A developer is updating the code for an AWS Lambda function to add new capabilities. The Lambda function has version aliases for production and development environments that run separate versions of the function. The developer needs to configure a staging environment for the Lambda function to handle invocations to both the development version and the production version.
Which solution will meet these requirements?
A. Create a weighted alias that references the production version of the function and the updated version of the function.
B. Add a Network Load Balancer. Add the production version of the function and updated version of the function as targets.
C. Use AWS CodeDeploy to create a linear traffic shifting deployment
D. Create a tag for the Lambda function that contains the production version and updated version of the code.
Show Answer
Correct Answer: A
Explanation: A Lambda alias can be configured as a weighted alias that routes a percentage of invocations to multiple function versions. This allows a staging environment to invoke both the production version and the development (updated) version simultaneously, which directly meets the requirement. The other options do not provide alias-based multi-version invocation for Lambda.
Question 103
A company is creating a new application that gives users the ability to upload and share short video files. The average size of the video files is 10 MB. After a user uploads a file, a message needs to be placed into an Amazon Simple Queue Service (Amazon SQS) queue so the file can be processed. The files need to be accessible for processing within 5 minutes.
Which solution will meet these requirements MOST cost-effectively?
A. Write the files to Amazon S3 Glacier Deep Archive. Add the S3 location of the files to the SQS queue.
B. Write the files to Amazon S3 Standard. Add the S3 location of the files to the SQS queue.
C. Write the files to an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD volume. Add the EBS location of the files to the SQS queue.
D. Write messages that contain the contents of the uploaded files to the SQS queue.
Show Answer
Correct Answer: B
Explanation: The files are 10 MB, which exceeds Amazon SQS message size limits (256 KB), so only a reference to the file should be sent to SQS. Amazon S3 Standard provides immediate access and is cost-effective for frequently accessed objects that must be processed within minutes. S3 Glacier Deep Archive has long retrieval times, EBS is more expensive and not designed for shared object access, and placing file contents directly in SQS is not possible due to size limits.
Question 104
A developer is working on a new authorization mechanism for an application. The developer must create an Amazon API Gateway API and must test JSON Web Token (JWT) authorization on the API.
The developer must use the built-in authorizer and must avoid managing the code with custom logic. The developer needs to define an API route that is available at /auth to test the authorizer configuration.
Which solution will meet these requirements?
A. Create a WebSocket API and the /auth route. Configure and attach the JWT authorizer to the API. Deploy the API.
B. Create a WebSocket API and the /auth route. Create and configure an AWS Lambda authorizer. Attach the Lambda authorizer to the API. Deploy the API.
C. Create an HTTP API and the /auth route. Create and configure an AWS Lambda authorizer. Attach the Lambda authorizer to the /auth route. Deploy the API.
D. Create an HTTP API and the /auth route. Configure the JWT authorizer. Attach the JWT authorizer to the /auth route. Deploy the API.
Show Answer
Correct Answer: D
Explanation: The requirement is to test JWT authorization using a built-in authorizer and avoid custom code. Amazon API Gateway HTTP APIs natively support built-in JWT authorizers, which can be directly attached to specific routes such as /auth. WebSocket APIs do not support JWT authorizers, and Lambda authorizers require custom logic, which violates the constraints. Therefore, creating an HTTP API, configuring a JWT authorizer, and attaching it to the /auth route is the correct solution.
Question 105
A developer has an AWS Lambda function that needs to access an Amazon DynamoDB table named DailyOrders. The Lambda function must be able to perform read operations on the table. The Lambda function must not be able to perform write operations on the table.
The developer needs to create an IAM policy to associate with the Lambda function's execution role.
Which IAM policy statement will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: The requirement is to allow the Lambda function to read from the DailyOrders DynamoDB table while preventing any write operations. The correct policy statement explicitly allows only read actions such as dynamodb:GetItem, dynamodb:Query, and dynamodb:Scan on the DailyOrders table ARN, and does not allow (or explicitly denies) write actions like PutItem, UpdateItem, or DeleteItem. This satisfies least-privilege access for read-only usage.
Question 106
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company’s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notification Service (Amazon SNS) topic that has the security team’s email address as a subscriber.
Which solution will provide the security team with the required notification about certificates?
A. Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule’s target.
B. Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
C. Create an AWS Step Functions workflow that is invoked by each certificate’s expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
D. Configure AWS Config with the acm-certificate-expiration-check managed rule to run every 24 hours. Create an Amazon EventBridge rule that includes an event pattern that specifies the Config Rules Compliance Change detail type and the configured rule. Set the SNS topic as the EventBridge rule’s target.
Show Answer
Correct Answer: D
Explanation: The requirement is to notify 90 days before expiration for imported ACM certificates. The ACM Certificate Approaching Expiration EventBridge event cannot be configured to 90 days (it starts much closer to expiration), whereas the AWS Config managed rule acm-certificate-expiration-check allows a configurable threshold in days and works for imported certificates. An EventBridge rule can then forward the compliance change to SNS, meeting the notification requirement.
Question 107
A developer is launching a global application that delivers content to multiple countries. The developer needs to serve specific content based on the country of each user and each user’s primary language. The developer must ensure that content is served reliably and with low latency.
Which solution will meet these requirements?
A. Create an Amazon API Gateway REST API. Create an AWS Global Accelerator standard accelerator to resolve requests to the API. Configure endpoint groups on the accelerator. Attach listeners for each country and language.
B. Store the content in a centralized Amazon S3 bucket. Enable S3 Transfer Acceleration on the bucket. Create an Amazon Route 53 hosted zone that includes the endpoint for the S3 bucket. Create records in Route 53 that use geoproximity and geolocation routing policies.
C. Create an Amazon API Gateway REST API. Connect the REST API to AWS WAF. Use geo match statements and regex match statements to allow or deny requests based on the labels returned from web request evaluations.
D. Configure an Amazon CloudFront distribution that uses the application as an origin. Configure the distribution to forward the Accept-Language header and the CloudFront-Viewer-Country header to the origin.
Show Answer
Correct Answer: D
Explanation: Amazon CloudFront provides a global edge network that delivers content with low latency and high reliability. By forwarding the CloudFront-Viewer-Country header and the Accept-Language header to the origin, the application can determine each user’s country and primary language and return the appropriate localized content. CloudFront can cache responses based on these headers, further improving performance. The other options either do not provide content localization and caching at the edge or are not designed for content delivery optimization.
Question 108
An application stores user data in Amazon S3 buckets in multiple AWS Regions. A developer needs to implement a solution that analyzes the user data in the S3 buckets to find sensitive information. The analysis findings from all the S3 buckets must be available in the eu-west-2 Region.
Which solution will meet these requirements with the LEAST development effort?
A. Create an AWS Lambda function to generate findings. Program the Lambda function to send the findings to another S3 bucket in eu-west-2.
B. Configure Amazon Macie to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
C. Configure Amazon Inspector to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
D. Configure Amazon Macie to generate findings and to publish the findings to AWS CloudTrail. Use a CloudTrail trail to copy the results to eu-west-2.
Show Answer
Correct Answer: B
Explanation: Amazon Macie is purpose-built to discover and analyze sensitive data in Amazon S3 with minimal setup. It automatically inspects S3 buckets across Regions and generates findings. Amazon EventBridge can route these findings to a centralized Region (eu-west-2) without custom code. This requires far less development effort than building custom Lambda logic or misusing services like Inspector or CloudTrail, which are not designed for S3 sensitive data discovery.
Question 109
An application ingests data from an Amazon Kinesis data stream. The shards in the data stream are set for normal traffic.
During tests for peak traffic, the application ingests data slowly. A developer needs to adjust the data stream to handle the peak traffic.
What should the developer do to meet this requirement MOST cost-effectively?
A. Install the Kinesis Producer Library (KPL) to ingest data into the data stream.
B. Switch to on-demand capacity mode for the data stream. Specify a partition key when writing data to the data stream.
C. Decrease the amount of time that data is kept in the data stream by using the DecreaseStreamRetentionPeriod API operation.
D. Increase the shard count in the data stream by using the UpdateShardCount API operation.
Show Answer
Correct Answer: D
Explanation: The ingestion is slow during known peak tests, which indicates insufficient shard throughput in a provisioned (normal) Kinesis data stream. Each shard provides fixed write and read capacity, so increasing the shard count directly increases throughput. This is the most cost-effective approach when peak traffic is predictable, because it avoids the higher per-GB cost of on-demand mode. On-demand mode is better for unpredictable workloads, but the question implies planned peak testing, making manual shard scaling the optimal choice.
Question 110
A developer is creating a video search application for a global company. The video files have an average size of 2.5 TB. The video storage system must provide instant access to the video files for the first 90 days. After the first 90 days, the video files can take more than 10 minutes to load.
Which solution will meet these requirements MOST cost-effectively?
A. Upload the video files to the Amazon Elastic File System (Amazon EFS) Standard storage class for the first 90 days. After 90 days, transition the video files to the EFS Standard-Infrequent Access (Standard-IA) storage class.
B. Upload the video files to Amazon S3. Use the S3 Glacier Deep Archive storage class for the first 90 days. After 90 days, transition the video file to the S3 Glacier Flexible Retrieval storage class.
C. Use Amazon Elastic Block Store (Amazon EBS) to store the video files for the first 90 days. After 90 days, transition the video files to the Amazon S3 Glacier Deep Archive storage class.
D. Upload the video files to Amazon S3. Use the S3 Glacier Instant Retrieval storage class for the first 90 days. After 90 days, transition the video files to the S3 Glacier Flexible Retrieval storage class.
Show Answer
Correct Answer: D
Explanation: The requirement is instant access for the first 90 days and low cost thereafter with tolerance for retrieval delays over 10 minutes. Amazon S3 Glacier Instant Retrieval provides millisecond access while being cheaper than S3 Standard, making it suitable for large 2.5 TB objects during the first 90 days. After 90 days, transitioning to S3 Glacier Flexible Retrieval is more cost-effective and supports retrieval times of minutes to hours, which satisfies the relaxed access requirement. Other options are either more expensive, unsuitable for very large objects, or do not meet access-time requirements.
Question 111
A company is developing a serverless application that requires storage of sensitive API keys as environment variables for various services. The application requires the automatic rotation of the encryption keys every year.
Which solution will meet these requirements with no development effort?
A. Encrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in Secrets Manager.
B. Encrypt the environment variables by using AWS Key Management Service (AWS KMS) customer managed keys. Enable automatic key rotation.
C. Encrypt the environment variables by using AWS Key Management Service (AWS KMS) AWS managed keys. Configure a custom AWS Lambda function to automate key rotation.
D. Encrypt the environment variables by using AWS Systems Manager Parameter Store. Set up automatic rotation in Parameter Store.
Show Answer
Correct Answer: B
Explanation: The requirement is to automatically rotate the **encryption keys** used to protect environment variables, with **no development effort**. AWS KMS customer managed keys support **native automatic key rotation every year** with a simple setting change. Lambda environment variables are already encrypted using KMS, so enabling rotation satisfies the requirement directly.
AWS Secrets Manager and Parameter Store manage and rotate **secrets**, not encryption keys. Secrets Manager rotation typically requires configuring a Lambda rotation function, which introduces development effort. Therefore, option B best meets all requirements.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.