A company has a web application that is hosted on AWS. The application is behind an Amazon CloudFront distribution. A developer needs a dashboard to monitor error rates and anomalies of the CloudFront distribution as frequently as possible.
Which combination of steps should the developer take to meet these requirements? (Choose two.)
A. Stream the CloudFront distribution logs to an Amazon S3 bucket. Detect anomalies and error rates by using Amazon Athena.
B. Enable real-time logs on the CloudFront distribution. Create a data stream in Amazon Kinesis Data Streams.
C. Set up Amazon Kinesis Data Streams to send the logs to Amazon OpenSearch Service by using an AWS Lambda function. Make a dashboard in OpenSearch Dashboards.
D. Stream the CloudFront distribution logs to Amazon Kinesis Data Firehose.
E. Set up Amazon Kinesis Data Firehose to send the logs to AWS CloudTrail. Create CloudTrail metrics, alarms, and dashboards.
Show Answer
Correct Answer: B, C
Explanation: To monitor CloudFront error rates and anomalies as frequently as possible, the solution must use near–real-time data and support live dashboards. Enabling CloudFront real-time logs streams request data with low latency into Amazon Kinesis Data Streams (B). From there, sending the stream to Amazon OpenSearch Service (for example via Lambda or OpenSearch ingestion) allows indexing and near–real-time visualization in OpenSearch Dashboards (C). Other options rely on standard logs or batch processing, which introduce delays and are not suitable for frequent, real-time monitoring.
Question 193
A developer received the following error message during an AWS CloudFormation deployment:
DELETE_FAILED (The following resource(s) failed to delete: [ASGInstanceRole12345678].)
Which action should the developer take to resolve this error?
A. Contact AWS Support to report an issue with the Auto Scaling Groups (ASG) service.
B. Add a DependsOn attribute to the ASGInstanceRole12345678 resource in the CloudFormation template. Then delete the stack.
C. Modify the CloudFormation template to retain the ASGInstanceRole12345678 resource. Then manually delete the resource after deployment.
D. Add a force parameter when calling CloudFormation with the role-arn of ASGInstanceRole12345678.
Show Answer
Correct Answer: C
Explanation: The DELETE_FAILED error commonly occurs when an IAM role cannot be deleted because it is still associated with instance profiles or other resources (such as an Auto Scaling Group). CloudFormation cannot force-delete such IAM resources. By modifying the template to retain the ASGInstanceRole12345678 resource, the stack deletion can complete. The developer can then manually remove any attached instance profiles or policies and delete the IAM role safely afterward.
Question 194
A company has a development team that uses AWS CodeCommit for version control. The development team has CodeCommit repositories in multiple AWS accounts. The team is expanding to include developers who work in various locations.
The company must ensure that the developers have secure access to the repositories.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Configure IAM roles for each developer and grant access individually.
B. Configure permission sets in AWS IAM Identity Center to grant access to the accounts.
C. Share AWS access keys with the development team for direct repository access.
D. Use public SSH keys for authentication to the CodeCommit repositories.
Show Answer
Correct Answer: B
Explanation: AWS IAM Identity Center (formerly AWS SSO) provides centralized, scalable identity and access management across multiple AWS accounts. Using permission sets allows the company to manage developer access to CodeCommit repositories efficiently as the team grows and spans locations, without per-user IAM role management or insecure key sharing.
Question 195
A developer has a continuous integration and continuous delivery (CI/CD) pipeline that uses AWS CodeArtifact and AWS CodeBuild. The build artifacts are between 0.5 GB and 1.5 GB in size. The builds happen frequently and retrieve many dependencies from CodeArtifact each time.
The builds have been slow because of the time it takes to transfer dependencies. The developer needs to improve build performance by reducing the number of dependencies that are retrieved for each build.
Which solution will meet this requirement?
A. Specify an Amazon S3 cache in CodeBuild. Add the S3 cache folder path to the buildspec.yaml file for the build project.
B. Specify a local cache in CodeBuild. Add the CodeArtifact repository name to the buildspec.yaml file for the build project.
C. Specify a local cache in CodeBuild. Add the cache folder path to the buildspec.yaml file for the build project.
D. Retrieve the buildspec.yaml file directly from CodeArtifact. Add the CodeArtifact repository name to the buildspec.yaml file for the build project.
Show Answer
Correct Answer: C
Explanation: To reduce repeated dependency downloads from CodeArtifact, CodeBuild must cache the dependency files between builds. A local cache in CodeBuild is designed for this purpose and provides the best performance for frequently accessed, large dependencies. By specifying the cache folder paths (such as package manager cache directories) in the buildspec.yaml file, subsequent builds can reuse previously downloaded dependencies instead of retrieving them again from CodeArtifact. Simply referencing the repository name is not sufficient, and retrieving buildspec files from CodeArtifact does not address dependency transfer time.
Question 196
A company runs a critical application on Amazon Elastic Container Service (Amazon ECS) by using Amazon EC2 instances. The company needs to migrate the application to Amazon ECS on AWS Fargate. A developer is configuring Fargate and the ECS capacity providers to make the change.
Which solution will meet these requirements with the LEAST downtime during migration?
A. Use the PutClusterCapacityProviders API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
B. Use the CreateCapacityProvider API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE as Provider 1 with a base value. Use FARGATE_SPOT as Provider 2 for failover.
C. Use the PutClusterCapacityProviders API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE_SPOT as Provider 1 with a base value. Use FARGATE as Provider 2 for failover.
D. Use the CreateCapacityProvider API operation to associate the ECS cluster with the FARGATE and FARGATE_SPOT capacity provider strategies. Use FARGATE_SPOT as Provider 1 with a base value. Use FARGATE as Provider 2 for failover.
Show Answer
Correct Answer: A
Explanation: To migrate from ECS on EC2 to ECS on Fargate with the least downtime, the cluster must be associated with Fargate capacity providers using PutClusterCapacityProviders, which is the correct API for attaching capacity providers to an existing cluster. FARGATE should be the primary provider (with a base value) to ensure tasks are placed on stable on-demand Fargate capacity, while FARGATE_SPOT can be secondary for optional cost optimization. CreateCapacityProvider is not used for Fargate (AWS-managed providers already exist), and making FARGATE_SPOT primary would risk interruptions and downtime.
Question 197
A company has a serverless application that uses Amazon API Gateway backed by AWS Lambda proxy integration. The company is developing several backend APIs. The company needs a landing page to provide an overview of navigation to the APIs.
A developer creates a new/LandingPage resource and a new GET method that uses mock integration.
What should the developer do next to meet these requirements?
A. Configure the integration request mapping template with Content-Type of text/html and statusCode of 200. Configure the integration response mapping template with Content-Type of application/json. In the integration response mapping template, include the LandingPage HTML code that references the APIs.
B. Configure the integration request mapping template with Content-Type of application/json. In the integration request mapping template, include the LandingPage HMTL code that references the APIs. Configure the integration response mapping template with Content-Type of text/html and statusCode of 200.
C. Configure the integration request mapping template with Content-Type of application/json and statusCode of 200. Configure the integration response mapping template with Content-Type of text/html. In the integration response mapping template, include the LandingPage HTML code that references the APIs.
D. Configure the integration request mapping template with Content-Type of text/html. In the integration request mapping template, include the LandingPage HTML code that references the APIs. Configure the integration response mapping template with Content-Type of application/json and statusCode of 200.
Show Answer
Correct Answer: C
Explanation: With a mock integration, API Gateway returns a static response defined in the integration response. The integration request mapping template should simply return a statusCode (e.g., 200). The HTML landing page content must be placed in the integration response mapping template and served with Content-Type text/html. Option C correctly configures the request to return statusCode 200 and the response to return HTML.
Question 198
A developer has an application that uses an Amazon DynamoDB table with a configured local secondary index (LSI). During application testing, the DynamoDB table metrics report a ProvisionedThroughputExceededException error message. The number of requests made by the test suite did not exceed the table's provisioned capacity limits.
What is the cause of this issue?
A. The data in the table's partition key column is not evenly distributed.
B. The LSI's capacity is different from the table's capacity.
C. The application is not implementing exponential backoff retry logic while interacting with the DynamoDB API.
D. The application has the IAM permission to query the DynamoDB table but not to query the LSI.
Show Answer
Correct Answer: A
Explanation: Even if the total request rate is below the table’s provisioned capacity, DynamoDB distributes capacity across partitions based on the partition key. If the partition key values are unevenly distributed, some partitions can become hot and exhaust their allocated throughput, causing ProvisionedThroughputExceededException errors. This is a common issue with LSIs because they share the same partition key as the base table, so hot partitions affect both table and index traffic.
Question 199
A company uses AWS CloudFormation templates to manage infrastructure for a public-facing application in its development, pre-production, and production environments. The company needs to scale for increasing customer demand. A developer must upgrade the Amazon RDS DB instance type to a larger instance.
The developer deploys an update to the CloudFormation stack with the instance size change in the pre-production environment. The developer notices that the stack is in an UPDATE_ROLLBACK_FAILED slate in CloudFormation.
Which option is the cause of this issue?
A. The new instance type specified in the CloudFormation template is invalid
B. The database was deleted or modified manually outside of the CloudFormation stack
C. There is a syntax error in the CloudFormation template
D. The developer has insufficient IAM permissions to provision an instance of the specified type
Show Answer
Correct Answer: B
Explanation: An UPDATE_ROLLBACK_FAILED state occurs when CloudFormation cannot revert resources to their previous state after a failed update. This commonly happens if a managed resource, such as an RDS instance, was modified or deleted manually outside of CloudFormation. In that case, CloudFormation no longer has full control of the resource, so the rollback fails.
Question 200
A company has a monolithic desktop-based application that processes images. A developer is converting the application into an AWS Lambda function by using Python. Currently, the desktop application runs every 5 minutes to process the latest image from an Amazon S3 bucket. The desktop application completes the image processing task within 1 minute.
During testing on AWS, the developer notices that the Lambda function runs at the specified 5-minute interval. However, the Lambda function takes more than 2 minutes to complete the image processing task. The developer needs a solution that will improve the Lambda function's performance.
Which solution will meet this requirement?
A. Update the instance type of the Lambda function to a compute optimized instance with at least eight virtual CPU (vCPU).
B. Update the configuration of the Lambda function to use the latest Python runtime.
C. Increase the memory that is allocated to the Lambda function.
D. Configure a reserved concurrency on the Lambda function.
Show Answer
Correct Answer: C
Explanation: AWS Lambda allocates CPU power proportionally to the amount of memory configured for the function. Increasing the memory allocation increases available CPU and network throughput, which can significantly reduce execution time for compute‑intensive tasks like image processing. The other options do not directly improve single‑invocation performance.
Question 201
A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS.
Which approach should the company take to allow the application to interact with Amazon S3?
A. Create an IAM role that has administrative access to AWS. Attach the role to the EC2 instance.
B. Create an IAM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
C. Create an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.
D. Create an IAM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
Show Answer
Correct Answer: C
Explanation: AWS security best practices recommend using IAM roles for EC2 instances instead of embedding long-term credentials. An IAM role with only the required Amazon S3 permissions can be attached to the EC2 instance, allowing the application to access S3 securely via temporary credentials managed by AWS, and following the principle of least privilege.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.