AWS DVA-C02 Chapter 3 Practice Questions (100 Questions)

Practice questions for the AWS DVA-C02 (Developer Associate) exam, Chapter 3.

1. Q1. A company is building a serverless application. The application authenticates with a backend application using an API key. The company wants to store the external API key as part of the AWS Lambda configuration. The company requires full control over the AWS Key Management Service (AWS KMS) key used to encrypt the API key and restrict visibility to authorized entities only. Which solution meets these requirements?

   • A. Store the API key in AWS Systems Manager Parameter Store as a String parameter. Use the AWS-provided default AWS KMS key to encrypt the API key.
   • B. Store the API key in AWS Lambda environment variables. Create a customer-managed AWS KMS key to encrypt the API key.
   • C. Store the API key in the code repository. Use an AWS-managed key to encrypt the code repository.
   • D. Store the API key as a record in an Amazon DynamoDB table. Use an AWS-managed key to encrypt the API key.

   View question →

2. Q2. A company runs a containerized application on AWS and uses AWS CodePipeline for its CI/CD pipeline. Developers must run unit tests and include them as part of the pipeline before testing artifacts. How should developers incorporate unit tests as part of the CI/CD pipeline?

   • A. Create a separate CodePipeline pipeline to run unit tests.
   • B. Update the AWS CodeBuild specification to include a phase that runs unit tests.
   • C. Install the AWS CodeDeploy agent on an Amazon EC2 instance to run unit tests.
   • D. Create a test branch in AWS CodeCommit to run unit tests.

   View question →

3. Q3. A developer is creating an AWS Lambda function. The Lambda function will poll messages from an Amazon Simple Queue Service (Amazon SQS) queue. The developer wants to integrate unit testing into the function's continuous integration and continuous delivery (CI/CD) pipeline. How should the developer perform unit testing for the function?

   • A. Create an AWS CloudFormation template that creates an SQS queue and deploys the Lambda function. During the CI/CD process, use the template to create a stack. Invoke the deployed function and verify the output.
   • B. Create an SQS event for testing. During the function's CI/CD process, use a test that retrieves messages from an SQS queue.
   • C. Create an SQS queue for testing. Use this SQS queue in the application's unit tests. Run the unit tests during the CI/CD process.
   • D. Use the aws lambda invoke command with a test event during the CI/CD process.

   View question →

4. Q4. A company wants to migrate its web application to AWS and use Auto Scaling to handle peak workloads. The solution architect determines that the best metric for Auto Scaling is concurrent users. Based on this information, what should developers use to scale based on concurrent users?

   • A. An Amazon SNS topic invoked when the concurrent user threshold is met.
   • B. The Amazon CloudWatch NetworkIn metric.
   • C. Amazon CloudFront with AWS edge locations.
   • D. A custom Amazon CloudWatch metric for concurrent users.

   View question →

5. Q5. A developer is building a serverless application using the AWS Serverless Application Model (AWS SAM), which includes an AWS Lambda function. When the application is deployed, the developer wants to shift 10% of traffic to the new version during the first 10 minutes after deployment. If no issues occur, all traffic should then shift to the new version. Which modification to the AWS SAM template satisfies these requirements?

   • A. Set DeploymentPreferenceType to Canary10Percent10Minutes. Set the AutoPublishAlias property to a Lambda alias.
   • B. Set DeploymentPreferenceType to Linear10PercentEvery10Minutes. Set the AutoPublishAlias property to a Lambda alias.
   • C. Set DeploymentPreferenceType to Canary10Percent10Minutes. Set the PreTraffic and PostTraffic properties to a Lambda alias.
   • D. Set DeploymentPreferenceType to Linear10PercentEvery10Minutes. Set the PreTraffic and PostTraffic properties to a Lambda alias.

   View question →

6. Q6. A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to its SFTP service. The Lambda function connects to the SFTP service using credentials such as username and password. The company stores these credentials in Lambda environment variables. The developer needs to implement encrypted username and password credentials. Which solution meets these requirements?

   • A. Remove the user credentials from Lambda environment variables and implement IAM database authentication.
   • B. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.
   • C. Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
   • D. Move the user credentials from Lambda environment variables to an encrypted .txt file stored in an S3 bucket.

   View question →

7. Q7. A developer is creating an AWS Lambda function that polls messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function processes some messages multiple times. How should the developer resolve this issue cost-effectively?

   • A. Convert the Amazon SQS standard queue to an Amazon SQS FIFO queue by using Amazon SQS message deduplication IDs.
   • B. Configure a dead-letter queue.
   • C. Set the AWS Lambda function’s maximum concurrency limit to 1.
   • D. Change the message processing mechanism to use Amazon Kinesis Data Streams instead of Amazon SQS.

   View question →

8. Q8. A developer is troubleshooting an Amazon API Gateway API. When a client attempts to access an endpoint of the API, the client receives an HTTP 400 response error. How can the developer determine the cause of these errors?

   • A. Create an Amazon Kinesis Data Firehose delivery stream to receive API Gateway API call logs. Configure Amazon CloudWatch Logs as the delivery stream’s destination.
   • B. Enable AWS CloudTrail Insights and create a trail. Specify the trail’s Amazon Resource Name (ARN) for the API’s stage.
   • C. Enable AWS X-Ray for the API’s stage. Create an Amazon CloudWatch Logs log group. Specify the log group’s ARN for the API’s stage.
   • D. Enable execution logging and access logging for the API’s stage and configure them to Amazon CloudWatch Logs. Create a CloudWatch Logs log group. Specify the log group’s ARN for the API’s stage.

   View question →

9. Q9. A developer is required to create an AWS Lambda function that is invoked when items in an Amazon DynamoDB table are updated. The function has been created, and appropriate permissions have been added to the Lambda execution role. DynamoDB Streams have been enabled on the table, but the function is still not being invoked. Which option will cause DynamoDB table updates to invoke the Lambda function?

   • A. Change the DynamoDB table’s StreamViewType parameter value to NEW_AND_OLD_IMAGES.
   • B. Configure an event source mapping for the Lambda function.
   • C. Map an Amazon Simple Notification Service (Amazon SNS) topic to the DynamoDB stream.
   • D. Increase the Lambda function’s maximum execution time (timeout) setting.

   View question →

10. Q10. A web application runs behind an Application Load Balancer. During non-peak hours, developers observe unexpected load on the application. Developers want to analyze patterns of client IP addresses accessing the application. Which HTTP header should developers use for this analysis?

    • A. X-Forwarded-Proto header
    • B. X-Forwarded-Host header
    • C. X-Forwarded-For header
    • D. X-Forwarded-Port header

    View question →

11. Q11. When new items are inserted into a DynamoDB table, how can a developer notify users without impacting the provisioned throughput?

    • A. Configure a DynamoDB stream to trigger a Lambda function that sends SNS notifications to users.
    • B. Schedule Amazon CloudWatch Events to periodically trigger a Lambda function that scans the DynamoDB table.
    • C. Run a polling application that queries the DynamoDB table every second and sends SNS notifications to users.
    • D. Embed a Lambda notification function directly in DynamoDB and configure DynamoDB to trigger the embedded Lambda function on changes.

    View question →

12. Q12. A developer has written application code and wants to share it with other developers on the team to gather feedback. The shared application code must be stored long-term, support versioning, and enable tracking of bulk changes. Which AWS service should the developer use?

    • A. AWS CodeBuild
    • B. Amazon S3
    • C. AWS CodeCommit
    • D. AWS CloudFront

    View question →

13. Q13. A retail company is developing a serverless application running on AWS. The application uses an AWS Lambda function to calculate order success rates, with data stored in an Amazon DynamoDB table. The developer wants to invoke the Lambda function efficiently every 15 minutes. Which solution requires the least development effort to meet this requirement?

    • A. Create an Amazon EventBridge rule with a rate expression that runs every 15 minutes and configure the Lambda function as the rule’s target.
    • B. Create an AWS Systems Manager document containing a script that invokes the Lambda function on Amazon EC2, and use Systems Manager Run Command to execute the script every 15 minutes.
    • C. Create an AWS Step Functions state machine configured with a Wait state to invoke the Lambda function at 15-minute intervals.
    • D. Launch a small Amazon EC2 instance and configure a cron job to invoke the Lambda function every 15 minutes.

    View question →

14. Q14. A company is developing an application accessible via an Amazon API Gateway REST API. Only registered users should access certain API resources. Credentials must expire automatically and require periodic refresh. How should the developer meet these requirements?

    • A. Create an Amazon Cognito identity pool, configure an Amazon Cognito Authorizer in API Gateway, and use temporary credentials issued by the identity pool.
    • B. Create and maintain database records with tokens for each user, and use an AWS Lambda authorizer in API Gateway.
    • C. Create an Amazon Cognito user pool, configure a Cognito Authorizer in API Gateway, and use ID or access tokens.
    • D. Create an IAM user for each API user, attach invocation permissions policies to the API, and use an IAM authorizer in API Gateway.

    View question →

15. Q15. An application generates a large volume of trace data using AWS X-Ray. The developer wants to filter returned results using custom attributes specified by users. How should the developer use X-Ray filter expressions to filter results?

    • A. Add the custom attribute as an annotation in the segment document.
    • B. Add the custom attribute as metadata in the segment document.
    • C. Add the custom attribute as a new segment field in the segment document.
    • D. Create a new sampling rule based on the custom attribute.

    View question →

16. Q16. A company deploys an application using AWS CloudFormation. The application integrates an Amazon API Gateway REST API with AWS Lambda functions and uses Amazon DynamoDB for data persistence. It has three environments: development, test, and production—each with its own DynamoDB table. Unexpected issues occurred when pushing changes to production, although changes succeeded in development and test. A developer needs to route 20% of traffic to a new production-stage API with the updated version, while routing the remaining 80% to the existing production-stage API. The solution must minimize the number of errors any single customer experiences. What action should the developer take to meet these requirements?

    • A. Update 20% of the planned changes to the production stage. Deploy the new production stage. Monitor results. Repeat this process five times to test all planned changes.
    • B. Update the Amazon Route 53 DNS record for the production API using a weighted routing policy with weight 80. Add a second Route 53 record for the same domain, configure it with a weighted routing policy with weight 20, and point it to the test-stage API.
    • C. Deploy an Application Load Balancer (ALB) in front of the REST API. Update the production API’s Amazon Route 53 record to point to the ALB. Register both production and test stages as ALB targets with weights of 80% and 20%, respectively.
    • D. Configure canary settings for the production-stage API. Set the percentage of traffic directed to the canary deployment to 20%. Apply the planned changes to the production stage and deploy.

    View question →

17. Q17. A company hosts a batch processing application on AWS Elastic Beanstalk, where instances run the latest Amazon Linux version. The application sorts and processes large datasets. Over recent weeks, application performance has significantly degraded during traffic peaks. Developers suspect memory-related issues but notice memory usage is not tracked in the Elastic Beanstalk console. How should developers collect more detailed information about the performance issue?

    • A. Configure the Amazon CloudWatch agent to push logs to Amazon CloudWatch Logs over port 443.
    • B. Configure Elastic Beanstalk .ebextensions to track instance memory usage.
    • C. Configure the Amazon CloudWatch agent to track instance memory usage.
    • D. Configure an Amazon CloudWatch dashboard to track instance memory usage.

    View question →

18. Q18. A developer is writing an IAM policy document to grant administrators access to AWS Key Management Service (AWS KMS) for federated identity users. The federated IAM role name is FederatedIAMRole, and the username is KeyAdmin. How should the developer specify the principal in the KMS key policy to meet these requirements?

    • A. "Principal": {"AWS": "arn:aws:sts::123456789012:role/FederatedIAMRole/KeyAdmin"}
    • B. "Principal": {"AWS": "arn:aws:sts:123456789012:user/FederatedIAMRole/KeyAdmin"}
    • C. "Principal": {"AWS": "arn:aws:sts::123456789012:user/KeyAdmin"}
    • D. "Principal": {"AWS": "arn:aws:sts::123456789012:assumed-role/FederatedIAMRole/KeyAdmin"}

    View question →

19. Q19. A development team is building an application on AWS Lambda that needs to access specific confidential objects in an Amazon S3 bucket. According to the principle of least privilege, the team must grant access to the S3 bucket using only temporary credentials. How should developers configure access to the S3 bucket in the most secure manner?

    • A. Hardcode the credentials required to access the S3 objects directly in the application code and use those credentials to access the required S3 objects.
    • B. Create an access key ID and secret access key with permissions to access the S3 bucket. Store the key and key ID in AWS Secrets Manager. Configure the application to retrieve the secret from Secrets Manager and use the credentials to access the S3 objects.
    • C. Create an execution role for the Lambda function. Attach a policy granting permissions to access specific objects in the S3 bucket to that role.
    • D. Create an access key ID and secret access key with permissions to access the S3 bucket. Store the key and key ID as environment variables in the Lambda function. Use the environment variables to access the required S3 objects.

    View question →

20. Q20. A developer is building a secure healthcare application using serverless components. The application must write temporary data to the /tmp storage of an AWS Lambda function.

    • A. Enable Amazon EBS volume encryption using an AWS KMS key in the Lambda function configuration so that all storage attached to the Lambda function is encrypted.
    • B. Configure the Lambda function with an IAM role and key policy to access an AWS KMS key. Use the KMS key to generate a data key for encrypting all data before writing to /tmp storage.
    • C. Use OpenSSL to generate a symmetric encryption key at Lambda startup and use this key to encrypt data before writing to /tmp.
    • D. Use a local hardware security module (HSM) to generate keys, where the Lambda function requests a data key from the HSM and uses it to encrypt all data processed by the function.

    View question →

21. Q21. A developer is designing a serverless application with two AWS Lambda functions to process images. One Lambda function stores objects in an Amazon S3 bucket and writes associated metadata to an Amazon DynamoDB table. The other Lambda function retrieves objects from the S3 bucket using metadata stored in the DynamoDB table. Both Lambda functions use the same Python libraries to perform complex computations and are approaching the maximum compressed deployment package size limit.

    • A. Package each Python library into its own ZIP archive file. Deploy each Lambda function with its own copy of the library.
    • B. Create a Lambda layer containing the required Python libraries. Use the Lambda layer in both Lambda functions.
    • C. Merge the two Lambda functions into a single Lambda function and deploy it as one ZIP archive.
    • D. Download the Python libraries to an S3 bucket and program the Lambda functions to reference the object URLs.

    View question →

22. Q22. A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution uses an Origin Access Identity (OAI) to access the S3 bucket. The S3 bucket policy explicitly denies access to all users except the OAI. The application presents users with a login page requiring authentication, after which signed cookies grant access to their personal storage directories. The developer configured the distribution with its default cache behavior and restricted viewer access, pointing the origin to the S3 bucket. However, when attempting to navigate to the login page, the developer receives a 403 Forbidden error. The developer needs a solution that allows unauthenticated access to the login page while preserving security for private content. Which solution satisfies these requirements?

    • A. Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern of the second cache behavior to the login page path and allow unrestricted viewer access. Keep the default cache behavior settings unchanged.
    • B. Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern of the second cache behavior to * and restrict viewer access. Change the default cache behavior’s path pattern to the login page path and allow unrestricted viewer access.
    • C. Add a second origin as a failover origin to the default cache behavior. Point the failover origin to the S3 bucket. Set the primary origin’s path pattern to * and restrict viewer access. Set the failover origin’s path pattern to the login page path and allow unrestricted viewer access.
    • D. Add a bucket policy to the S3 bucket allowing read access. Set the resource in the policy to the Amazon Resource Name (ARN) of the login page object in the S3 bucket. Add a CloudFront function to the default cache behavior to redirect unauthorized requests to the S3 URL of the login page.

    View question →

23. Q23. A company uses an AWS Lambda function behind Amazon API Gateway as its application layer. To handle orders under high traffic, the application invokes a POST API from the frontend. The POST API invokes the Lambda function asynchronously. In many cases, orders fail to process. No errors or failures appear in the Lambda application logs.

    • A. Check frontend logs for API failures. Manually invoke the POST API using request details from the logs.
    • B. Create and inspect the Lambda dead-letter queue (DLQ). Investigate failed invocations and reprocess events.
    • C. Check Lambda logs in Amazon CloudWatch for possible errors. Fix the errors.
    • D. Ensure caching is disabled for the POST API in API Gateway.

    View question →

24. Q24. A mobile application stores blog posts in an Amazon DynamoDB table. Several new posts are added daily, each represented as a separate item. The application only requires recent posts. Any post older than 48 hours can be deleted. What is the most cost-effective way to delete posts older than 48 hours?

    • A. For each item, add a new String-type attribute containing a timestamp set to the blog post creation time. Create a script that uses the BatchWriteItem API operation to find and delete old posts. Schedule the script as a cron job on an Amazon EC2 instance, running hourly.
    • B. For each item, add a new String-type attribute containing a timestamp set to the blog post creation time. Create a script that uses the BatchWriteItem API operation to find and delete old posts. Package the script in a container image and schedule an Amazon ECS task on AWS Fargate to run the container every 5 minutes.
    • C. For each item, add a new Date-type attribute containing a timestamp set to 48 hours after the blog post creation time. Create a Global Secondary Index (GSI) using the new attribute as the sort key. Create an AWS Lambda function that queries the GSI and deletes expired items using BatchWriteItem. Schedule the function using Amazon CloudWatch Events every minute.
    • D. For each item, add a new Number-type attribute containing a timestamp set to 48 hours after the blog post creation time. Configure the DynamoDB table to use TTL (Time to Live) referencing the new attribute.

    View question →

25. Q25. A company with multiple offices uses an Amazon DynamoDB table to store employee work order information. Each item contains attributes for employee name, office identifier, and cumulative daily work hours. The most frequent query retrieves a subset of employees per office, sorted alphabetically by employee name.

    • A. Partition key on office identifier and sort key on employee name
    • B. Partition key on employee name and sort key on office identifier
    • C. Partition key on employee name
    • D. Partition key on office identifier

    View question →

26. Q26. A developer has implemented an AWS Lambda function that is CPU-bound. The developer wants to ensure the function returns responses quickly.

    • A. Increase the number of CPU cores allocated to the function.
    • B. Increase the memory allocation for the function.
    • C. Increase the reserved concurrency for the function.
    • D. Increase the timeout setting for the function.

    View question →

27. Q27. A developer has built an e-commerce application that stores product pricing data in Amazon DynamoDB and uses Amazon ElastiCache in front of it. Product prices change frequently. Sellers have started complaining that after updating a product price, the updated price does not appear in the product listing.

    • A. The cache is not invalidated when item prices are changed.
    • B. Retrieving item prices through a write-through ElastiCache cluster.
    • C. The DynamoDB table's read capacity quota is insufficient.
    • D. The DynamoDB table's write capacity quota is insufficient.

    View question →

28. Q28. A developer created a web API using Amazon Elastic Container Service (Amazon ECS) and an Application Load Balancer (ALB). An Amazon CloudFront distribution uses the API as the origin for web clients. The application has received numerous requests containing invalid JSON Web Tokens (JWTs) in the Authorization header. The developer has extended the application to handle unauthenticated requests. How should the developer reduce the number of unauthenticated requests to the API?

    • A. Add a request routing rule to the ALB to return a 401 status code when the Authorization header is missing.
    • B. Add a container to the ECS task definition to validate JWTs and configure the new container as a dependency of the application container.
    • C. Create a CloudFront Function for the distribution and use cryptographic modules within the function to validate JWTs.
    • D. Add an AWS Lambda custom authorizer to the CloudFront distribution to validate JWTs.

    View question →

29. Q29. A company is using a Python-based AWS Lambda function to add items to an Amazon DynamoDB table. The developer wants to implement a solution that inserts records into the DynamoDB table and retries on insertion failure. Which solution satisfies these requirements with the minimal code changes?

    • A. Configure the Python code to invoke the PutItem operation via AWS CLI using shell commands.
    • B. Use the DynamoDB HTTP API to invoke the PutItem operation from Python.
    • C. Queue items in AWS Glue, which then writes them to the DynamoDB table.
    • D. Use the AWS SDK for Python (boto3) to invoke the PutItem operation.

    View question →

30. Q30. A developer is using the AWS CLI to create an Amazon DynamoDB table. The DynamoDB table must use AWS-owned encryption keys for server-side encryption. How should the developer create the DynamoDB table to meet these requirements?

    • A. Create an AWS Key Management Service (AWS KMS) customer-managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter when creating the DynamoDB table.
    • B. Create an AWS Key Management Service (AWS KMS) AWS-managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter when creating the DynamoDB table.
    • C. Create an AWS-owned key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter when creating the DynamoDB table.
    • D. Create the DynamoDB table using the default encryption option.

    View question →

31. Q31. A company has an e-commerce application. To track product reviews, the company’s development team uses an Amazon DynamoDB table. Each record includes the following attributes: Review ID—a 16-digit universally unique identifier (UUID); Product ID and User ID—16-digit UUIDs referencing other tables; Product Rating—a numeric rating from 1 to 5; and an optional review comment. The partition key of the table is Review ID. The most frequently executed query is retrieving the top 10 reviews with the highest ratings for a given product. Which index will provide the fastest response for this query?

    • A. A Global Secondary Index (GSI) with Product ID as the partition key and Product Rating as the sort key.
    • B. A Global Secondary Index (GSI) with Product ID as the partition key and Review ID as the sort key.
    • C. A Local Secondary Index (LSI) with Product ID as the partition key and Product Rating as the sort key.
    • D. A Local Secondary Index (LSI) with Review ID as the partition key and Product ID as the sort key.

    View question →

32. Q32. A company has multiple Amazon VPC endpoints in the same VPC. A developer wants to configure an Amazon S3 bucket policy so users can access the S3 bucket only through these VPC endpoints. Which solution meets these requirements?

    • A. Create multiple S3 bucket policies—one per VPC endpoint ID—with the aws:SourceVpce value used in a StringNotEquals condition.
    • B. Create a single S3 bucket policy with the aws:SourceVpc value and the VPC ID used in a StringNotEquals condition.
    • C. Create a single S3 bucket policy with the aws:SourceVpce value and 'vpce*' used in a StringNotEquals condition.
    • D. Create a single S3 bucket policy with multiple aws:sourceVpce values in a StringNotEquals condition—one for each VPC endpoint.

    View question →

33. Q33. A company is building a scalable data ingestion solution using AWS services to accelerate development velocity and flexibility. The solution will ingest large volumes of data from various sources and process them through multiple business rules and transformations. The solution requires business rules to execute sequentially and handle data reprocessing when failures occur during rule execution. The company requires the solution to be scalable and minimize operational overhead. To meet these requirements, which AWS service should the company use to orchestrate and automate the data flow?

    • A. AWS Batch
    • B. AWS Step Functions
    • C. AWS Glue
    • D. AWS Lambda

    View question →

34. Q34. A static website is hosted in an Amazon S3 bucket. The site’s HTML pages use JavaScript to load images from another Amazon S3 bucket. Users browsing the website do not see these images displayed.

    • A. The referenced Amazon S3 bucket resides in a different Region.
    • B. Images must be stored in the same Amazon S3 bucket.
    • C. The security group associated with the Amazon S3 bucket must allow port 80.
    • D. Cross-origin resource sharing (CORS) must be enabled on the Amazon S3 bucket.

    View question →

35. Q35. Todd has an application running on an Amazon EC2 instance that needs to access files stored in an Amazon S3 bucket. The application lists objects stored in the S3 bucket and displays them to users in a table. During testing, developers find that no objects appear in the list. What is the most secure cause of this issue?

    • A. Update the IAM instance profile attached to the EC2 instance to include S3:* permissions on the S3 bucket.
    • B. Update the IAM instance profile attached to the EC2 instance to include the S3:ListBucket permission on the S3 bucket.
    • C. Update the developer's user permissions to include the S3:ListBucket permission on the S3 bucket.
    • D. Update the S3 bucket policy to include the S3:ListBucket permission and resolve the issue by setting the Principal element to the account number of the EC2 instance.

    View question →

36. Q36. A developer configured an Amazon Kinesis Data Stream with four shards, optimized for ingesting 2,500 records per second. A Lambda function is configured to process these records. In what order will these records be processed?

    • A. Lambda will receive each record in reverse order of how it was placed into the stream, using a LIFO (Last-In-First-Out) approach.
    • B. Lambda will receive each record in exactly the same order it was placed into the stream, using a FIFO (First-In-First-Out) approach.
    • C. Lambda will receive each record in exactly the same order it was placed into the shard, using a FIFO (First-In-First-Out) approach. Ordering across shards is not guaranteed.
    • D. The developer can use the GetRecords API to choose FIFO (First-In-First-Out), LIFO (Last-In-First-Out), random, or request specific records.

    View question →

37. Q37. A developer is building an event-driven application using AWS Lambda and Amazon EventBridge. The Lambda function needs to push events to the EventBridge event bus. The developer uses the SDK to invoke the PutEvents EventBridge operation but does not specify credentials in the code. After deploying the Lambda function, the developer notices that the function execution fails with an AccessDeniedException in the logs. How should the developer resolve this issue?

    • A. Configure a VPC peering connection between the Lambda function and EventBridge.
    • B. Modify their AWS credentials to include permissions for the PutEvents EventBridge operation.
    • C. Modify the Lambda function’s execution role to include permissions for the PutEvents EventBridge operation.
    • D. Add a resource-based policy to the Lambda function to include permissions for the PutEvents EventBridge operation.

    View question →

38. Q38. A developer is building a web application that requires feature toggling to activate specific functionality. The developer wants to hide features from end users until they are ready for release. Which solution satisfies these requirements?

    • A. Create a feature flag configuration profile in AWS AppSync. Store feature flag values in the profile and activate or deactivate them as needed.
    • B. Store pre-release data in an Amazon DynamoDB table. Enable Amazon DynamoDB Streams on the table. Toggle between hidden and visible states using DynamoDB Streams.
    • C. Create a feature flag configuration profile in AWS AppConfig. Store feature flag values in the profile and activate or deactivate them as needed.
    • D. Store pre-release data in AWS Amplify DataStore. Toggle between hidden and visible states using Amplify DataStore cloud synchronization.

    View question →

39. Q39. A developer is using a Border Gateway Protocol (BGP)-based AWS VPN connection to connect an on-premises network to Amazon EC2 instances in the developer’s AWS account. The developer can access EC2 instances in subnet A within the same VPC, but cannot access EC2 instances in subnet B. Which logs can the developer use to verify whether traffic reaches subnet B?

    • A. VPN logs
    • B. BGP logs
    • C. VPC flow logs
    • D. AWS CloudTrail logs

    View question →

40. Q40. A developer wants to reduce risk when deploying a new version of an existing AWS Lambda function. To test the Lambda function, the developer needs to split traffic between the existing version and the new version of the Lambda function. Which solution satisfies these requirements?

    • A. Configure a weighted routing policy in Amazon Route 53. Associate the Lambda function versions with the weighted routing policy.
    • B. Create a function alias. Configure the alias to split traffic between two Lambda function versions.
    • C. Create an Application Load Balancer (ALB) with the Lambda function as a target. Configure the ALB to split traffic between two Lambda function versions.
    • D. Create the new version of the Lambda function as a Lambda layer on top of the existing version. Configure the function to split traffic between the two layers.

    View question →

41. Q41. A developer stores sensitive data generated by an application in Amazon S3. The developer wants to encrypt the data at rest, and company policy requires audit trails tracking who used and when an AWS Key Management Service (AWS KMS) key was used.

    • A. Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)
    • B. Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS)
    • C. Server-Side Encryption with Customer-Provided Keys (SSE-C)
    • D. Server-Side Encryption with customer-managed keys

    View question →

42. Q42. A developer is creating an application deployed on internet-connected devices. The application sends data to a RESTful API hosted as an AWS Lambda function. The application assigns a unique identifier to each API request. The volume of API requests from the application may spike randomly at any time during the day. During rate limiting, the application may need to retry requests. The API must handle duplicate requests without causing inconsistency or data loss.

    • A. Create an Amazon RDS for MySQL database instance. Store each request’s unique identifier in a database table. Modify the Lambda function to check the table for the identifier before processing the request.
    • B. Create an Amazon DynamoDB table. Store each request’s unique identifier in the table. Modify the Lambda function to check the table for the identifier before processing the request.
    • C. Create an Amazon DynamoDB table. Store each request’s unique identifier in the table. Modify the Lambda function to return a client error response when it receives a duplicate request.
    • D. Create an Amazon ElastiCache for Memcached cluster. Store each request’s unique identifier in the cache. Modify the Lambda function to check the cache for the identifier before processing the request.

    View question →

43. Q43. A developer built a retail application that stores pricing data in Amazon DynamoDB, with Amazon ElastiCache in front. Retail product prices change frequently. Customers began complaining that after they update a product price, the price displayed in the product listing does not change immediately.

    • A. The cache is not invalidated when product prices change.
    • B. Using a write-through ElastiCache cluster to retrieve product prices.
    • C. The DynamoDB table is configured with insufficient read capacity.
    • D. The DynamoDB table is configured with insufficient write capacity.

    View question →

44. Q44. A company hosts a photo storage web application on AWS. The application runs on Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group serves as a target group for an Application Load Balancer (ALB), and photos for sale are stored in Amazon S3. The company wants to develop a testing system for new features. This feature must route requests to a separate target group hosting a new test version of the application. Which solution meets this requirement with the least operational effort?

    • A. Create a new Auto Scaling group and target group for the test version of the application. Update the ALB routing rules to include a condition that looks for a cookie named 'version' with value 'beta'. Update the test system code to send this cookie when testing the test version.
    • B. Create a new ALB, Auto Scaling group, and target group for the test version. Configure a secondary Amazon Route 53 record pointing to the new ALB endpoint. Use the secondary Route 53 endpoint in test system requests.
    • C. Create a new ALB, Auto Scaling group, and target group for the test version. Use Amazon CloudFront and Lambda@Edge to determine which specific requests should be forwarded to the new ALB. Send test system requests through the CloudFront endpoint.
    • D. Create a new Auto Scaling group and target group for the test version. Update the ALB routing rules to include a condition that looks for a cookie named 'version' with value 'beta'. Use Amazon CloudFront and Lambda@Edge to inject the required cookie into test system requests before they reach the ALB.

    View question →

45. Q45. An application uploads images to an Amazon S3 bucket. The application must resize each uploaded image into a thumbnail. Each thumbnail is saved with a new name in the same S3 bucket. Which AWS service can a developer configure to automatically process each S3 object upload?

    • A. Amazon EC2
    • B. Amazon Elastic Container Service (Amazon ECS)
    • C. AWS Elastic Beanstalk
    • D. AWS Lambda

    View question →

46. Q46. A developer is building an application that allows users to view bank account data from multiple sources on a single dashboard. The developer has already automated retrieval of API credentials for these sources. This automation invokes an AWS Lambda function associated with a custom AWS CloudFormation resource. The developer wants to store the API credentials with the lowest possible operational cost while ensuring security. Which solution best meets these requirements?

    • A. Add an AWS Secrets Manager GenerateSecretString resource in the CloudFormation template. Set the value to reference the newly generated credential.
    • B. In the Lambda function, use the AWS SDK ssm:PutParameter operation to store the credential as a parameter, setting the parameter value to reference the new credential and the parameter type to SecureString.
    • C. Add an AWS Systems Manager Parameter Store resource in the CloudFormation template. Set the CloudFormation resource’s value to reference the new credential and set the NoEcho property to true.
    • D. In the Lambda function, use the AWS SDK ssm:PutParameter operation to store the credential as a parameter, setting the parameter value to reference the new credential and the parameter’s NoEcho property to true.

    View question →

47. Q47. A developer is creating an AWS Lambda function that generates and exports a file. During execution, the function requires 100 MB of temporary storage to stage the file. These files are no longer needed after the function completes. How can the developer most efficiently handle these temporary files?

    • A. Store the files in Amazon Elastic Block Store (Amazon EBS) and delete them at the end of the Lambda function.
    • B. Copy the files to Amazon Elastic File System (Amazon EFS) and delete them at the end of the Lambda function.
    • C. Store the files in the /tmp directory and delete them at the end of the Lambda function.
    • D. Copy the files to an Amazon S3 bucket configured with a lifecycle policy to delete the files.

    View question →

48. Q48. A company receives food orders from multiple partners. It operates a microservices application using Amazon API Gateway APIs integrated with AWS Lambda. Each partner invokes a custom API exposed by API Gateway to submit orders. API invocations trigger a shared Lambda function to process orders. After processing, partners must receive notifications. Each partner must receive updates only for their own orders. The company wants to minimize code changes when adding new partners in the future. Which solution meets these requirements in the most scalable way?

    • A. Create a separate Amazon Simple Notification Service (Amazon SNS) topic for each partner. Configure the Lambda function to publish each partner’s message to their respective SNS topic.
    • B. Create a separate Lambda function for each partner. Configure each Lambda function to notify its partner’s endpoint directly.
    • C. Create a single Amazon Simple Notification Service (Amazon SNS) topic. Configure the Lambda function to publish messages with specific attributes identifying the partner. Subscribe each partner to the SNS topic and apply appropriate subscription filter policies.
    • D. Create a single Amazon Simple Notification Service (Amazon SNS) topic. Subscribe all partners to the same SNS topic.

    View question →

49. Q49. A company hosts its application in the us-west-1 Region. The company wants to add redundancy in the us-east-1 Region. Application secrets are stored in AWS Secrets Manager in us-west-1. Developers need to replicate these secrets to us-east-1. Which solution satisfies this requirement?

    • A. Configure replication for each secret. Add us-east-1 as a replica region. Select an AWS Key Management Service (AWS KMS) key located in us-east-1 to encrypt the replicated secret.
    • B. Create a new secret in us-east-1 for each secret. Configure replication in us-east-1. Set the source to the corresponding secret in us-west-1. Select an AWS KMS key located in us-west-1 to encrypt the replicated secret.
    • C. Create a replication rule for each secret. Set us-east-1 as the target region. Configure the rule to run during secret rotation. Select an AWS KMS key located in us-east-1 to encrypt the replicated secret.
    • D. Create a Secrets Manager lifecycle rule to copy each secret to a new Amazon S3 bucket in us-west-1. Configure an S3 replication rule to copy the secrets to us-east-1.

    View question →

50. Q50. A company is building a web application on AWS. When a customer submits a request, the application generates a report and delivers it to the customer after a brief delay. Reports must remain available to customers for 8 hours. Some reports exceed 1 MB. Each report is unique and customer-specific. The application must delete reports older than 2 days. Which solution meets these requirements with the lowest operational overhead?

    • A. Generate the report and store it as a DynamoDB item with a specified TTL. Generate a URL to retrieve the report from DynamoDB. Provide the URL to the customer via the web application.
    • B. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Attach the report to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe customers to receive email notifications from Amazon SNS.
    • C. Generate the report and store it in an Amazon S3 bucket with server-side encryption. Generate a presigned URL with an expiration time. Provide the URL to the customer via the web application. Add a lifecycle configuration rule to the S3 bucket to delete old reports.
    • D. Generate the report and store it in an Amazon RDS database with a timestamp. Generate a URL to retrieve the report. Provide the URL to the customer via the web application. Schedule an AWS Lambda function to run hourly and delete database records with expired timestamps.

    View question →

51. Q51. A company has a web application that hosts a product catalog. The catalog is stored in an Amazon S3 bucket named DOC-EXAMPLE-BUCKET. The application must be able to list objects in the S3 bucket and must be able to download objects using an IAM policy. Which policy grants the minimum access required to meet these requirements?

    • A. {"Version": "2012-10-17","Statement":[{"Effect": "Allow","Action": "s3:ListBucket","Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET"}]
    • B. {"Version": "2012-10-17","Statement": [{"Effect": "Allow","Action": "s3:ListBucket","Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET"
    • C. {"version": "2012-10-17","statement":[{"Effect": "Allow","Action": "s3:ListBucket","Resonrce": "arn:aws:s3:::DOC-EXAMPLB-BUCKET"
    • D. {"version":"2012-10-17","Statement": [{"Ettect": "Al1ow","Action":["s3:DisLBuckel"],"Resource":"arn:aws:s3:::DOC-EXAMPLE-BUCKET"}]

    View question →

52. Q52. A company has an application running across multiple AWS Regions. The application experiences sporadic latency issues at irregular intervals. Developers must implement distributed tracing for the application using AWS X-Ray to identify the root cause of latency issues. What should developers do to meet this requirement?

    • A. Use the X-Ray console to add annotations for AWS services and user-defined services.
    • B. Use X-Ray’s automatic region annotations for AWS services. Add region annotations for user-defined services.
    • C. Use the X-Ray daemon to add annotations for AWS services and user-defined services.
    • D. Use X-Ray’s automatic region annotations for user-defined services. Configure X-Ray to add region annotations for AWS services.

    View question →

53. Q53. A company is building a serverless application using AWS Lambda functions. The company wants to create a test event to test Lambda functions in the development environment. The test event will be shared among developers in an IAM group named 'Developers'. The test event must be accessible by any IAM user in the 'Developers' IAM group. Which solution meets these requirements?

    • A. Create the test event in Amazon S3 and store it as a JSON object. Allow all IAM users in the Developers group access to the S3 bucket.
    • B. Create the test event. Configure event sharing settings to make the test event shareable.
    • C. Create and store the test event in Amazon DynamoDB. Allow access to DynamoDB using an IAM role.
    • D. Create the test event. Configure event sharing settings to make the test event private.

    View question →

54. Q54. A company’s new mobile application uses Amazon API Gateway. When the development team completes a new version of the API, developers must deploy the API changes safely and transparently. What is the simplest solution for developers to release the new API version to a limited number of users using API Gateway?

    • A. Create a new API in API Gateway. Use an Amazon Route 53 weighted routing policy to route a portion of traffic to the new API.
    • B. Validate the new API version and promote it to production during the window of lowest expected utilization.
    • C. Implement Amazon CloudWatch alarms to trigger rollback when the observed HTTP 500 status code rate exceeds a predefined threshold.
    • D. Use the canary release deployment option in API Gateway. Use the canarySettings to route a percentage of API traffic.

    View question →

55. Q55. A developer created an AWS Lambda function to send notifications via Amazon Simple Notification Service (Amazon SNS) when files larger than 50 MB are uploaded to Amazon S3. The developer deployed and tested the Lambda function using the AWS CLI. However, when a 3,000 MB file was uploaded to the S3 bucket, the Lambda function did not execute. What is the most likely cause of the Lambda function not executing?

    • A. S3 event notifications do not activate for files larger than 1,000 MB.
    • B. The Lambda function’s resource-based policy does not include permissions required for Amazon S3 to invoke it.
    • C. Lambda functions cannot be invoked directly from S3 events.
    • D. The S3 bucket must be made public.

    View question →

56. Q56. A development team uses AWS Elastic Beanstalk for application deployments. The team configured an application version lifecycle policy to limit the number of application versions to 25. However, even with this lifecycle policy enabled, source bundles are still being deleted from the Amazon S3 source bucket. What should the development team do in the Elastic Beanstalk application version lifecycle settings to retain source bundles in the S3 bucket?

    • A. Enable versioning on the source bundle S3 bucket.
    • B. Disable the S3 bucket lifecycle policy to prevent source bundle archival.
    • C. Update the Elastic Beanstalk application version lifecycle policy to increase the version quota to 50.
    • D. Update the Elastic Beanstalk application version lifecycle policy to retain source bundles in Amazon S3.

    View question →

57. Q57. A company has an application that uses Amazon Cognito User Pools as its identity provider. The company must ensure secure access to user records. The company has already enabled multi-factor authentication (MFA). The company also wants to send login activity notifications via email each time a user logs in. What is the most efficient solution to meet these requirements?

    • A. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Add an Amazon API Gateway API to invoke the function. Call the API from the client after receiving login confirmation.
    • B. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Add an Amazon Cognito Post Authentication Lambda trigger for the function.
    • C. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send email notifications. Create an Amazon CloudWatch Logs subscription filter to invoke the function based on login status.
    • D. Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and send email notifications based on each user’s login status.

    View question →

58. Q58. A company is developing a mobile application that uses an Amazon API Gateway API. The application uses AWS Lambda as its backend. Before releasing code to production, the company wants to test the code in a dedicated, closely monitored test environment. Which solution meets these requirements?

    • A. Use a single stage in API Gateway. Create a separate Lambda function for each environment. Configure API clients to send query parameters indicating the environment and the specific Lambda function.
    • B. Use multiple stages in API Gateway. Create a single Lambda function for all environments. Add environment-specific code blocks in the Lambda function based on Lambda environment variables.
    • C. Use multiple stages in API Gateway. Create a separate Lambda function for each environment. Configure API Gateway stage variables to route traffic to the Lambda function for that environment.
    • D. Use a single stage in API Gateway. Configure API clients to send query parameters indicating the environment. Add environment-specific code blocks in the Lambda function to match the query parameter value.

    View question →

59. Q59. A company has an AWS Lambda function that uses the Amazon SQS API to read messages from an Amazon Simple Queue Service (Amazon SQS) queue. Due to random failures of a downstream dependency, the Lambda function fails to process all messages successfully. The developer needs to enhance the reliability of the Lambda function so that it can successfully process each message even when the downstream dependency fails. Which solution requires the least effort to meet this requirement?

    • A. Move the calls to the third-party dependency into an exception-handling block. If a failure in the third-party dependency is caught in the exception handler, write the message back to the SQS queue.
    • B. Update the code in the Lambda function to remove the call to the SQS SDK ReceiveMessage function. Configure the Lambda function to use the SQS queue as an event source. Set the maxReceiveCount value of the SQS queue's redrive policy to at least 5.
    • C. Create a second SQS queue to serve as a dead-letter queue. Configure a redrive policy on the original SQS queue to send failed messages to the dead-letter queue. Modify the Lambda function to read messages from both queues.
    • D. Create a second SQS queue to serve as a dead-letter queue. Move the calls to the third-party dependency into an exception-handling block. If a failure in the third-party dependency is caught in the exception handler, write the message to the dead-letter queue.

    View question →

60. Q60. A developer is building an application that uses Amazon DynamoDB. The developer wants to retrieve a specific item from the database using a single API call. Which DynamoDB API call meets these requirements while minimizing impact on the database?

    • A. BatchGetItem
    • B. GetItem
    • C. Scan
    • D. Query

    View question →

61. Q61. A company recently deployed a new serverless user portal. Users report that a specific section of the portal is slow. Preliminary analysis identifies an Amazon API Gateway endpoint as the likely source of the issue. This endpoint integrates with an AWS Lambda function, which in turn interacts with other APIs and AWS services. How should the developer use operational best practices to identify the source of increased response time?

    • A. Update the Lambda function by adding log statements with high-precision timestamps before and after each external request. Deploy the updated Lambda function. After collecting sufficient usage data, examine the Lambda function's Amazon CloudWatch logs to identify potential sources of increased response time.
    • B. Instrument the Lambda function using the AWS X-Ray SDK. Add HTTP and HTTPS interceptors and SDK client handlers. Deploy the updated Lambda function. Enable X-Ray tracing. After collecting sufficient usage data, use the X-Ray service map to inspect average response times and identify potential sources.
    • C. View the Lambda function's Amazon CloudWatch metrics using the Metrics Explorer. Apply anomaly detection to the Duration and Throttles metrics. Review anomalies to identify potential sources.
    • D. Create a new Canary using Amazon CloudWatch Synthetics. Enable AWS X-Ray tracing on the Canary. Configure the Canary to scan the user portal. After collecting sufficient usage data, use the CloudWatch Synthetics Canary dashboard to view the Canary's metrics.

    View question →

62. Q62. A photo-sharing application uses Amazon S3 to store image files. All user photos undergo manual review by the company to prevent inappropriate content. Reviews are completed within 1–24 hours and results are stored in an Amazon DynamoDB table, using the S3 object key as the primary key. Database items can be queried via a REST API created by the company. A developer needs to implement an automated workflow to tag each S3 object with its review result. What should the developer do to meet these requirements most efficiently?

    • A. Create an AWS Lambda function triggered by s3:ObjectCreated events. Write the S3 key to an Amazon Simple Queue Service (Amazon SQS) queue with a visibility timeout of 24 hours. Create and configure a second Lambda function to read items from the queue. Retrieve each item's result from the DynamoDB table and tag the corresponding S3 object accordingly.
    • B. Create an AWS Lambda function triggered by s3:ObjectCreated events. Integrate the function into an AWS Step Functions standard workflow. Define an AWS Step Functions Wait state set to 24 hours. Create and configure a second Lambda function to retrieve the review result after the Wait state completes and tag the S3 object accordingly.
    • C. Create an AWS Lambda function that loads all untagged S3 objects. Retrieve each item's result from the REST API and tag each S3 object accordingly. Create and configure an Amazon EventBridge rule to run periodically. Set the Lambda function as the target of the EventBridge rule.
    • D. Launch an Amazon EC2 instance. Deploy a script to the EC2 instance that tags S3 objects using external database results. Configure a crontab file to run the script periodically.

    View question →

63. Q63. A developer built an application that calls an external API to retrieve data, processes the data, and saves the results to Amazon S3. The developer built a container image containing all necessary dependencies to run the application as a container. The application runs locally and requires maximum CPU and RAM resources. The developer has already created an Amazon ECS cluster. The developer needs to run the application hourly on Amazon Elastic Container Service (Amazon ECS). Which solution meets these requirements with the lowest infrastructure management overhead?

    • A. Add a capacity provider to manage instances.
    • B. Add an Amazon EC2 instance to run the application.
    • C. Define a task definition using the AWS Fargate launch type.
    • D. Create an Amazon ECS cluster and add a managed node group to run the application.

    View question →

64. Q64. A developer created a Python-based AWS Lambda function that reads data from objects in Amazon S3 and writes the data to an Amazon DynamoDB table. Object creation triggers the function successfully via S3 event notifications. However, the function fails when attempting to write to the DynamoDB table. What is the most likely cause of this issue?

    • A. The Lambda function has exceeded its concurrency limit.
    • B. The DynamoDB table requires a Global Secondary Index (GSI) to support writes.
    • C. The Lambda function lacks IAM permissions to write to DynamoDB.
    • D. The DynamoDB table is not running in the same Availability Zone as the Lambda function.

    View question →

65. Q65. A company uses AWS Lambda functions and Amazon S3 event notifications to process images uploaded to S3 buckets. The development team set up multiple environments in a single AWS account. After a recent production deployment, the team observed that uploads to the development S3 bucket triggered the production environment’s Lambda function. These invocations caused the production Lambda function to unintentionally process development S3 files. The team must prevent these unintended invocations and follow security best practices. Which solution meets these requirements?

    • A. Update the production Lambda function’s execution role to add a policy allowing the role to read only from the production S3 bucket.
    • B. Move the development and production environments to separate AWS accounts. Add resource-based policies to each Lambda function permitting invocation only from S3 buckets within the same account.
    • C. Add a resource-based policy to the production Lambda function allowing invocation only from the production S3 bucket.
    • D. Move the development and production environments to separate AWS accounts. Update each function’s Lambda execution role to add a policy allowing the role to read from S3 buckets only within the same account.

    View question →

66. Q66. Due to regulatory requirements, a financial company must retain original customer records for 10 years. Full records contain personally identifiable information (PII). Per local regulations, PII may only be accessed by certain personnel within the company and must not be shared externally. The company needs to provide aggregated records to external organizations for statistical analysis without sharing PII. A developer wants to store immutable original records in Amazon S3. Depending on who accesses the S3 object, the document should either be returned unchanged or have all PII removed. The developer wrote an AWS Lambda function named removePii to remove PII from documents. What should the developer do to meet the PII requirements while retaining only one copy of each document?

    • A. Configure S3 event notifications to invoke the removePii function on S3 GET requests. Call Amazon S3 using GET requests to access objects without PII.
    • B. Configure S3 event notifications to invoke the removePii function on S3 PUT requests. Call Amazon S3 using PUT requests to access objects without PII.
    • C. Create an S3 Object Lambda Access Point from the S3 console. Select the removePii function. Use the S3 Access Point to access objects without PII.
    • D. Create an S3 Access Point from the S3 console. Call the GetObjectLegalHold S3 API function using the access point name. Pass the removePii function name to access objects without PII.

    View question →

67. Q67. A developer is implementing an AWS Lambda function that is invoked when objects are uploaded to Amazon S3. The developer wants to test the Lambda function locally on their development machine before deploying the function to a production AWS account. Which solution meets these requirements with the least operational overhead?

    • A. Use the aws s3api put-object CLI command to upload an object to Amazon S3. Wait for the local Lambda invocation from the S3 event.
    • B. Create a sample JSON file for a PutObject S3 event. Invoke the Lambda function locally using the aws lambda invoke CLI command, passing the JSON file and the Lambda function name as parameters.
    • C. Use the sam local start-lambda CLI command to start Lambda locally. Use the sam local generate-event s3 put CLI command to create a Lambda test JSON file. Invoke the Lambda function using the sam local invoke CLI command, passing the JSON file as a parameter.
    • D. Create a JSON string for a PutObject S3 event. In the AWS Management Console, create a test event for the local Lambda function using the JSON string and execute the test.

    View question →

68. Q68. For the past three months, a development team has been using a build server running on an Amazon EC2 instance to perform builds and deployments. The EC2 instance’s instance profile uses an IAM role with an overly permissive IAM policy. The development team must replace this policy with one that grants only the minimum required permissions. What is the fastest way to create a custom IAM policy for the EC2 instance to meet this requirement?

    • A. Create a new IAM policy based on the services deployed or updated by the build server over the past three months.
    • B. Create a new IAM policy containing all actions logged by AWS CloudTrail for the IAM role over the past three months.
    • C. Create a new permissions boundary policy that denies all access and associate the permissions boundary with the IAM role.
    • D. Create a new IAM policy by querying the Amazon S3 bucket containing AWS CloudTrail events for the IAM role over the past three months using Amazon Athena.

    View question →

69. Q69. A company wants to harden its container images before they enter production. The company’s application uses Amazon Elastic Container Registry (Amazon ECR) as the image registry, Amazon Elastic Kubernetes Service (Amazon EKS) for compute, and AWS CodePipeline for CI/CD workflows integrating containers. After deploying a new container image to the development namespace in the EKS cluster, end-to-end application testing occurs in the final stage of the pipeline. Developers want to insert an analysis stage earlier in the CI/CD pipeline to analyze container images before deployment. Which solution meets these requirements with the highest operational efficiency?

    • A. Build the container image and run the docker scan command locally. Remediate any findings before pushing changes to the source code repository. Implement a pre-commit hook to enforce this workflow before commits.
    • B. Create a new CodePipeline stage that occurs after building the container image. Configure ECR basic image scanning to scan images upon push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check scan results and fail the pipeline if findings are detected.
    • C. Create a new CodePipeline stage that occurs after retrieving source code from its repository. Run a security scanner against the latest version of the source code. Fail the pipeline if findings are detected.
    • D. Add an action to the pipeline’s deploy stage so that it occurs before deployment to the EKS cluster. Configure ECR basic image scanning to scan images upon push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check scan results and fail the pipeline if findings are detected.

    View question →

70. Q70. A developer needs to implement caching to store frequently accessed query results from an Amazon RDS for MySQL database. The data to be cached includes sets and sorted sets. How should the developer implement caching to achieve the lowest latency?

    • A. Create an Amazon ElastiCache cluster for Memcached. Serialize data to JSON before caching.
    • B. Create an Amazon ElastiCache cluster for Redis. Use a Redis client library to cache data.
    • C. Create an Amazon DynamoDB table. Serialize data to JSON before caching.
    • D. Create an Amazon ElastiCache cluster for Memcached. Use a Memcached client library to cache data.

    View question →

71. Q71. A microservice application is deployed across multiple containers in Amazon Elastic Container Service (Amazon ECS). To improve observability, developers want to capture and visualize trace information between microservices to understand the microservice architecture.

    • A. Build a container from the amazon/aws-xray-daemon base image. Instrument the application using the AWS X-Ray SDK.
    • B. Install the Amazon CloudWatch agent on the container image. Publish custom metrics from each microservice using the CloudWatch SDK.
    • C. Install the AWS X-Ray daemon on each ECS instance.
    • D. Configure AWS CloudTrail data events to capture traffic between microservices.

    View question →

72. Q72. A developer is creating an AWS Lambda function triggered by messages from an Amazon Simple Notification Service (Amazon SNS) topic. Messages represent customer data updates from a Customer Relationship Management (CRM) system. The developer wants the Lambda function to process only messages related to email address changes. Other subscribers to the SNS topic will handle all other messages. Which solution meets these requirements with the least development effort?

    • A. Use Lambda event filtering to allow only messages related to email address changes to invoke the Lambda function.
    • B. Use an SNS filter policy on the Lambda function subscription to allow only messages related to email address changes to invoke the Lambda function.
    • C. Subscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic. Configure an SQS queue filter policy to allow only messages related to email address changes. Connect the SQS queue to the Lambda function.
    • D. Configure the Lambda code to inspect incoming messages. If a message is unrelated to email address changes, configure the Lambda function to republish the message back to the SNS topic for other subscribers to process.

    View question →

73. Q73. A developer is creating an AWS Lambda function in VPC mode. An Amazon S3 event invokes the Lambda function when objects are uploaded to an S3 bucket. The Lambda function processes the object and produces some analytical results, which are written to a file. Each processed object also generates a log entry, which is written to a file. Other Lambda functions, AWS services, and on-premises resources must have access to both the results file and the log file. Each log entry must also be appended to the same shared log file. The developer needs a solution that supports shared file access and allows appending results to existing files. Which solution should the developer use to meet these requirements?

    • A. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in Lambda. Store the results file and log file in the mount point. Append log entries to the log file.
    • B. Create an Amazon Elastic Block Store (Amazon EBS) volume with multi-attach enabled. Attach the EBS volume to all Lambda functions. Update the Lambda function code to download the log file, append the log entry, and upload the modified log file back to Amazon EBS.
    • C. Create a reference to the /tmp local directory. Use the directory reference to store the results file and log file. Append log entries to the log file.
    • D. Create a reference to the /opt storage directory. Use the directory reference to store the results file and log file. Append log entries to the log file.

    View question →

74. Q74. A company’s application includes an AWS Lambda function that processes messages from IoT devices. The company wants to monitor the Lambda function to ensure it meets its business-critical service level agreement (SLA). A developer must implement a solution to measure application throughput in near real time. Throughput must be based on the number of messages received and processed by the Lambda function within a given time window. Lambda function initialization and post-processing steps must be excluded from throughput calculations. What should the developer do to meet these requirements?

    • A. Use the ConcurrentExecutions metric for the Lambda function in Amazon CloudWatch to measure throughput.
    • B. Modify the application to log calculated throughput to Amazon CloudWatch Logs. Use Amazon EventBridge to invoke a separate Lambda function on a schedule to process the logs.
    • C. Modify the application to publish custom Amazon CloudWatch metrics each time the Lambda function receives and processes a message. Use these metrics to calculate throughput.
    • D. Use the Invocations and Duration metrics for the Lambda function in Amazon CloudWatch to calculate throughput.

    View question →

75. Q75. What is the purpose of an Amazon SQS delay queue?

    • A. Messages are hidden for a configurable period when first added to the queue.
    • B. Messages are hidden for a configurable period after being consumed from the queue.
    • C. Consumers can poll the queue for a configurable period before retrieving messages.
    • D. Messages cannot be deleted for a configurable period after being consumed from the queue.

    View question →

76. Q76. A developer is building a serverless application that connects to an Amazon Aurora PostgreSQL database. The serverless application consists of multiple AWS Lambda functions. Each time a Lambda function scales, a new database connection is established, increasing database resource consumption. The developer wants to reduce the number of database connections. The solution must not impact the scalability of the Lambda functions. Which solution meets these requirements?

    • A. Configure provisioned concurrency for each Lambda function and set the ProvisionedConcurrentExecutions parameter to 10.
    • B. Enable cluster cache management for Aurora PostgreSQL. Update each Lambda function’s connection string to point to the cluster cache manager.
    • C. Use Amazon RDS Proxy to create a connection pool to manage database connections. Update each Lambda function’s connection string to reference the proxy.
    • D. Configure reserved concurrency for each Lambda function and set the ReservedConcurrentExecutions parameter to 10.

    View question →

77. Q77. A company operates a website that displays a daily news bulletin. When users visit the site, an AWS Lambda function processes the request, queries the company’s on-premises database to retrieve the current bulletin, and stores the bulletin in plain text. The Lambda function uses the Amazon Translate TranslateText API operation to translate the bulletin and displays the translated result to users. Due to increased traffic, the website’s response time has slowed and the database is overloaded. The company cannot modify the database and requires a solution to improve the Lambda function’s response time. Which solution meets these requirements?

    • A. Switch to asynchronous Lambda function invocations.
    • B. Cache translated news bulletins in the Lambda /tmp directory.
    • C. Enable TranslateText API caching.
    • D. Modify the Lambda function to use parallel processing.

    View question →

78. Q78. A developer is building a serverless application deployed on AWS. The developer wants to accelerate the development workflow by deploying incremental changes to AWS for testing. The developer wants to deploy only the changed components, not redeploy the entire application for every code commit. What should the developer do to meet these requirements?

    • A. Use AWS Serverless Application Model (AWS SAM) to build the application. Use the sam sync command to deploy incremental changes.
    • B. Use AWS Serverless Application Model (AWS SAM) to build the application. Use the sam init command to deploy incremental changes.
    • C. Use AWS Cloud Development Kit (AWS CDK) to build the application. Use the cdk synth command to deploy incremental changes.
    • D. Use AWS Cloud Development Kit (AWS CDK) to build the application. Use the cdk bootstrap command to deploy incremental changes.

    View question →

79. Q79. An organization stores large files in Amazon S3 and is developing a web application to display metadata about those files to end users. Based on the metadata, users select an object for download. The organization requires a mechanism to index file metadata and retrieve it with low latency—measured in milliseconds. Which AWS service should be used to achieve this?

    • A. Amazon DynamoDB
    • B. Amazon EC2
    • C. AWS Lambda
    • D. Amazon RDS

    View question →

80. Q80. A company needs to share information with a partner. The partner exposes an HTTP API endpoint, and the company uses an API key to access it. The company requires a secure method to manage the API key in code, ensuring API key integration with the application code does not impact application performance. Which solution most securely meets these requirements?

    • A. Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime using the AWS SDK. Use the credentials for API calls.
    • B. Store API credentials in local code variables. Push the code to a secure Git repository. Use the local code variables for API calls at runtime.
    • C. Store API credentials as objects in a private Amazon S3 bucket. Restrict access to the S3 object using IAM policies. Retrieve the API credentials at runtime using the AWS SDK. Use the credentials for API calls.
    • D. Store API credentials in an Amazon DynamoDB table. Restrict access to the table using resource-based policies. Retrieve the API credentials at runtime using the AWS SDK. Use the credentials for API calls.

    View question →

81. Q81. An application under development needs to store hundreds of video files. Before storage, the application must encrypt the data using a unique key for each video file. How should the developer implement this application?

    • A. Use the KMS Encrypt API to encrypt the data. Store the encrypted data key and the encrypted data.
    • B. Use a cryptographic library to generate an encryption key within the application. Use that key to encrypt the data. Store only the encrypted data.
    • C. Use the KMS GenerateDataKey API to obtain a data key. Use the plaintext data key to encrypt the data. Store the encrypted data key and the encrypted data.
    • D. Use AWS KMS–based server-side encryption when uploading data to an S3 bucket.

    View question →

82. Q82. A developer needs to manage AWS infrastructure as code and must be able to deploy identical copies of infrastructure, perform staged changes, and revert to previous versions. Which approach meets these requirements?

    • A. Use Cost Allocation Reports and AWS OpsWorks to deploy and manage infrastructure.
    • B. Use Amazon CloudWatch metrics and alarms along with resource tagging to deploy and manage infrastructure.
    • C. Use AWS Elastic Beanstalk and AWS CodeCommit to deploy and manage infrastructure.
    • D. Use AWS CloudFormation and AWS CodeCommit to deploy and manage infrastructure.

    View question →

83. Q83. A company has an application that runs as a series of AWS Lambda functions. Each Lambda function receives data from Amazon Simple Notification Service (Amazon SNS) and writes the data to an Amazon Aurora DB instance. To comply with information security policies, the company must ensure all Lambda functions use a secure, encrypted database connection string to access Aurora. Which solution meets these requirements?

    • A. Use IAM database authentication for Aurora to enable secure database connections for all Lambda functions.
    • B. Store credentials in an encrypted Amazon RDS DB instance and read them from there.
    • C. Store credentials in AWS Systems Manager Parameter Store as a SecureString parameter.
    • D. Use Lambda environment variables encrypted with a shared AWS Key Management Service (AWS KMS) key.

    View question →

84. Q84. A company is deploying a new application on AWS. The company is streaming application logs to Amazon CloudWatch Logs. The development team must receive email notifications whenever the term 'ERROR' appears in any log line. A developer has created an Amazon Simple Notification Service (Amazon SNS) topic and subscribed the development team to that topic. What action should the developer take next to meet this requirement?

    • A. Select the appropriate log group. Create a CloudWatch metric filter with 'ERROR' as the search pattern. Create an alarm on this metric and configure it to notify the SNS topic when the metric value is 1 or higher.
    • B. In CloudWatch Logs Insights, select the appropriate log group. Create a metric query searching for the term 'ERROR' in logs. Create an alarm on this metric and configure it to notify the SNS topic when the metric value is 1 or higher.
    • C. Select the appropriate log group. Create an SNS subscription filter with 'ERROR' as the filter pattern. Select the SNS topic as the destination.
    • D. Create a CloudWatch alarm with 'ERROR' as the filter pattern, define the appropriate log group dimension, and specify the SNS topic as the target.

    View question →

85. Q85. A company has multiple AWS Lambda functions. The company's QA team needs to test these Lambda functions using Lambda function URLs. Developers need to configure Lambda function authentication to allow access so that QA IAM users can invoke the Lambda functions using the public URL. Which solution meets these requirements?

    • A. Create a CLI script that iterates over the Lambda functions to add Lambda function URLs with AWS IAM authentication type. Run another script to create an IAM identity-based policy allowing the lambda:InvokeFunctionUrl action on all Lambda function Amazon Resource Names (ARNs). Attach the policy to the QA IAM group.
    • B. Create a CLI script that iterates over the Lambda functions to add Lambda function URLs with NONE authentication type. Run another script to create an IAM resource-based policy allowing the lambda:InvokeFunctionUrl action on all Lambda function ARNs. Attach the policy to the QA IAM group.
    • C. Create a CLI script that iterates over the Lambda functions to add Lambda function URLs with AWS IAM authentication type. Run another script to iterate over the Lambda functions to create an IAM identity-based policy allowing the lambda:InvokeFunctionUrl action from the QA IAM group's ARN.
    • D. Create a CLI script that iterates over the Lambda functions to add Lambda function URLs with NONE authentication type. Run another script to iterate over the Lambda functions to create an IAM resource-based policy allowing the lambda:InvokeFunctionUrl action from the QA IAM group's ARN.

    View question →

86. Q86. An organization stores large files in Amazon S3 and is building a web application to display metadata about those files to end users. Based on the metadata, users select objects to download. The organization requires a mechanism to index file size metadata with single-digit millisecond latency retrieval. Which AWS service should be used to accomplish this task?

    • A. Amazon DynamoDB
    • B. Amazon EC2
    • C. AWS Lambda
    • D. Amazon RDS

    View question →

87. Q87. A game stores user game data in an Amazon DynamoDB table. Individual users must not access other users' game data. How can this be achieved?

    • A. Encrypt game data using individual user keys.
    • B. Restrict access to specific items based on certain primary key values.
    • C. Stage data in an SQS queue to inject metadata before accessing DynamoDB.
    • D. Read records from DynamoDB and discard irrelevant data on the client side.

    View question →

88. Q88. A developer is troubleshooting an application using Amazon DynamoDB in the us-west-2 Region. The application is deployed on an Amazon EC2 instance. The application requires read-only operations on a table named Cars. The EC2 instance is attached to an IAM role with the following IAM policy: {"Version":"2012-10-17"}

    • A. Modify the IAM policy's Resource to "arn:aws:dynamodb:us-west-2:account-id:table/*".
    • B. Modify the IAM policy to include dynamodb:* actions.
    • C. Create a trust policy specifying the EC2 service principal. Associate the role with the policy.
    • D. Create a trust relationship between the role and dynamodb.amazonaws.com.

    View question →

89. Q89. A developer is designing a serverless application that allows customers to select seats for concerts. Customers submit ticket requests via an AWS Lambda function integrated with an Amazon API Gateway API, which generates an order ID. The application includes two additional Lambda functions: one for inventory management and one for payment processing. These two Lambda functions run asynchronously and write orders to an Amazon DynamoDB table. The application must fulfill the following requirement: If a seat is accidentally sold more than once, the application must reject the second order. In such cases, only the second order’s payment must be processed. However, if the second order’s payment is rejected during processing, the third order must claim the seat—and its payment must be processed. Which solution meets these requirements?

    • A. Send the order ID to an Amazon Simple Notification Service (Amazon SNS) FIFO topic, which fans out to one Amazon Simple Queue Service (Amazon SQS) FIFO queue for inventory management and another SQS FIFO queue for payment processing.
    • B. Modify the Lambda function that generates the order ID to invoke the inventory management Lambda function, then invoke the payment processing Lambda function.
    • C. Send the order ID to an Amazon Simple Notification Service (Amazon SNS) topic and subscribe Lambda functions for inventory management and payment processing to the topic.
    • D. Send the order ID to an Amazon Simple Queue Service (Amazon SQS) queue and configure Lambda functions for inventory management and payment processing to poll the queue.

    View question →

90. Q90. A company has an analytics application that uses AWS Lambda functions to process transaction data asynchronously. Developers notice that asynchronous Lambda function invocations sometimes fail. When a Lambda function invocation fails, developers want to invoke a second Lambda function to handle the error and log detailed information. Which solution meets these requirements?

    • A. Configure a Lambda function destination and specify failure conditions. Set Lambda function as the destination type and specify the Amazon Resource Name (ARN) of the error-handling Lambda function as the resource.
    • B. Enable AWS X-Ray active tracing on the initial Lambda function. Configure X-Ray to capture stack traces for failed invocations. Invoke the error-handling Lambda function by including the stack trace in the event object.
    • C. Configure a Lambda function trigger and specify failure conditions. Set Lambda function as the destination type and specify the ARN of the error-handling Lambda function as the resource.
    • D. Create a status-check alarm on the initial Lambda function. Configure the alarm to invoke the error-handling Lambda function when triggered. Ensure the alarm passes the stack trace in the event object.

    View question →

91. Q91. A company has deployed a microservices application using Amazon API Gateway, AWS Lambda, Amazon Simple Queue Service (Amazon SQS), and Amazon DynamoDB. A Lambda function adds messages to an SQS FIFO queue. When developers reviewed the application logs, they discovered duplicate items in the DynamoDB table. These items were inserted by another polling function that processes messages from the queue. What is the most likely cause of this issue?

    • A. Write operations on the DynamoDB table are being throttled.
    • B. The SQS queue is delivering the same message multiple times to the function.
    • C. API Gateway is duplicating messages in the SQS queue.
    • D. The polling function's timeout is greater than the queue's visibility timeout.

    View question →

92. Q92. Due to regulatory requirements, a financial company must retain original customer records for 10 years. The complete record includes personally identifiable information (PII). Per local regulations, PII may only be accessed by specific personnel within the company and must not be shared with third parties. The company wishes to provide anonymized records to third-party organizations for statistical analysis without sharing PII. Developers want to store the original immutable records in Amazon S3. Documents should be returned unchanged—or with PII removed—depending on who accesses them in S3. Developers have written an AWS Lambda function named removePii to remove PII from documents. How should developers implement this solution to meet PII compliance requirements while retaining only one copy of each document?

    • A. Configure an S3 event notification to invoke the removePii function on S3 GET requests. Access objects without PII by issuing GET requests to Amazon S3.
    • B. Configure an S3 event notification to invoke the removePii function on S3 PUT requests. Access objects without PII by issuing PUT requests to Amazon S3.
    • C. Create an S3 Object Lambda Access Point from the S3 console and select the removePii function. Access objects without PII using the S3 Object Lambda Access Point.
    • D. Create an S3 Access Point from the S3 console. Call the GetObjectLegalHold S3 API function using the access point name and pass the removePii function name to access objects without PII.

    View question →

93. Q93. A developer designed an application that stores input data as JSON files in Amazon S3 objects. Subsequently, a custom business logic in an AWS Lambda function processes these objects, and the Lambda function loads the data into an Amazon DynamoDB table. Recently, the workload’s traffic experienced sudden and significant fluctuations. The data stream into the DynamoDB table is being throttled. The developer needs to implement a solution to eliminate throttling and load data more consistently into the DynamoDB table. Which solution meets these requirements?

    • A. Refactor the Lambda function into two functions: one for data transformation and one for loading data into the DynamoDB table. Introduce an Amazon Simple Queue Service (Amazon SQS) queue between the functions to store items as messages and invoke the second function.
    • B. Enable auto scaling for the DynamoDB table. Use Amazon CloudWatch to monitor the table’s read and write capacity metrics and track consumed capacity.
    • C. Create an alias for the Lambda function. Configure provisioned concurrency for the application.
    • D. Refactor the Lambda function into two functions: one to store data in the DynamoDB table and another to process and update items after storage. Enable a DynamoDB Stream to invoke the second function after data is stored.

    View question →

94. Q94. An application consists of two tiers: one for web services and one for databases. The web tier serves web pages and manages session state in memory. The database tier hosts a MySQL database containing order details. During high-traffic periods, the web tier’s memory utilization approaches 100%, and application performance degrades significantly. Developers identify that much of the increased memory usage and potential slowdown stems from managing session state for additional users. For migrating the web tier, developers plan to use Amazon EC2 instances behind an Application Load Balancer with Auto Scaling. What additional changes should developers make to the application to improve scalability?

    • A. Host the MySQL database on EC2 instances. Store both session data and application data in the MySQL database.
    • B. Use Amazon ElastiCache for Memcached to store and manage session data. Use an Amazon RDS for MySQL DB instance to store application data.
    • C. Use Amazon ElastiCache for Memcached to store and manage both session data and application data.
    • D. Use EC2 instance storage to manage session data. Use an Amazon RDS for MySQL DB instance to store application data.

    View question →

95. Q95. An IT department uses Amazon S3 to store sensitive images. After one year, the company moves images to archival storage. Although access to these images is infrequent, the IT department requires retrieval of archived images within 24 hours. Which solution provides the most cost-effective way to meet these requirements while maximizing reliability?

    • A. Store images in S3 Standard-Infrequent Access (S3 Standard-IA). Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
    • B. Store images in S3 Standard-Infrequent Access (S3 Standard-IA). Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.
    • C. Store images in S3 Intelligent-Tiering. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
    • D. Store images in S3 One Zone-Infrequent Access (S3 One Zone-IA). Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.

    View question →

96. Q96. A developer is building a web application that stores data in Amazon DynamoDB. The ExamScores table has the following attributes: student_id, subject_name, and top_score. Each item in the ExamScores table is uniquely identified by student_id as the partition key and subject_name as the sort key. The web application must display the student_id with the highest top_score for each subject. The developer wants to optimize query speed to retrieve the top-scoring student ID per subject. Which solution meets these requirements?

    • A. Create a Local Secondary Index (LSI) with subject_name as the partition key and top_score as the sort key.
    • B. Create a Local Secondary Index (LSI) with top_score as the partition key and student_id as the sort key.
    • C. Create a Global Secondary Index (GSI) with subject_name as the partition key and top_score as the sort key.
    • D. Create a Global Secondary Index (GSI) with subject_name as the partition key and student_id as the sort key.

    View question →

97. Q97. A developer is using AWS Copilot to build a new containerized application. The developer deploys the application during development using the AWS Copilot CLI. The application code is pushed to a new AWS CodeCommit repository. Before releasing the new application to production, the developer must create an automated deployment pipeline. To meet these requirements with maximum operational efficiency, what should the developer do?

    • A. Create a buildspec file that invokes AWS Copilot CLI commands to build and deploy the application. Use the AWS Copilot CLI to create an AWS CodePipeline with CodeCommit as the source stage and AWS CodeBuild as the build stage.
    • B. Use the AWS Serverless Application Model (AWS SAM) CLI to bootstrap and initialize an AWS CodePipeline configuration. Use the CodeCommit repository as the source. Invoke the AWS Copilot CLI to build and deploy the application.
    • C. Use the AWS Copilot CLI to define an AWS Copilot pipeline and deploy AWS CodePipeline. Select CodeCommit as the source for the AWS CodePipeline.
    • D. Define an AWS CloudFormation template for AWS CodePipeline with CodeCommit as the source. Configure the template as an add-on to the AWS Copilot CLI. Use the AWS Copilot CLI to deploy the application.

    View question →

98. Q98. A developer has an application that makes asynchronous invocations of an AWS Lambda function. The developer wants to store messages that cause Lambda function invocation failures so the application can retry those invocations later. What should the developer do to achieve this goal with the lowest operational overhead?

    • A. Configure an Amazon CloudWatch Logs log group to filter messages and store them in an Amazon S3 bucket. Import the messages in Lambda and re-invoke the Lambda function.
    • B. Configure Amazon EventBridge (Amazon CloudWatch Events) to send failed messages to Amazon Simple Notification Service (Amazon SNS) to re-invoke the Lambda function.
    • C. Implement a dead-letter queue (DLQ) for failed invocations. Configure the DLQ as an event source for the Lambda function.
    • D. Send Amazon EventBridge (Amazon CloudWatch Events) events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to poll messages from the SQS queue and re-invoke itself.

    View question →

99. Q99. A company is using an Amazon API Gateway REST API endpoint as a webhook to publish commits from its on-premises source code management (SCM) system to Amazon EventBridge. The company has configured an EventBridge rule in a central AWS account to listen for application deployments from the SCM system. The company needs to deliver commits to multiple receiving AWS accounts. How can developers meet these requirements without changing the SCM system configuration?

    • A. Deploy the API Gateway REST API to all required AWS accounts. Use the same custom domain name for all gateway endpoints so that a single SCM webhook can be used for events from all accounts.
    • B. Deploy the API Gateway REST API to all receiving AWS accounts. Create as many SCM webhooks as there are AWS accounts.
    • C. Grant the central AWS account's EventBridge permission to access the receiving AWS accounts. Add EventBridge event buses in the receiving AWS accounts as targets to the existing EventBridge rule.
    • D. Convert the API Gateway type from REST API to HTTP API.

    View question →

100. Q100. A company plans to use AWS CodeDeploy to deploy an application to AWS Lambda. During deployment of a new application version, the company initially routes only 10% of live traffic to the newly deployed application version. Then, every 10 minutes, the company routes an additional 10% of live traffic to the newly deployed application version until all live traffic is routed to the new version. Which CodeDeploy predefined deployment configuration meets these requirements?

     • A. CodeDeploy Default.OneAtATime
     • B. CodeDeploy Default.LambdaCanary10Percent10Minutes
     • C. CodeDeploy Default.LambdaLinear10PercentEvery10Minutes
     • D. CodeDeploy Default.ECSLinear10PercentEvery3Minutes

     View question →