A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities.
Which solution will meet these requirements?
A. Store the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
B. Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.
C. Store the API key in the code repository. Use an AWS managed key to encrypt the code repository.
D. Store the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the API key.
Show Answer
Correct Answer: B
Explanation: AWS Lambda environment variables are part of the Lambda function configuration and can be encrypted with a customer managed AWS KMS key, giving the company full control over key policies, rotation, and access. This satisfies the requirement to store the API key as part of the Lambda configuration while restricting visibility to authorized entities. The other options either use AWS-managed/default keys (not full control), store the secret in code, or do not store it as part of the Lambda configuration.
Question 213
A developer uses AWS IAM Identity Center (AWS Single Sign-On) to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation.
What is the MOST likely cause of the developer's access issue?
A. The access permissions to the developer's AWS CLI binary file have changed.
B. The permission set that is assumed by IAM Identity Center does not have the necessary permissions to complete the API call.
C. The credentials from the IAM Identity Center federated role have expired.
D. The developer is attempting to make API calls to the incorrect AWS account.
Show Answer
Correct Answer: C
Explanation: IAM Identity Center (AWS SSO) provides temporary credentials for the AWS CLI and SDKs. If API calls previously worked without any configuration changes and now fail, the most likely cause is that the temporary federated credentials have expired and the user needs to refresh them by signing in again (for example, using `aws sso login`). If the permission set were insufficient, the calls would generally have failed from the outset rather than only after time elapsed.
Question 214
A developer is creating a new application for a pet store. The application will manage customer rewards points. The developer will use Amazon DynamoDB to store the data for the application. The developer needs to optimize query performance and limit partition overload before actual performance analysis.
Which option should the developer use for a partition key to meet these requirements?
A. A randomly generated universally unique identifier (UUID)
B. The customer's full name
C. The date when the customer signed up for the rewards program
D. The name of the customer's pet
Show Answer
Correct Answer: A
Explanation: A randomly generated UUID provides high-cardinality, evenly distributed partition key values, which helps avoid hot partitions and optimizes write/query scalability before workload characteristics are known. Full names, signup dates, and pet names all have lower cardinality or skewed distributions that can concentrate traffic on partitions.
Question 215
A developer is building a new containerized application by using AWS Copilot. The developer uses the AWS Copilot command line interface (CLI) to deploy the application during development. The developer committed the application code to a new AWS CodeCommit repository. The developer must create an automated deployment process before releasing the new application to production.
What should the developer do to meet these requirements in the MOST operationally efficient way?
A. Create a buildspec file that invokes the AWS Copilot CLI commands to build and deploy the application. Use the AWS Copilot CLI to create an AWS CodePipeline that uses the CodeCommit repository in the source stage and AWS CodeBuild in the build stage.
B. Use the AWS Serverless Application Model (AWS SAM) CLI to bootstrap and initialize an AWS CodePipeline configuration. Use the CodeCommit repository as the source. Invoke the AWS Copilot CLI to build and deploy the application.
C. Use the AWS Copilot CLI to define the AWS Copilot pipeline and to deploy the AWS CodePipeline. Select CodeCommit as the source for the AWS CodePipeline.
D. Define an AWS CloudFormation template for an AWS CodePipeline with CodeCommit as the source. Configure the template as an AWS Copilot CLI add-on. Use the AWS Copilot CLI to deploy the application.
Show Answer
Correct Answer: C
Explanation: AWS Copilot has built-in support for creating and managing CI/CD pipelines. The recommended and most operationally efficient approach is to use the Copilot CLI to initialize the pipeline manifest and deploy the underlying AWS CodePipeline, selecting CodeCommit as the source repository. This leverages Copilot's native pipeline workflow instead of manually authoring buildspec files or CloudFormation templates.
Question 216
A company uses an AWS Lambda function to call a third-party service. The third-party service has a limit of requests each minute. If the number of requests exceeds the limit, the third-party service returns rate-limiting errors.
A developer needs to configure the Lambda function to avoid receiving rate limiting errors from the third-party service.
Which solution will meet these requirements?
A. Set the reserved concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.
B. Decrease the memory that is allocated to the Lambda function.
C. Set the provisioned concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.
D. Increase the timeout value that is specified on the Lambda function.
Show Answer
Correct Answer: A
Explanation: Reserved concurrency sets a hard limit on the maximum number of concurrent Lambda executions. By configuring reserved concurrency to align with the third-party service's allowed request rate (assuming each invocation makes one request), you can throttle Lambda's parallelism and reduce the chance of exceeding the service's limits. Decreasing memory only affects resources, provisioned concurrency only pre-warms execution environments and does not cap concurrency, and increasing the timeout does not control request rate.
Question 217
A developer is deploying an application in the AWS Cloud by using AWS CloudFormation. The application will connect to an existing Amazon RDS database. The hostname of the RDS database is stored in AWS Systems Manager Parameter Store as a plaintext value. The developer needs to incorporate the database hostname into the CloudFormation template to initialize the application when the stack is created.
How should the developer reference the parameter that contains the database hostname?
A. Use the ssm dynamic reference.
B. Use the Ref intrinsic function.
C. Use the Fn::ImportValue intrinsic function.
D. Use the ssm-secure dynamic reference.
Show Answer
Correct Answer: A
Explanation: CloudFormation can reference plaintext Systems Manager Parameter Store values by using the SSM dynamic reference (for String/StringList parameters). The ssm-secure dynamic reference is only for SecureString parameters. Ref does not retrieve an existing Parameter Store value unless used with a CloudFormation parameter of the appropriate type, and Fn::ImportValue is for values exported from another CloudFormation stack.
Question 218
A gaming website gives users the ability to trade game items with each other on the platform. The platform requires both users' records to be updated and persisted in one transaction. If any update fails, the transaction must roll back.
Which AWS solutions can provide the transactional capability that is required for this feature? (Choose two.)
A. Amazon DynamoDB with operations made with the ConsistentRead parameter set to true
B. Amazon ElastiCache for Memcached with operations made within a transaction block
C. Amazon DynamoDB with reads and writes made by using Transact* operations
D. Amazon Aurora MySQL with operations made within a transaction block
E. Amazon Athena with operations made within a transaction block
Show Answer
Correct Answer: C, D
Explanation: The requirement is ACID-style transactional updates across two users' records with rollback if any operation fails. DynamoDB supports this through TransactWriteItems/TransactGetItems (Transact* APIs), which provide atomic transactions across multiple items. Amazon Aurora MySQL supports standard SQL transactions using transaction blocks (BEGIN/COMMIT/ROLLBACK). ConsistentRead only affects read consistency, not transactions. Memcached does not support transactional semantics, and Athena is a query service that does not provide transactional update blocks.
Question 219
A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. Developers are working on an application that is running on Amazon EC2 instances in Account B. The application in Account B requires access to the PII table.
An administrator in Account A creates an IAM role named AccessPII that has permission to access the PII table. The administrator also creates a trust policy that specifies Account B as a principal that can assume the role.
Which combination of steps should the developers take in Account B to allow their application to access the PII table? (Choose two.)
A. Allow the EC2 IAM role the permission to assume the AccessPII role.
B. Allow the EC2 IAM role the permission to access the PII table.
C. Include the AWS API in the application code logic to obtain temporary credentials from the EC2 IAM role to access the PII table.
D. Include the AssumeRole API operation in the application code logic to obtain temporary credentials to access the PII table.
E. Include the GetSessionToken API operation in the application code logic to obtain temporary credentials to access the PII table.
Show Answer
Correct Answer: A, D
Explanation: For cross-account access, the EC2 instance profile role in Account B must be allowed to call sts:AssumeRole on the AccessPII role in Account A. The application must then call the STS AssumeRole API to obtain temporary credentials for the AccessPII role, and use those credentials to access the DynamoDB table. Direct DynamoDB permissions on the EC2 role are not sufficient because the table access is granted through the cross-account role. GetSessionToken is not used for assuming roles.
Question 220
A developer has an application that asynchronously invokes an AWS Lambda function. The developer wants to store messages that resulted in failed invocations of the Lambda function so that the application can retry the call later.
What should the developer do to accomplish this goal with the LEAST operational overhead?
A. Set up Amazon CloudWatch Logs log groups to filter and store the messages in an Amazon S3 bucket. Import the messages in Lambda. Run the Lambda function again.
B. Configure Amazon EventBridge to send the messages to Amazon Simple Notification Service (Amazon SNS) to initiate the Lambda function again.
C. Implement a dead-letter queue for discarded messages. Set the dead-letter queue as an event source for the Lambda function.
D. Send Amazon EventBridge events to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function to pull messages from the SQS queue. Run the Lambda function again.
Show Answer
Correct Answer: C
Explanation: For asynchronous Lambda invocations, configure a dead-letter queue (DLQ) such as an Amazon SQS queue or Amazon SNS topic. If the function invocation fails after Lambda's retry attempts, the event is sent to the DLQ for later processing. You can then configure the Lambda function to consume from the SQS DLQ (or otherwise reprocess the messages), providing the lowest operational overhead among the options.
Question 221
A company with multiple branch locations has an analytics and reporting application. Each branch office pushes a sales report to a shared Amazon S3 bucket at a predefined time each day. The company has developed an AWS Lambda function that analyzes the reports from all branch offices in a single pass. The Lambda function stores the results in a database.
The company needs to start the analysis once each day at a specific time.
Which solution will meet these requirements MOST cost-effectively?
A. Configure an S3 event notification to invoke the Lambda function when a branch office uploads a sales report.
B. Create an AWS Step Functions state machine that invokes the Lambda function once each day at the predefined time.
C. Configure the Lambda function to run continuously and to begin analysis only at the predefined time each day.
D. Create an Amazon EventBridge scheduled rule that invokes the Lambda function once each day at the predefined time.
Show Answer
Correct Answer: D
Explanation: The requirement is to run the analysis exactly once per day at a predefined time after all branch reports have been uploaded. An Amazon EventBridge scheduled rule (cron or rate expression) can invoke the Lambda function once daily at the specified time. S3 event notifications would invoke the function on every upload, Step Functions is unnecessary orchestration for a single scheduled invocation, and Lambda cannot run continuously.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.