A company is developing a publicly accessible single-page application. The application makes calls from a client web browser to backend services to provide a user interface to customers. The application depends on a third-party web service exposed as an HTTP API. The web client must provide an API key to the third-party web service by using the HTTP header as part of the HTTP request. The company's API key must not be exposed to the users of the web application.
Which solution will meet these requirements MOST cost-effectively?
A. Use Amazon API Gateway to create a private REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company’s API key to the HTTP headers list of the integration request configuration.
B. Use Amazon API Gateway to create a private REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.
C. Use Amazon API Gateway to create a REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company's API key to the HTTP headers list of the integration request configuration.
D. Use Amazon API Gateway to create a REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.
Show Answer
Correct Answer: C
Explanation: The application is publicly accessible, so a private API is not appropriate. API Gateway can directly integrate with an external HTTP endpoint and inject static headers in the integration request, allowing the third-party API key to be added server-side so it is never exposed to the browser. This avoids the additional cost and operational overhead of invoking a Lambda function solely to forward requests and add a header.
Question 143
A developer is creating an application on Amazon Elastic Container Service (Amazon ECS). The developer needs to configure the application parameters. The developer must configure limits for the application's maximum number of simultaneous connections and maximum number of transactions per second.
The maximum number of connections and transactions can change in the future. The developer needs a solution that can automatically deploy these changes to the application, as needed, without causing downtime.
Which solution will meet these requirements?
A. Make the configuration changes for the application. Use AWS CodeDeploy to create a deployment configuration. Specify an in-place deployment to deploy the changes.
B. Bootstrap the application to use the AWS Cloud Development Kit (AWS CDK) and make the configuration changes. Specify the ECSCanary10Percent15Minutes launch type in the properties section of the ECS resource. Deploy the application by using the AWS CDK to implement the changes.
C. Install the AWS AppConfig agent on Amazon ECS. Configure an IAM role with access to AWS AppConfig. Make the deployment changes by using AWS AppConfig. Specify Canary10Percent20Minutes as the deployment strategy.
D. Create an AWS Lambda function to make the configuration changes. Create an Amazon CloudWatch alarm that monitors the Lambda function every 5 minutes to check if the Lambda function has been updated. When the Lambda function is updated, deploy the changes by using AWS CodeDeploy.
Show Answer
Correct Answer: C
Explanation: AWS AppConfig is designed for dynamic application configuration that can be updated independently of application code. Running the AWS AppConfig Agent on Amazon ECS lets the application retrieve updated configuration from a local cache, enabling configuration changes such as connection and transaction limits without restarting tasks or causing downtime. AppConfig deployment strategies such as Canary10Percent20Minutes allow safe, gradual rollout of configuration changes. The other options focus on application deployments rather than dynamic runtime configuration or misuse the services.
Question 144
A developer uses an AWS Lambda function in an application to edit users' uploaded photos. The developer needs to update the Lambda function code and needs to test the updates.
For testing, the developer must divide the user traffic between the original version of the Lambda function and the new version of the Lambda function.
Which combination of steps will meet these requirements? (Choose two.)
A. Publish a version of the original Lambda function. Make the necessary changes to the Lambda code. Publish a new version of the Lambda function.
B. Use AWS CodeBuild to detect updates to the Lambda function. Configure CodeBuild to incrementally shift traffic from the original version of the Lambda function to the new version of the Lambda function.
C. Update the original version of the Lambda function to add a function URL. Make the necessary changes to the Lambda code. Publish another function URL for the updated Lambda code.
D. Create an alias that points to the original version of the Lambda function. Configure the alias to be a weighted alias that also includes the new version of the Lambda function. Divide traffic between the two versions.
E. Create an alias that points to the original function URL. Configure the alias to be a weighted alias that also includes the additional function URL. Divide traffic between the two function URLs.
Show Answer
Correct Answer: A, D
Explanation: To split traffic between two Lambda implementations, you must first have two published, immutable Lambda versions. Publish the original version, update the code, and publish the new version. Then create or update a Lambda alias and configure weighted routing so the alias sends a percentage of traffic to the original version and the remainder to the new version. CodeBuild does not perform Lambda traffic shifting, and weighted aliases work with Lambda versions, not function URLs.
Question 145
A developer has AWS Lambda functions that need to access a company's internal data science libraries and reference data. Separate teams manage the libraries and the data. The teams must be able to update and upload new data independently. The Lambda functions are connected to the company's central VPC.
Which solution will provide the Lambda functions with access to the libraries and data?
A. Attach an Amazon Elastic Block Store (Amazon EBS) volume to the Lambda functions by using EBS Multi-Attach in the central VPC. Update the Lambda function execution roles to give the functions to access the EBS volume. Update the Lambda function code to reference the files in the EBS volume.
B. Compress the libraries and reference data in a Lambda /tmp folder. Update the Lambda function code to reference the files in the /tmp folder.
C. Set up an Amazon Elastic File System (Amazon EFS) file system with mount targets in the central VPConfigure the Lambda functions to mount the EFS file system. Update the Lambda function execution roles to give the functions to access the EFS file system.
D. Set up an Amazon FSx for Windows File Server file system with mount targets in the central VPC. Configure the Lambda functions to mount the Amazon FSx file system. Update the Lambda function execution roles to give the functions to access the Amazon FSx file system.
Show Answer
Correct Answer: C
Explanation: AWS Lambda supports mounting Amazon EFS file systems when the function is connected to a VPC. EFS provides a shared, persistent file system that multiple teams can update independently, making it suitable for shared libraries and reference data. Lambda cannot attach EBS volumes, /tmp is ephemeral and not a distribution mechanism for shared data, and FSx for Windows File Server is not the standard supported shared filesystem integration for Lambda in this scenario.
Question 146
A developer built an application by using multiple AWS Lambda functions. The Lambda functions must access dynamic configuration data at runtime. The data is maintained as a 6 KB JSON document in AWS AppConfig. The configuration data needs to be updated without requiring the redeployment of the application.
The developer needs a solution that will give the Lambda functions access to the dynamic configuration data.
What should the developer do to meet these requirements with the LEAST development effort?
A. Migrate the document from AWS AppConfig to a Lambda environment variable. Read the document at the runtime.
B. Configure the AWS AppConfig Agent Lambda extension. Access the dynamic configuration data by calling the extension on a local host.
C. Use the AWS X-Ray SDK to call the AWS AppConfig APIs. Retrieve the configuration file at runtime.
D. Migrate the configuration file to a Lambda deployment package. Read the file from the file system at runtime.
Show Answer
Correct Answer: B
Explanation: The AWS AppConfig Agent Lambda extension is purpose-built for Lambda to retrieve and cache AppConfig configuration locally via a localhost endpoint. It supports dynamic configuration updates without redeploying the Lambda functions and requires minimal code changes. Environment variables cannot hold a 6 KB document because Lambda environment variables have a 4 KB total size limit. Using X-Ray SDK is unrelated to AppConfig retrieval, and bundling the configuration into the deployment package would require redeployment for updates.
Question 147
A developer is setting up AWS CodePipeline for a new application. During each build, the developer must generate a test report.
Which solution will meet this requirement?
A. Create an AWS CodeBuild build project that runs tests. Configure the buildspec file with the test report information.
B. Create an AWS CodeDeploy deployment that runs tests. Configure the AppSpec file with the test report information.
C. Run the builds on an Amazon EC2 instance that has AWS Systems Manager Agent (SSM Agent) installed and activated.
D. Create a repository in AWS CodeArtifact. Select the test report template.
Show Answer
Correct Answer: A
Explanation: AWS CodeBuild supports generating test reports through the buildspec.yml file using the reports section. CodePipeline can invoke a CodeBuild project during the build stage, where tests are run and reports are published. CodeDeploy and AppSpec do not provide test report generation, EC2 with SSM Agent is unrelated to CodePipeline test reporting, and CodeArtifact is a package repository, not a test reporting service.
Question 148
A developer needs to use a code template to create an automated deployment of an application onto Amazon EC2 instances. The template must be configured to repeat deployment, installation, and updates of resources for the application. The template must be able to create identical environments and roll back to previous versions.
Which solution will meet these requirements?
A. Use AWS Amplify for automatic deployment templates. Use a traffic-splitting deployment to copy any deployments. Modify any resources created by Amplify, if necessary.
B. Use AWS CodeBuild for automatic deployment. Upload the required AppSpec file template. Save the appspec.yml file in the root directory folder of the revision. Specify the deployment group that includes the EC2 instances for the deployment.
C. Use AWS CloudFormation to create an infrastructure template in JSON format to deploy the EC2 instances. Use CloudFormation helper scripts to install the necessary software and to start the application. Call the scripts directly from the template.
D. Use AWS AppSync to deploy the application. Upload the template as a GraphQL schema. Specify the EC2 instances for deployment of the application. Use resolvers as a version control mechanism and to make any updates to the deployments.
Show Answer
Correct Answer: C
Explanation: AWS CloudFormation is the infrastructure-as-code service designed to create reusable templates for provisioning identical environments, repeatedly deploying and updating resources, and supporting rollback to previous stack states. CloudFormation helper scripts (cfn-init, cfn-signal, etc.) can install software and configure EC2 instances during provisioning. The other options misuse services: Amplify targets web/mobile app hosting, CodeBuild is a build service rather than deployment/orchestration to EC2, and AppSync is a GraphQL service.
Question 149
A company uses an AWS CloudFormation template to deploy and manage its AWS infrastructure. The CloudFormation template creates Amazon VPC security groups and Amazon EC2 security groups.
A manager finds out that some engineers modified the security groups of a few EC2 instances for testing purposes. A developer needs to determine what modifications occurred.
Which solution will meet this requirement?
A. Add a Conditions section statement in the source YAML file of the template. Run the CloudFormation stack.
B. Perform a drift detection operation on the CloudFormation stack.
C. Execute a change set for the CloudFormation stack.
D. Use Amazon Detective to detect the modifications.
Show Answer
Correct Answer: B
Explanation: CloudFormation drift detection compares the actual configuration of supported stack resources against the expected configuration defined in the CloudFormation template. It identifies resources that were modified outside of CloudFormation, such as changes to EC2 security groups or VPC security groups, making it the appropriate way to determine what modifications occurred.
Question 150
A developer needs to freeze changes to an AWS CodeCommit repository before a production release. The developer will work on new features while a quality assurance (QA) team tests the release.
The QA testing and all bug fixes must take place in isolation from the main branch. After the release, the developer must integrate all bug fixes into the main branch.
Which solution will meet these requirements?
A. Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Merge the release branch into the main branch after the release.
B. Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply fixes to the main branch. Update the Git tag for the release to be on the latest commit on the main branch.
C. Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Rebase the main branch onto the release branch after the release.
D. Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply the Git commits for fixes to the Git tag for the release.
Show Answer
Correct Answer: A
Explanation: A release branch is the standard Git workflow for freezing a release while allowing ongoing feature development on the main branch. QA and bug fixes occur on the isolated release branch, and once the release is complete, the release branch is merged back into the main branch so the fixes are incorporated. Git tags are immutable references and are not used for ongoing development, and rebasing the main branch onto the release branch is not the appropriate integration strategy here.
Question 151
A company had an Amazon RDS for MySQL DB instance that was named mysql-db. The DB instance was deleted within the past 90 days.
A developer needs to find which IAM user or role deleted the DB instance in the AWS environment.
Which solution will provide this information?
A. Retrieve the AWS CloudTrail events for the resource mysql-db where the event name is DeleteDBInstance. Inspect each event.
B. Retrieve the Amazon CloudWatch log events from the most recent log stream within the rds/mysql-db log group. Inspect the log events.
C. Retrieve the AWS X-Ray trace summaries. Filter by services with the name mysql-db. Inspect the ErrorRootCauses values within each summary.
D. Retrieve the AWS Systems Manager deletions inventory. Filter the inventory by deletions that have a TypeName value of RDS. Inspect the deletion details.
Show Answer
Correct Answer: A
Explanation: AWS CloudTrail records RDS management API calls such as DeleteDBInstance, including the identity (IAM user or role) that invoked the action. Filtering CloudTrail events for the deleted DB instance resource and the DeleteDBInstance event allows you to identify who deleted the instance. CloudWatch Logs do not record IAM deletion identity for this purpose, X-Ray is unrelated to RDS management API auditing, and Systems Manager does not maintain such a deletion inventory.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.