A developer needs to store files in an Amazon S3 bucket for a company's application. Each S3 object can have multiple versions. The objects must be permanently removed 1 year after object creation.
The developer creates an S3 bucket that has versioning enabled.
What should the developer do next to meet the data retention requirements?
A. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.
B. Create an event notification for all object creation events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
C. Create an event notification for all object removal events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
D. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to delete expired object delete markers and permanently delete noncurrent versions 1 year after object creation.
Show Answer
Correct Answer: A
Explanation: With S3 Versioning enabled, a Lifecycle rule should both expire current object versions and permanently delete noncurrent versions after the required retention period. Expiring the current version alone creates a delete marker, and the noncurrent versions must also be permanently removed to satisfy the requirement that objects are permanently removed 1 year after creation.
Question 153
A developer has an application that uses WebSocket APIs in Amazon API Gateway. The developer wants to use an API Gateway Lambda authorizer to control access to the application.
The developer needs to add credential caching and reduce repeated usage of secret keys and authorization tokens on every request.
Which combination of steps should the developer take to meet these requirements? (Choose two.)
A. Use a token-based Lambda authorizer.
B. Use a request parameter-based Lambda authorizer.
C. Configure an integration request mapping template to reference the context map from the APIGateway Lambda authorizer.
D. Configure an integration request mapping template to reference the identity API key value from the API Gateway Lambda authorizer.
E. Use VPC endpoint policies for the WebSocket APIs.
Show Answer
Correct Answer: B, C
Explanation: For Amazon API Gateway WebSocket APIs, Lambda authorizers support REQUEST authorizers, not TOKEN authorizers. REQUEST authorizers can use identity sources and support caching based on those identity sources. To pass authorizer output to the backend and avoid repeatedly sending secrets or tokens, configure an integration request mapping template that references the Lambda authorizer context map.
Question 154
A company has an ecommerce web application that uses an on-premises MySQL database as a data store. The company migrates the on-premises MySQL database to Amazon RDS for MySQL.
A developer needs to configure the application's access to the RDS for MySQL database. The developer's solution must not use long term credentials.
Which solution will meet these requirements?
A. Enable IAM database authentication on the RDS for MySQL DB instance. Create an IAM role that has the minimum required permissions. Assign the role to the application.
B. Store the MySQL credentials as secrets in AWS Secrets Manager. Create an IAM role that has the minimum required permissions to retrieve the secrets. Assign the role to the application.
C. Configure the MySQL credentials as environment variables that are available at runtime for the application.
D. Store the MySQL credentials as SecureString parameters in AWS Systems Manager Parameter Store. Create an IAM role that has the minimum required permissions to retrieve the parameters. Assign the role to the application.
Show Answer
Correct Answer: A
Explanation: IAM database authentication for Amazon RDS for MySQL allows applications to authenticate using short-lived IAM-generated authentication tokens (valid for about 15 minutes) instead of storing long-term database passwords. Assigning an IAM role with the required rds-db:connect permission satisfies the requirement to avoid long-term credentials. Secrets Manager and Parameter Store still store long-lived database usernames/passwords, even if rotation is enabled, and environment variables are also long-term credentials.
Question 155
A company uses AWS X-Ray to monitor a serverless application. The components of the application have different request rates. The user interactions and transactions are important to trace, but they are low in volume. The background processes such as application health checks, polling, and connection maintenance generate high volumes of read-only requests.
Currently, the default X-Ray sampling rules are universal for all requests. Only the first request per second and some additional requests are recorded. This setup is not helping the company review the requests based on service or request type.
A developer must configure rules to trace requests based on service or request properties. The developer must trace the user interactions and transactions without wasting effort recording minor background tasks.
Which solution will meet these requirements?
A. Disable sampling for high-volume read-only requests. Sample at a lower rate for all requests that handle user interactions or transactions.
B. Disable sampling and trace all requests for requests that handle user interactions or transactions. Sample high-volume read-only requests at a higher rate.
C. Disable sampling and trace all requests for requests that handle user interactions or transactions. Sample high-volume read-only requests at a lower rate.
D. Disable sampling for high-volume read-only requests. Sample at a higher rate for all requests that handle user interactions or transactions.
Show Answer
Correct Answer: C
Explanation: AWS X-Ray supports custom sampling rules based on service and request attributes. For low-volume, high-value user interactions and transactions, disabling sampling (recording all matching requests) ensures complete traces. For high-volume background read-only requests such as health checks and polling, applying a lower sampling rate reduces unnecessary trace volume while still allowing occasional visibility. This aligns with tracing important requests without wasting resources.
Question 156
A developer builds a serverless application on AWS by using Amazon API Gateway, AWS Lambda functions, and Amazon Route 53. During testing, the developer notices errors but cannot immediately locate the root cause.
To identify the errors, the developer needs to search all the application's logs.
What should the developer do to meet these requirements with the LEAST operational overhead?
A. Set up API Gateway health checks to monitor the application's availability. Use the Amazon CloudWatch PutMetricData API operation to publish the logs to CloudWatch. Search and query the logs by using Amazon Athena.
B. Set up Route 53 health checks to monitor the application's availability. Turn on AWS CloudTrail logs for all the AWS services that the application uses. Send the logs to a specified Amazon S3 bucket. Use Amazon Athena to query the log files directly from Amazon S3.
C. Configure all the application's AWS services to publish a real-time feed of log events to an Amazon Kinesis Data Firehose delivery stream. Configure the delivery stream to publish all the logs to an Amazon S3 bucket. Use Amazon OpenSearch Service to search and analyze the logs.
D. Set up Route 53 health checks to monitor the application's availability. Turn on Amazon CloudWatch Logs for the API Gateway stages to log API requests with a JSON log format. Use CloudWatch Logs Insights to search and analyze the logs from the AWS services that the application uses.
Show Answer
Correct Answer: D
Explanation: API Gateway and Lambda integrate natively with Amazon CloudWatch Logs, and CloudWatch Logs Insights can search and analyze logs across the application's CloudWatch log groups with minimal operational overhead. Enabling API Gateway access/execution logging and using CloudWatch Logs Insights is simpler than building log pipelines with Kinesis/OpenSearch or querying CloudTrail/S3, which is not intended for application log analysis. Route 53 health checks can monitor endpoint availability but are not the primary log source.
Question 157
A developer is creating an application that must transfer expired items from Amazon DynamoDB to Amazon S3. The developer sets up the DynamoDB table to automatically delete items after a specific TTL. The application must process the items in DynamoDB and then must store the expired items in Amazon S3. The entire process, including item processing and storage in Amazon S3, will take 5 minutes.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure DynamoDB Accelerator (DAX) to query for expired items based on the TTL. Save the results to Amazon S3.
B. Configure DynamoDB Streams to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
C. Deploy a custom application on an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2 instances. Program the custom application to process the items and to store the expired items in Amazon S3.
D. Create an Amazon EventBridge rule to invoke an AWS Lambda function. Program the Lambda function to process the items and to store the expired items in Amazon S3.
Show Answer
Correct Answer: B
Explanation: DynamoDB TTL deletions generate records in DynamoDB Streams as service deletes. A Lambda function can be triggered from the stream to process each expired item and write it to Amazon S3. A 5-minute processing time fits within the Lambda maximum execution time. This is fully managed and has the least operational overhead. DAX is a cache and cannot retrieve already deleted TTL items, ECS on EC2 adds operational overhead, and EventBridge does not natively emit TTL deletion events from DynamoDB.
Question 158
A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS Key Management Service (AWS KMS) keys, which can be rotated on demand.
Which combination of steps will meet these requirements? (Choose two.)
A. Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
B. Configure an S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key.
C. Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing personal data to Amazon S3.
D. Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:SecureTransport condition.
E. Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS.
Show Answer
Correct Answer: C, D
Explanation: Use a bucket policy with the aws:SecureTransport condition to deny non-HTTPS requests, ensuring encryption in transit. For encryption at rest with AWS KMS customer managed keys that support on-demand rotation, configure the application to encrypt objects using a customer managed KMS key before uploading (client-side encryption with KMS-managed data keys). Option A is incorrect because permissions boundaries are for IAM principals, not bucket policies. Option B is incorrect because bucket policies cannot enable client-side encryption. Option E concerns public access, not HTTPS enforcement.
Question 159
An AWS Lambda function is invoked asynchronously to process events. Occasionally, the Lambda function falls to process events. A developer needs to collect and analyze these failed events to fix the issue.
What should the developer do to meet these requirements with the LEAST development effort?
A. Add logging statements for all events in the Lambda function. Filter AWS CloudTrail logs for errors.
B. Configure the Lambda function to start an AWS Step Functions workflow with retries for failed events.
C. Add a dead-letter queue to send messages to an Amazon Simple Queue Service (Amazon SQS) standard queue.
D. Add a dead-letter queue to send messages to an Amazon Simple Notification Service (Amazon SNS) FIFO topic.
Show Answer
Correct Answer: C
Explanation: For asynchronously invoked AWS Lambda functions, configuring a dead-letter queue (DLQ) is the built-in, lowest-effort way to capture events that fail processing after retries. An Amazon SQS standard queue is a supported DLQ target and allows developers to inspect and analyze failed events. CloudTrail does not log Lambda invocation payload failures, Step Functions requires additional orchestration, and an SNS FIFO topic is not a supported Lambda DLQ target.
Question 160
A developer creates an Amazon DynamoDB table. The table has OrderID as the partition key and NumberOfItemsPurchased as the sort key. The data type of the partition key and the sort key is Number.
When the developer queries the table, the results are sorted by NumberOfItemsPurchased in ascending order. The developer needs the query results to be sorted by NumberOfItemsPurchased in descending order.
Which solution will meet this requirement?
A. Create a local secondary index (LSI) on the NumberOfItemsPurchased sort key.
B. Change the sort key from NumberOfItemsPurchased to NumberOfItemsPurchasedDescending.
C. In the Query operation, set the ScanIndexForward parameter to false.
D. In the Query operation, set the KeyConditionExpression parameter to false.
Show Answer
Correct Answer: C
Explanation: DynamoDB Query results are sorted by the sort key in ascending order by default. To return items in descending order, set the Query operation's ScanIndexForward parameter to false. Creating an LSI is unnecessary, changing the schema is unnecessary, and KeyConditionExpression defines key matching conditions, not sort direction.
Question 161
A developer manages a website that distributes its content by using Amazon CloudFront. The website's static artifacts are stored in an Amazon S3 bucket.
The developer deploys some changes and can see the new artifacts in the S3 bucket. However, the changes do not appear on the webpage that the CloudFront distribution delivers.
How should the developer resolve this issue?
A. Configure S3 Object Lock to update to the latest version of the files every time an S3 object is updated.
B. Configure the S3 bucket to clear all old objects from the bucket before new artifacts are uploaded.
C. Set CloudFront to invalidate the cache after the artifacts have been deployed to Amazon S3.
D. Set CloudFront to modify the distribution origin after the artifacts have been deployed to Amazon S3.
Show Answer
Correct Answer: C
Explanation: CloudFront caches objects at edge locations. After updating static files in the S3 origin, users may still receive cached versions until the cache expires. Creating a CloudFront invalidation (or using versioned object names) forces CloudFront to fetch the updated objects from S3. Object Lock, deleting old S3 objects, or modifying the distribution origin do not solve stale cached content.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.