A developer needs to deploy the code for a new application on an AWS Lambda function. The application needs a dependency file that is 500 MB to run the business logic.
Which solution will meet these requirements?
A. Compress the application code and dependencies into a .zip file. Directly upload the .zip file as a deployment package for the Lambda function instead of copying the code.
B. Compress the application code and dependencies into a .zip file. Upload the .zip file to an Amazon S3 bucket. Configure the Lambda function to run the code from the .zip file in the S3 bucket.
C. Package the application code and dependencies into a container image. Upload the image to an Amazon S3 bucket. Configure the Lambda function to run the code in the image.
D. Package the application code and dependencies into a container image. Push the image to an Amazon Elastic Container Registry (Amazon ECR) repository. Deploy the image to the Lambda function.
Show Answer
Correct Answer: D
Explanation: AWS Lambda .zip deployment packages have size limits (50 MB direct upload, 250 MB unzipped including layers). A 500 MB dependency cannot be packaged as a standard .zip deployment. Lambda supports container images up to 10 GB, and container images must be stored in Amazon ECR, not S3. Therefore, package the application and dependencies into a container image, push it to Amazon ECR, and deploy the Lambda function from that image.
Sources:
https://docs.aws.amazon.com/pdfs/lambda/latest/dg/lambda-dg.pdf
https://docs.aws.amazon.com/lambda/latest/dg/golang-package.html
Question 133
A developer has built an application running on AWS Lambda using AWS Serverless Application Model (AWS SAM).
What is the correct sequence of steps to successfully deploy the application?
A. 1. Build the SAM template in Amazon EC2. 2. Package the SAM template to Amazon EBS storage. 3. Deploy the SAM template from Amazon EBS.
B. 1. Build the SAM template locally. 2. Package the SAM template onto Amazon S3. 3. Deploy the SAM template from Amazon S3.
C. 1. Build the SAM template locally. 2. Deploy the SAM template from Amazon S3. 3. Package the SAM template for use.
D. 1. Build the SAM template locally. 2. Package the SAM template from AWS CodeCommit. 3. Deploy the SAM template to CodeCommit.
Show Answer
Correct Answer: B
Explanation: The standard AWS SAM deployment workflow is: build the application locally (sam build), package/upload deployment artifacts to Amazon S3 (historically via sam package, now integrated into sam deploy), and then deploy the CloudFormation/SAM stack using the artifacts stored in S3. The other options use incorrect services or an incorrect order.
Question 134
A company has an application that uses an AWS Lambda function to consume messages from an Amazon Simple Queue Service (Amazon SQS) queue. The SQS queue is configured with a dead-letter queue. Due to a defect in the application, AWS Lambda failed to process some messages. A developer fixed the bug and wants to process the failed messages again.
How should the developer resolve this issue?
A. Use the SendMessageBatch API to send messages from the dead-letter queue to the original SQS queue.
B. Use the ChangeMessageVisibility API to configure messages in the dead-letter queue to be visible in the original SQS queue.
C. Use the StartMessageMoveTask API to move messages from the dead-letter queue to the original SQS queue.
D. Use the PurgeQueue API to remove messages from the dead-letter queue and return the messages to the original SQS queue.
Show Answer
Correct Answer: C
Explanation: Amazon SQS provides the StartMessageMoveTask API specifically to redrive messages from a dead-letter queue (DLQ) back to the source queue (or another configured destination). This is the recommended and managed way to reprocess failed messages after the application issue has been fixed. SendMessageBatch would require manually reading and resending messages, ChangeMessageVisibility only affects message visibility within the same queue, and PurgeQueue permanently deletes messages rather than returning them.
Question 135
A developer is creating a script to automate the deployment process for a serverless application. The developer wants to use an existing AWS Serverless Application Model (AWS SAM) template for the application.
What should the developer use for the project? (Choose two.)
A. Call aws cloudformation package to create the deployment package. Call aws cloudformation deploy to deploy the package afterward.
B. Call sam package to create the deployment package. Call sam deploy to deploy the package afterward.
C. Call aws s3 cp to upload the AWS SAM template to Amazon S3. Call aws lambda update-function-code to create the application.
D. Create a ZIP package locally and call aws serverlessrepo create-applicatiion to create the application.
E. Create a ZIP package and upload it to Amazon S3. Call aws cloudformation create-stack to create the application.
Show Answer
Correct Answer: A, B
Explanation: AWS SAM applications can be packaged and deployed either with the AWS SAM CLI (`sam package`/`sam deploy`) or with the equivalent AWS CloudFormation CLI commands (`aws cloudformation package`/`aws cloudformation deploy`). The other options misuse services or omit the required packaging/deployment flow for an existing SAM template.
Sources:
https://docs.aws.amazon.com/pdfs/serverless-application-model/latest/developerguide/serverless-application-model.pdf
https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/deploy-upload-local-files.html
Question 136
A developer is troubleshooting an application. The application includes several AWS Lambda functions that invoke an Amazon API Gateway API. The API Gateway's method request is set up to use an Amazon Cognito authorizer for authentication.
All the Lambda functions pass the user ID as part of the Authorization header to the API Gateway API. The API Gateway API returns a 403 status code for all GET requests.
How should the developer resolve this issue?
A. Modify the client GET request to include a valid API key in the Authorization header.
B. Modify the client GET request to include a valid token in the Authorization header.
C. Update the resource policy for the API Gateway API to allow the execute-api:Invoke action.
D. Modify the client to send an OPTIONS preflight request before the GET request.
Show Answer
Correct Answer: B
Explanation: An API Gateway method configured with an Amazon Cognito authorizer expects a valid Cognito JWT (typically an ID token or access token, depending on configuration) in the Authorization header. Passing only a user ID will fail authorization and API Gateway will return 403. API keys are separate from Cognito authorization, resource policies are not the issue described, and an OPTIONS preflight request is only relevant for CORS in browsers, not for fixing Cognito authentication.
Question 137
A company processes incoming documents from an Amazon S3 bucket. Users upload documents to an S3 bucket using a web user interface. Upon receiving files in S3, an AWS Lambda function is invoked to process the files, but the Lambda function times out intermittently.
If the Lambda function is configured with the default settings, what will happen to the S3 event when there is a timeout exception?
A. Notification of a failed S3 event is sent as an email through Amazon SNS.
B. The S3 event is sent to the default Dead Letter Queue.
C. The S3 event is processed until it is successful.
D. The S3 event is discarded after the event is retried twice.
Show Answer
Correct Answer: D
Explanation: Amazon S3 invokes Lambda asynchronously for event notifications. If the function times out or returns an error, Lambda automatically retries the asynchronous invocation twice (for a total of three attempts). With the default configuration and no dead-letter queue or on-failure destination configured, the event is discarded after the retries are exhausted.
Sources:
https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html
Question 138
A company has an application that is deployed on AWS Elastic Beanstalk. The application generates user-specific PDFs and stores the PDFs in an Amazon S3 bucket. The application then uses Amazon Simple Email Service (Amazon SES) to send the PDFs by email to subscribers.
Users no longer access the PDFs 90 days after the PDFs are generated. The S3 bucket is not versioned and contains many obsolete PDFs.
A developer must reduce the number of files in the S3 bucket by removing PDFs that are older than 90 days.
Which solution will meet this requirement with the LEAST development effort?
A. Update the application code. In the code, add a rule to scan all the objects in the S3 bucket every day and to delete objects after 90 days.
B. Create an AWS Lambda function. Program the Lambda function to scan all the objects in the S3 bucket every day and to delete objects after 90 days.
C. Create an S3 Lifecycle rule for the S3 bucket to expire objects after 90 days.
D. Partition the S3 objects with a / / key prefix. Create an AWS Lambda function to remove objects that have prefixes that have reached the expiration date.
Show Answer
Correct Answer: C
Explanation: Amazon S3 Lifecycle rules are designed to automatically manage object retention and expiration. Configuring a lifecycle expiration rule to delete objects after 90 days requires no application code changes or custom Lambda functions, making it the solution with the least development effort.
Question 139
A developer is deploying an application on Amazon EC2 instances that run in Account A. The application needs to read data from an existing Amazon Kinesis data stream in Account B.
Which actions should the developer take to provide the application with access to the stream? (Choose two.)
A. Update the instance profile role in Account A with stream read permissions.
B. Create an IAM role with stream read permissions in Account
C. Add a trust policy to the instance profile role and IAM role in Account B to allow the instance profile role to assume the IAM role.
D. Add a trust policy to the instance profile role and IAM role in Account B to allow reads from the stream.
E. Add a resource-based policy in Account B to allow read access from the instance profile role.
Show Answer
Correct Answer: B, C
Explanation: For cross-account access, the standard IAM pattern is to create a role in Account B that has permissions to read the Kinesis data stream, then allow the EC2 instance role from Account A to assume that role via a trust policy. The instance profile role in Account A also needs permission to call sts:AssumeRole on the Account B role. A trust policy is required for role assumption; simply granting stream permissions to the Account A instance role is insufficient because it does not control access to resources in another account. The option referring to a resource-based policy is not the standard cross-account IAM role solution expected here for Kinesis Data Streams.
Question 140
A development team wants to immediately build and deploy an application whenever there is a change to the source code.
Which approaches could be used to trigger the deployment? (Choose two.)
A. Store the source code in an Amazon S3 bucket. Configure AWS CodePipeline to start whenever a file in the bucket changes.
B. Store the source code in an encrypted Amazon EBS volume. Configure AWS CodePipeline to start whenever a file in the volume changes.
C. Store the source code in an AWS CodeCommit repository. Configure AWS CodePipeline to start whenever a change is committed to the repository.
D. Store the source code in an Amazon S3 bucket. Configure AWS CodePipeline to start every 15 minutes.
E. Store the source code in an Amazon EC2 instance’s ephemeral storage. Configure the instance to start AWS CodePipeline whenever there are changes to the source code.
Show Answer
Correct Answer: A, C
Explanation: AWS CodePipeline supports Amazon S3 buckets and AWS CodeCommit repositories as source providers that can automatically trigger pipeline executions when source changes occur. Amazon EBS volumes and EC2 ephemeral storage are not supported source providers for automatic pipeline triggers, and polling every 15 minutes is not an immediate trigger.
Question 141
A developer is setting up the deployment of application stacks to new test environments by using the AWS Cloud Development Kit (AWS CDK). The application contains the code for several AWS Lambda functions that will be deployed as assets. Each Lambda function is defined by using the AWS CDK Lambda construct library.
The developer has already successfully deployed the application stacks to the alpha environment in the first account by using the AWS CDK CLI's cdk deploy command. The developer is preparing to deploy to the beta environment in a second account for the first time. The developer makes no significant changes to the CDK code between deployments, but the initial deployment in the second account is unsuccessful and returns a NoSuchBucket error.
Which command should the developer run before redeployment to resolve this error?
A. cdk synth
B. cdk bootstrap
C. cdk init
D. cdk destroy
Show Answer
Correct Answer: B
Explanation: The deployment failed in a new AWS account with a NoSuchBucket error because AWS CDK assets (such as Lambda function code) are uploaded to a CDK bootstrap bucket. The first account was already bootstrapped, but the second account was not. Running `cdk bootstrap` creates the required infrastructure, including the S3 bucket and related resources, allowing `cdk deploy` to succeed.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.