A developer is building an application that consists of many AWS Lambda functions. The Lambda functions connect to a single Amazon RDS database.
The developer needs to implement a solution to store the database credentials securely. When the credentials are updated, the Lambda functions must be able to use the new credentials without requiring a code update or a configuration update.
Which solution will meet these requirements?
A. Store the credentials as a secret in AWS Secrets Manager. Access the secret at runtime from within the Lambda functions.
B. Store the credentials as a secret in AWS Secrets Manager. Access the credentials in environment variables by using the containerDefinitions and valueFrom elements in reference to the secret value.
C. Store the credentials as a SecureString parameter in AWS Systems Manager Parameter Store. Add a trigger to pass the credentials to the Lambda functions when the Lambda functions run.
D. Store the credentials as a SecureString parameter in AWS Systems Manager Parameter Store. Add a reference to the parameter in an environment variable in the Lambda functions.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is purpose-built for storing and rotating database credentials. If each Lambda function retrieves the secret at runtime using the Secrets Manager API, updated credentials are used automatically without changing Lambda code or configuration. Environment variables that reference secrets or parameters are not dynamically refreshed, and Parameter Store is not the best fit for automatic credential rotation.
Question 12
A development team is designing a mobile app that requires multi-factor authentication.
Which steps should be taken to achieve this? (Choose two.)
A. Use Amazon Cognito to create a user pool and create users in the user pool.
B. Send multi-factor authentication text codes to users with the Amazon SNS Publish API call in the app code.
C. Enable multi-factor authentication for the Amazon Cognito user pool.
D. Use AWS IAM to create IAM users.
E. Enable multifactor authentication for the users created in AWS IAM.
Show Answer
Correct Answer: A, C
Explanation: For a mobile application, Amazon Cognito User Pools provide user authentication and built-in MFA support. Create and manage application users in a Cognito User Pool, then enable MFA on that user pool. Sending SMS codes manually through Amazon SNS is not the recommended approach because Cognito manages MFA workflows. AWS IAM users and IAM MFA are intended for AWS account access, not end-user authentication in mobile apps.
Question 13
A company has an application that processes audio files for different departments. When audio files are saved to an Amazon S3 bucket, an AWS Lambda function receives an event notification and processes the audio input.
A developer needs to update the solution so that the application can process the audio files for each department independently. The application must publish the audio file location for each department to each department's existing Amazon Simple Queue Service (Amazon SQS) queue.
Which solution will meet these requirements with no changes to the Lambda function code?
A. Configure the S3 bucket to send the event notifications to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe each department’s SQS queue to the SNS topic. Configure subscription filter policies.
B. Update the Lambda function to write the file location to a single shared SQS queue. Configure the shared SQS queue to send the file reference to each department’s SQS queue.
C. Update the Lambda function to send the file location to each department’s SQS queue.
D. Configure the S3 bucket to send the event notifications to each department’s SQS queue.
Show Answer
Correct Answer: A
Explanation: Using Amazon SNS as the S3 event destination enables fan-out to multiple existing SQS queues without modifying the Lambda code. Each department's SQS queue subscribes to the SNS topic, and subscription filter policies can route only the relevant notifications to each department. The other options either require Lambda code changes or do not provide scalable fan-out/routing.
Question 14
A company stores data in an Amazon S3 bucket. The data is updated multiple times every day from an application that runs on a server in the company’s on-premises data center.
The company enables S3 Versioning on the S3 bucket. After some time, the company observes multiple versions of the same objects in the S3 bucket.
The company needs the S3 bucket to keep the current version of each object and the version immediately previous to the current version.
Which solution will meet these requirements?
A. Configure an S3 bucket policy to retain one newer noncurrent version of the objects.
B. Configure an S3 Lifecycle rule to retain one newer noncurrent version of the objects.
C. Enable S3 Object Lock. Configure an S3 Object Lock policy to retain one newer noncurrent version of the objects.
D. Suspend S3 Versioning. Modify the application code to check the number of object versions before updating the objects.
Show Answer
Correct Answer: B
Explanation: An Amazon S3 Lifecycle rule can manage noncurrent object versions in a versioned bucket. Configure the lifecycle rule to retain only one newer noncurrent version (using the NewerNoncurrentVersions setting) and expire older noncurrent versions. Bucket policies control access, not version retention. Object Lock is for WORM retention and legal holds, not limiting version count. Suspending versioning does not manage existing versions and would not meet the requirement.
Question 15
A developer has an application that runs in AWS Account A. The application must retrieve an AWS Secrets Manager secret that is encrypted by an AWS Key Management Service (AWS KMS) key from AWS Account B. The application’s role has permissions to access the secret in Account B.
The developer must add a statement to the KMS key’s key policy to allow the role in Account A to use the KMS key in Account B. The permissions must grant least privilege access to the role.
Which permissions will meet these requirements?
A. kms:Decrypt and kms:DescribeKey
B. secretsmanager:DescribeSecret and secretsmanager:GetSecretValue
C. kms:*
D. secretsmanager:*
Show Answer
Correct Answer: A
Explanation: To allow a principal in Account A to use a KMS key in Account B for decrypting a Secrets Manager secret, the KMS key policy must grant the minimum KMS permissions required. Retrieving the secret requires the KMS key to decrypt the encrypted secret value, and DescribeKey is commonly included so the principal can obtain key metadata. Secrets Manager permissions belong on the IAM policy for the role or resource policy for the secret, not on the KMS key policy. Granting kms:* is broader than necessary and violates least privilege.
Question 16
A company is creating a new feature for existing software. Before the company fully releases a new version of the software, the company wants to test the feature.
The company needs to gather feedback about the feature from a small group of users while the current software version remains deployed. If the testing validates the feature, the company needs to deploy the new software version to all other users at the same time.
Which deployment strategy will meet these requirements?
A. All-at-once deployment
B. Canary deployment
C. In-place deployment
D. Linear deployment
Show Answer
Correct Answer: B
Explanation: A canary deployment releases the new version to a small subset of users while the existing version remains available for everyone else. After validating the feature with feedback from that group, the deployment can be promoted to all remaining users. All-at-once deploys to everyone immediately, in-place describes the update method rather than staged exposure, and linear deployment rolls out incrementally to increasingly larger groups rather than switching all remaining users at once after validation.
Question 17
A developer is working on a project that requires regular updates to a web application’s backend code. The code is stored in AWS CodeCommit. Company policy states that all code must have complete unit testing and that the test results must be available for access.
The developer needs to implement a solution that will take each change to the code repository, build the code, and run unit tests. The solution also must provide a detailed report of the test results.
Which solution will meet these requirements?
A. Configure AWS CodeDeploy to deploy code from CodeCommit and to run unit tests. Send the test results to Amazon CloudWatch metrics to view reports.
B. Configure Amazon CodeWhisperer to create the code and to run unit tests. Save the test results in an Amazon S3 bucket to generate reports.
C. Configure AWS CodeBuild to build the code and to run unit tests. Use test reporting in CodeBuild to generate and view reports.
D. Create AWS Lambda functions that run when changes are made in CodeCommit. Program the Lambda functions to build the code, run unit tests, and save the test results to a Lambda layer.
Show Answer
Correct Answer: C
Explanation: AWS CodeBuild integrates with CodeCommit to automatically build source code and run unit tests. CodeBuild supports test reporting, allowing developers to publish, view, and retain detailed test reports in the AWS Management Console. CodeDeploy is for deployments rather than building/testing, CodeWhisperer is an AI coding assistant, and Lambda with custom build logic is unnecessary and does not provide the required reporting features.
Question 18
A developer is writing an application that will run on Amazon EC2 instances in an Auto Scaling group. The developer wants to externalize the session state to support the application.
Which AWS services or resources can the developer use to meet these requirements? (Choose two.)
A. Amazon DynamoDB
B. Amazon Cognito
C. Amazon ElastiCache
D. Application Load Balancer
E. Amazon Simple Queue Service (Amazon SQS)
Show Answer
Correct Answer: A, C
Explanation: Externalizing session state for stateless EC2 instances in an Auto Scaling group is commonly done by storing session data in a shared data store. Amazon DynamoDB provides a highly scalable, durable key-value store suitable for session data, and Amazon ElastiCache (Redis or Memcached) provides low-latency in-memory storage that is widely used for session management. Cognito handles user identity rather than application session storage, an Application Load Balancer does not externalize session state, and Amazon SQS is a messaging service, not a session store.
Question 19
A company is using the AWS Serverless Application Model (AWS SAM) to develop a social media application. A developer needs a quick way to test AWS Lambda functions locally by using test event payloads. The developer needs the structure of these test event payloads to match the actual events that AWS services create.
Which solution will meet these requirements with the LEAST development effort?
A. Create shareable test Lambda events. Use these test Lambda events for local testing.
B. Store manually created test event payloads locally. Use the sam local invoke command with the file path to the payloads.
C. Store manually created test event payloads in an Amazon S3 bucket. Use the sam local invoke command with the S3 path to the payloads.
D. Use the sam local generate-event command to create test payloads for local testing.
Show Answer
Correct Answer: D
Explanation: The AWS SAM CLI includes the `sam local generate-event` command, which generates sample event payloads that match the structure of events produced by supported AWS services. These generated payloads can be used directly with local Lambda testing, providing the least development effort compared to manually creating and maintaining event JSON.
Question 20
A company stores customer credit reports in an Amazon S3 bucket. An analytics service uses standard Amazon S3 GET requests to access the reports.
A developer must implement a solution to redact personally identifiable information (PII) from the reports before the reports reach the analytics service.
Which solution will meet this requirement with the MOST operational efficiency?
A. Load the S3 objects into Amazon Redshift by using a COPY command. Implement dynamic data masking. Refactor the analytics service to read from Amazon Redshift.
B. Set up an S3 Object Lambda function. Attach the function to an S3 Object Lambda Access Point. Program the function to call a PII redaction API.
C. Use AWS Key Management Service (AWS KMS) to implement encryption in the S3 bucket. Re-upload all the existing S3 objects. Give the kms:Decrypt permission to the analytics service.
D. Create an Amazon Simple Notification Service (Amazon SNS) topic. Implement message data protection. Refactor the analytics service to publish data access requests to the SNS topic.
Show Answer
Correct Answer: B
Explanation: Amazon S3 Object Lambda can intercept standard S3 GET requests through an S3 Object Lambda Access Point and invoke a Lambda function to transform object data before it is returned. The Lambda function can call a PII redaction service or API, allowing the analytics service to continue using GET requests while receiving redacted content. The other options require significant application refactoring or do not perform PII redaction.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.