A developer is building an application that consists of many AWS Lambda functions. The Lambda functions connect to a single Amazon RDS database.
The developer needs to implement a solution to store the database credentials securely. When the credentials are updated, the Lambda functions must be able to use the new credentials without requiring a code update or a configuration update.
Which solution will meet these requirements?
A. Store the credentials as a secret in AWS Secrets Manager. Access the secret at runtime from within the Lambda functions.
B. Store the credentials as a secret in AWS Secrets Manager. Access the credentials in environment variables by using the containerDefinitions and valueFrom elements in reference to the secret value.
C. Store the credentials as a SecureString parameter in AWS Systems Manager Parameter Store. Add a trigger to pass the credentials to the Lambda functions when the Lambda functions run.
D. Store the credentials as a SecureString parameter in AWS Systems Manager Parameter Store. Add a reference to the parameter in an environment variable in the Lambda functions.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is purpose-built for managing and rotating database credentials. By retrieving the secret at runtime inside each Lambda function, updated credentials are picked up automatically without any code or configuration changes. Environment variable–based approaches (Secrets Manager or Parameter Store) require a Lambda redeploy or restart to refresh values, which does not meet the requirement. Parameter Store is also more general-purpose and not ideal for automatic credential updates.
Question 12
A development team is designing a mobile app that requires multi-factor authentication.
Which steps should be taken to achieve this? (Choose two.)
A. Use Amazon Cognito to create a user pool and create users in the user pool.
B. Send multi-factor authentication text codes to users with the Amazon SNS Publish API call in the app code.
C. Enable multi-factor authentication for the Amazon Cognito user pool.
D. Use AWS IAM to create IAM users.
E. Enable multifactor authentication for the users created in AWS IAM.
Show Answer
Correct Answer: A, C
Explanation: Amazon Cognito user pools are designed for mobile and web app authentication. Creating users in a Cognito user pool provides managed user identities, and enabling MFA on the user pool enforces multi-factor authentication. Implementing MFA manually with SNS or using IAM users is not appropriate for end-user mobile app authentication.
Question 13
A company has an application that processes audio files for different departments. When audio files are saved to an Amazon S3 bucket, an AWS Lambda function receives an event notification and processes the audio input.
A developer needs to update the solution so that the application can process the audio files for each department independently. The application must publish the audio file location for each department to each department's existing Amazon Simple Queue Service (Amazon SQS) queue.
Which solution will meet these requirements with no changes to the Lambda function code?
A. Configure the S3 bucket to send the event notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe each department’s SQS queue to the SNS topic. Configure subscription filter policies.
B. Update the Lambda function to write the file location to a single shared SQS queue. Configure the shared SQS queue to send the file reference to each department’s SQS queue.
C. Update the Lambda function to send the file location to each department’s SQS queue.
D. Configure the S3 bucket to send the event notifications to each department’s SQS queue.
Show Answer
Correct Answer: A
Explanation: The requirement is to fan out S3 event notifications so each department’s existing SQS queue receives the audio file location, without changing the Lambda function code. Using Amazon SNS between S3 and SQS enables fan-out: S3 publishes events to an SNS topic, and each department’s SQS queue subscribes to the topic. Subscription filter policies can route messages per department. The other options require modifying the Lambda function or do not support flexible fan-out without code changes.
Question 14
A company stores data in an Amazon S3 bucket. The data is updated multiple times every day from an application that runs on a server in the company’s on-premises data center.
The company enables S3 Versioning on the S3 bucket. After some time, the company observes multiple versions of the same objects in the S3 bucket.
The company needs the S3 bucket to keep the current version of each object and the version immediately previous to the current version.
Which solution will meet these requirements?
A. Configure an S3 bucket policy to retain one newer noncurrent version of the objects.
B. Configure an S3 Lifecycle rule to retain one newer noncurrent version of the objects.
C. Enable S3 Object Lock. Configure an S3 Object Lock policy to retain one newer noncurrent version of the objects.
D. Suspend S3 Versioning. Modify the application code to check the number of object versions before updating the objects.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Versioning retains all object versions by default. To keep only the current version and the immediately previous version, the correct approach is to use an S3 Lifecycle rule that manages noncurrent versions. Lifecycle rules can be configured to delete older noncurrent versions while retaining a specified number (in this case, one) of the most recent noncurrent version. Bucket policies do not manage version retention, Object Lock is for compliance/WORM use cases, and suspending versioning or modifying the application does not properly control existing object versions.
Question 15
A developer has an application that runs in AWS Account A. The application must retrieve an AWS Secrets Manager secret that is encrypted by an AWS Key Management Service (AWS KMS) key from AWS Account B. The application’s role has permissions to access the secret in Account B.
The developer must add a statement to the KMS key’s key policy to allow the role in Account A to use the KMS key in Account B. The permissions must grant least privilege access to the role.
Which permissions will meet these requirements?
A. kms:Decrypt and kms:DescribeKey
B. secretsmanager:DescribeSecret and secretsmanager:GetSecretValue
C. kms:*
D. secretsmanager:*
Show Answer
Correct Answer: A
Explanation: To retrieve a secret encrypted with a KMS key in another account, the role must be allowed to use that KMS key. The minimum required KMS permissions for decrypting a Secrets Manager secret are kms:Decrypt (to decrypt the data key) and kms:DescribeKey (often required for key usage validation). Other options either reference the wrong service (Secrets Manager instead of KMS) or grant overly broad permissions, violating least privilege.
Question 16
A company is creating a new feature for existing software. Before the company fully releases a new version of the software, the company wants to test the feature.
The company needs to gather feedback about the feature from a small group of users while the current software version remains deployed. If the testing validates the feature, the company needs to deploy the new software version to all other users at the same time.
Which deployment strategy will meet these requirements?
A. All-at-once deployment
B. Canary deployment
C. In-place deployment
D. Linear deployment
Show Answer
Correct Answer: B
Explanation: A canary deployment releases the new feature to a small subset of users while the existing version remains in place for everyone else. This allows the company to gather real-user feedback and validate the feature. Once validated, the new version can be rolled out to all remaining users at the same time.
Question 17
A developer is working on a project that requires regular updates to a web application’s backend code. The code is stored in AWS CodeCommit. Company policy states that all code must have complete unit testing and that the test results must be available for access.
The developer needs to implement a solution that will take each change to the code repository, build the code, and run unit tests. The solution also must provide a detailed report of the test results.
Which solution will meet these requirements?
A. Configure AWS CodeDeploy to deploy code from CodeCommit and to run unit tests. Send the test results to Amazon CloudWatch metrics to view reports.
B. Configure Amazon CodeWhisperer to create the code and to run unit tests. Save the test results in an Amazon S3 bucket to generate reports.
C. Configure AWS CodeBuild to build the code and to run unit tests. Use test reporting in CodeBuild to generate and view reports.
D. Create AWS Lambda functions that run when changes are made in CodeCommit. Program the Lambda functions to build the code, run unit tests, and save the test results to a Lambda layer.
Show Answer
Correct Answer: C
Explanation: AWS CodeBuild is designed to compile source code, run unit tests, and produce build and test artifacts. It integrates directly with AWS CodeCommit to trigger builds on code changes and supports native test reporting, allowing detailed test results to be generated and viewed in the AWS Management Console. The other options do not provide a proper CI build-and-test workflow with accessible test reports.
Question 18
A developer is writing an application that will run on Amazon EC2 instances in an Auto Scaling group. The developer wants to externalize the session state to support the application.
Which AWS services or resources can the developer use to meet these requirements? (Choose two.)
A. Amazon DynamoDB
B. Amazon Cognito
C. Amazon ElastiCache
D. Application Load Balancer
E. Amazon Simple Queue Service (Amazon SQS)
Show Answer
Correct Answer: A, C
Explanation: To externalize session state for applications running on EC2 instances in an Auto Scaling group, the session data must be stored in a shared, scalable service. Amazon DynamoDB provides a fully managed, highly scalable key-value store suitable for persisting session data. Amazon ElastiCache (Redis or Memcached) provides low-latency, in-memory storage commonly used for session state. The other options do not provide appropriate shared session storage.
Question 19
A company is using the AWS Serverless Application Model (AWS SAM) to develop a social media application. A developer needs a quick way to test AWS Lambda functions locally by using test event payloads. The developer needs the structure of these test event payloads to match the actual events that AWS services create.
Which solution will meet these requirements with the LEAST development effort?
A. Create shareable test Lambda events. Use these test Lambda events for local testing.
B. Store manually created test event payloads locally. Use the sam local invoke command with the file path to the payloads.
C. Store manually created test event payloads in an Amazon S3 bucket. Use the sam local invoke command with the S3 path to the payloads.
D. Use the sam local generate-event command to create test payloads for local testing.
Show Answer
Correct Answer: D
Explanation: AWS SAM provides the `sam local generate-event` command to quickly generate test event payloads that accurately match the structure of events produced by AWS services (such as S3, API Gateway, or SNS). This requires minimal effort compared to manually creating or managing payload files and is designed specifically for local Lambda testing.
Question 20
A company stores customer credit reports in an Amazon S3 bucket. An analytics service uses standard Amazon S3 GET requests to access the reports.
A developer must implement a solution to redact personally identifiable information (PII) from the reports before the reports reach the analytics service.
Which solution will meet this requirement with the MOST operational efficiency?
A. Load the S3 objects into Amazon Redshift by using a COPY command. Implement dynamic data masking. Refactor the analytics service to read from Amazon Redshift.
B. Set up an S3 Object Lambda function. Attach the function to an S3 Object Lambda Access Point. Program the function to call a PII redaction API.
C. Use AWS Key Management Service (AWS KMS) to implement encryption in the S3 bucket. Re-upload all the existing S3 objects. Give the kms:Decrypt permission to the analytics service.
D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Implement message data protection. Refactor the analytics service to publish data access requests to the SNS topic.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Object Lambda allows interception of standard S3 GET requests and transformation of object data on the fly before it is returned to the caller. By attaching a Lambda function that redacts PII, the analytics service can continue using S3 GET without refactoring or data duplication, providing the most operationally efficient solution.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.