A company has an application that receives batches of orders from partners every day. The application uses an AWS Lambda function to process the batches.
If a batch contains no orders, the Lambda function must publish to an Amazon Simple Notification Service (Amazon SNS) topic as soon as possible.
Which combination of steps will meet this requirement with the LEAST implementation effort? (Choose two.)
A. Update the existing Lambda function's code to send an Amazon CloudWatch custom metric for the number of orders in a batch for each partner.
B. Create a new Lambda function as an Amazon Kinesis data stream consumer. Configure the new Lambda function to track orders and to publish to the SNS topic when a batch contains no orders.
C. Set up an Amazon CloudWatch alarm that will send a notification to the SNS topic when the value of the custom metric is 0.
D. Schedule a new Lambda function to analyze Amazon CloudWatch metrics every 24 hours to identify batches that contain no orders. Configure the Lambda function to publish to the SNS topic.
E. Modify the existing Lambda function to log orders to an Amazon Kinesis data stream.
Show Answer
Correct Answer: A, C
Explanation: Publishing a custom CloudWatch metric for the number of orders per batch requires only a small code change to the existing Lambda. A CloudWatch alarm can then trigger immediately when the metric value is 0 and publish to SNS. This avoids adding new data streams, consumers, or scheduled analysis, resulting in the least implementation effort and fastest notification.
Question 163
A company has a website that displays a daily newsletter. When a user visits the website, an AWS Lambda function processes the browser's request and queries the company's on-premises database to obtain the current newsletter. The newsletters are stored in English. The Lambda function uses the Amazon Translate TranslateText API operation to translate the newsletters, and the translation is displayed to the user.
Due to an increase in popularity, the website's response time has slowed. The database is overloaded. The company cannot change the database and needs a solution that improves the response time of the Lambda function.
Which solution meets these requirements?
A. Change to asynchronous Lambda function invocation.
B. Cache the translated newsletters in the Lambda/tmp directory.
C. Enable TranslateText API caching.
D. Change the Lambda function to use parallel processing.
Show Answer
Correct Answer: B
Explanation: The bottleneck is repeated reads from the overloaded on‑premises database. Caching the translated newsletter avoids querying the database and calling Amazon Translate on every request, significantly improving Lambda response time. Lambda’s /tmp storage persists for the lifetime of a warm execution environment, making it suitable for short‑term caching. The other options do not reduce database load or are not supported features.
Question 164
A developer is creating a new batch application that will run on an Amazon EC2 instance. The application requires read access to an Amazon S3 bucket. The developer needs to follow security best practices to grant S3 read access to the application.
Which solution meets these requirements?
A. Add the permissions to an IAM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.
B. Add the permissions inline to an IAM group. Attach the group to the EC2 instance profile.
C. Add the permissions to an IAM policy. Attach the policy to a user. Attach the user to the EC2 instance profile.
D. Add the permissions to an IAM policy. Use IAM web identity federation to access the S3 bucket with the policy.
Show Answer
Correct Answer: A
Explanation: Best practice for EC2 access to AWS services is to use an IAM role attached to an instance profile. Attaching an IAM policy with S3 read permissions to the role provides temporary credentials automatically, avoids hard-coded credentials, and follows the principle of least privilege. Groups and users cannot be attached to instance profiles, and web identity federation is not appropriate for EC2 instances.
Question 165
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials.
A developer needs to implement encrypted username and password credentials.
Which solution will meet these requirements?
A. Remove the user credentials from the Lambda environment. Implement IAM database authentication.
B. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.
C. Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
D. Move the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Parameter Store supports SecureString parameters that are encrypted using AWS KMS. This provides encryption at rest and in transit, fine-grained IAM access control, and is a best practice for storing secrets used by Lambda functions. KMS alone does not store credentials, and storing encrypted files in S3 or using IAM database authentication does not fit the SFTP credential use case.
Question 166
A company maintains a REST service using Amazon API Gateway and the API Gateway native API key validation. The company recently launched a new registration page, which allows users to sign up for the service. The registration page creates a new API key using CreateApiKey and sends the new key to the user. When the user attempts to call the API using this key, the user receives a 403 Forbidden error. Existing users are unaffected and can still call the API.
What code updates will grant these new users access to the API?
A. The createDeployment method must be called so the API can be redeployed to include the newly created API key.
B. The updateAuthorizer method must be called to update the API's authorizer to include the newly created API key.
C. The importApiKeys method must be called to import all newly created API keys into the current stage of the API.
D. The createUsagePlanKey method must be called to associate the newly created API key with the correct usage plan.
Show Answer
Correct Answer: D
Explanation: In API Gateway with native API key validation, creating an API key alone is not sufficient. The key must be associated with a usage plan that is linked to the deployed API stage. Existing users work because their keys are already attached to a usage plan. Newly created keys return 403 Forbidden until createUsagePlanKey is called to associate the API key with the correct usage plan.
Question 167
A company has a web application that contains an Amazon API Gateway REST API. A developer has created an AWS CloudFormation template for the initial deployment of the application. The developer has deployed the application successfully as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) process. All resources and methods are available through the deployed stage endpoint.
The CloudFormation template contains the following resource types:
• AWS::ApiGateway::RestApi
• AWS::ApiGateway::Resource
• AWS::ApiGateway::Method
• AWS::ApiGateway::Stage
• AWS::ApiGateway::Deployment
The developer adds a new resource to the REST API with additional methods and redeploys the template. CloudFormation reports that the deployment is successful and that the stack is in the UPDATE_COMPLETE state. However, calls to all new methods are returning 404 (Not Found) errors.
What should the developer do to make the new methods available?
A. Specify the disable-rollback option during the update-stack operation.
B. Unset the CloudFormation stack failure options.
C. Add an AWS CodeBuild stage to CodePipeline to run the aws apigateway create-deployment AWS CLI command.
D. Add an action to CodePipeline to run the aws cloudfront create-invalidation AWS CLI command.
Show Answer
Correct Answer: C
Explanation: In API Gateway, changes to resources and methods are not automatically exposed on an existing stage unless a new deployment is created. Although CloudFormation updated the stack successfully, the AWS::ApiGateway::Deployment resource was not effectively updated to redeploy the API, so the stage still points to the old deployment and returns 404 for new methods. Adding a CodeBuild action in CodePipeline to run `aws apigateway create-deployment` forces creation of a new deployment, making the newly added resources and methods available on the stage.
Question 168
A developer is monitoring an application that runs on an Amazon EC2 instance. The developer has configured a custom Amazon CloudWatch metric with data granularity of 1 second. If any issues occur, the developer wants to be notified within 30 seconds by Amazon Simple Notification Service (Amazon SNS).
What should the developer do to meet this requirement?
A. Configure a high-resolution CloudWatch alarm.
B. Set up a custom CloudWatch dashboard.
C. Use Amazon CloudWatch Logs Insights.
D. Change to a default CloudWatch metric.
Show Answer
Correct Answer: A
Explanation: To receive notifications within 30 seconds, the alarm must evaluate metrics at sub-minute intervals. High-resolution CloudWatch alarms support 1-second granularity custom metrics and can trigger quickly, enabling SNS notifications within the required timeframe. Other options do not provide fast alerting based on metric evaluation.
Question 169
A company launched an online portal to announce a new product that the company will release in 6 months. The portal requests that users enter an email address to receive communications about the product. The company needs to create a REST API that will store the email addresses in Amazon DynamoDB.
A developer has created an AWS Lambda function that can store the email addresses. The developer will deploy the Lambda function by using the AWS Serverless Application Model (AWS SAM). The developer must provide access to the Lambda function over HTTP.
Which solutions will meet these requirements with the LEAST additional configuration? (Choose two.)
A. Expose the Lambda function by using function URLs.
B. Expose the Lambda function by using a Gateway Load Balancer.
C. Expose the Lambda function by using a Network Load Balancer.
D. Expose the Lambda function by using AWS Global Accelerator.
E. Expose the Lambda function by using Amazon API Gateway.
Show Answer
Correct Answer: A, E
Explanation: The requirement is to expose an AWS Lambda function over HTTP with the least additional configuration. Lambda Function URLs provide a built-in HTTPS endpoint directly for a Lambda function with minimal setup, making option A valid. Amazon API Gateway is a native serverless HTTP front end for Lambda that integrates seamlessly with AWS SAM and requires minimal configuration, making option E valid. The other options involve load balancers or accelerators that add unnecessary infrastructure and configuration for a simple REST API use case.
Question 170
A company used AWS to develop an application for customers. The application includes an Amazon API Gateway API that invokes AWS Lambda functions. The Lambda functions process data and store the data in Amazon DynamoDB tables.
The company must monitor the entire application to identify potential bottlenecks in the architecture that can negatively affect customers.
Which solution will meet this requirement with the LEAST development effort?
A. Instrument the application with AWS X-Ray. Inspect the service map to identify errors and issues.
B. Configure Lambda exceptions and additional logging to Amazon CloudWatch. Use CloudWatch Logs Insights to query the logs.
C. Configure API Gateway to log responses to Amazon CloudWatch. Create a metric filter for the TooManyRequestsException error message.
D. Use Amazon CloudWatch metrics for the DynamoDB tables to identify all the ProvisionedThroughputExceededException error messages.
Show Answer
Correct Answer: A
Explanation: AWS X-Ray provides end-to-end distributed tracing across API Gateway, Lambda, and DynamoDB with minimal configuration. The service map and traces help identify latency, errors, and bottlenecks across the entire serverless architecture with the least development effort compared to adding custom logging or metric analysis.
Question 171
A company is developing an application that will be accessed through the Amazon API Gateway REST API. Registered users should be the only ones who can access certain resources of this API. The token being used should expire automatically and needs to be refreshed periodically.
How can a developer meet these requirements?
A. Create an Amazon Cognito identity pool, configure the Amazon Cognito Authorizer in API Gateway, and use the temporary credentials generated by the identity pool.
B. Create and maintain a database record for each user with a corresponding token and use an AWS Lambda authorizer in API Gateway.
C. Create an Amazon Cognito user pool, configure the Cognito Authorizer in API Gateway, and use the identity or access token.
D. Create an IAM user for each API user, attach an invoke permissions policy to the API, and use an IAM authorizer in API Gateway.
Show Answer
Correct Answer: C
Explanation: Amazon Cognito user pools provide managed user authentication, issuing ID and access tokens with built-in expiration and refresh mechanisms. API Gateway’s Cognito authorizer can validate these tokens automatically, ensuring that only registered users can access protected REST API resources without custom token management or IAM user overhead.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.