A developer needs to store files in an Amazon S3 bucket for a company's application. Each S3 object can have multiple versions. The objects must be permanently removed 1 year after object creation.
The developer creates an S3 bucket that has versioning enabled.
What should the developer do next to meet the data retention requirements?
A. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.
B. Create an event notification for all object creation events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
C. Create an event notification for all object removal events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
D. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to delete expired object delete markers and permanently delete noncurrent versions 1 year after object creation.
Show Answer
Correct Answer: A
Explanation: With S3 versioning enabled, lifecycle rules are the native way to enforce time-based retention. To permanently remove data after 1 year from object creation, the rule must both expire current versions and permanently delete noncurrent versions after 1 year. This ensures all versions are removed without custom code. Event notifications with Lambda are unnecessary and less reliable for retention, and delete markers alone would not remove current versions.
Question 153
A developer has an application that uses WebSocket APIs in Amazon API Gateway. The developer wants to use an API Gateway Lambda authorizer to control access to the application.
The developer needs to add credential caching and reduce repeated usage of secret keys and authorization tokens on every request.
Which combination of steps should the developer take to meet these requirements? (Choose two.)
A. Use a token-based Lambda authorizer.
B. Use a request parameter-based Lambda authorizer.
C. Configure an integration request mapping template to reference the context map from the APIGateway Lambda authorizer.
D. Configure an integration request mapping template to reference the identity API key value from the API Gateway Lambda authorizer.
E. Use VPC endpoint policies for the WebSocket APIs.
Show Answer
Correct Answer: B, C
Explanation: For Amazon API Gateway WebSocket APIs, only request parameter-based Lambda authorizers are supported (not token-based authorizers). To reduce repeated use of credentials, the Lambda authorizer can cache the authorization result, and values returned in the authorizer context can be reused. An integration request mapping template can reference the authorizer context map so downstream integrations do not need to reprocess secret keys or tokens on every request.
Question 154
A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL.
A developer needs to configure the application's access to the RDS for MySQL database. The developer's solution must not use long term credentials.
Which solution will meet these requirements?
A. Enable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that has the minimum required permissions. Assign the role to the application.
B. Store the MySQL credentials as secrets in AWS Secrets Manager. Create an IAM role that has the minimum required permissions to retrieve the secrets. Assign the role to the application.
C. Configure the MySQL credentials as environment variables that are available at runtime for the application.
D. Store the MySQL credentials as SecureString parameters in AWS Systems Manager Parameter Store. Create an IAM role that has the minimum required permissions to retrieve the parameters. Assign the role to the application.
Show Answer
Correct Answer: A
Explanation: The requirement is that the application must not use long-term credentials. IAM database authentication for Amazon RDS for MySQL allows the application to connect using short-lived IAM authentication tokens (valid for about 15 minutes) that are generated dynamically by AWS and tied to an IAM role. No static username/password needs to be stored. In contrast, Secrets Manager, Parameter Store, or environment variables still rely on database usernames and passwords that exist for extended periods, even if rotated. Therefore, enabling IAM database authentication and using an IAM role best meets the requirement.
Question 155
A company uses AWS X-Ray to monitor a serverless application. The components of the application have different request rates. The user interactions and transactions are important to trace, but they are low in volume. The background processes such as application health checks, polling, and connection maintenance generate high volumes of read-only requests.
Currently, the default X-Ray sampling rules are universal for all requests. Only the first request per second and some additional requests are recorded. This setup is not helping the company review the requests based on service or request type.
A developer must configure rules to trace requests based on service or request properties. The developer must trace the user interactions and transactions without wasting effort recording minor background tasks.
Which solution will meet these requirements?
A. Disable sampling for high-volume read-only requests. Sample at a lower rate for all requests that handle user interactions or transactions.
B. Disable sampling and trace all requests for requests that handle user interactions or transactions. Sample high-volume read-only requests at a higher rate.
C. Disable sampling and trace all requests for requests that handle user interactions or transactions. Sample high-volume read-only requests at a lower rate.
D. Disable sampling for high-volume read-only requests. Sample at a higher rate for all requests that handle user interactions or transactions.
Show Answer
Correct Answer: C
Explanation: The requirement is to ensure that all low-volume but high-value user interactions and transactions are traced, while avoiding waste from high-volume background requests. Disabling sampling for user-facing requests guarantees complete traces for those critical paths. High-volume read-only background tasks should still be sampled, but at a lower rate, to reduce noise and cost. This is exactly what option C describes.
Question 156
A developer builds a serverless application on AWS by using Amazon API Gateway, AWS Lambda functions, and Amazon Route 53. During testing, the developer notices errors but cannot immediately locate the root cause.
To identify the errors, the developer needs to search all the application's logs.
What should the developer do to meet these requirements with the LEAST operational overhead?
A. Set up API Gateway health checks to monitor the application's availability. Use the Amazon CloudWatch PutMetricData API operation to publish the logs to CloudWatch. Search and query the logs by using Amazon Athena.
B. Set up Route 53 health checks to monitor the application's availability. Turn on AWS CloudTrail logs for all the AWS services that the application uses. Send the logs to a specified Amazon S3 bucket. Use Amazon Athena to query the log files directly from Amazon S3.
C. Configure all the application's AWS services to publish a real-time feed of log events to an Amazon Kinesis Data Firehose delivery stream. Configure the delivery stream to publish all the logs to an Amazon S3 bucket. Use Amazon OpenSearch Service to search and analyze the logs.
D. Set up Route 53 health checks to monitor the application's availability. Turn on Amazon CloudWatch Logs for the API Gateway stages to log API requests with a JSON log format. Use CloudWatch Logs Insights to search and analyze the logs from the AWS services that the application uses.
Show Answer
Correct Answer: D
Explanation: The goal is to search and analyze all application logs with the least operational overhead. Amazon API Gateway and AWS Lambda natively publish logs to Amazon CloudWatch Logs. Enabling CloudWatch Logs for API Gateway stages and using CloudWatch Logs Insights provides centralized, serverless log querying without additional infrastructure. Route 53 health checks help monitor availability but do not add logging complexity. Other options introduce unnecessary services such as Athena, S3 pipelines, Kinesis, or OpenSearch, which increase setup and maintenance overhead.
Question 157
A developer is creating an application that must transfer expired items from Amazon DynamoDB to Amazon S3. The developer sets up the DynamoDB table to automatically delete items after a specific TTL. The application must process the items in DynamoDB and then must store the expired items in Amazon S3. The entire process, including item processing and storage in Amazon S3, will take 5 minutes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure DynamoDB Accelerator (DAX) to query for expired items based on the TTL. Save the results to Amazon S3.
B. Configure DynamoDB Streams to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
C. Deploy a custom application on an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2 instances. Program the custom application to process the items and to store the expired items in Amazon S3.
D. Create an Amazon EventBridge rule to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
Show Answer
Correct Answer: B
Explanation: DynamoDB Streams can capture item deletions caused by TTL expiration and automatically invoke an AWS Lambda function. This is a fully managed, event-driven solution with minimal operational overhead. The Lambda function can process each expired item and store it in Amazon S3 within the required time window. Other options either cannot reliably detect TTL expirations (DAX, EventBridge) or require significantly more infrastructure management (ECS).
Question 158
A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS Key Management Service (AWS KMS) keys, which can be rotated on demand.
Which combination of steps will meet these requirements? (Choose two.)
A. Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
B. Configure an S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key.
C. Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing personal data to Amazon S3.
D. Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:SecureTransport condition.
E. Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS.
Show Answer
Correct Answer: C, D
Explanation: Encryption in transit is enforced by requiring HTTPS using an S3 bucket policy with the aws:SecureTransport condition (D). Encryption at rest with AWS KMS keys that can be rotated on demand is achieved by configuring the application to encrypt objects using a customer managed KMS key before uploading to S3 (client-side encryption) (C).
Question 159
An AWS Lambda function is invoked asynchronously to process events. Occasionally, the Lambda function falls to process events. A developer needs to collect and analyze these failed events to fix the issue.
What should the developer do to meet these requirements with the LEAST development effort?
A. Add logging statements for all events in the Lambda function. Filter AWS CloudTrail logs for errors.
B. Configure the Lambda function to start an AWS Step Functions workflow with retries for failed events.
C. Add a dead-letter queue to send messages to an Amazon Simple Queue Service (Amazon SQS) standard queue.
D. Add a dead-letter queue to send messages to an Amazon Simple Notification Service (Amazon SNS) FIFO topic.
Show Answer
Correct Answer: C
Explanation: For asynchronously invoked Lambda functions, AWS provides built-in support for dead-letter queues (DLQs) to capture events that fail processing after retries. Configuring a DLQ to an Amazon SQS standard queue requires minimal development effort and allows the developer to collect, inspect, and analyze failed events. CloudTrail logs do not capture payload-level failures, Step Functions add unnecessary complexity, and SNS FIFO topics are not supported as Lambda DLQs.
Question 160
A developer creates an Amazon DynamoDB table. The table has OrderID as the partition key and NumberOfItemsPurchased as the sort key. The data type of the partition key and the sort key is Number.
When the developer queries the table, the results are sorted by NumberOfItemsPurchased in ascending order. The developer needs the query results to be sorted by NumberOfItemsPurchased in descending order.
Which solution will meet this requirement?
A. Create a local secondary index (LSI) on the NumberOfItemsPurchased sort key.
B. Change the sort key from NumberOfItemsPurchased to NumberOfItemsPurchasedDescending.
C. In the Query operation, set the ScanIndexForward parameter to false.
D. In the Query operation, set the KeyConditionExpression parameter to false.
Show Answer
Correct Answer: C
Explanation: DynamoDB Query results are sorted by the sort key in ascending order by default. To retrieve results in descending order without changing the table schema or indexes, the Query operation provides the ScanIndexForward parameter. Setting ScanIndexForward to false reverses the sort order on the sort key (NumberOfItemsPurchased), returning results in descending order.
Question 161
A developer manages a website that distributes its content by using Amazon CloudFront. The website's static artifacts are stored in an Amazon S3 bucket.
The developer deploys some changes and can see the new artifacts in the S3 bucket. However, the changes do not appear on the webpage that the CloudFront distribution delivers.
How should the developer resolve this issue?
A. Configure S3 Object Lock to update to the latest version of the files every time an S3 object is updated.
B. Configure the S3 bucket to clear all old objects from the bucket before new artifacts are uploaded.
C. Set CloudFront to invalidate the cache after the artifacts have been deployed to Amazon S3.
D. Set CloudFront to modify the distribution origin after the artifacts have been deployed to Amazon S3.
Show Answer
Correct Answer: C
Explanation: Amazon CloudFront caches objects at edge locations. After updating static artifacts in the S3 origin, CloudFront may continue serving the cached (old) versions until the cache expires. Creating a CloudFront cache invalidation forces CloudFront to remove the outdated objects so the next requests fetch the updated artifacts from S3. The other options do not address CloudFront caching behavior.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.