A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a VPC.
The company creates a role that includes the necessary permissions to access the DB instance. The company then assigns the role to the Lambda function. A developer must take additional action to give the Lambda function access to the DB instance.
What should the developer do to meet these requirements?
A. Assign a public IP address to the DB instance. Modify the security group of the DB instance to allow inbound traffic from the IP address of the Lambda function.
B. Set up an AWS Direct Connect connection between the Lambda function and the DB instance.
C. Configure an Amazon CloudFront distribution to create a secure connection between the Lambda function and the DB instance.
D. Configure the Lambda function to connect to the private subnets in the VPC. Add security group rules to allow traffic to the DB instance from the Lambda function.
Show Answer
Correct Answer: D
Explanation: An AWS Lambda function needs network-level access to reach resources in a private VPC. To access an Amazon RDS instance in a private subnet, the Lambda function must be configured to run within the VPC by attaching it to the appropriate private subnets. AWS then creates elastic network interfaces (ENIs) for the function in those subnets. In addition, security group rules must allow inbound traffic from the Lambda function’s security group to the DB instance. IAM permissions alone are not sufficient for network connectivity.
Question 203
A developer is running an application on an Amazon EC2 instance. When the application tries to read an Amazon S3 bucket, the application fails. The developer notices that the associated IAM role is missing the S3 read permission. The developer needs to give the application the ability to read the S3 bucket.
Which solution will meet this requirement with the LEAST application disruption?
A. Add the permission to the role. Terminate the existing EC2 instance. Launch a new EC2 instance.
B. Add the permission to the role so that the change will take effect automatically.
C. Add the permission to the role. Hibernate and restart the existing EC2 instance.
D. Add the permission to the S3 bucket. Restart the EC2 instance.
Show Answer
Correct Answer: B
Explanation: IAM role permission changes propagate automatically to attached EC2 instances, typically within minutes, without requiring a restart, hibernation, or instance replacement. This provides S3 read access with the least application disruption.
Question 204
A developer at a company writes an AWS CloudFormation template. The template refers to subnets that were created by a separate AWS CloudFormation template that the company's network team wrote. When the developer attempts to launch the stack for the first time, the launch fails.
Which template coding mistakes could have caused this failure? (Choose two.)
A. The developer's template does not use the Ref intrinsic function to refer to the subnets.
B. The developer's template does not use the ImportValue intrinsic function to refer to the subnets.
C. The Mappings section of the developer's template does not refer to the subnets.
D. The network team's template does not export the subnets in the Outputs section.
E. The network team's template does not export the subnets in the Mappings section.
Show Answer
Correct Answer: B, D
Explanation: To reference resources created in another CloudFormation stack, the source stack must export values in its Outputs section, and the consuming stack must use the Fn::ImportValue intrinsic function to import those values. If the developer did not use ImportValue, or if the network team did not export the subnet IDs in Outputs, the stack launch would fail. Other options (Ref, Mappings) are not used for cross-stack references.
Question 205
A developer is implementing an AWS Lambda function that will be invoked when an object is uploaded to Amazon S3. The developer wants to test the Lambda function in a local development machine before publishing the function to a production AWS account.
Which solution will meet these requirements with the LEAST operational overhead?
A. Upload an object to Amazon S3 by using the aws s3api put-object CLI command. Wait for the local Lambda invocation from the S3 event.
B. Create a sample JSON text file for a put object S3 event. Invoke the Lambda function locally. Use the aws lambda invoke CLI command with the JSON file and Lambda function name as arguments.
C. Use the sam local start-lambda CLI command to start Lambda. Use the sam local generate-event s3 put CLI command to create the Lambda test JSON file. Use the sam local invoke CLI command with the JSON file as the argument to invoke the Lambda function.
D. Create a JSON string for the put object S3 event. In the AWS Management Console, use the JSON string to create a test event for the local Lambda function. Perform the test.
Show Answer
Correct Answer: C
Explanation: The requirement is to test an S3‑triggered Lambda function locally with the least operational overhead. AWS SAM CLI is specifically designed for local serverless development and testing. Using sam local generate-event s3 put quickly creates an accurate S3 event payload, and sam local invoke runs the Lambda locally without deploying to AWS. Other options either require AWS resources (A, D) or invoke Lambda in AWS rather than locally (B). Therefore, option C best meets the requirements with minimal overhead.
Question 206
A developer needs temporary access to resources in a second account.
What is the MOST secure way to achieve this?
A. Use the Amazon Cognito user pools to get short-lived credentials for the second account.
B. Create a dedicated IAM access key for the second account, and send it by mail.
C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.
D. Establish trust, and add an SSH key for the second account to the IAM user.
Show Answer
Correct Answer: C
Explanation: Using a cross-account IAM role with sts:AssumeRole provides temporary, short-lived credentials without sharing long-term secrets. It enforces least privilege, supports auditing, and is the AWS-recommended best practice for secure cross-account access.
Question 207
A developer is publishing critical log data to a log group in Amazon CloudWatch Logs. The log group was created 2 months ago. The developer must encrypt the log data by using an AWS Key Management Service (AWS KMS) key so that future data can be encrypted to comply with the company's security policy.
Which solution will meet this requirement with the LEAST effort?
A. Use the AWS Encryption SDK for encryption and decryption of the data before writing to the log group.
B. Use the AWS KMS console to associate the KMS key with the log group.
C. Use the AWS CLI aws logs create-log-group command, and specify the key Amazon Resource Name (ARN).
D. Use the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN).
Show Answer
Correct Answer: D
Explanation: The log group already exists, so the requirement is to encrypt future log data with a KMS key with the least effort. CloudWatch Logs supports associating a KMS key with an existing log group using the aws logs associate-kms-key command. This immediately enables encryption for all new log events. Creating a new log group or encrypting data manually is unnecessary.
Question 208
A developer is writing a web application that is deployed on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The developer must add an Amazon CloudFront distribution in front of the ALB. The developer also must ensure that customer data from outside the VPC is encrypted in transit.
Which combination of CloudFront configuration settings should the developer use to meet these requirements? (Choose two.)
A. Restrict viewer access by using signed URLs.
B. Set the Origin Protocol Policy setting to Match Viewer.
C. Enable field-level encryption.
D. Enable automatic object compression.
E. Set the Viewer Protocol Policy setting to Redirect HTTP to HTTPS.
Show Answer
Correct Answer: B, E
Explanation: To encrypt customer data in transit from outside the VPC, CloudFront must enforce HTTPS for viewers and use HTTPS consistently to the origin. Setting the Viewer Protocol Policy to Redirect HTTP to HTTPS ensures all client connections are encrypted. Setting the Origin Protocol Policy to Match Viewer ensures CloudFront uses HTTPS to connect to the ALB when viewers use HTTPS, maintaining end-to-end encryption.
Question 209
A developer is working on a web application that requires selective activation of specific features. The developer wants to keep the features hidden from end users until the features are ready for public access.
Which solution will meet these requirements?
A. Create a feature flag configuration profile in AWS AppSync. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.
B. Store prerelease data in an Amazon DynamoDB table. Enable Amazon DynamoDB Streams in the table. Toggle between hidden and visible states by using DynamoDB Streams.
C. Create a feature flag configuration profile in AWS AppConfig. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.
D. Store prerelease data in AWS Amplify DataStore. Toggle between hidden and visible states by using Amplify DataStore cloud synchronization.
Show Answer
Correct Answer: C
Explanation: AWS AppConfig is specifically designed for feature flags and runtime configuration. Creating a feature flag configuration profile in AppConfig allows selective activation/deactivation of features without redeploying the application and keeps features hidden until ready. AppSync, DynamoDB Streams, and Amplify DataStore are not intended feature-flag management solutions.
Question 210
A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a public Network Load Balancer.
B. Create a public Application Load Balancer.
C. Configure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration.
D. Configure a listener for the load balancer that listens on HTTP port 80. Add a default authenticate action providing the OIDC IdP configuration.
E. Configure a listener for the load balancer that listens on HTTPS port 443. Add a default AWS Lambda action providing an Amazon Resource Name (ARN) to a Lambda authentication function.
Show Answer
Correct Answer: B, C
Explanation: An Application Load Balancer supports built-in user authentication with OIDC, allowing authentication to be enforced without modifying the website. The listener must use HTTPS on port 443 and include a default authenticate action configured with the company’s OIDC IdP. Network Load Balancers and Lambda-based authentication are not required, and ALB authentication does not apply to HTTP-only listeners.
Question 211
A developer is writing an application to analyze the traffic to a fleet of Amazon EC2 instances. The EC2 instances run behind a public Application Load Balancer (ALB). An HTTP server runs on each of the EC2 instances, logging all requests to a log file.
The developer wants to capture the client public IP addresses. The developer analyzes the log files and notices only the IP address of the ALB.
What must the developer do to capture the client public IP addresses in the log file?
A. Add a Host header to the HTTP server log configuration file.
B. Install the Amazon CloudWatch Logs agent on each EC2 instance. Configure the agent to write to the log file.
C. Install the AWS X-Ray daemon on each EC2 instance. Configure the daemon to write to the log file.
D. Add an X-Forwarded-For header to the HTTP server log configuration file.
Show Answer
Correct Answer: D
Explanation: When traffic passes through an Application Load Balancer, the source IP seen by the EC2 instance is the ALB’s IP, not the client’s. ALB automatically adds the X-Forwarded-For HTTP header containing the original client public IP. Configuring the HTTP server to log the X-Forwarded-For header allows the application logs to capture the client’s public IP address.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.