A developer is updating the code for an AWS Lambda function to add new capabilities. The Lambda function has version aliases for production and development environments that run separate versions of the function. The developer needs to configure a staging environment for the Lambda function to handle invocations to both the development version and the production version.
Which solution will meet these requirements?
A. Create a weighted alias that references the production version of the function and the updated version of the function.
B. Add a Network Load Balancer. Add the production version of the function and updated version of the function as targets.
C. Use AWS CodeDeploy to create a linear traffic shifting deployment
D. Create a tag for the Lambda function that contains the production version and updated version of the code.
Show Answer
Correct Answer: A
Explanation: A weighted Lambda alias can route a configurable percentage of invocations between two published function versions. This is commonly used for staging, canary testing, or gradually exposing a new version while still sending traffic to the production version. Network Load Balancers do not target Lambda versions in this way, CodeDeploy automates traffic shifting during deployments but does not itself create a persistent staging alias handling both versions, and tags do not affect invocation routing.
Question 103
A company is creating a new application that gives users the ability to upload and share short video files. The average size of the video files is 10 MB. After a user uploads a file, a message needs to be placed into an Amazon Simple Queue Service (Amazon SQS) queue so the file can be processed. The files need to be accessible for processing within 5 minutes.
Which solution will meet these requirements MOST cost-effectively?
A. Write the files to Amazon S3 Glacier Deep Archive. Add the S3 location of the files to the SQS queue.
B. Write the files to Amazon S3 Standard. Add the S3 location of the files to the SQS queue.
C. Write the files to an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD volume. Add the EBS location of the files to the SQS queue.
D. Write messages that contain the contents of the uploaded files to the SQS queue.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Standard is the most cost-effective choice for storing 10 MB uploaded video files that must be available for processing within 5 minutes. Store the object in S3 Standard and send its S3 object location (bucket/key) in the SQS message. SQS messages have a maximum size of 256 KB, so the video content itself cannot be placed in the queue. S3 Glacier Deep Archive has retrieval times of hours, making it unsuitable. EBS is block storage for EC2 instances and is not an appropriate or cost-effective shared object store for uploaded files.
Question 104
A developer is working on a new authorization mechanism for an application. The developer must create an Amazon API Gateway API and must test JSON Web Token (JWT) authorization on the API.
The developer must use the built-in authorizer and must avoid managing the code with custom logic. The developer needs to define an API route that is available at /auth to test the authorizer configuration.
Which solution will meet these requirements?
A. Create a WebSocket API and the /auth route. Configure and attach the JWT authorizer to the API. Deploy the API.
B. Create a WebSocket API and the /auth route. Create and configure an AWS Lambda authorizer. Attach the Lambda authorizer to the API. Deploy the API.
C. Create an HTTP API and the /auth route. Create and configure an AWS Lambda authorizer. Attach the Lambda authorizer to the /auth route. Deploy the API.
D. Create an HTTP API and the /auth route. Configure the JWT authorizer. Attach the JWT authorizer to the /auth route. Deploy the API.
Show Answer
Correct Answer: D
Explanation: HTTP APIs in Amazon API Gateway support the built-in JWT authorizer. The requirement is to use the built-in authorizer and avoid custom authorization code, so a Lambda authorizer is not appropriate. WebSocket APIs do not use the built-in JWT authorizer in this way. Therefore, create an HTTP API, add the /auth route, configure a JWT authorizer, attach it to that route, and deploy the API.
Question 105
A developer has an AWS Lambda function that needs to access an Amazon DynamoDB table named DailyOrders. The Lambda function must be able to perform read operations on the table. The Lambda function must not be able to perform write operations on the table.
The developer needs to create an IAM policy to associate with the Lambda function's execution role.
Which IAM policy statement will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: D
Explanation: The Lambda execution role should allow only DynamoDB read actions (such as GetItem, Query, Scan, BatchGetItem, and DescribeTable) on the DailyOrders table and should not grant write actions like PutItem, UpdateItem, DeleteItem, or BatchWriteItem. The correct policy statement is the one that grants only read permissions (or explicitly denies writes while allowing reads), which corresponds to option D.
Question 106
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company’s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notification Service (Amazon SNS) topic that has the security team’s email address as a subscriber.
Which solution will provide the security team with the required notification about certificates?
A. Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule’s target.
B. Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
C. Create an AWS Step Functions workflow that is invoked by each certificate’s expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
D. Configure AWS Config with the acm-certificate-expiration-check managed rule to run every 24 hours. Create an Amazon EventBridge rule that includes an event pattern that specifies the Config Rules Compliance Change detail type and the configured rule. Set the SNS topic as the EventBridge rule’s target.
Show Answer
Correct Answer: D
Explanation: AWS Config's managed rule acm-certificate-expiration-check can evaluate ACM certificates, including imported certificates, against a configurable expiration threshold such as 90 days. An EventBridge rule can match the resulting Config compliance change events and send notifications to the existing SNS topic. The ACM Certificate Approaching Expiration EventBridge event does not satisfy the stated 90-day requirement by default, whereas AWS Config explicitly supports the required threshold.
Question 107
A developer is launching a global application that delivers content to multiple countries. The developer needs to serve specific content based on the country of each user and each user’s primary language. The developer must ensure that content is served reliably and with low latency.
Which solution will meet these requirements?
A. Create an Amazon API Gateway REST API. Create an AWS Global Accelerator standard accelerator to resolve requests to the API. Configure endpoint groups on the accelerator. Attach listeners for each country and language.
B. Store the content in a centralized Amazon S3 bucket. Enable S3 Transfer Acceleration on the bucket. Create an Amazon Route 53 hosted zone that includes the endpoint for the S3 bucket. Create records in Route 53 that use geoproximity and geolocation routing policies.
C. Create an Amazon API Gateway REST API. Connect the REST API to AWS WAF. Use geo match statements and regex match statements to allow or deny requests based on the labels returned from web request evaluations.
D. Configure an Amazon CloudFront distribution that uses the application as an origin. Configure the distribution to forward the Accept-Language header and the CloudFront-Viewer-Country header to the origin.
Show Answer
Correct Answer: D
Explanation: Amazon CloudFront is designed for low-latency global content delivery. It can add the CloudFront-Viewer-Country header and forward the Accept-Language header to the origin, allowing the application to select content based on both the user's country and preferred language while benefiting from CloudFront's global edge network.
Question 108
An application stores user data in Amazon S3 buckets in multiple AWS Regions. A developer needs to implement a solution that analyzes the user data in the S3 buckets to find sensitive information. The analysis findings from all the S3 buckets must be available in the eu-west-2 Region.
Which solution will meet these requirements with the LEAST development effort?
A. Create an AWS Lambda function to generate findings. Program the Lambda function to send the findings to another S3 bucket in eu-west-2.
B. Configure Amazon Macie to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
C. Configure Amazon Inspector to generate findings. Use Amazon EventBridge to create rules that copy the findings to eu-west-2.
D. Configure Amazon Macie to generate findings and to publish the findings to AWS CloudTrail. Use a CloudTrail trail to copy the results to eu-west-2.
Show Answer
Correct Answer: B
Explanation: Amazon Macie is the managed service designed to discover and classify sensitive data in Amazon S3. Macie findings are regional, and Amazon EventBridge can be used to route/copy findings from multiple Regions into a central Region such as eu-west-2 with minimal development effort. Amazon Inspector does not analyze S3 data for sensitive information, Lambda would require custom development, and CloudTrail is not a destination for Macie findings.
Question 109
An application ingests data from an Amazon Kinesis data stream. The shards in the data stream are set for normal traffic.
During tests for peak traffic, the application ingests data slowly. A developer needs to adjust the data stream to handle the peak traffic.
What should the developer do to meet this requirement MOST cost-effectively?
A. Install the Kinesis Producer Library (KPL) to ingest data into the data stream.
B. Switch to on-demand capacity mode for the data stream. Specify a partition key when writing data to the data stream.
C. Decrease the amount of time that data is kept in the data stream by using the DecreaseStreamRetentionPeriod API operation.
D. Increase the shard count in the data stream by using the UpdateShardCount API operation.
Show Answer
Correct Answer: B
Explanation: The stream is currently configured with provisioned shards sized for normal traffic. To handle peak traffic most cost-effectively without manual capacity planning, switch the stream to on-demand capacity mode. On-demand automatically manages shard capacity based on workload, avoiding overprovisioning for infrequent peaks. Specifying a partition key is standard practice to distribute records across shards and avoid hot partitions. Increasing shard count (D) works but requires provisioning for peak capacity and is less cost-effective for occasional peak loads. KPL (A) improves producer efficiency but does not increase stream capacity. Retention period (C) does not affect ingest throughput.
Sources:
https://docs.aws.amazon.com/streams/latest/dev/how-do-i-size-a-stream.html
https://aws.amazon.com/blogs/big-data/amazon-kinesis-data-streams-launches-on-demand-advantage-for-instant-throughput-increases-and-streaming-at-scale
Question 110
A developer is creating a video search application for a global company. The video files have an average size of 2.5 TB. The video storage system must provide instant access to the video files for the first 90 days. After the first 90 days, the video files can take more than 10 minutes to load.
Which solution will meet these requirements MOST cost-effectively?
A. Upload the video files to the Amazon Elastic File System (Amazon EFS) Standard storage class for the first 90 days. After 90 days, transition the video files to the EFS Standard-Infrequent Access (Standard-IA) storage class.
B. Upload the video files to Amazon S3. Use the S3 Glacier Deep Archive storage class for the first 90 days. After 90 days, transition the video file to the S3 Glacier Flexible Retrieval storage class.
C. Use Amazon Elastic Block Store (Amazon EBS) to store the video files for the first 90 days. After 90 days, transition the video files to the Amazon S3 Glacier Deep Archive storage class.
D. Upload the video files to Amazon S3. Use the S3 Glacier Instant Retrieval storage class for the first 90 days. After 90 days, transition the video files to the S3 Glacier Flexible Retrieval storage class.
Show Answer
Correct Answer: D
Explanation: S3 Glacier Instant Retrieval provides millisecond access, satisfying the requirement for instant access during the first 90 days at a lower cost than standard storage for infrequently accessed large objects. After 90 days, transitioning to S3 Glacier Flexible Retrieval is more cost-effective and allows retrieval times greater than 10 minutes, which meets the requirement. EFS and EBS are unnecessarily expensive for this archival use case, and option B reverses the storage classes, using the slowest archive tier first.
Question 111
A company is developing a serverless application that requires storage of sensitive API keys as environment variables for various services. The application requires the automatic rotation of the encryption keys every year.
Which solution will meet these requirements with no development effort?
A. Encrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in Secrets Manager.
B. Encrypt the environment variables by using AWS Key Management Service (AWS KMS) customer managed keys. Enable automatic key rotation.
C. Encrypt the environment variables by using AWS Key Management Service (AWS KMS) AWS managed keys. Configure a custom AWS Lambda function to automate key rotation.
D. Encrypt the environment variables by using AWS Systems Manager Parameter Store. Set up automatic rotation in Parameter Store.
Show Answer
Correct Answer: B
Explanation: The requirement is automatic rotation of the encryption keys every year with no development effort. AWS KMS customer managed keys support automatic annual key rotation. Lambda environment variables can be encrypted with a customer managed KMS key. Secrets Manager rotates secrets, not the KMS encryption key, and secret rotation typically requires a rotation function for API keys. AWS managed KMS keys cannot be configured for customer-controlled rotation, and Parameter Store does not provide automatic secret rotation.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.