fonts. What should the developers do to prevent browsers from blocking these resources?

    • A. Create four access points to allow access to the central S3 bucket. Assign one access point to each web application bucket.
    • B. Create a bucket policy that allows access to the central S3 bucket and attach it to the central S3 bucket.
    • C. Create a Cross-Origin Resource Sharing (CORS) configuration that allows access to the central S3 bucket and add the CORS configuration to the central S3 bucket.
    • D. Create a Content-MD5 header to provide message integrity checks for the central S3 bucket. Insert the Content-MD5 header for each web application request.

    View question →

23. Q23. A developer manages multiple AWS accounts. Each account contains an Amazon RDS database instance deployed within a private VPC. The developer needs to create and manage identical database users consistently across all databases. The solution must ensure the same users are created and updated identically in every account. Which solution meets these requirements with the highest operational efficiency?

    • A. Create an AWS CloudFormation template. Declare users in the template and attach them to the database. Deploy the template in each account.
    • B. Create an AWS CloudFormation template with a custom resource to create users in the database. Deploy the template in each account.
    • C. Write a script to create users. Deploy an Amazon EC2 instance in each account to run the script against the database. Run the script in each account.
    • D. Implement an AWS Lambda function to create users in the database. Provide details for all three accounts to the function.

    View question →

24. Q24. A developer is building a multi-tier web application that must handle at least 5,000 requests per minute. The web tier must be fully stateless, while the application maintains user session state externally. How should session data be externalized to keep latency as low as possible?

    • A. Create an Amazon RDS instance and implement session handling at the application level to store session data in the RDS database.
    • B. Implement a shared file system solution across underlying Amazon EC2 instances and implement session handling at the application level to store session data on the shared file system.
    • C. Create an Amazon ElastiCache Memcached cluster and implement session handling at the application level to store session data in the cluster.
    • D. Create an Amazon DynamoDB table and implement session handling at the application level to store session data in the table.

    View question →

25. Q25. A developer is migrating an on-premises application to AWS. The application currently stores user uploads in a local directory on the server. All uploads must be immediately accessible to every instance in an Auto Scaling group.

    • A. Use Amazon EBS and configure the application AMI to use a snapshot of the same EBS volume at launch.
    • B. Use Amazon S3 and refactor the application so all uploads are stored in S3.
    • C. Use instance store and share it across instances launched from the same Amazon Machine Image (AMI).
    • D. Use Amazon EBS and file synchronization software to achieve eventual consistency across Auto Scaling group instances.

    View question →

26. Q26. { "Version ":"2012-10-17 "Statement":[ { "Effect": "Allow", "Action":[ "s3: Getobject", "s3: Putobject" ], "Resource" : "arn:aws:s3:::DOC-EXAMPLE-BUCKET/∗" }, { "Effect":"Deny", "Action":"s3:∗", "Resource":"arn:aws:s3:DOC-EXAMPLE-BUCKET/secrets∗" } ] } 对于s3:Getobject 和s3:Putobject 操作，该策略允许据些访问？

    • A. 访问除DOC-EXAMPLE -BUCKET 存储桶之外的所有存储桶
    • B. 访问以“DOC-EXAMPLE -BUCKET 开头的所有存储桶(DOC-EXAMPLE -BUCKET /secrets ”存储桶除外)
    • C. 访问“DOC-EXAMPLE -BUCKET 存储桶中的所有对象，以及访问“DOC-EXAMPLE -BUCKET 存储桶中以" secrets 开头的对象的所有S3操作
    • D. 访问“DOC-EXAMPLE -BUCKET 存储桶中的所有对象（以“secret 开头的对象除外）

    View question →

27. Q27. A developer accesses AWS CodeCommit via SSH. The SSH key used to access AWS CodeCommit is associated with an IAM user having the following permissions: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "codecommit:BatchGetRepositories", "codecommit:Get*", "codecommit:List*", "codecommit:GitFull" ], "Resource": "*" } ]}. The developer needs to create and delete branches. Based on the principle of least privilege, which specific IAM permissions should be added?

    • A. "codecommit:CreateBranch", "codecommit:DeleteBranch"
    • B. "codecommit:Put*"
    • C. "codecommit:Update*"
    • D. "codecommit:*"

    View question →

28. Q28. A company has an application that uploads files to an Amazon S3 bucket. Whenever a new file arrives, an S3 event notification triggers an AWS Lambda function to process it. The Lambda function code is expected to work correctly. However, when developers inspect Lambda logs, they observe duplicate invocations for each file. What causes the duplicate invocations?

    • A. The S3 bucket name is misconfigured in the application and targets a different S3 bucket.
    • B. The Lambda function fails intermittently, causing Lambda to retry the invocation.
    • C. Amazon S3 delivers the same event multiple times.
    • D. The application stops and resumes intermittently, splitting logs into multiple smaller files.

    View question →

29. Q29. A company built a live quiz platform. For each quiz, the company generates a leaderboard based on scores. Leaderboard data is stored in Amazon DynamoDB and retained for 30 days after the quiz ends. Later, the company uses a scheduled job to delete old leaderboard data. The DynamoDB table is configured with provisioned write capacity. During months with frequent quizzes, the scheduled deletion job triggers write throttling (ProvisionedThroughputExceededException). Developers need a long-term solution to delete old leaderboard data while minimizing write capacity consumption. Which solution meets these requirements?

    • A. Configure a TTL (Time-to-Live) attribute for leaderboard data.
    • B. Use DynamoDB Streams to schedule and delete leaderboard data.
    • C. Use AWS Step Functions to schedule and delete leaderboard data.
    • D. Increase the write capacity units temporarily while the scheduled deletion job runs.

    View question →

30. Q30. A developer is creating an AWS Lambda function that runs in a VPC. An Amazon S3 event triggers the Lambda function when objects are uploaded to an S3 bucket. The Lambda function processes the object and generates some analytical results, which are written to a file. Each processed object also generates a log entry, which is written to another file. Other Lambda functions, AWS services, and on-premises resources must be able to access both the results file and the log file. Each log entry must also be appended to a shared log file. The developer needs a solution that enables shared file access and allows appending results to existing files. Which solution should the developer use to meet these requirements?

    • A. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in Lambda. Store the results file and log file on the mount point. Append log entries to the log file.
    • B. Create an Amazon Elastic Block Store (Amazon EBS) volume with multi-attach enabled. Attach the EBS volume to all Lambda functions. Update the Lambda function code to download the log file, append the log entry, and upload the modified log file to Amazon EBS.
    • C. Create a reference to the /tmp local directory. Use this directory reference to store the results file and log file. Append log entries to the log file.
    • D. Create a reference to the /opt storage directory. Use this directory reference to store the results file and log file. Append log entries to the log file.

    View question →

31. Q31. 给定以药AWS CloudFormation模板:Description: Creates a new Amazon S3 bucket for shared content. Uses a random bucket name to avoid conflicts.Resources: ContentBucket: Type: AWS::S3::BucketOutputs: ContentBucketName:Value: !Ref ContentBucket封另伊个AWS CloudFormation模板中反用新的Amazon S3存储桶的最有效远因是什么?

    • A. 在原始模板的 Outputs 部分添加 Export 声明,并在其他模板中使用 ImportValue。
    • B. 在原始模板的 Content.Bucket 中添加 Exported: true,并在其他模板中使用 ImportResource。
    • C. 创建一个自定义 AWS CloudFormation 资源,该资源从第一个堆栈的 ContentBucket 资源获取存储桶名称。
    • D. 使用 Fn::Include 将现有模板包含在其他模板中,并直接使用 ContentBucket 资源。

    View question →

32. Q32. An application uses Amazon DynamoDB as its data store and must support strongly consistent reads of 100 items per second. Each item is 5 KB in size. What should the table's provisioned read capacity be set to?

    • A. 50 read capacity units
    • B. 100 read capacity units
    • C. 200 read capacity units
    • D. 500 read capacity units

    View question →

33. Q33. A developer is building a serverless application on AWS to process large volumes of data in a workflow. Within the workflow, an AWS Step Functions state machine invokes several AWS Lambda functions. One of the Lambda functions occasionally fails with a timeout error during execution. The developer must ensure that if a timeout error occurs, the workflow automatically retries the failed function invocation. Which solution meets this requirement?

    • A. Add a Retry field in the Step Functions state machine definition. Configure the state machine to specify the maximum number of retries and the timeout error type to retry.
    • B. Add a Timeout field in the Step Functions state machine definition. Configure the state machine to specify the maximum number of retries.
    • C. Add a Fail state in the Step Functions state machine definition. Configure the state machine to specify the maximum number of retries.
    • D. Update the Step Functions state machine to send the invocation request to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe a Lambda function to the SNS topic. Configure the Lambda function’s maximum retry count for the timeout error type.

    View question →

34. Q34. A developer is building a new application that uses an Amazon DynamoDB table. The specification requires deletion of all items older than 48 hours. Which solution meets this requirement?

    • A. Create a new attribute with numeric data type. Add a Local Secondary Index (LSI) on this attribute and enable TTL with a 48-hour expiration. In application code, set this attribute’s value to the current timestamp for each newly inserted item.
    • B. Create a new attribute with string data type. Add a Local Secondary Index (LSI) on this attribute and enable TTL with a 48-hour expiration. In application code, set this attribute’s value to the current timestamp for each newly inserted item.
    • C. Create a new attribute with numeric data type. Enable TTL on the DynamoDB table for this attribute. In application code, set this attribute’s value to the current timestamp plus 48 hours for each newly inserted item.
    • D. Create a new attribute with string data type. Enable TTL on the DynamoDB table for this attribute. In application code, set this attribute’s value to the current timestamp plus 48 hours for each newly inserted item.

    View question →

35. Q35. A developer needs to modify the application architecture to meet new functional requirements. Application data is stored in Amazon DynamoDB and is analyzed during batch processing. Data analysts do not want to wait until the next day to view processed data; instead, they require near real-time visibility. Which application architecture pattern enables data processing as it is ingested?

    • A. Event-driven
    • B. Client-server driven
    • C. Fan-out driven
    • D. Time-driven

    View question →

36. Q36. A developer manages an application that uses AWS Secrets Manager to store secrets. These applications use rotating secrets. The developer needs to identify which secrets are still in active use and wants to avoid any application downtime. What should the developer do to meet these requirements?

    • A. Configure AWS CloudTrail to deliver log files to an Amazon S3 bucket. Create an Amazon CloudWatch alarm for GetSecretValue Secrets Manager API calls.
    • B. Create a secretsmanager-secret-unused AWS Config managed rule. Create an Amazon EventBridge rule to trigger notifications when the AWS Config managed rule evaluates to true.
    • C. Temporarily disable the application’s secrets and monitor application error logs.
    • D. Configure AWS X-Ray for the application. Create a sampling rule to match GetSecretValue Secrets Manager API calls.

    View question →

37. Q37. A developer created a Lambda function for a web application backend. When testing the Lambda function in the AWS Lambda console, the developer observes that the function executes, but no log data appears in Amazon CloudWatch Logs—even after several minutes. What is causing this behavior?

    • A. The Lambda function contains no explicit logging statements to send log data to CloudWatch Logs.
    • B. The Lambda function lacks CloudWatch Logs as a source trigger for log data.
    • C. The Lambda function’s execution role lacks permissions to write log data to CloudWatch Logs.
    • D. The Lambda function lacks a target CloudWatch Logs log group.

    View question →

38. Q38. A company is hosting a workshop for external users and wants to share registration documents with them for 7 days. The company stores the registration documents in its own Amazon S3 bucket. What is the most secure way to share the documents with external users?

    • A. Use S3 pre-signed URLs to share the documents with external users. Set a 7-day expiration time.
    • B. Move the documents to an Amazon WorkDocs folder and share a link to the WorkDocs folder with external users.
    • C. Create a temporary IAM user with read-only access to the S3 bucket. Share the access keys with external users and expire the credentials after 7 days.
    • D. Create an IAM role with read-only access to the S3 bucket. Share the role’s Amazon Resource Name (ARN) with external users.

    View question →

39. Q39. A developer is using AWS CloudFormation to deploy an Amazon API Gateway API and an AWS Step Functions state machine. After deploying the CloudFormation template, the state machine must invoke the API Gateway API. The developer needs a solution to enable the state machine to invoke the API Gateway endpoint. Which solution will most cost-effectively meet these requirements?

    • A. Configure the CloudFormation template to reference the API endpoint in the DefinitionSubstitutions property of the AWS::StepFunctions::StateMachine resource.
    • B. Configure the CloudFormation template to store the API endpoint in environment variables of the AWS::StepFunctions::StateMachine resource. Configure the state machine to reference the environment variable.
    • C. Configure the CloudFormation template to store the API endpoint in a standard AWS::SecretsManager::Secret resource. Configure the state machine to reference the resource.
    • D. Configure the CloudFormation template to store the API endpoint in a standard AWS::AppConfig::ConfigurationProfile resource. Configure the state machine to reference the resource.

    View question →

40. Q40. A company plans to use AWS CodeDeploy to deploy an application to Amazon Elastic Container Service (Amazon ECS). During deployment of a new application version, the company initially must expose only 10% of live traffic to the newly deployed application version. Then, after 15 minutes, the company must route all remaining live traffic to the newly deployed application version. Which predefined CodeDeploy configuration meets these requirements?

    • A. CodeDeployDefault.ECSCanary10Percent15Minutes
    • B. CodeDeployDefault.LambdaCanary10Percent5Minutes
    • C. CodeDeployDefault.LambdaCanary10Percent15Minutes
    • D. CodeDeployDefault.ECSLinear10PercentEvery1Minute

    View question →

41. Q41. A developer is using AWS CodePipeline to provide continuous integration and continuous delivery (CI/CD) support for a Java application. The developer wants to update the pipeline to support ingestion of a new application dependency .jar file. The pipeline must trigger a build when a new version of the .jar file becomes available. Which solution meets these requirements?

    • A. Create an Amazon S3 bucket to store the dependency .jar file. Publish the dependency .jar file to the S3 bucket. Use Amazon Simple Notification Service (Amazon SNS) notifications to trigger the CodePipeline pipeline build.
    • B. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use an ECR source action to trigger the CodePipeline pipeline build.
    • C. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use Amazon Simple Notification Service (Amazon SNS) notifications to trigger the CodePipeline pipeline build.
    • D. Create an AWS CodeArtifact repository. Publish the dependency .jar file to the repository. Use an Amazon EventBridge rule to trigger the CodePipeline pipeline build.

    View question →

42. Q42. A developer is creating an AWS Lambda function. The Lambda function will process messages from an Amazon Simple Queue Service (Amazon SQS) queue. The developer wants to integrate unit testing into the CI/CD workflow.

    • A. Create an AWS CloudFormation template to create the SQS queue and deploy the Lambda function. Create the stack from the template during the CI/CD process. Invoke the deployed function and verify output.
    • B. Create an SQS event for testing. Use a test that consumes messages from the SQS queue during the function's CI/CD process.
    • C. Create an SQS queue for testing. Use this SQS queue in the application's unit tests. Run unit tests during the CI/CD process.
    • D. Use the aws lambda invoke command with a test event during the CI/CD process.

    View question →

43. Q43. A developer has deployed an application running on an Amazon EC2 instance. The developer is adding functionality to upload objects to an Amazon S3 bucket.

    • A. IAM policy attached to the EC2 instance profile role.
    • B. Session policy applied to the EC2 instance role session.
    • C. AWS Key Management Service (AWS KMS) key policy attached to the EC2 instance profile role.
    • D. Amazon VPC endpoint policy.

    View question →

44. Q44. A developer is optimizing an AWS Lambda function and wants to test these changes on a subset of production traffic. The Lambda function serves requests for a REST API in Amazon API Gateway. The developer needs to deploy their changes for testing in production without changing the API Gateway URL. Which solution meets these requirements?

    • A. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. In the production API Gateway stage, define a canary release and configure traffic percentage to route to the canary. Update the API Gateway endpoint to use the Lambda function’s $LATEST version. Deploy the API to the canary stage.
    • B. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the Lambda function’s $LATEST version. Deploy a new API Gateway stage.
    • C. Define an alias on the Lambda function’s $LATEST version. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. In the production API Gateway stage, define a canary release and configure traffic percentage to route to the canary. Update the API Gateway endpoint to use the Lambda function’s $LATEST version. Deploy to the canary stage.
    • D. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the Lambda function’s $LATEST version. Deploy the API to the production API Gateway stage.

    View question →

45. Q45. A developer uses Amazon S3 as an event source, invoking a Lambda function when new objects are created in the bucket. The event source mapping information is stored in the bucket notification configuration. The developer uses different versions of the Lambda function and frequently needs to update the notification configuration so Amazon S3 invokes the correct version.

    • A. Use different Lambda triggers.
    • B. Use Lambda environment variables.
    • C. Use Lambda aliases.
    • D. Use Lambda tags.

    View question →

46. Q46. A developer is building a service that uses an Amazon S3 bucket for image uploads. The service will use an AWS Lambda function to generate thumbnails for each uploaded image. Each time an image is uploaded, the service must send an email notification confirming thumbnail creation. The developer needs to configure both image processing and email notification. Which solution meets these requirements?

    • A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure S3 event notifications with the target set to the SNS topic. Subscribe the Lambda function to the SNS topic. Create an email subscription for the SNS topic.
    • B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure S3 event notifications with the target set to the SNS topic. Subscribe the Lambda function to the SNS topic. Create an Amazon Simple Queue Service (Amazon SQS) queue. Subscribe the SQS queue to the SNS topic. Create an email notification subscription for the SQS queue.
    • C. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure S3 event notifications with the target set to the SQS queue. Subscribe the Lambda function to the SQS queue. Create an email notification subscription for the SQS queue.
    • D. Create an Amazon Simple Queue Service (Amazon SQS) queue. Send S3 event notifications to Amazon EventBridge. Create an EventBridge rule to run the Lambda function when an image is uploaded to the S3 bucket. Create an EventBridge rule to send notifications to the SQS queue. Create an email notification subscription for the SQS queue.

    View question →

47. Q47. A developer needs to analyze performance issues in a distributed production application implemented as AWS Lambda functions. These distributed Lambda applications invoke other components of the application. How should the developer identify and troubleshoot the root cause of performance issues in the production environment?

    • A. Add logging statements in the Lambda functions and then use Amazon CloudWatch to view the logs.
    • B. Use AWS CloudTrail and then examine the logs.
    • C. Use AWS X-Ray and then examine segments and errors.
    • D. Run the Amazon Inspector agent and then analyze performance.

    View question →

48. Q48. A company runs an application on Amazon EC2 instances. The EC2 instances connect to an Amazon RDS for SQL Server database. A developer needs to store and access credentials securely and rotate them automatically. The developer does not want to store database credentials in code. Which solution meets these requirements in the most secure way?

    • A. Create an IAM role with permissions to access the database and attach the IAM role to the EC2 instance.
    • B. Store credentials as secrets in AWS Secrets Manager. Create an AWS Lambda function to update the secrets and the database password. Retrieve credentials from Secrets Manager as needed.
    • C. Store credentials in an encrypted text file in an Amazon S3 bucket. Configure the EC2 instance launch template to download the credentials from Amazon S3 at instance launch. Create an AWS Lambda function to update the secrets and the database.
    • D. Store credentials in an Amazon DynamoDB table. Configure an Amazon CloudWatch Events rule to invoke an AWS Lambda function to periodically update the secrets and the database.

    View question →

49. Q49. A developer is deploying an AWS Lambda function. The developer wants to quickly and seamlessly revert to a previous version of the function. How can the developer achieve this goal with the lowest operational overhead?

    • A. Use AWS OpsWorks to perform blue/green deployments.
    • B. Use function aliases with different versions.
    • C. Retain previous versions of the deployment package in Amazon S3.
    • D. Use AWS CodePipeline for deployment and rollback.

    View question →

50. Q50. A developer supports an application that accesses data in an Amazon DynamoDB table. One of the item attributes is expirationDate, formatted as a timestamp. The application uses a scheduled job to scan the table, retrieve items with expired timestamps, and delete them. The application is being deprecated, and the developer must adopt an alternative implementation for this functionality. The developer needs a solution requiring the least amount of custom code. Which solution meets these requirements?

    • A. Enable TTL on the expirationDate attribute in the table. Create a DynamoDB stream. Create an AWS Lambda function to process deleted items. Configure a DynamoDB trigger for the Lambda function.
    • B. Create two AWS Lambda functions—one to delete items and one to process items. Create a DynamoDB stream. Use the DeleteItem API operation to delete items based on the expirationDate attribute. Use the GetRecords API operation to retrieve items from the DynamoDB stream for processing.
    • C. Create two AWS Lambda functions—one to delete items and one to process items. Create an Amazon EventBridge scheduled rule to invoke the Lambda functions. Use the DeleteItem API operation to delete items based on the expirationDate attribute. Use the GetRecords API operation to retrieve items directly from the DynamoDB table for processing.
    • D. Enable TTL on the expirationDate attribute in the table. Specify an Amazon Simple Queue Service (Amazon SQS) dead-letter queue as the destination for deleted items. Create an AWS Lambda function to process items.

    View question →

51. Q51. A developer needs to use Amazon DynamoDB to store customer orders. The company requires static encryption of all customer data using a company-generated key. What should the developer do to meet these requirements?

    • A. Create a DynamoDB table with encryption set to None. Code the application to decrypt data using the key when reading from the table and encrypt data using the key when writing to the table.
    • B. Use AWS Key Management Service (AWS KMS) to store the key. During DynamoDB table creation, select an AWS KMS customer-managed key and provide the Amazon Resource Name (ARN) of the AWS KMS key.
    • C. Use AWS Key Management Service (AWS KMS) to store the key. Create the DynamoDB table with default encryption. When using the DynamoDB SDK, include the kms:Encrypt parameter with the ARN of the AWS KMS key.
    • D. Use AWS Key Management Service (AWS KMS) to store the key. During DynamoDB table creation, select an AWS KMS AWS-managed key and provide the Amazon Resource Name (ARN) of the AWS KMS key.

    View question →

52. Q52. A developer wants to use AWS Elastic Beanstalk to test a new application version in a test environment. Which deployment strategy is the fastest?

    • A. Immutable
    • B. Rolling
    • C. Rolling with additional batches
    • D. All at once

    View question →

53. Q53. A company has a development team using AWS CodeCommit for version control. The team has a CodeCommit repository in a single AWS account. The team is expanding to include developers working from different locations. The company must ensure developers can securely access these repositories. Which solution meets these requirements in the most operationally efficient way?

    • A. Configure an IAM role for each developer and grant access individually.
    • B. Configure permission sets in AWS IAM Identity Center to grant access to the account.
    • C. Share AWS access keys with the development team for direct repository access.
    • D. Use public SSH keys for authentication to CodeCommit repositories.

    View question →

54. Q54. A company’s developer is building an application using Amazon API Gateway. The company wants to ensure only users from the Sales department can use the application. Users authenticate via Amazon Cognito using federated credentials from a backend identity provider (IdP). The developer has configured a claim mapping to map a Department claim and pass it to a custom AWS Lambda authorizer. To test access restrictions, the developer sets their department to Engineering in the IdP and attempts to log in—the request is denied. Then, the developer updates their department to Sales in the IdP and attempts to log in again—but is still denied. The developer checks logs and finds the access denial occurred because the Department claim in the authorization context still has the value Engineering. What is the most likely reason the Department claim remains Engineering instead of updating to Sales?

    • A. Authorization caching is enabled in the custom Lambda authorizer.
    • B. Authorization caching is enabled on the Amazon Cognito user pool.
    • C. The IAM role for the custom Lambda authorizer does not have a Department tag.
    • D. The IAM role for the Amazon Cognito user pool does not have a Department tag.

    View question →

55. Q55. A company is storing large files in Amazon S3 and is building a web application to display metadata about those files to end users. Users select objects to download based on this metadata. The company requires a mechanism to index the files and store metadata with single-digit millisecond latency for retrieval.

    • A. Amazon DynamoDB
    • B. Amazon EC2
    • C. AWS Lambda
    • D. Amazon RDS

    View question →

56. Q56. A developer is integrating AWS X-Ray into an application that processes personally identifiable information (PII). The application runs on Amazon EC2 instances. Application trace messages, including encrypted API calls, are sent to Amazon CloudWatch. The developer must ensure API calls do not leave the EC2 instance boundary. Which solution satisfies these requirements?

    • A. Manually instrument the X-Ray SDK in the application code.
    • B. Use X-Ray automatic instrumentation.
    • C. Use Amazon Macie to detect and redact PII; invoke X-Ray APIs from AWS Lambda.
    • D. Use AWS Distro for OpenTelemetry.

    View question →

57. Q57. A company is migrating its on-premises database to Amazon RDS for MySQL. The company has a heavy read workload and wants to refactor its code to achieve optimal query read performance. Which solution meets this requirement with minimal current and future effort?

    • A. Use a Multi-AZ Amazon RDS deployment. Increase the number of connections the application establishes to the database or increase the connection pool size if using a connection pool.
    • B. Use a Multi-AZ Amazon RDS deployment. Modify the code so queries access the standby RDS instance.
    • C. Deploy Amazon RDS with one or more read replicas. Modify the application code so queries use the read replica endpoint URL.
    • D. Use open-source replication software to create a MySQL database replica on Amazon EC2 instances. Modify the application code so queries use the EC2 instance IP address.

    View question →

58. Q58. A developer created an AWS Lambda function to retrieve data from a public API endpoint and process it. The Lambda function is configured to connect to a VPC’s private subnet. An Internet Gateway is attached to the VPC. The VPC uses default network ACLs and security group configurations. The developer finds the Lambda function cannot access the public API. The public API is confirmed accessible externally, but the Lambda function cannot reach it. How should the developer resolve this connectivity issue?

    • A. Ensure the network ACL allows outbound traffic to the public internet.
    • B. Ensure the security group allows outbound traffic to the public internet.
    • C. Ensure outbound traffic from the private subnet is routed to a public NAT gateway.
    • D. Ensure outbound traffic from the private subnet is routed to a new Internet Gateway.

    View question →

59. Q59. A company uses AWS Lambda functions and an Amazon API Gateway API to run a batch processing application, deploying across stages such as development, user acceptance testing (UAT), and production. A development team needs to configure the API to connect to different backend service endpoints per deployment stage. Which solution satisfies this requirement?

    • A. Store stage-specific third-party service endpoints in a Lambda layer.
    • B. Store stage-specific third-party service endpoints in API Gateway stage variables.
    • C. Encode third-party service endpoints as query parameters in the API Gateway request URL.
    • D. Store third-party service endpoints for each environment in AWS AppConfig.

    View question →

60. Q60. A company is building a compute-intensive application that runs on a single Amazon EC2 instance. The application uses attached Amazon EBS volumes to store data. The application processes sensitive information, and all data must be encrypted at rest.

    • A. Configure the Amazon EC2 instance launch template to use encrypted EBS volumes for data storage.
    • B. Add logic to write all data to an encrypted Amazon S3 bucket.
    • C. Add custom encryption algorithms to the application to encrypt and decrypt all data.
    • D. Create a new Amazon Machine Image (AMI) with an encrypted root volume and store data on the instance store (ephemeral) disk.

    View question →

61. Q61. An application running on an Amazon EC2 instance retrieves messages from a standard Amazon SQS queue. The requirement is that all messages must be encrypted at rest. The developer is instructed to use a solution that supports centralized key management and minimizes ongoing support effort.

    • A. Encrypt individual messages using client-side encryption with a customer-managed key, then write them to the SQS queue.
    • B. Use the SQS Extended Client Library with Amazon S3 and client-side encryption to encrypt individual messages.
    • C. Create an SQS queue and enable server-side encryption (SSE) using AWS KMS to encrypt the queue.
    • D. Create an SQS queue and use client-side encryption to encrypt the queue itself.

    View question →

62. Q62. A developer is designing a serverless application for customers to book concert seats. Customers submit booking requests via an Amazon API Gateway API backed by an AWS Lambda function that validates orders and generates order IDs. The application includes two additional Lambda functions: one for inventory management and another for payment processing. Both functions run asynchronously and write order records to an Amazon DynamoDB table. The application must assign seats to customers in strict order of request receipt. If a seat is accidentally oversold, the application must assign the seat to the first-order received. In that case, only the first order’s payment must be processed. However, if the first order’s payment is declined during processing, the second order must receive the seat—and its payment must be processed. Which solution satisfies these requirements?

    • A. Send the order ID to an Amazon SNS FIFO topic, which fans out to two separate Amazon SQS FIFO queues—one for inventory management and one for payment processing.
    • B. Modify the order-ID-generating Lambda function to synchronously invoke the inventory management Lambda function, then invoke the payment processing Lambda function.
    • C. Send the order ID to an Amazon SNS standard topic and subscribe both the inventory management and payment processing Lambda functions to that topic.
    • D. Send the order ID to an Amazon SQS standard queue and configure both Lambda functions to poll that queue.

    View question →

63. Q63. A company has a three-tier application that uses Amazon API Gateway, AWS Lambda, and Amazon RDS. The company wants to investigate slow response times for calls to the API Gateway API. What is the most effective way to determine which downstream call is causing the slow response time?

    • A. Use Amazon CloudWatch.
    • B. Use AWS X-Ray.
    • C. Use AWS CloudTrail.
    • D. Use VPC Flow Logs.

    View question →

64. Q64. A company is implementing an audit monitoring system using Amazon OpenSearch Service. A developer needs to create a custom AWS CloudFormation resource associated with an AWS Lambda function to configure the OpenSearch Service domain. The Lambda function must use the OpenSearch Service master user credentials to access the OpenSearch Service domain. What is the most secure way to pass these credentials to the Lambda function?

    • A. Use CloudFormation parameters to pass the master user credentials to the OpenSearch Service domain's MasterUserOptions and to the Lambda function's environment variables during deployment. Set the NoEcho property to true.
    • B. Use CloudFormation parameters to pass the master user credentials to the OpenSearch Service domain's MasterUserOptions, and create a parameter in AWS Systems Manager Parameter Store. Set the NoEcho property to true. Create an IAM role with ssm:GetParameter permission and assign it to the Lambda function. Store the parameter name as an environment variable in the Lambda function and resolve the parameter value at runtime.
    • C. Use CloudFormation parameters to pass the master user credentials to the OpenSearch Service domain's MasterUserOptions and to the Lambda function's environment variables during deployment. Encrypt the parameter values using the AWS Key Management Service (AWS KMS) encrypt command.
    • D. Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret's value for the OpenSearch Service domain's MasterUserOptions. Create an IAM role with secretsmanager:GetSecretValue permission and assign it to the Lambda function. Store the secret name as an environment variable in the Lambda function and resolve the secret value at runtime.

    View question →

65. Q65. A company runs a custom application on an on-premises Linux server, accessed via Amazon API Gateway. AWS X-Ray tracing has been enabled during API testing. How can a developer enable X-Ray tracing on the on-premises server with minimal configuration?

    • A. Install and run the X-Ray SDK on the on-premises server to capture and relay data to the X-Ray service.
    • B. Install and run the X-Ray daemon on the on-premises server to capture and relay data to the X-Ray service.
    • C. Capture incoming requests locally and configure an AWS Lambda function to pull, process, and relay related data to X-Ray using the PutTraceSegments API.
    • D. Capture incoming requests locally and configure an AWS Lambda function to pull, process, and relay related data to X-Ray using the PutTelemetryRecords API.

    View question →

66. Q66. A developer built an application that uses an AWS Lambda function to asynchronously generate short videos based on customer requests. Video generation may take up to 10 minutes. After video generation completes, a URL to download the video is pushed to the customer’s web browser. Customers must be able to access these videos for at least 3 hours after generation. Which solution meets these requirements?

    • A. Store the video in the /tmp folder of the Lambda execution environment. Push the Lambda function URL to the customer.
    • B. Store the video in an Amazon Elastic File System (Amazon EFS) file system attached to the Lambda function. Generate a presigned URL for the video object and push that URL to the customer.
    • C. Store the video in Amazon S3. Generate a presigned URL for the video object and push that URL to the customer.
    • D. Store the video in an Amazon CloudFront distribution. Generate a presigned URL for the video object and push that URL to the customer.

    View question →

67. Q67. A software company must ensure documents uploaded by users are securely stored in Amazon S3. Documents must be encrypted at rest in Amazon S3. The company wishes to avoid client-side encryption and does not want to manage security infrastructure. Additionally, the company wants to control the keys used for at-rest encryption. Which encryption key solution should developers use to meet these requirements?

    • A. Amazon S3 managed keys
    • B. Application-level encryption using customer-provided encryption keys stored in an on-premises hardware security module (HSM)
    • C. AWS Key Management Service (AWS KMS) customer-managed keys
    • D. IAM access keys

    View question →

68. Q68. A developer is troubleshooting an Amazon API Gateway API. When clients attempt to access the API endpoint, they consistently receive HTTP 400 response errors. How can the developer determine the root cause of these errors?

    • A. Create an Amazon Kinesis Data Firehose delivery stream to receive API call logs from API Gateway. Configure Amazon CloudWatch Logs as the delivery stream destination.
    • B. Enable AWS CloudTrail Insights and create a trail. Specify the Amazon Resource Name (ARN) of the API stage for the trail.
    • C. Enable AWS X-Ray for the API stage. Create an Amazon CloudWatch Logs log group. Specify the ARN of the log group for the API stage.
    • D. Enable execution logging and access logging for the API stage in Amazon CloudWatch Logs. Create a CloudWatch Logs log group. Specify the ARN of the log group for the API stage.

    View question →

69. Q69. There is a table named 'artists' and another named 'songs'. The 'artists' table uses 'ArtistName' as its partition key. The 'songs' table uses 'songName' as its partition key and 'artistName' as its sort key. The access pattern includes retrieving multiple songs and their corresponding artists in a single database operation. A developer wants the solution that minimizes network traffic and delivers optimal application performance when retrieving this information. Which solution meets these requirements?

    • A. Perform a BatchGetItem operation to retrieve items from both tables. Use a list of songName/artistName keys for the songs table and a list of artistName keys for the artists table.
    • B. Create a local secondary index (LSI) on the songs table using artistName as the partition key. Perform query operations on the songs table for each artist name and filter by song name list. Perform query operations on the artists table for each artist name.
    • C. Perform a BatchGetItem operation on the songs table using songName/artistName keys. Perform a BatchGetItem operation on the artists table using ArtistName as the key.
    • D. Perform scan operations on each table, filtering by the list of song names and artist names in the songs table and the list of artist names in the artists table.

    View question →

70. Q70. A company has an Amazon S3 bucket containing premium content. The company intends to restrict access to this content exclusively to its paying subscribers. The S3 bucket currently has default permissions—i.e., all objects are private—to prevent unauthorized public access. How can the company restrict download capability for premium content files in the S3 bucket to only paying subscribers?

    • A. Apply a bucket policy allowing anonymous users to download content from the S3 bucket.
    • B. Generate presigned object URLs for premium content files when a paying subscriber requests a download.
    • C. Add a bucket policy requiring multi-factor authentication (MFA) to access S3 bucket objects.
    • D. Enable server-side encryption on the S3 bucket to prevent non-paying website visitors from accessing the data.

    View question →

71. Q71. A developer is debugging an AWS Lambda function behind Amazon API Gateway. Every time the API Gateway endpoint is invoked, it returns an HTTP status code of 200, even though the AWS Lambda function is logging 4xx errors. What changes must be made to enable API Gateway to return the correct error codes?

    • A. Enable CORS in the API Gateway method settings.
    • B. Use Lambda proxy integration to return HTTP status codes and headers.
    • C. Enable API Gateway error passthrough.
    • D. Return the value in the x-amzn-ErrorType header.

    View question →

72. Q72. A company has deployed a photo processing application on Amazon EC2 instances. The application must process each photo in under 5 seconds. If processing exceeds 5 seconds, the development team must be notified. How can the developer implement timing measurement and notification with minimal operational overhead?

    • A. Create an Amazon CloudWatch custom metric. Publish the processing time as a metric value each time a photo is processed. Create a CloudWatch alarm based on a static threshold of 5 seconds. Notify the development team using an Amazon Simple Notification Service (Amazon SNS) topic.
    • B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Publish the processing time to the queue each time a photo is processed. Create an application to consume from the queue and determine whether any values exceed 5 seconds. Notify the development team using an Amazon Simple Notification Service (Amazon SNS) topic.
    • C. Create an Amazon CloudWatch custom metric. Publish the processing time as a metric value each time a photo is processed. Create a CloudWatch alarm that enters the ALARM state if the average value exceeds 5 seconds. Notify the development team by sending an Amazon Simple Email Service (Amazon SES) message.
    • D. Create an Amazon Kinesis data stream. Publish the processing time to the data stream each time a photo is processed. Create a CloudWatch alarm that enters the ALARM state if any value exceeds 5 seconds. Notify the development team using an Amazon Simple Notification Service (Amazon SNS) topic.

    View question →

73. Q73. A developer is building a serverless application that requires an AWS Lambda function to process any changes to an Amazon DynamoDB table. How should the developer configure the Lambda function to detect changes to the DynamoDB table?

    • A. Create an Amazon Kinesis data stream and attach it to the DynamoDB table. Create a trigger to connect the data stream to the Lambda function.
    • B. Create an Amazon EventBridge rule to invoke the Lambda function periodically. Connect the Lambda function to the DynamoDB table to detect changes.
    • C. Enable DynamoDB Streams on the table. Create a trigger to connect the DynamoDB Stream to the Lambda function.
    • D. Create an Amazon Kinesis Data Firehose delivery stream and attach it to the DynamoDB table. Configure the delivery stream destination as the Lambda function.

    View question →

74. Q74. A developer is using an AWS CodeCommit repository to store application source code and AWS CodePipeline to deploy the application. The pipeline does not start automatically and must be manually started when deployment is required. The developer needs to configure the pipeline to start automatically. Which solution meets the requirement with the lowest latency?

    • A. Create a webhook in the CodeCommit repository to directly invoke the CodePipeline API to start the pipeline.
    • B. Create an Amazon EventBridge (formerly Amazon CloudWatch Events) rule to start the pipeline when a change is detected in the CodeCommit repository.
    • C. Configure the pipeline to poll the CodeCommit repository for changes and start automatically when changes are detected.
    • D. Create a CodeCommit trigger for an Amazon Simple Notification Service (Amazon SNS) topic. Configure the SNS topic to publish to the CodePipeline API to start the pipeline.

    View question →

75. Q75. A developer is building an application in AWS Lambda. To simplify testing and deployment, the developer needs to change the database connection string without modifying the Lambda code.

    • A. Store the connection string as a secret in AWS Secrets Manager.
    • B. Store the connection string in an IAM user account.
    • C. Store the connection string in AWS KMS.
    • D. Store the connection string as a Lambda layer.

    View question →

76. Q76. A company operates a social media application receiving high traffic. User posts and interactions are persisted in an Amazon RDS database. Data changes frequently and schema may be complex. The application must serve read requests with minimal latency. The current architecture struggles to handle rapid data updates efficiently. The company needs a solution to improve application performance. Which solution meets these requirements?

    • A. Use Amazon DynamoDB Accelerator (DAX) in front of the RDS database to provide a caching layer for high-volume, rapidly changing data.
    • B. Enable Amazon S3 Transfer Acceleration on the RDS database to enhance data transfer speed from the database to the application.
    • C. Add an Amazon CloudFront distribution in front of the RDS database to provide a caching layer for high-volume, rapidly changing data.
    • D. Create an Amazon ElastiCache for Redis cluster. Update the application code to use a write-through caching strategy and read data from Redis.

    View question →

77. Q77. What is the execution order of hooks for in-place deployments using AWS CodeDeploy?

    • A. BeforeInstall -> ApplicationStop -> ApplicationStart -> AfterInstall
    • B. ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart
    • C. BeforeInstall -> ApplicationStop -> ValidateService -> ApplicationStart
    • D. ApplicationStop -> BeforeInstall -> ValidateService -> ApplicationStart

    View question →

78. Q78. A developer is building a mobile application that invokes a backend service via an Amazon API Gateway REST API. During integration testing in development, the developer wants to simulate various backend responses without actually invoking the backend service. Which solution satisfies this requirement with minimal operational overhead?

    • A. Create an AWS Lambda function. Use API Gateway proxy integration to return constant HTTP responses.
    • B. Use an AWS CloudFormation template to launch an Amazon EC2 instance hosting a mock backend REST API.
    • C. Customize the API Gateway stage to select response type based on the request.
    • D. Use request mapping templates to select mock integration responses.

    View question →

79. Q79. A company has built an application to consume and process data. The application uses Amazon Simple Queue Service (Amazon SQS) and AWS Lambda functions. The application currently works as expected, but occasionally receives a few messages that cannot be processed correctly. The company wants to remove these messages to prevent the queue from becoming blocked. Developers must implement a solution to ensure queue processing remains operational at all times. The solution must allow the company to delay erroneous messages and retain them for further analysis. What is the most effective solution that meets these requirements?

    • A. Configure Amazon CloudWatch Logs to save error messages to a separate log stream.
    • B. Create a new SQS queue. Configure the new queue as a dead-letter queue (DLQ) for the application queue. Configure the maximum receive count setting.
    • C. Convert the SQS queue to a FIFO queue. Configure the message retention period to 0 seconds.
    • D. Configure Amazon CloudWatch alarms for Lambda function errors. Publish messages to an Amazon Simple Notification Service (Amazon SNS) topic to notify administrator users.

    View question →

80. Q80. A developer is designing a serverless application that includes two AWS Lambda functions for processing images. One Lambda function stores objects in an Amazon S3 bucket and stores associated metadata in an Amazon DynamoDB table. Another Lambda function retrieves objects from the S3 bucket using metadata retrieved from the DynamoDB table. Both Lambda functions use the same Python libraries to perform complex computations and are approaching the maximum deployment package size limit. To reduce the Lambda deployment package size, what should the developer do while minimizing operational overhead?

    • A. Package each Python library into its own .zip file archive. Deploy each Lambda function with its own copy of the library.
    • B. Create a Lambda layer containing the required Python libraries. Use this Lambda layer in both Lambda functions.
    • C. Merge the two Lambda functions into a single Lambda function. Deploy the Lambda function as a single .zip file archive.
    • D. Download the Python libraries to an S3 bucket. Write the Lambda functions to reference the object’s URL.

    View question →

81. Q81. A company is launching a new feature. Users can access the new feature by submitting a form. The company expects a large volume of requests when the form becomes available. Each request will be stored as an item in an Amazon DynamoDB table. Each item will contain the user’s username, submission date, and verification status (UNVALIDATED, VALID, or NOT VALID). Each item will also include the user’s rating of the process, on a scale from 1 to 5. Each user may submit only one request. For the DynamoDB table, developers must select a partition key that ensures good distribution of workload across partitions. Which DynamoDB attribute best meets these requirements?

    • A. Username
    • B. Submission date
    • C. Verification status
    • D. Rating of the process, on a scale from 1 to 5

    View question →

82. Q82. A company is adopting serverless computing for some of its new services. A development team wants to use the AWS Serverless Application Model (AWS SAM) to create serverless infrastructure. All infrastructure must be deployed using AWS CloudFormation templates. What should the development team do to meet these requirements?

    • A. Add a Resources section in the CloudFormation template containing an AWS::Lambda::Function resource.
    • B. Add a Mappings section in the CloudFormation template containing AWS::Serverless::Function and AWS::Serverless::API resources.
    • C. Add a Transform section in the CloudFormation template. Define resources using AWS SAM syntax.
    • D. Add a Parameters section in the CloudFormation template specifying relevant AWS SAM Globals.

    View question →

83. Q83. A company has an Amazon S3 bucket containing sensitive data. Data must be encrypted both in transit and at rest. The company uses an AWS Key Management Service (AWS KMS) key to encrypt data in the S3 bucket. Developers need to grant several other AWS accounts permission to retrieve data from the S3 bucket using the s3:GetObject operation. How can developers enforce that all requests retrieving data must use encryption in transit?

    • A. Define a resource-based policy on the S3 bucket that denies access when the request condition "aws:SecureTransport": "false" is met.
    • B. Define a resource-based policy on the S3 bucket that allows access when the request condition "aws:SecureTransport": "false" is met.
    • C. Define a role-based policy on the roles of the other accounts that denies access when the request condition "aws:SecureTransport": "false" is met.
    • D. Define a resource-based policy on the KMS key that denies access when the request condition "aws:SecureTransport": "false" is met.

    View question →

84. Q84. A developer is creating an Amazon DynamoDB table. The entire table must be encrypted at rest. Which solution meets this requirement in the most cost-effective manner?

    • A. Create the DynamoDB table using the default encryption settings.
    • B. Encrypt data using the DynamoDB Encryption Client.
    • C. Configure server-side encryption with an AWS managed key from AWS Key Management Service (AWS KMS) during DynamoDB table creation.
    • D. Configure server-side encryption with a customer-managed key from AWS Key Management Service (AWS KMS) during DynamoDB table creation.

    View question →

85. Q85. A company stores images in an Amazon S3 bucket. The company wants to automatically resize images after they are uploaded to the S3 bucket. The company created an AWS Lambda function to resize the images. Which solution meets these requirements?

    • A. Configure S3 event notifications to invoke the Lambda function.
    • B. Configure S3 lifecycle rules to invoke the Lambda function.
    • C. Schedule S3 Select to invoke the Lambda function.
    • D. Configure S3 Storage Lens to invoke the Lambda function.

    View question →

86. Q86. A company is developing a new serverless application. Developers want an automated mechanism to deploy AWS Lambda functions and their dependent infrastructure while minimizing coding effort. The application must also be reliable. Which mechanism meets these requirements with the lowest operational overhead?

    • A. Build the application using shell scripts to create a .zip file for each Lambda function. Manually upload the .zip files via the AWS Management Console.
    • B. Build the application using the AWS Serverless Application Model (AWS SAM). Deploy Lambda functions using a CI/CD pipeline and the SAM CLI.
    • C. Build the application using shell scripts to create a .zip file for each Lambda function. Upload the .zip files and use the AWS CLI within a CI/CD pipeline to deploy them as Lambda functions.
    • D. Build a container for each Lambda function. Store container images in AWS CodeArtifact. Use the AWS CLI in a CI/CD pipeline to deploy containers as Lambda functions.

    View question →

87. Q87. A company plans to use AWS CodeDeploy to deploy an application to Amazon Elastic Container Service (Amazon ECS). During deployment of a new application version, the company initially must expose only 10% of live traffic to the newly deployed application version. Then, after 15 minutes, the company must route all remaining live traffic to the newly deployed application version. Which predefined CodeDeploy deployment configuration satisfies these requirements?

    • A. CodeDeployDefault.ECSCanary10Percent15Minutes
    • B. CodeDeployDefault.LambdaCanary10Percent5Minutes
    • C. CodeDeployDefault.LambdaCanary10Percent15Minutes
    • D. CodeDeployDefault.ECSLinear10PercentEvery1Minutes

    View question →

88. Q88. A developer is using an AWS Lambda function to generate thumbnails for personal photos uploaded to an Amazon S3 bucket. The Lambda function is automatically invoked for personal photos stored under the `/original/` S3 prefix. The developer notices that certain photos cause the Lambda function to time out. The developer wishes to implement a fallback mechanism using another Lambda function that resizes photos. Which solution meets these requirements with the least development effort?

    • A. Configure the image-resizing Lambda function as the destination for failed events from the thumbnail-generator Lambda function.
    • B. Create an Amazon Simple Queue Service (Amazon SQS) queue. Configure the SQS queue as the destination for failed invocations of the thumbnail-generator Lambda function. Configure the image-resizing Lambda function to poll the SQS queue.
    • C. Create an AWS Step Functions state machine that invokes the thumbnail-generator Lambda function and uses the image-resizing Lambda function as a fallback. Create an Amazon EventBridge rule matching S3 bucket events to invoke the state machine.
    • D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure the SNS topic as the destination for failed invocations of the thumbnail-generator Lambda function. Subscribe the image-resizing Lambda function to the SNS topic.

    View question →

89. Q89. A company is using a continuous integration/continuous delivery (CI/CD) system. Developers must automatically deploy application packages to on-premises Amazon EC2 instances and virtual servers.

    • A. AWS CloudG
    • B. AWS CodeBuild
    • C. AWS Elastic Beanstalk
    • D. AWS CodeDeploy

    View question →

90. Q90. A developer is building an application that allows users to store photos from their mobile devices in the cloud. The application must support millions of users. It uses an Amazon API Gateway REST API integrated with AWS Lambda functions to process photos. Photo metadata is stored in Amazon DynamoDB. Users must create an account to access the application. Within the application, users must be able to upload photos and retrieve previously uploaded photos. Photo sizes range from 300 KB to 5 MB.

    • A. Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use a Lambda function to store photos and metadata in a DynamoDB table. Retrieve previously uploaded photos directly from the DynamoDB table.
    • B. Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use a Lambda function to store photos in Amazon S3. Store the S3 object key as part of the photo metadata in a DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
    • C. Create an IAM user for each application user during registration. Use IAM authentication to access the API Gateway API. Use a Lambda function to store photos in Amazon S3. Store the S3 object key as part of the photo metadata in a DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
    • D. Create a user table in DynamoDB. Use this table to manage user accounts. Create a Lambda authorizer to validate user credentials against the user table. Integrate the Lambda authorizer with API Gateway to control API access. Use a Lambda function to store photos in Amazon S3. Store the S3 object key as part of the photo metadata in a DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.

    View question →

91. Q91. A developer has built an application that runs on an Amazon EC2 instance and generates a value every minute. The developer wants to monitor and plot the generated values over time without logging into the instance every minute.

    • A. Use the default Amazon CloudWatch metrics reported for all EC2 instances. View each value from the CloudWatch console.
    • B. Modify the application to store each value every minute in a file on Amazon S3, named with a timestamp.
    • C. Use the available AWS SDK to publish each generated value as a custom metric to Amazon CloudWatch.
    • D. Store each value as a variable and add that variable to the list of EC2 metrics reported to the Amazon CloudWatch console.

    View question →

92. Q92. A developer wants to extend an application to run in multiple AWS Regions. The developer wants to replicate Amazon Machine Images (AMIs) containing the latest changes to create new application stacks in the target Region. Per company policy, all AMIs must be encrypted in all Regions. However, currently, none of the company’s AMIs are encrypted. How can the developer extend the application to the target Region while meeting the encryption requirement?

    • A. Create new AMIs and specify encryption parameters during creation. Copy the encrypted AMIs to the target Region. Delete the unencrypted AMIs.
    • B. Enable encryption for unencrypted AMIs using AWS Key Management Service (AWS KMS). Copy the encrypted AMIs to the target Region.
    • C. Enable encryption for unencrypted AMIs using AWS Certificate Manager (ACM). Copy the encrypted AMIs to the target Region.
    • D. Copy unencrypted AMIs to the target Region. Enable default encryption in the target Region.

    View question →

93. Q93. A company is developing a serverless multi-tier application on AWS. The company will build the serverless logic layer using Amazon API Gateway and AWS Lambda. While building the logic layer, frontend developers working on the application must develop integration tests. Tests must cover positive and negative scenarios, specifically based on successful and error HTTP status codes. Which solution meets these requirements with the least effort?

    • A. Configure a mock integration for the API method in API Gateway. In the integration request, add simple logic to return success or error based on HTTP status codes. In the integration response, add messages corresponding to the HTTP status codes.
    • B. Create two mock integration resources for the API method in API Gateway. In the integration request, configure one resource to return a success HTTP status code and the other to return an error HTTP status code. In the integration response, add messages corresponding to the HTTP status codes.
    • C. Create a Lambda function to execute tests. Add simple logic to return success or error based on HTTP status codes. Build an API Gateway Lambda integration. Select the appropriate Lambda function corresponding to the HTTP status code.
    • D. Create a Lambda function to execute tests. Add simple logic to return success or error HTTP status codes. Create a mock integration in API Gateway. Select the Lambda function corresponding to the HTTP status code.

    View question →

94. Q94. A company is developing an application accessed via an Amazon API Gateway REST API. Only registered users can access certain API resources. Credentials must expire and require periodic refresh.

    • A. Create an Amazon Cognito identity pool, configure an Amazon Cognito authorizer in API Gateway, and use temporary credentials generated by the identity pool.
    • B. Create and maintain a database record for each user, and use an AWS Lambda authorizer in API Gateway for validation.
    • C. Create an Amazon Cognito user pool, configure a Cognito authorizer in API Gateway, and use ID tokens or access tokens.
    • D. Create an IAM user for each API user, attach an invoke-permission policy to the API, and use an IAM authorizer in API Gateway.

    View question →

95. Q95. A company has an Amazon RDS for MySQL database instance named mysql-db. This database instance was deleted 90 days ago. Developers need to identify the IAM user or role that deleted this database instance in the AWS environment. Which solution provides this information?

    • A. Retrieve AWS CloudTrail events for the mysql-db resource where the event name is DeleteDBInstance. Examine each event.
    • B. Retrieve Amazon CloudWatch Logs events from the latest log stream of the rds/mysql-db log group. Examine the log events.
    • C. Retrieve AWS X-Ray trace summaries. Filter by service name mysql-db. Examine the ErrorRootCauses value in each summary.
    • D. Retrieve the AWS Systems Manager deletion inventory. Filter by TypeName value RDS for deleted items. Examine the deletion details.

    View question →

96. Q96. A company is delivering daily updated commodity pricing information as a publicly accessible, unauthenticated read-only API over the internet. The company uses Amazon API Gateway and AWS Lambda to develop these APIs. The service has become very popular, and the company wants to improve API response latency. Which action would help the company achieve this goal?

    • A. Enable API caching in API Gateway.
    • B. Configure API Gateway to use an interface VPC endpoint.
    • C. Enable Cross-Origin Resource Sharing (CORS) for the API.
    • D. Configure usage plans and API keys in API Gateway.

    View question →

97. Q97. A company has built an AWS Lambda function to convert large image files into output files usable by downstream applications. The company recently added a new module to the function to enhance output file generation. However, the new module increased the deployment package size and significantly increased the Lambda function code deployment time. How can developers increase the Lambda function deployment speed?

    • A. Use AWS CodeDeploy to deploy the function code.
    • B. Use Lambda layers to package and load dependencies.
    • C. Increase the function's memory allocation.
    • D. Host the function’s dependencies in Amazon S3.

    View question →

98. Q98. A company is migrating a legacy application to a serverless application on AWS. The legacy application includes a web service exposed via an Amazon API Gateway API. Developers want to replace the existing web service implementation with AWS Lambda functions. Developers need to test the new version of the API in production while minimizing impact on application users. Which solution meets these requirements?

    • A. Create a beta stage for the new API version. Send the updated endpoint to users.
    • B. Create a development stage for the new API version. Use canary deployment.
    • C. Create a development stage for the new API version. Promote the canary version.
    • D. Create a deployment stage. Enable mutual TLS for the new API version.

    View question →

99. Q99. A company uses Amazon API Gateway to develop APIs for its AWS-based application. A developer needs to test and generate API responses. Other teams need to immediately test the API. What should the developer do to meet these requirements?

    • A. Set up a mock integration request in API Gateway. Configure the method’s integration request and integration response to associate responses with given status codes.
    • B. Set up a request validator in the API’s OpenAPI definition file. Import the OpenAPI definition into API Gateway to test the API.
    • C. Set up a gateway response in API Gateway. Configure response headers using hardcoded HTTP status codes and responses.
    • D. Set up a Lambda authorizer based on request parameters to control access to the API. Configure the Lambda function with required mapping templates.

    View question →

100. Q100. An application runs behind multiple EC2 instances managed by an Elastic Load Balancing (ELB) load balancer. To reliably track session data across multiple requests, where should the session data be stored?

     • A. Write the data to Amazon ElastiCache.
     • B. Write the data to Amazon Elastic Block Store.
     • C. Write the data to Amazon EC2 instance store.
     • D. Write the data to the root file system.

     View question →