A developer created reusable code that several AWS Lambda functions need to use. The developer bundled the code into a zip archive. The developer needs to deploy the code to AWS and update the Lambda functions to use the code.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Upload the zip archive to Amazon S3. Configure an import path on the Lambda functions to point to the zip archive.
B. Create a new Lambda function that contains and runs the shared code. Update the existing Lambda functions to invoke the new Lambda function synchronously.
C. Create a Lambda layer that contains the zip archive. Attach the Lambda layer to the Lambda functions.
D. Create a Lambda container image that includes the shared code. Use the container image as a Lambda base image for all the functions.
Show Answer
Correct Answer: C
Explanation: Lambda layers are the AWS-native mechanism for packaging and sharing reusable code across multiple Lambda functions. Upload the shared code as a layer and attach it to each function, allowing centralized versioning and updates without duplicating code. S3 cannot be used as an import path for Lambda code, invoking another Lambda for shared libraries adds unnecessary latency and operational complexity, and container images are intended for packaging entire functions rather than sharing common code across existing functions.
Question 92
A company has an application that uses an Amazon Cognito user pool for authentication. A developer needs to add a new REST API that will use the user pool to authenticate requests.
Which solution will meet this requirement with the LEAST development effort?
A. Create a new API key and a new usage plan. Associate the API key and the REST API with the usage plan.
B. Create a Cognito authorizer for the correct user pool. Reference the header that contains the Cognito token.
C. Create an AWS Lambda token authorizer. Reference the authorization token in the event payload. Authenticate requests based on the token value.
D. Create an AWS Lambda request authorizer. Reference the authorization header in the event payload. Authenticate requests by using the header value in a request to the Cognito API.
Show Answer
Correct Answer: B
Explanation: API Gateway REST APIs natively support Amazon Cognito user pool authorizers. Creating a Cognito authorizer that references the Authorization header containing the Cognito JWT allows API Gateway to validate the token without writing custom authentication code. API keys do not authenticate Cognito users, and Lambda token/request authorizers require additional development and maintenance.
Question 94
A developer is using AWS CloudFormation to deploy an AWS Lambda function. The developer needs to set the Lambda function's timeout value based on the environment parameter of the template. The template contains mappings of EnvironmentData for each environment's timeout value. The environment parameter and EnvironmentData mappings are as follows:
Environment parameter:
EnvironmentData mappings:
Which statement will meet these requirements?
A. Timeout: !GetAtt [EnvironmentData, !Ref Environment, Timeout]
B. Timeout: !FindInMap [EnvironmentData, !Ref Environment, Timeout]
C. Timeout: !Select [EnvironmentData, !Ref Environment, Timeout]
D. Timeout: !ForEach[EnvironmentData, !Ref Environment, Timeout]
Show Answer
Correct Answer: B
Explanation: Use the CloudFormation intrinsic function FindInMap to retrieve a value from a mapping. Given a mapping named EnvironmentData with the top-level key from !Ref Environment and the second-level key Timeout, the correct syntax is `!FindInMap [EnvironmentData, !Ref Environment, Timeout]`. `GetAtt` retrieves resource attributes, `Select` selects an item from a list by index, and `ForEach` is not a valid intrinsic function for this purpose.
Question 95
A developer is building an application that processes a stream of user-supplied data. The data stream must be consumed by multiple Amazon EC2 based processing applications in parallel and in real time. Each processor must be able to resume without losing data if there is a service interruption. The application architect plans to add other processors in the near future, and wants to minimize the amount of data duplication involved.
Which solution will satisfy these requirements?
A. Publish the data to Amazon Simple Queue Service (Amazon SQS).
B. Publish the data to Amazon Data Firehose.
C. Publish the data to Amazon EventBridge.
D. Publish the data to Amazon Kinesis Data Streams.
Show Answer
Correct Answer: D
Explanation: Amazon Kinesis Data Streams is designed for real-time streaming with multiple independent consumers. Multiple EC2-based applications can consume the same stream in parallel, each maintaining its own checkpoint to resume processing after interruptions without data loss. Kinesis retains data for replay, minimizing duplication because a single stream feeds multiple consumers. Amazon SQS is primarily point-to-point competing consumers, Firehose is for delivery to destinations rather than multiple real-time processors, and EventBridge is an event bus rather than a high-throughput streaming service with replay/checkpoint semantics for stream processing.
Question 96
A developer is implementing a serverless application by using AWS CloudFormation to provision Amazon S3 web hosting. Amazon API Gateway, and AWS Lambda functions. The Lambda function source code is zipped and uploaded to an S3 bucket. The S3 object key of the zipped source code is specified in the Lambda resource in the CloudFormation template.
The developer notices that there are no changes in the Lambda function every time the CloudFormation stack is updated.
How can the developer resolve this issue?
A. Create a new Lambda function alias before updating the CloudFormation stack.
B. Change the S3 object key or the S3 version in the CloudFormation template before updating the CloudFormation stack.
C. Upload the zipped source code to another S3 bucket before updating the CioudFormation stack.
D. Associate a cade signing configuration with the Lambda function before updating the CloudFormation stack.
Show Answer
Correct Answer: B
Explanation: CloudFormation updates a Lambda function's code only when it detects a change in the Lambda resource properties. If the deployment package is overwritten at the same S3 object key without changing the template, CloudFormation does not detect a code change. Updating the S3 object key or specifying a different S3 object version (with S3 versioning enabled) changes the resource properties and triggers a Lambda code update.
Question 97
A developer is building an application that uses an AWS Lambda function to process data. The application requires minimum latency. The Lambda function must have predictable function start times. All setup activities for the execution environment must happen before invocation of the Lambda function.
Which solution will meet these requirements?
A. Increase the memory of the Lambda function to the maximum amount. Configure an Amazon EventBridge rule to schedule invocations of the Lambda function every minute to keep the execution environment active.
B. Optimize the static initialization code that runs when a new execution environment is prepared for the first time. Decrease and compress the size of the Lambda function package and the imported libraries and dependencies.
C. Increase the reserved concurrency of the Lambda function to the maximum value for unreserved account concurrency. Run any setup activities manually before the initial invocation of the Lambda function.
D. Publish a new version of the Lambda function. Configure provisioned concurrency for the Lambda function with the required minimum number of execution environments.
Show Answer
Correct Answer: D
Explanation: Provisioned concurrency pre-initializes Lambda execution environments, completing initialization and setup before requests arrive. This minimizes cold starts, provides predictable startup latency, and ensures initialization code runs before invocation. Increasing memory, optimizing initialization, or reserving concurrency alone do not guarantee pre-initialized execution environments.
Question 98
An AWS Lambda function generates a 3 MB JSON file and then uploads it to an Amazon S3 bucket daily. The file contains sensitive information, so the developer must ensure that it is encrypted before uploading to the bucket.
Which of the following modifications should the developer make to ensure that the data is encrypted before uploading it to the bucket?
A. Use the default AWS Key Management Service (AWS KMS) key for Amazon S3 in the Lambda function code.
B. Use the S3 managed key and call the GenerateDataKey API to encrypt the file.
C. Use the GenerateDataKey API, then use that data key to encrypt the file in the Lambda function code.
D. Use an AWS Key Management Service (AWS KMS) customer managed key for Amazon S3 in the Lambda function code.
Show Answer
Correct Answer: C
Explanation: The requirement is to encrypt the JSON file before it is uploaded to Amazon S3 (client-side encryption). The correct approach is to call AWS KMS GenerateDataKey, use the returned plaintext data key to encrypt the file within the Lambda function, and retain the encrypted (ciphertext) data key for later decryption. Options using S3-managed or KMS keys for Amazon S3 refer to server-side encryption, which occurs after upload, not before upload. GenerateDataKey is not supported with S3-managed keys.
Question 99
A developer has deployed an AWS Lambda function that is subscribed to an Amazon Simple Notification Service (Amazon SNS) topic. The developer must implement a solution to add a record of each Lambda function invocation to an Amazon Simple Queue Service (Amazon SQS) queue.
Which solution will meet this requirement?
A. Configure the SQS queue as a dead-letter queue for the Lambda function.
B. Create code that uses the AWS SDK to call the SQS SendMessage operation to add the invocation details to the SQS queue. Add the code to the end of the Lambda function.
C. Add two asynchronous invocation destinations to the Lambda function: one destination for successful invocations and one destination for failed invocations. Configure the SQS queue as the destination for each type. Create an Amazon CloudWatch alarm based on the DestinationDeliveryFailures metric to catch any message that cannot be delivered.
D. Add a single asynchronous invocation destination to the Lambda function to capture successful invocations. Configure the SQS queue as the destination. Create an Amazon CloudWatch alarm based on the DestinationDeliveryFailures metric to catch any message that cannot be delivered.
Show Answer
Correct Answer: B
Explanation: The requirement is to add a record of each Lambda function invocation to an SQS queue. Lambda destinations apply only to asynchronous invocations made directly to Lambda, not to Lambda functions invoked by Amazon SNS as an event source. A dead-letter queue only captures failed processing. Adding code at the end of the function to send an SQS message with invocation details ensures every successful execution records the invocation. Among the given options, this is the applicable solution for an SNS-triggered Lambda.
Sources:
https://docs.aws.amazon.com/lambda/latest/dg/troubleshooting-invocation.html
Question 100
A developer is writing a mobile application that allows users to view images from an S3 bucket. The users must be able to log in with their Amazon login, as well as supported social media accounts.
How can the developer provide this authentication functionality?
A. Use Amazon Cognito with web identity federation.
B. Use Amazon Cognito with SAML-based identity federation.
C. Use IAM access keys and secret keys in the application code to allow Get* on the S3 bucket.
D. Use AWS STS AssumeRole in the application code and assume a role with Get* permissions on the S3 bucket.
Show Answer
Correct Answer: A
Explanation: Amazon Cognito with web identity federation is designed for mobile and web applications that authenticate users through Amazon and supported social identity providers (such as Google, Facebook, Login with Amazon) and then provide temporary AWS credentials to access resources like Amazon S3. SAML federation is intended for enterprise identity providers. Embedding IAM access keys in a mobile app is insecure, and STS AssumeRole by itself does not provide user authentication with social identity providers.
Question 101
A developer is building an ecommerce application that uses multiple AWS Lambda functions. Each function performs a specific step in a customer order workflow, such as order processing and inventory management.
The developer must ensure that the Lambda functions run in a specific order.
Which solution will meet this requirement with the LEAST operational overhead?
A. Configure an Amazon Simple Queue Service (Amazon SQS) queue to contain messages about each step a function must perform. Configure the Lambda functions to run sequentially based on the order of messages in the SQS queue.
B. Configure an Amazon Simple Notification Service (Amazon SNS) topic to contain notifications about each step a function must perform. Subscribe the Lambda functions to the SNS topic. Use subscription filters based on the step each function must perform.
C. Configure an AWS Step Functions state machine to invoke the Lambda functions in a specific order.
D. Configure Amazon EventBridge Scheduler schedules to invoke the Lambda functions in a specific order.
Show Answer
Correct Answer: C
Explanation: AWS Step Functions is the managed orchestration service designed to coordinate multiple AWS Lambda functions in a defined sequence. It provides state management, retries, error handling, and branching with minimal operational overhead. SQS and SNS are messaging services that do not inherently orchestrate ordered workflow execution across multiple functions, and EventBridge Scheduler is intended for time-based scheduling rather than workflow sequencing.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.