A company has a web application that is hosted on AWS. The application is behind an Amazon CloudFront distribution. A developer needs a dashboard to monitor error rates and anomalies of the CloudFront distribution as frequently as possible.
Which combination of steps should the developer take to meet these requirements? (Choose two.)
A. Stream the CloudFront distribution logs to an Amazon S3 bucket. Detect anomalies and error rates by using Amazon Athena.
B. Enable real-time logs on the CloudFront distribution. Create a data stream in Amazon Kinesis Data Streams.
C. Set up Amazon Kinesis Data Streams to send the logs to Amazon OpenSearch Service by using an AWS Lambda function. Make a dashboard in OpenSearch Dashboards.
D. Stream the CloudFront distribution logs to Amazon Kinesis Data Firehose.
E. Set up Amazon Kinesis Data Firehose to send the logs to AWS CloudTrail. Create CloudTrail metrics, alarms, and dashboards.
Show Answer
Correct Answer: B, C
Explanation: To monitor CloudFront error rates and anomalies as frequently as possible, use CloudFront real-time logs, which are delivered through Amazon Kinesis Data Streams. Then ingest the streaming data into Amazon OpenSearch Service (commonly via AWS Lambda from Kinesis Data Streams) and build dashboards in OpenSearch Dashboards for near real-time visualization and anomaly detection. S3/Athena is batch-oriented rather than real-time, Firehose is not the delivery target for CloudFront real-time logs, and CloudTrail is unrelated to log analytics dashboards.
Question 193
A developer received the following error message during an AWS CloudFormation deployment:
DELETE_FAILED (The following resource(s) failed to delete: [ASGInstanceRole12345678].)
Which action should the developer take to resolve this error?
A. Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
B. Add a DependsOn attribute to the ASGInstanceRole12345678 resource in the CloudFormation template. Then delete the stack.
C. Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource after deployment.
D. Add a force parameter when calling CloudFormation with the role-arn of ASGInstanceRole12345678.
Show Answer
Correct Answer: C
Explanation: A DELETE_FAILED on an IAM role commonly occurs because the role is still associated with an instance profile or has attached policies, preventing CloudFormation from deleting it. Configuring the resource to be retained allows the stack operation to complete, after which the IAM role and its dependencies can be cleaned up and deleted manually. The other options are not valid CloudFormation remediation steps: there is no force parameter for this purpose, DependsOn does not solve deletion dependency issues of external attachments, and contacting AWS Support is not the appropriate first action.
Question 194
A company has a development team that uses AWS CodeCommit for version control. The development team has CodeCommit repositories in multiple AWS accounts. The team is expanding to include developers who work in various locations.
The company must ensure that the developers have secure access to the repositories.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Configure IAM roles for each developer and grant access individually.
B. Configure permission sets in AWS IAM Identity Center to grant access to the accounts.
C. Share AWS access keys with the development team for direct repository access.
D. Use public SSH keys for authentication to the CodeCommit repositories.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center provides centralized identity and access management across multiple AWS accounts by using permission sets, making it the most operationally efficient solution for managing developer access to CodeCommit repositories across accounts. Individual IAM roles do not scale well, sharing access keys is insecure, and SSH keys alone do not provide centralized authorization across multiple AWS accounts.
Question 195
A developer has a continuous integration and continuous delivery (CI/CD) pipeline that uses AWS CodeArtifact and AWS CodeBuild. The build artifacts are between 0.5 GB and 1.5 GB in size. The builds happen frequently and retrieve many dependencies from CodeArtifact each time.
The builds have been slow because of the time it takes to transfer dependencies. The developer needs to improve build performance by reducing the number of dependencies that are retrieved for each build.
Which solution will meet this requirement?
A. Specify an Amazon S3 cache in CodeBuild. Add the S3 cache folder path to the buildspec.yaml file for the build project.
B. Specify a local cache in CodeBuild. Add the CodeArtifact repository name to the buildspec.yaml file for the build project.
C. Specify a local cache in CodeBuild. Add the cache folder path to the buildspec.yaml file for the build project.
D. Retrieve the buildspec.yaml file directly from CodeArtifact. Add the CodeArtifact repository name to the buildspec.yaml file for the build project.
Show Answer
Correct Answer: C
Explanation: Use CodeBuild local caching with cache paths defined in buildspec.yaml to cache downloaded package dependencies (for example, Maven, npm, pip, Gradle caches). This reduces repeated downloads from CodeArtifact and improves build performance. Adding the repository name is not how CodeBuild caching is configured. S3 caching is slower than local caching for frequently reused dependencies because local cache resides on the build host.
Question 196
A company runs a critical application on Amazon Elastic Container Service (Amazon ECS) by using Amazon EC2 instances. The company needs to migrate the application to Amazon ECS on AWS Fargate. A developer is configuring Fargate and the ECS capacity providers to make the change.
Which solution will meet these requirements with the LEAST downtime during migration?
A. Use the PutClusterCapacityProviders API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
B. Use the CreateCapacityProvider API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
C. Use the PutClusterCapacityProviders API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE_SPOT as Provider 1 with a base value. Use FARGATE as Provider 2 for failover.
D. Use the CreateCapacityProvider API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE_SPOT as Provider 1 with a base value. Use FARGATE as Provider 2 for failover.
Show Answer
Correct Answer: A
Explanation: FARGATE and FARGATE_SPOT are AWS-managed capacity providers, so you associate them with a cluster by using PutClusterCapacityProviders, not CreateCapacityProvider (which is for creating custom capacity providers backed by Auto Scaling groups). For a critical application with the least migration downtime, FARGATE should be the primary provider (using a base value to guarantee tasks run on standard Fargate), while FARGATE_SPOT can receive additional tasks but is not suitable as the primary provider because Spot capacity can be interrupted.
Question 197
A company has a serverless application that uses Amazon API Gateway backed by AWS Lambda proxy integration. The company is developing several backend APIs. The company needs a landing page to provide an overview of navigation to the APIs.
A developer creates a new/LandingPage resource and a new GET method that uses mock integration.
What should the developer do next to meet these requirements?
A. Configure the integration request mapping template with Content-Type of text/html and statusCode of 200. Configure the integration response mapping template with Content-Type of application/json. In the integration response mapping template, include the LandingPage HTML code that references the APIs.
B. Configure the integration request mapping template with Content-Type of application/json. In the integration request mapping template, include the LandingPage HMTL code that references the APIs. Configure the integration response mapping template with Content-Type of text/html and statusCode of 200.
C. Configure the integration request mapping template with Content-Type of application/json and statusCode of 200. Configure the integration response mapping template with Content-Type of text/html. In the integration response mapping template, include the LandingPage HTML code that references the APIs.
D. Configure the integration request mapping template with Content-Type of text/html. In the integration request mapping template, include the LandingPage HTML code that references the APIs. Configure the integration response mapping template with Content-Type of application/json and statusCode of 200.
Show Answer
Correct Answer: C
Explanation: For an API Gateway mock integration, the integration request mapping template supplies a mock payload such as {"statusCode":200}. The HTML content is generated in the integration response mapping template, which should return Content-Type: text/html so the browser renders the landing page. Therefore the request uses application/json with statusCode 200, and the response mapping contains the HTML.
Question 198
A developer has an application that uses an Amazon DynamoDB table with a configured local secondary index (LSI). During application testing, the DynamoDB table metrics report a ProvisionedThroughputExceededException error message. The number of requests made by the test suite did not exceed the table's provisioned capacity limits.
What is the cause of this issue?
A. The data in the table's partition key column is not evenly distributed.
B. The LSI's capacity is different from the table's capacity.
C. The application is not implementing exponential backoff retry logic while interacting with the DynamoDB API.
D. The application has the IAM permission to query the DynamoDB table but not to query the LSI.
Show Answer
Correct Answer: A
Explanation: A ProvisionedThroughputExceededException can occur even when total table provisioned capacity is not exceeded if requests are concentrated on a small number of partitions. With an LSI, reads and writes still consume the base table's partition throughput because LSIs share the table's provisioned capacity. Uneven partition key distribution creates hot partitions that throttle independently of overall table capacity.
Question 199
A company uses AWS CloudFormation templates to manage infrastructure for a public-facing application in its development, pre-production, and production environments. The company needs to scale for increasing customer demand. A developer must upgrade the Amazon RDS DB instance type to a larger instance.
The developer deploys an update to the CloudFormation stack with the instance size change in the pre-production environment. The developer notices that the stack is in an UPDATE_ROLLBACK_FAILED slate in CloudFormation.
Which option is the cause of this issue?
A. The new instance type specified in the CloudFormation template is invalid
B. The database was deleted or modified manually outside of the CloudFormation stack
C. There is a syntax error in the CloudFormation template
D. The developer has insufficient IAM permissions to provision an instance of the specified type
Show Answer
Correct Answer: B
Explanation: An UPDATE_ROLLBACK_FAILED state occurs when a stack update fails and CloudFormation is unable to successfully roll back to the previous state. A common cause is that a managed resource was deleted or modified outside CloudFormation, preventing rollback. An invalid instance type, template syntax error, or insufficient IAM permissions would typically cause the update to fail, but would not by themselves specifically explain a rollback failure unless the previous resource state could not be restored.
Question 200
A company has a monolithic desktop-based application that processes images. A developer is converting the application into an AWS Lambda function by using Python. Currently, the desktop application runs every 5 minutes to process the latest image from an Amazon S3 bucket. The desktop application completes the image processing task within 1 minute.
During testing on AWS, the developer notices that the Lambda function runs at the specified 5-minute interval. However, the Lambda function takes more than 2 minutes to complete the image processing task. The developer needs a solution that will improve the Lambda function's performance.
Which solution will meet this requirement?
A. Update the instance type of the Lambda function to a compute optimized instance with at least eight virtual CPU (vCPU).
B. Update the configuration of the Lambda function to use the latest Python runtime.
C. Increase the memory that is allocated to the Lambda function.
D. Configure a reserved concurrency on the Lambda function.
Show Answer
Correct Answer: C
Explanation: AWS Lambda allocates CPU power proportionally to the configured memory. Increasing the function's memory increases the available CPU, which commonly reduces execution time for CPU-intensive workloads such as image processing. Lambda does not use selectable EC2 instance types, updating the Python runtime alone is unlikely to provide the required performance improvement, and reserved concurrency affects scaling rather than the speed of a single invocation.
Question 201
A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS.
Which approach should the company take to allow the application to interact with Amazon S3?
A. Create an IAM role that has administrative access to AWS. Attach the role to the EC2 instance.
B. Create an IAM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
C. Create an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.
D. Create an IAM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
Show Answer
Correct Answer: C
Explanation: Use an IAM role attached to the EC2 instance with only the permissions required to access the specific S3 bucket or objects. This follows AWS security best practices by using temporary credentials provided through the instance metadata service and the principle of least privilege. Avoid embedding long-term access keys in application code, and avoid granting unnecessary administrative permissions.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.