A company is developing a publicly accessible single-page application. The application makes calls from a client web browser to backend services to provide a user interface to customers. The application depends on a third-party web service exposed as an HTTP API. The web client must provide an API key to the third-party web service by using the HTTP header as part of the HTTP request. The company's API key must not be exposed to the users of the web application.
Which solution will meet these requirements MOST cost-effectively?
A. Use Amazon API Gateway to create a private REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company’s API key to the HTTP headers list of the integration request configuration.
B. Use Amazon API Gateway to create a private REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.
C. Use Amazon API Gateway to create a REST API. Create an HTTP integration to integrate with the third-party HTTP API. Add the company's API key to the HTTP headers list of the integration request configuration.
D. Use Amazon API Gateway to create a REST API. Create an AWS Lambda proxy integration. Make calls to the third-party HTTP API from the Lambda function. Pass the company's API key as an HTTP request header.
Show Answer
Correct Answer: C
Explanation: The requirement is to keep the third-party API key hidden from the client while minimizing cost. A public Amazon API Gateway REST API with an HTTP integration can directly call the third-party HTTP API and inject the API key into the request headers at the integration level. This prevents exposure of the key to users and avoids the additional cost and operational overhead of AWS Lambda. Private REST APIs (A, B) are not suitable for a publicly accessible SPA and add VPC endpoint cost. Lambda-based options (B, D) work functionally but are less cost-effective due to Lambda invocation costs.
Question 143
A developer is creating an application on Amazon Elastic Container Service (Amazon ECS). The developer needs to configure the application parameters. The developer must configure limits for the application's maximum number of simultaneous connections and maximum number of transactions per second.
The maximum number of connections and transactions can change in the future. The developer needs a solution that can automatically deploy these changes to the application, as needed, without causing downtime.
Which solution will meet these requirements?
A. Make the configuration changes for the application. Use AWS CodeDeploy to create a deployment configuration. Specify an in-place deployment to deploy the changes.
B. Bootstrap the application to use the AWS Cloud Development Kit (AWS CDK) and make the configuration changes. Specify the ECSCanary10Percent15Minutes launch type in the properties section of the ECS resource. Deploy the application by using the AWS CDK to implement the changes.
C. Install the AWS AppConfig agent on Amazon ECS. Configure an IAM role with access to AWS AppConfig. Make the deployment changes by using AWS AppConfig. Specify Canary10Percent20Minutes as the deployment strategy.
D. Create an AWS Lambda function to make the configuration changes. Create an Amazon CloudWatch alarm that monitors the Lambda function every 5 minutes to check if the Lambda function has been updated. When the Lambda function is updated, deploy the changes by using AWS CodeDeploy.
Show Answer
Correct Answer: C
Explanation: The requirement is to change application configuration (connection limits and TPS) dynamically, deploy changes automatically, and avoid downtime. AWS AppConfig is purpose-built for managing and deploying application configuration and feature flags independently of application code or container deployments. Installing the AWS AppConfig agent on ECS allows the application to retrieve configuration from a local cache with minimal latency and no restarts. AppConfig supports controlled deployment strategies such as canary deployments (e.g., Canary10Percent20Minutes), enabling safe, gradual rollout of configuration changes without downtime. The other options involve redeploying application code or infrastructure, which is unnecessary and risks downtime for simple configuration changes.
Question 144
A developer uses an AWS Lambda function in an application to edit users' uploaded photos. The developer needs to update the Lambda function code and needs to test the updates.
For testing, the developer must divide the user traffic between the original version of the Lambda function and the new version of the Lambda function.
Which combination of steps will meet these requirements? (Choose two.)
A. Publish a version of the original Lambda function. Make the necessary changes to the Lambda code. Publish a new version of the Lambda function.
B. Use AWS CodeBuild to detect updates to the Lambda function. Configure CodeBuild to incrementally shift traffic from the original version of the Lambda function to the new version of the Lambda function.
C. Update the original version of the Lambda function to add a function URL. Make the necessary changes to the Lambda code. Publish another function URL for the updated Lambda code.
D. Create an alias that points to the original version of the Lambda function. Configure the alias to be a weighted alias that also includes the new version of the Lambda function. Divide traffic between the two versions.
E. Create an alias that points to the original function URL. Configure the alias to be a weighted alias that also includes the additional function URL. Divide traffic between the two function URLs.
Show Answer
Correct Answer: A, D
Explanation: To split production traffic between two Lambda implementations, the function code must be versioned and traffic routing must be configured. Publishing the original function and the updated code as separate versions (A) creates immutable versions that can be referenced. Creating an alias that points to the original version and configuring it as a weighted alias to include the new version (D) allows controlled division of user traffic between the two versions for testing. Other options do not support native Lambda traffic shifting.
Question 145
A developer has AWS Lambda functions that need to access a company's internal data science libraries and reference data. Separate teams manage the libraries and the data. The teams must be able to update and upload new data independently. The Lambda functions are connected to the company's central VPC.
Which solution will provide the Lambda functions with access to the libraries and data?
A. Attach an Amazon Elastic Block Store (Amazon EBS) volume to the Lambda functions by using EBS Multi-Attach in the central VPC. Update the Lambda function execution roles to give the functions to access the EBS volume. Update the Lambda function code to reference the files in the EBS volume.
B. Compress the libraries and reference data in a Lambda /tmp folder. Update the Lambda function code to reference the files in the /tmp folder.
C. Set up an Amazon Elastic File System (Amazon EFS) file system with mount targets in the central VPConfigure the Lambda functions to mount the EFS file system. Update the Lambda function execution roles to give the functions to access the EFS file system.
D. Set up an Amazon FSx for Windows File Server file system with mount targets in the central VPC. Configure the Lambda functions to mount the Amazon FSx file system. Update the Lambda function execution roles to give the functions to access the Amazon FSx file system.
Show Answer
Correct Answer: C
Explanation: AWS Lambda can mount Amazon EFS file systems that are accessible within the same VPC. EFS supports shared, scalable file storage that multiple teams can update independently without redeploying Lambda code. Libraries and reference data can be updated directly on EFS, and Lambda functions can read them at runtime. EBS cannot be attached to Lambda, /tmp storage is ephemeral and size-limited, and FSx for Windows is unnecessary and not supported for Lambda mounting.
Question 146
A developer built an application by using multiple AWS Lambda functions. The Lambda functions must access dynamic configuration data at runtime. The data is maintained as a 6 KB JSON document in AWS AppConfig. The configuration data needs to be updated without requiring the redeployment of the application.
The developer needs a solution that will give the Lambda functions access to the dynamic configuration data.
What should the developer do to meet these requirements with the LEAST development effort?
A. Migrate the document from AWS AppConfig to a Lambda environment variable. Read the document at the runtime.
B. Configure the AWS AppConfig Agent Lambda extension. Access the dynamic configuration data by calling the extension on a local host.
C. Use the AWS X-Ray SDK to call the AWS AppConfig APIs. Retrieve the configuration file at runtime.
D. Migrate the configuration file to a Lambda deployment package. Read the file from the file system at runtime.
Show Answer
Correct Answer: B
Explanation: AWS AppConfig is designed for dynamic configuration without redeployment. The AppConfig Agent Lambda extension lets Lambda functions fetch configuration data locally at runtime with minimal code changes. Environment variables cannot store 6 KB (4 KB limit), packaging the file or using X-Ray APIs would either prevent dynamic updates or require more development effort. Therefore, configuring the AppConfig Agent Lambda extension is the least-effort correct solution.
Question 147
A developer is setting up AWS CodePipeline for a new application. During each build, the developer must generate a test report.
Which solution will meet this requirement?
A. Create an AWS CodeBuild build project that runs tests. Configure the buildspec file with the test report information.
B. Create an AWS CodeDeploy deployment that runs tests. Configure the AppSpec file with the test report information.
C. Run the builds on an Amazon EC2 instance that has AWS Systems Manager Agent (SSM Agent) installed and activated.
D. Create a repository in AWS CodeArtifact. Select the test report template.
Show Answer
Correct Answer: A
Explanation: AWS CodeBuild is the service designed to run builds and tests within CodePipeline. By defining test execution and report configuration in the buildspec file (for example, using the `reports` section), CodeBuild can automatically generate and publish test reports for each build. CodeDeploy focuses on deployments, CodeArtifact is for package management, and EC2 with SSM is unnecessary for managed CI test reporting.
Question 148
A developer needs to use a code template to create an automated deployment of an application onto Amazon EC2 instances. The template must be configured to repeat deployment, installation, and updates of resources for the application. The template must be able to create identical environments and roll back to previous versions.
Which solution will meet these requirements?
A. Use AWS Amplify for automatic deployment templates. Use a traffic-splitting deployment to copy any deployments. Modify any resources created by Amplify, if necessary.
B. Use AWS CodeBuild for automatic deployment. Upload the required AppSpec file template. Save the appspec.yml file in the root directory folder of the revision. Specify the deployment group that includes the EC2 instances for the deployment.
C. Use AWS CloudFormation to create an infrastructure template in JSON format to deploy the EC2 instances. Use CloudFormation helper scripts to install the necessary software and to start the application. Call the scripts directly from the template.
D. Use AWS AppSync to deploy the application. Upload the template as a GraphQL schema. Specify the EC2 instances for deployment of the application. Use resolvers as a version control mechanism and to make any updates to the deployments.
Show Answer
Correct Answer: C
Explanation: AWS CloudFormation is designed for infrastructure as code and supports repeatable deployments, creation of identical environments, updates, and automatic rollback to previous stack versions. By defining EC2 instances and related resources in a CloudFormation template and using helper scripts for software installation and application startup, the developer can automate deployments and manage versioned changes reliably. The other options do not provide full infrastructure templating with rollback for EC2-based applications.
Question 149
A company uses an AWS CloudFormation template to deploy and manage its AWS infrastructure. The CloudFormation template creates Amazon VPC security groups and Amazon EC2 security groups.
A manager finds out that some engineers modified the security groups of a few EC2 instances for testing purposes. A developer needs to determine what modifications occurred.
Which solution will meet this requirement?
A. Add a Conditions section statement in the source YAML file of the template. Run the CloudFormation stack.
B. Perform a drift detection operation on the CloudFormation stack.
C. Execute a change set for the CloudFormation stack.
D. Use Amazon Detective to detect the modifications.
Show Answer
Correct Answer: B
Explanation: AWS CloudFormation drift detection identifies differences between the expected stack configuration and the actual configuration of resources that were modified outside of CloudFormation. This directly reveals what security group changes engineers made to EC2 instances after stack deployment. The other options do not detect out-of-band modifications.
Question 150
A developer needs to freeze changes to an AWS CodeCommit repository before a production release. The developer will work on new features while a quality assurance (QA) team tests the release.
The QA testing and all bug fixes must take place in isolation from the main branch. After the release, the developer must integrate all bug fixes into the main branch.
Which solution will meet these requirements?
A. Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Merge the release branch into the main branch after the release.
B. Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply fixes to the main branch. Update the Git tag for the release to be on the latest commit on the main branch.
C. Create a release branch from the latest Git commit that will be in the release. Apply fixes to the release branch. Continue developing new features, and merge the features into the main branch. Rebase the main branch onto the release branch after the release.
D. Create a Git tag on the latest Git commit that will be in the release. Continue developing new features, and merge the features into the main branch. Apply the Git commits for fixes to the Git tag for the release.
Show Answer
Correct Answer: A
Explanation: A release branch isolates QA testing and bug fixes from ongoing feature development on the main branch. Bug fixes are applied only to the release branch during testing, while new features continue on main. After the release, merging the release branch back into main cleanly integrates all fixes. The other options misuse tags (which are immutable references, not branches for ongoing work) or involve rebasing main, which is risky and unnecessary for integrating release fixes.
Question 151
A company had an Amazon RDS for MySQL DB instance that was named mysql-db. The DB instance was deleted within the past 90 days.
A developer needs to find which IAM user or role deleted the DB instance in the AWS environment.
Which solution will provide this information?
A. Retrieve the AWS CloudTrail events for the resource mysql-db where the event name is DeleteDBInstance. Inspect each event.
B. Retrieve the Amazon CloudWatch log events from the most recent log stream within the rds/mysql-db log group. Inspect the log events.
C. Retrieve the AWS X-Ray trace summaries. Filter by services with the name mysql-db. Inspect the ErrorRootCauses values within each summary.
D. Retrieve the AWS Systems Manager deletions inventory. Filter the inventory by deletions that have a TypeName value of RDS. Inspect the deletion details.
Show Answer
Correct Answer: A
Explanation: Amazon RDS instance deletions are recorded as AWS CloudTrail management events. The DeleteDBInstance API call includes the identity (IAM user or role) that initiated the deletion. CloudWatch Logs, X-Ray, and Systems Manager do not track who deleted RDS resources.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.