A company has an application that receives batches of orders from partners every day. The application uses an AWS Lambda function to process the batches.
If a batch contains no orders, the Lambda function must publish to an Amazon Simple Notification Service (Amazon SNS) topic as soon as possible.
Which combination of steps will meet this requirement with the LEAST implementation effort? (Choose two.)
A. Update the existing Lambda function's code to send an Amazon CloudWatch custom metric for the number of orders in a batch for each partner.
B. Create a new Lambda function as an Amazon Kinesis data stream consumer. Configure the new Lambda function to track orders and to publish to the SNS topic when a batch contains no orders.
C. Set up an Amazon CloudWatch alarm that will send a notification to the SNS topic when the value of the custom metric is 0.
D. Schedule a new Lambda function to analyze Amazon CloudWatch metrics every 24 hours to identify batches that contain no orders. Configure the Lambda function to publish to the SNS topic.
E. Modify the existing Lambda function to log orders to an Amazon Kinesis data stream.
Show Answer
Correct Answer: A, C
Explanation: Publish a custom CloudWatch metric from the existing Lambda that records the number of orders processed in each batch. Then create a CloudWatch alarm that triggers when the metric value is 0 and configure the alarm to notify the SNS topic. This requires only a small code change plus managed CloudWatch functionality, with less implementation effort than introducing Kinesis or scheduled analysis.
Question 163
A company has a website that displays a daily newsletter. When a user visits the website, an AWS Lambda function processes the browser's request and queries the company's on-premises database to obtain the current newsletter. The newsletters are stored in English. The Lambda function uses the Amazon Translate TranslateText API operation to translate the newsletters, and the translation is displayed to the user.
Due to an increase in popularity, the website's response time has slowed. The database is overloaded. The company cannot change the database and needs a solution that improves the response time of the Lambda function.
Which solution meets these requirements?
A. Change to asynchronous Lambda function invocation.
B. Cache the translated newsletters in the Lambda/tmp directory.
C. Enable TranslateText API caching.
D. Change the Lambda function to use parallel processing.
Show Answer
Correct Answer: B
Explanation: The workload repeatedly retrieves the same daily newsletter and translates it. Caching the translated result avoids repeated queries to the overloaded on-premises database and repeated translation work, improving response time. Although the Lambda /tmp directory is ephemeral and scoped to an execution environment, it can serve as a cache across warm invocations. The other options do not fit: asynchronous invocation does not help synchronous website responses, Amazon Translate has no built-in TranslateText API caching feature, and parallel processing would not reduce the need to query the overloaded database.
Question 164
A developer is creating a new batch application that will run on an Amazon EC2 instance. The application requires read access to an Amazon S3 bucket. The developer needs to follow security best practices to grant S3 read access to the application.
Which solution meets these requirements?
A. Add the permissions to an IAM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.
B. Add the permissions inline to an IAM group. Attach the group to the EC2 instance profile.
C. Add the permissions to an IAM policy. Attach the policy to a user. Attach the user to the EC2 instance profile.
D. Add the permissions to an IAM policy. Use IAM web identity federation to access the S3 bucket with the policy.
Show Answer
Correct Answer: A
Explanation: The recommended AWS security best practice is to grant applications running on Amazon EC2 temporary credentials through an IAM role attached to an EC2 instance profile. Attach an IAM policy with S3 read permissions to the role, then associate the role with the EC2 instance profile. IAM groups cannot be attached to instance profiles, IAM users should not be used for EC2 application credentials, and web identity federation is intended for external identity providers rather than EC2 instances.
Question 165
A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials.
A developer needs to implement encrypted username and password credentials.
Which solution will meet these requirements?
A. Remove the user credentials from the Lambda environment. Implement IAM database authentication.
B. Move the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.
C. Move the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
D. Move the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.
Show Answer
Correct Answer: B
Explanation: AWS Systems Manager Parameter Store is the appropriate service for storing application secrets such as usernames and passwords. By using SecureString parameters, the credentials are encrypted with AWS KMS and can be securely retrieved by the Lambda function. KMS manages encryption keys but is not a secret store, IAM database authentication is unrelated to an SFTP server, and storing an encrypted text file in S3 is not the recommended secret management approach.
Question 166
A company maintains a REST service using Amazon API Gateway and the API Gateway native API key validation. The company recently launched a new registration page, which allows users to sign up for the service. The registration page creates a new API key using CreateApiKey and sends the new key to the user. When the user attempts to call the API using this key, the user receives a 403 Forbidden error. Existing users are unaffected and can still call the API.
What code updates will grant these new users access to the API?
A. The createDeployment method must be called so the API can be redeployed to include the newly created API key.
B. The updateAuthorizer method must be called to update the API's authorizer to include the newly created API key.
C. The importApiKeys method must be called to import all newly created API keys into the current stage of the API.
D. The createUsagePlanKey method must be called to associate the newly created API key with the correct usage plan.
Show Answer
Correct Answer: D
Explanation: Creating an API key alone does not grant access to a REST API that uses usage plans. The new API key must be associated with the appropriate usage plan using createUsagePlanKey. Redeployment is not required for API key creation, authorizers are unrelated to native API key validation, and importApiKeys is intended for bulk import rather than associating keys with usage plans.
Question 167
A company has a web application that contains an Amazon API Gateway REST API. A developer has created an AWS CloudFormation template for the initial deployment of the application. The developer has deployed the application successfully as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) process. All resources and methods are available through the deployed stage endpoint.
The CloudFormation template contains the following resource types:
• AWS::ApiGateway::RestApi
• AWS::ApiGateway::Resource
• AWS::ApiGateway::Method
• AWS::ApiGateway::Stage
• AWS::ApiGateway::Deployment
The developer adds a new resource to the REST API with additional methods and redeploys the template. CloudFormation reports that the deployment is successful and that the stack is in the UPDATE_COMPLETE state. However, calls to all new methods are returning 404 (Not Found) errors.
What should the developer do to make the new methods available?
A. Specify the disable-rollback option during the update-stack operation.
B. Unset the CloudFormation stack failure options.
C. Add an AWS CodeBuild stage to CodePipeline to run the aws apigateway create-deployment AWS CLI command.
D. Add an action to CodePipeline to run the aws cloudfront create-invalidation AWS CLI command.
Show Answer
Correct Answer: C
Explanation: API Gateway deployments are immutable snapshots of the API configuration. Updating API resources and methods in CloudFormation does not automatically create a new deployment unless the Deployment resource is replaced. The existing stage continues to point to the old deployment, so new methods return 404. Creating a new API Gateway deployment (for example, by running `aws apigateway create-deployment` in the CI/CD pipeline) publishes the updated API configuration to the stage. The other options are unrelated to API Gateway deployment behavior.
Question 168
A developer is monitoring an application that runs on an Amazon EC2 instance. The developer has configured a custom Amazon CloudWatch metric with data granularity of 1 second. If any issues occur, the developer wants to be notified within 30 seconds by Amazon Simple Notification Service (Amazon SNS).
What should the developer do to meet this requirement?
A. Configure a high-resolution CloudWatch alarm.
B. Set up a custom CloudWatch dashboard.
C. Use Amazon CloudWatch Logs Insights.
D. Change to a default CloudWatch metric.
Show Answer
Correct Answer: A
Explanation: A 1-second custom CloudWatch metric supports high-resolution alarms. High-resolution CloudWatch alarms can evaluate at 10-second intervals, enabling notification via Amazon SNS within about 30 seconds when a threshold is breached. Dashboards and Logs Insights do not provide alarm notifications, and default metrics are lower resolution.
Question 169
A company launched an online portal to announce a new product that the company will release in 6 months. The portal requests that users enter an email address to receive communications about the product. The company needs to create a REST API that will store the email addresses in Amazon DynamoDB.
A developer has created an AWS Lambda function that can store the email addresses. The developer will deploy the Lambda function by using the AWS Serverless Application Model (AWS SAM). The developer must provide access to the Lambda function over HTTP.
Which solutions will meet these requirements with the LEAST additional configuration? (Choose two.)
A. Expose the Lambda function by using function URLs.
B. Expose the Lambda function by using a Gateway Load Balancer.
C. Expose the Lambda function by using a Network Load Balancer.
D. Expose the Lambda function by using AWS Global Accelerator.
E. Expose the Lambda function by using Amazon API Gateway.
Show Answer
Correct Answer: A, E
Explanation: The simplest ways to expose an AWS Lambda function over HTTP are Lambda Function URLs and Amazon API Gateway. Lambda Function URLs provide a built-in HTTPS endpoint with minimal configuration. API Gateway is the standard service for building REST APIs and integrates directly with Lambda, including support through AWS SAM. Gateway Load Balancer is for transparent network appliance insertion, Network Load Balancer does not directly expose Lambda as a simple HTTP REST endpoint in this context, and Global Accelerator accelerates existing endpoints rather than exposing Lambda directly.
Question 170
A company used AWS to develop an application for customers. The application includes an Amazon API Gateway API that invokes AWS Lambda functions. The Lambda functions process data and store the data in Amazon DynamoDB tables.
The company must monitor the entire application to identify potential bottlenecks in the architecture that can negatively affect customers.
Which solution will meet this requirement with the LEAST development effort?
A. Instrument the application with AWS X-Ray. Inspect the service map to identify errors and issues.
B. Configure Lambda exceptions and additional logging to Amazon CloudWatch. Use CloudWatch Logs Insights to query the logs.
C. Configure API Gateway to log responses to Amazon CloudWatch. Create a metric filter for the TooManyRequestsException error message.
D. Use Amazon CloudWatch metrics for the DynamoDB tables to identify all the ProvisionedThroughputExceededException error messages.
Show Answer
Correct Answer: A
Explanation: AWS X-Ray provides end-to-end distributed tracing across API Gateway, Lambda, and DynamoDB, generating a service map that helps identify latency, errors, and bottlenecks across the entire serverless application with minimal development effort. The other options provide partial visibility (logs or metrics for individual services) rather than end-to-end tracing.
Question 171
A company is developing an application that will be accessed through the Amazon API Gateway REST API. Registered users should be the only ones who can access certain resources of this API. The token being used should expire automatically and needs to be refreshed periodically.
How can a developer meet these requirements?
A. Create an Amazon Cognito identity pool, configure the Amazon Cognito Authorizer in API Gateway, and use the temporary credentials generated by the identity pool.
B. Create and maintain a database record for each user with a corresponding token and use an AWS Lambda authorizer in API Gateway.
C. Create an Amazon Cognito user pool, configure the Cognito Authorizer in API Gateway, and use the identity or access token.
D. Create an IAM user for each API user, attach an invoke permissions policy to the API, and use an IAM authorizer in API Gateway.
Show Answer
Correct Answer: C
Explanation: Amazon Cognito User Pools provide user authentication and issue JWT ID and access tokens with built-in expiration. Clients can use refresh tokens to obtain new ID/access tokens without reauthentication. API Gateway REST APIs integrate directly with Cognito User Pool authorizers to validate these tokens and restrict access to registered users. Identity Pools are for obtaining temporary AWS credentials, not primary user authentication for API authorization; maintaining custom tokens in a database is unnecessary; creating IAM users for every end user is not an appropriate pattern.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.