A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities.
Which solution will meet these requirements?
A. Store the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
B. Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.
C. Store the API key in the code repository. Use an AWS managed key to encrypt the code repository.
D. Store the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the API key.
Show Answer
Correct Answer: B
Explanation: The requirement is to store the API key as part of the AWS Lambda configuration while maintaining full control over the KMS keys and restricting visibility to authorized entities. Lambda environment variables support encryption with a customer managed KMS key, giving full control over key policies and access. The other options either use AWS managed/default keys (no full control), store secrets in insecure locations, or do not align with Lambda configuration.
Question 213
A developer uses AWS IAM Identity Center (AWS Single Sign-On) to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation.
What is the MOST likely cause of the developer's access issue?
A. The access permissions to the developer's AWS CLI binary file have changed.
B. The permission set that is assumed by IAM Identity Center does not have the necessary permissions to complete the API call.
C. The credentials from the IAM Identity Center federated role have expired.
D. The developer is attempting to make API calls to the incorrect AWS account.
Show Answer
Correct Answer: C
Explanation: AWS IAM Identity Center (SSO) provides temporary credentials to the AWS CLI and SDKs. These credentials expire after a set session duration. If the developer previously had working access and made no configuration changes, the most likely cause of new Access Denied errors is that the cached SSO credentials have expired and need to be refreshed by re-authenticating (for example, running `aws sso login`).
Question 214
A developer is creating a new application for a pet store. The application will manage customer rewards points. The developer will use Amazon DynamoDB to store the data for the application. The developer needs to optimize query performance and limit partition overload before actual performance analysis.
Which option should the developer use for a partition key to meet these requirements?
A. A randomly generated universally unique identifier (UUID)
B. The customer's full name
C. The date when the customer signed up for the rewards program
D. The name of the customer's pet
Show Answer
Correct Answer: A
Explanation: In DynamoDB, the partition key should distribute items evenly to avoid hot partitions and optimize query performance. A randomly generated UUID provides high cardinality and uniform distribution across partitions, minimizing the risk of partition overload before workload characteristics are fully known. The other options (customer name, signup date, or pet name) can easily create skewed access patterns or hot partitions due to duplication or time-based clustering.
Question 215
A developer is building a new containerized application by using AWS Copilot. The developer uses the AWS Copilot command line interface (CLI) to deploy the application during development. The developer committed the application code to a new AWS CodeCommit repository. The developer must create an automated deployment process before releasing the new application to production.
What should the developer do to meet these requirements in the MOST operationally efficient way?
A. Create a buildspec file that invokes the AWS Copilot CLI commands to build and deploy the application. Use the AWS Copilot CLI to create an AWS CodePipeline that uses the CodeCommit repository in the source stage and AWS CodeBuild in the build stage.
B. Use the AWS Serverless Application Model (AWS SAM) CLI to bootstrap and initialize an AWS CodePipeline configuration. Use the CodeCommit repository as the source. Invoke the AWS Copilot CLI to build and deploy the application.
C. Use the AWS Copilot CLI to define the AWS Copilot pipeline and to deploy the AWS CodePipeline. Select CodeCommit as the source for the AWS CodePipeline.
D. Define an AWS CloudFormation template for an AWS CodePipeline with CodeCommit as the source. Configure the template as an AWS Copilot CLI add-on. Use the AWS Copilot CLI to deploy the application.
Show Answer
Correct Answer: C
Explanation: AWS Copilot natively supports defining and deploying CI/CD pipelines (including AWS CodePipeline) for containerized applications. Using the Copilot CLI to create a Copilot pipeline with CodeCommit as the source requires the least custom configuration and leverages built-in best practices, making it the most operationally efficient approach compared to manually wiring CodeBuild, SAM, or custom CloudFormation.
Question 216
A company uses an AWS Lambda function to call a third-party service. The third-party service has a limit of requests each minute. If the number of requests exceeds the limit, the third-party service returns rate-limiting errors.
A developer needs to configure the Lambda function to avoid receiving rate limiting errors from the third-party service.
Which solution will meet these requirements?
A. Set the reserved concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.
B. Decrease the memory that is allocated to the Lambda function.
C. Set the provisioned concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.
D. Increase the timeout value that is specified on the Lambda function.
Show Answer
Correct Answer: A
Explanation: The issue is excessive concurrent requests from Lambda causing the third-party service to exceed its per-minute rate limit. Reserved concurrency places a hard cap on the maximum number of concurrent Lambda executions, directly controlling how many simultaneous requests can be sent to the external service. Provisioned concurrency only keeps a minimum number of environments warm and does not limit concurrency. Memory size and timeout settings do not control request rate.
Question 217
A developer is deploying an application in the AWS Cloud by using AWS CloudFormation. The application will connect to an existing Amazon RDS database. The hostname of the RDS database is stored in AWS Systems Manager Parameter Store as a plaintext value. The developer needs to incorporate the database hostname into the CloudFormation template to initialize the application when the stack is created.
How should the developer reference the parameter that contains the database hostname?
A. Use the ssm dynamic reference.
B. Use the Ref intrinsic function.
C. Use the Fn::ImportValue intrinsic function.
D. Use the ssm-secure dynamic reference.
Show Answer
Correct Answer: A
Explanation: The database hostname is stored in AWS Systems Manager Parameter Store as a plaintext (String) parameter. CloudFormation templates reference plaintext Parameter Store values by using an SSM dynamic reference ({{resolve:ssm:parameter-name}}). Secure dynamic references (ssm-secure) are only for SecureString parameters, Ref is for template parameters or resources, and Fn::ImportValue requires an exported value from another stack.
Question 218
A gaming website gives users the ability to trade game items with each other on the platform. The platform requires both users' records to be updated and persisted in one transaction. If any update fails, the transaction must roll back.
Which AWS solutions can provide the transactional capability that is required for this feature? (Choose two.)
A. Amazon DynamoDB with operations made with the ConsistentRead parameter set to true
B. Amazon ElastiCache for Memcached with operations made within a transaction block
C. Amazon DynamoDB with reads and writes made by using Transact* operations
D. Amazon Aurora MySQL with operations made within a transaction block
E. Amazon Athena with operations made within a transaction block
Show Answer
Correct Answer: C, D
Explanation: The requirement is an atomic, all-or-nothing update across multiple user records. Amazon DynamoDB supports this through TransactWriteItems/TransactGetItems (Transact* operations), which provide ACID transactions across multiple items and tables. Amazon Aurora MySQL is a relational database that natively supports ACID transactions using transaction blocks. The other options do not provide true multi-record transactional guarantees for this use case.
Question 219
A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. Developers are working on an application that is running on Amazon EC2 instances in Account B. The application in Account B requires access to the PII table.
An administrator in Account A creates an IAM role named AccessPII that has permission to access the PII table. The administrator also creates a trust policy that specifies Account B as a principal that can assume the role.
Which combination of steps should the developers take in Account B to allow their application to access the PII table? (Choose two.)
A. Allow the EC2 IAM role the permission to assume the AccessPII role.
B. Allow the EC2 IAM role the permission to access the PII table.
C. Include the AWS API in the application code logic to obtain temporary credentials from the EC2 IAM role to access the PII table.
D. Include the AssumeRole API operation in the application code logic to obtain temporary credentials to access the PII table.
E. Include the GetSessionToken API operation in the application code logic to obtain temporary credentials to access the PII table.
Show Answer
Correct Answer: A, D
Explanation: This is a cross-account access scenario using IAM roles. In Account B, the EC2 instance role must be allowed to assume the AccessPII role that exists in Account A (A). The application must then call the STS AssumeRole API to obtain temporary credentials for that role (D). Direct permissions to the DynamoDB table are not granted to Account B, and GetSessionToken is not used for cross-account role assumption.
Question 220
A developer has an application that asynchronously invokes an AWS Lambda function. The developer wants to store messages that resulted in failed invocations of the Lambda function so that the application can retry the call later.
What should the developer do to accomplish this goal with the LEAST operational overhead?
A. Set up Amazon CloudWatch Logs log groups to filter and store the messages in an Amazon S3 bucket. Import the messages in Lambda. Run the Lambda function again.
B. Configure Amazon EventBridge to send the messages to Amazon Simple Notification Service (Amazon SNS) to initiate the Lambda function again.
C. Implement a dead-letter queue for discarded messages. Set the dead-letter queue as an event source for the Lambda function.
D. Send Amazon EventBridge events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to pull messages from the SQS queue. Run the Lambda function again.
Show Answer
Correct Answer: C
Explanation: For asynchronous AWS Lambda invocations, AWS natively supports dead-letter queues (DLQs) to capture events that fail processing after retries. Configuring a DLQ (Amazon SQS or SNS) requires minimal operational effort and automatically stores failed invocation payloads, allowing the application to retry later. The other options introduce unnecessary components or manual processing, increasing operational overhead.
Question 221
A company with multiple branch locations has an analytics and reporting application. Each branch office pushes a sales report to a shared Amazon S3 bucket at a predefined time each day. The company has developed an AWS Lambda function that analyzes the reports from all branch offices in a single pass. The Lambda function stores the results in a database.
The company needs to start the analysis once each day at a specific time.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 event notification to invoke the Lambda function when a branch office uploads a sales report.
B. Create an AWS Step Functions state machine that invokes the Lambda function once each day at the predefined time.
C. Configure the Lambda function to run continuously and to begin analysis only at the predefined time each day.
D. Create an Amazon EventBridge scheduled rule that invokes the Lambda function once each day at the predefined time.
Show Answer
Correct Answer: D
Explanation: The requirement is to run the analysis exactly once per day at a predefined time, after all branch reports are available, and to do so at the lowest cost. An Amazon EventBridge scheduled rule can invoke the Lambda function using a cron or rate expression, resulting in a single daily invocation. S3 event notifications would trigger multiple invocations per upload, Step Functions is unnecessary and more expensive for simple scheduling, and a continuously running Lambda is not supported and would be cost-inefficient.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.