A company has an ecommerce platform. A developer is designing an Amazon DynamoDB table to store customer order data for the platform. The table uses the order ID as the partition key.
The developer needs to modify the table to get all order IDs that are associated with a given customer email address in a single query. The solution must give the developer the ability to query order IDs by other item attributes in the future.
Which solution will meet these requirements?
A. Configure the partition key to use the customer email address as the sort key.
B. Update the table to use the customer email address as the partition key.
C. Create a local secondary index (LSI) with the customer email address as the sort key.
D. Create a global secondary index (GSI) with the customer email address as the partition key.
Show Answer
Correct Answer: D
Explanation: A global secondary index (GSI) allows a different partition key than the base table. Keeping the base table partition key as order ID preserves efficient order lookups, while a GSI with customer email as the partition key enables querying all orders for a customer in a single query. GSIs also support adding additional indexes later for other access patterns.
Question 4
Given the following AWS CloudFormation template:
What is the MOST efficient way to reference the new Amazon S3 bucket from another AWS CloudFormation template?
A. Add an Export declaration to the Outputs section of the original template and use ImportValue in other templates.
B. Add Exported: true to the Content.Bucket in the original template and use ImportResource in other templates.
C. Create a custom AWS CloudFormation resource that gets the bucket name from the ContentBucket resource of the first stack.
D. Use Fn::Include to include the existing template in other templates and use the ContentBucket resource directly.
Show Answer
Correct Answer: A
Explanation: Export the bucket name from the original stack’s Outputs section, then reference it in another stack with Fn::ImportValue. This is CloudFormation’s standard cross-stack reference mechanism.
Question 5
A developer built an application that uses AWS Lambda functions to process images. The developer wants to improve image processing times throughout the day.
The developer needs to create an Amazon CloudWatch Logs Insights query that shows the average, slowest, and fastest processing time in 1-minute intervals.
Which query will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: AWS Lambda writes REPORT log entries that include the Duration metric. A CloudWatch Logs Insights query that filters for REPORT lines, parses the Duration value, and aggregates with avg(duration), min(duration), and max(duration) using bin(1m) provides the average, fastest, and slowest processing times in 1-minute intervals.
Question 5
A developer is designing a serverless application that customers use to select seats for a concert venue. Customers send the ticket requests to an Amazon API Gateway API with an AWS Lambda function that acknowledges the order and generates an order ID. The application includes two additional Lambda functions: one for inventory management and one for payment processing. These two Lambda functions run in parallel and write the order to an Amazon Dynamo DB table.
The application must provide seats to customers according to the following requirements. If a seat is accidently sold more than once, the first order that the application received must get the seat. In these cases, the application must process the payment for only the first order. However, if the first order is rejected during payment processing, the second order must get the seat. In these cases, the application must process the payment for the second order.
Which solution will meet these requirements?
A. Send the order ID to an Amazon Simple Notification Service (Amazon SNS) FIFO topic that fans out to one Amazon Simple Queue Service (Amazon SQS) FIFO queue for inventory management and another SQS FIFO queue for payment processing.
B. Change the Lambda function that generates the order ID to initiate the Lambda function for inventory management. Then initiate the Lambda function for payment processing.
C. Send the order ID to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda functions for inventory management and payment processing to the topic.
D. Deliver the order ID to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda functions for inventory management and payment processing to poll the queue.
Show Answer
Correct Answer: A
Explanation: An SNS FIFO topic can fan each order out to separate SQS FIFO queues while preserving message order within the relevant message group. This lets inventory and payment processing handle requests in order, unlike a standard SNS topic or a shared SQS queue with competing consumers. The processing logic must use the DynamoDB order state to charge only the order that currently holds the seat and allow the next order to proceed if payment is rejected.
Question 5
A developer accesses AWS CodeCommit over SSH. The SSH keys configured to access AWS CodeCommit are tied to a user with the following permissions:
The developer needs to create/delete branches.
Which specific IAM permissions need to be added, based on the principle of least privilege?
A. "codecommit:CreateBranch" "codecommit:DeleteBranch"
B. "codecommit:Put*"
C. "codecommit:Update*"
D. "codecommit:*"
Show Answer
Correct Answer: A
Explanation: Add only `codecommit:CreateBranch` and `codecommit:DeleteBranch` to the IAM policy. These actions allow creating and deleting branches without granting broader CodeCommit permissions.
Question 6
A developer is building an application that stores sensitive user data. The application includes an Amazon CloudFront distribution and multiple AWS Lambda functions that handle user requests.
The user requests contain over 20 data fields. Each application transaction contains sensitive data that must be encrypted. Only specific parts of the application need to have the ability to decrypt the data.
Which solution will meet these requirements?
A. Associate the CloudFront distribution with a Lambda@Edge function. Configure the function to perform field-level asymmetric encryption by using a user-defined RSA public key that is stored in AWS Key Management Service (AWS KMS).
B. Integrate AWS WAF with CloudFront to protect the sensitive data. Use a Lambda function and self-managed keys to perform the encryption and decryption processes.
C. Configure the CloudFront distribution to use WebSockets by forwarding all viewer request headers to the origin. Create an asymmetric AWS KMS key. Configure the CloudFront distribution to use field-level encryption. Use the AWS KMS key.
D. Configure the cache behavior in the CloudFront distribution to require HTTPS for communication between viewers and CloudFront. Configure GoudFront to require users to access the files by using either signed URLs or signed cookies.
Show Answer
Correct Answer: A
Explanation: CloudFront field-level encryption is designed to encrypt sensitive fields at the edge so that only components with the corresponding private key can decrypt them. CloudFront uses uploaded RSA public keys for field-level encryption, not AWS KMS asymmetric keys directly. Option C is incorrect because CloudFront field-level encryption does not integrate directly with KMS asymmetric keys. Options B and D do not satisfy the requirement for selective field encryption and restricted decryption capability.
Question 6
A company uses AWS Lambda functions and an Amazon S3 trigger to process images into an S3 bucket. A development team set up multiple environments in a single AWS account.
After a recent production deployment, the development team observed that the development S3 buckets invoked the production environment Lambda functions. These invocations caused unwanted execution of development S3 files by using production Lambda functions. The development team must prevent these invocations. The team must follow security best practices.
Which solution will meet these requirements?
A. Update the Lambda execution role for the production Lambda function to add a policy that allows the execution role to read from only the production environment S3 bucket.
B. Move the development and production environments into separate AWS accounts. Add a resource policy to each Lambda function to allow only S3 buckets that are within the same account to invoke the function.
C. Add a resource policy to the production Lambda function to allow only the production environment S3 bucket to invoke the function.
D. Move the development and production environments into separate AWS accounts. Update the Lambda execution role for each function to add a policy that allows the execution role to read from the S3 bucket that is within the same account.
Show Answer
Correct Answer: B
Explanation: Separate development and production into different AWS accounts to create a stronger isolation boundary, which is a security best practice for distinct environments. Then configure each Lambda function’s resource-based policy to allow invocation only by S3 buckets in its own account. The Lambda execution role controls what the function can access after it runs; it does not control which S3 bucket can invoke it.
Question 6
A developer is troubleshooting an application that uses Amazon DynamoDB in the us-west-2 Region. The application is deployed to an Amazon EC2 instance. The application requires read-only permissions to a table that is named Cars. The EC2 instance has an attached IAM role that contains the following IAM policy:
When the application tries to read from the Cars table, an Access Denied error occurs.
How can the developer resolve this error?
A. Modify the IAM policy resource to be “arn:aws:dynamodb:us-west-2:account-id:table/*”.
B. Modify the IAM policy to include the dynamodb:* action.
C. Create a trust policy that specifies the EC2 service principal. Associate the role with the policy.
D. Create a trust relationship between the role and dynamodb.amazonaws.com.
Show Answer
Correct Answer: C
Explanation: The policy already grants read operations on the Cars table ARN. The role must also trust the EC2 service principal (`ec2.amazonaws.com`) so EC2 can assume it and provide its credentials to the application. A trust policy is separate from the permissions policy shown.
Question 7
A developer has written the following IAM policy to provide access to an Amazon S3 bucket:
Which access does the policy allow regarding the s3:GetObject and s3:PutObject actions?
A. Access on all buckets except the “DOC-EXAMPLE-BUCKET” bucket
B. Access on all buckets that start with “DOC-EXAMPLE-BUCKET” except the “DOC-EXAMPLE-BUCKET/secrets” bucket
C. Access on all objects in the “DOC-EXAMPLE-BUCKET” bucket along with access to all S3 actions for objects in the “DOC-EXAMPLE-BUCKET” bucket that start with “secrets”
D. Access on all objects in the “DOC-EXAMPLE-BUCKET” bucket except on objects that start with “secrets”
Show Answer
Correct Answer: D
Explanation: The policy allows `s3:GetObject` and `s3:PutObject` on objects in `DOC-EXAMPLE-BUCKET`. Its explicit `Deny` applies to all S3 actions on object keys beginning with `secrets`, overriding the allow for those objects.
Question 7
A developer is designing an event-driven architecture. An AWS Lambda function that processes data needs to push processed data to a subset of four consumer Lambda functions. The data must be routed based on the value of one field in the data.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue and event source mapping for each consumer Lambda function. Add message routing logic to the data-processing Lambda function.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add message filtering logic to each consumer Lambda function. Subscribe the data-processing Lambda function to the SNS topic.
C. Create a separate Amazon Simple Notification Service (Amazon SNS) topic and subscription for each consumer Lambda function. Add message routing logic to the data-processing Lambda function to publish to the appropriate topic.
D. Create a single Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add SNS subscription filter policies to each subscription. Configure the data-processing Lambda function to publish to the topic.
Show Answer
Correct Answer: D
Explanation: A single Amazon SNS topic with subscription filter policies routes messages to only the relevant Lambda subscribers based on message attributes. This keeps routing logic out of the producer and consumers, minimizes operational overhead, and uses managed SNS filtering. Options A and C require custom routing logic in the producer, while B delivers all messages to all consumers and requires each consumer to filter.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
