A developer is building an event-driven application by using AWS Lambda and Amazon EventBridge. The Lambda function needs to push events to an EventBridge event bus. The developer uses an SDK to run the PutEvents EventBridge action and specifies no credentials in the code. After deploying the Lambda function, the developer notices that the function is failing and there are AccessDeniedException errors in the logs.
How should the developer resolve this issue?
A. Configure a VPC peering connection between the Lambda function and EventBridge.
B. Modify their AWS credentials to include permissions for the PutEvents EventBridge action.
C. Modify the Lambda function execution role to include permissions for the PutEvents EventBridge action.
D. Add a resource-based policy to the Lambda function to include permissions for the PutEvents EventBridge action.
Show Answer
Correct Answer: C
Explanation: When a Lambda function uses the AWS SDK without explicitly providing credentials, it uses the Lambda execution role's temporary credentials. An AccessDeniedException for EventBridge PutEvents indicates that the execution role lacks the required IAM permission. Grant the execution role the events:PutEvents permission (scoped to the target event bus if possible). A resource-based policy on the Lambda function does not grant outbound permissions, VPC peering is unrelated, and modifying AWS credentials in code is not appropriate when using the execution role.
Question 223
A company is using AWS CloudFormation templates to deploy AWS resources. The company needs to update one of its AWS CloudFormation stacks.
What can the company do to find out how the changes will impact the resources that are running?
A. Investigate the change sets.
B. Investigate the stack policies.
C. Investigate the Metadata section.
D. Investigate the Resources section.
Show Answer
Correct Answer: A
Explanation: AWS CloudFormation change sets let you preview how a proposed stack update will affect existing resources before executing the update. They show which resources will be added, modified, replaced, or deleted. Stack policies control update permissions, Metadata stores additional information, and the Resources section defines resources but does not preview update impact.
Question 224
A developer is using an AWS CodePipeline pipeline to provide continuous integration and continuous delivery (CI/CD) support for a Java application. The developer needs to update the pipeline to support the introduction of a new application dependency .jar file. The pipeline must start a build when a new version of the .jar file becomes available.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket to store the dependency .jar file. Publish the dependency .jar file to the S3 bucket. Use an Amazon Simple Notification Service (Amazon SNS) notification to start a CodePipeline pipeline build.
B. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use an ECR source action to start a CodePipeline pipeline build.
C. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use an Amazon Simple Notification Service (Amazon SNS) notification to start a CodePipeline pipeline build.
D. Create an AWS CodeArtifact repository. Publish the dependency .jar file to the repository. Use an Amazon EventBridge rule to start a CodePipeline pipeline build.
Show Answer
Correct Answer: D
Explanation: AWS CodeArtifact is the appropriate managed repository for Java .jar dependencies. CodeArtifact emits events that Amazon EventBridge can use to trigger a CodePipeline execution when a new package version is published. Amazon ECR is for container images, not Java JAR dependencies, and SNS is not the standard mechanism to trigger CodePipeline from new artifact publication.
Question 225
A company's application has an AWS Lambda function that processes messages from IoT devices. The company wants to monitor the Lambda function to ensure that the Lambda function is meeting its required service level agreement (SLA).
A developer must implement a solution to determine the application's throughput in near real time. The throughput must be based on the number of messages that the Lambda function receives and processes in a given time period. The Lambda function performs initialization and post-processing steps that must not factor into the throughput measurement.
What should the developer do to meet these requirements?
A. Use the Lambda function's ConcurrentExecutions metric in Amazon CloudWatch to measure the throughput.
B. Modify the application to log the calculated throughput to Amazon CloudWatch Logs. Use Amazon EventBridge to invoke a separate Lambda function to process the logs on a schedule.
C. Modify the application to publish custom Amazon CloudWatch metrics when the Lambda function receives and processes each message. Use the metrics to calculate the throughput.
D. Use the Lambda function's Invocations metric and Duration metric to calculate the throughput in Amazon CloudWatch.
Show Answer
Correct Answer: C
Explanation: The requirement defines throughput specifically as the number of messages received and processed over a given time period, while excluding Lambda initialization and post-processing. Built-in Lambda metrics such as Invocations, Duration, or ConcurrentExecutions do not isolate only the message-processing portion of the function. Publishing custom CloudWatch metrics at the relevant points in the application (for received and processed messages) provides an accurate near-real-time basis for calculating throughput.
Question 226
A company recently deployed a new serverless user portal. Users have reported that part of the portal is slow. The initial analysis found a single Amazon API Gateway endpoint that is responsible for the performance issues. The endpoint integrates with an AWS Lambda function. However, the Lambda function interacts with other APIs and AWS services.
How can a developer find the source of the increased response time by using operational best practices?
A. Update the Lambda function by adding logging statements with high-precision timestamps before and after each external request. Deploy the updated Lambda function. After accumulating enough usage data, examine the Amazon CloudWatch logs for the Lambda function to determine the likely sources for the increased response time.
B. Instrument the Lambda function with the AWS X-Ray SDK. Add HTTP and HTTPS interceptors and SDK client handlers. Deploy the updated Lambda function. Turn on X-Ray tracing. After accumulating enough usage data, use the X-Ray service map to examine the average response times to determine the likely sources.
C. Review the Lambda function's Amazon CloudWatch metrics by using the metrics explorer. Apply anomaly detection to the Duration metric and the Throttles metric. Review the anomalies to determine the likely sources.
D. Use Amazon CloudWatch Synthetics to create a new canary. Turn on AWS X-Ray tracing on the canary. Configure the canary to scan the user portal. After accumulating enough usage data, use the CloudWatch Synthetics canary dashboard to view the metrics from the canary.
Show Answer
Correct Answer: B
Explanation: AWS X-Ray is the operational best-practice tool for distributed tracing across Lambda, downstream AWS services, and external HTTP calls. Instrumenting the Lambda function with the X-Ray SDK, HTTP/HTTPS interceptors, and AWS SDK client handlers provides end-to-end traces and a service map that identifies latency contributors and average response times. CloudWatch metrics alone cannot pinpoint which downstream dependency is slow, manual logging is more labor-intensive and less comprehensive, and CloudWatch Synthetics is primarily for proactive monitoring rather than isolating latency inside a request path.
Question 227
A company uses Amazon Simple Queue Service (Amazon SQS) to decouple its microservices architecture. Some messages in an SQS queue contain sensitive information. A developer must implement a solution that encrypts all the data at rest.
Which solution will meet this requirement?
A. Enable server-side encryption for the SQS queue by using an SQS managed encryption key (SSE-SQS).
B. Use the aws:SecureTransport condition in the queue policy to ensure that only HTTPS (TLS) is used for all requests to the SQS queue.
C. Use AWS Certificate Manager (ACM) to generate an SSL/TLS certificate. Reference the certificate when messages are sent to the queue.
D. Set a message attribute in the SQS SendMessage request for messages that are sent to the queue. Set the Name to ENCRYPT. Set the Value to TRUE.
Show Answer
Correct Answer: A
Explanation: To encrypt Amazon SQS message data at rest, enable server-side encryption (SSE) on the queue. SSE-SQS uses SQS-managed encryption keys to automatically encrypt message contents stored in the queue. Option B enforces encryption in transit (HTTPS), not at rest. Option C concerns TLS certificates for transport security and is not how SQS at-rest encryption is configured. Option D has no effect because message attributes do not trigger encryption.
Question 228
A company deploys a new application to AWS. The company is streaming application logs to Amazon CloudWatch Logs. The company's development team must receive notification by email when the word "ERROR" appears in any log lines. A developer sets up an Amazon Simple Notification Service (Amazon SNS) topic and subscribes the development team to the topic.
What should the developer do next to meet the requirements?
A. Select the appropriate log group. Create a CloudWatch metric filter with "ERROR" as the search term. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
B. In CloudWatch Logs Insights, select the appropriate log group. Create a metric query to search for the term "ERROR" in the logs. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
C. Select the appropriate log group. Create an SNS subscription filter with "ERROR" as the filter pattern. Select the SNS topic as the destination.
D. Create a CloudWatch alarm that includes "ERROR" as a filter pattern, a log group dimension that defines the appropriate log group, and a destination that notifies the SNS topic.
Show Answer
Correct Answer: A
Explanation: Amazon CloudWatch Logs uses metric filters to search log events for patterns such as "ERROR" and publish a custom CloudWatch metric. A CloudWatch alarm can then watch that metric and send notifications through an Amazon SNS topic when the metric is 1 or greater. Logs Insights queries do not create persistent alarm metrics in this way, SNS subscription filtering does not apply to CloudWatch Logs log groups, and CloudWatch alarms cannot directly filter log text without an underlying metric.
Question 229
A developer is storing many objects in a single Amazon S3 bucket. The developer needs to optimize the S3 bucket for high request rates.
How should the developer store the objects to meet this requirement?
A. Store the objects by using S3 Intelligent-Tiering.
B. Store the objects at the root of the S3 bucket.
C. Store the objects by using object key names distributed across multiple prefixes.
D. Store each object with an object tag named "prefix" that contains a unique value.
Show Answer
Correct Answer: C
Explanation: Amazon S3 automatically scales request rates per prefix. Distributing object key names across multiple prefixes allows requests to be spread across partitions, supporting very high request rates. Storage class selection, storing objects at the bucket root, or using object tags do not improve request-rate scaling.
Question 230
A developer is working on an ecommerce platform that communicates with several third-party payment processing APIs. The third-party payment services do not provide a test environment.
The developer needs to validate the ecommerce platform's integration with the third-party payment processing APIs. The developer must test the API integration code without invoking the third-party payment processing APIs.
Which solution will meet these requirements?
A. Set up an Amazon API Gateway REST API with a gateway response configured for status code 200. Add response templates that contain sample responses captured from the real third-party API.
B. Set up an AWS AppSync GraphQL API with a data source configured for each third-party API. Specify an integration type of Mock. Configure integration responses by using sample responses captured from the real third-party API.
C. Create an AWS Lambda function for each third-party API. Embed responses captured from the real third-party API. Configure Amazon Route 53 Resolver with an inbound endpoint for each Lambda function's Amazon Resource Name (ARN).
D. Set up an Amazon API Gateway REST API for each third-party API. Specify an integration request type of Mock. Configure integration responses by using sample responses captured from the real third-party API.
Show Answer
Correct Answer: D
Explanation: Amazon API Gateway supports MOCK integrations for REST APIs, allowing developers to return predefined responses without calling a backend. By configuring a REST API with a Mock integration and integration responses using captured sample payloads, the application can test its payment API integration without invoking the real third-party services. Gateway responses are for API Gateway-generated errors and are not a substitute for backend mocking. AppSync Mock integrations are not applicable to third-party REST payment APIs, and Route 53 Resolver cannot route requests to Lambda ARNs.
Question 231
A developer is creating a publicly accessible enterprise website consisting of only static assets. The developer is hosting the website in Amazon S3 and serving the website to users through an Amazon CloudFront distribution. The users of this application must not be able to access the application content directly from an S3 bucket. All content must be served through the Amazon CloudFront distribution.
Which solution will meet these requirements?
A. Create a new origin access control (OAC) in CloudFront. Configure the CloudFront distribution's origin to use the new OAC. Update the S3 bucket policy to allow CloudFront OAC with read and write access to access Amazon S3 as the origin.
B. Update the S3 bucket settings. Enable the block all public access setting in Amazon S3. Configure the CloudFront distribution's with Amazon S3 as the origin. Update the S3 bucket policy to allow CloudFront write access.
C. Update the S3 bucket's static website settings. Enable static website hosting and specifying index and error documents. Update the CloudFront origin to use the S3 bucket's website endpoint.
D. Update the CloudFront distribution's origin to send a custom header. Update the S3 bucket policy with a condition by using the aws:RequestTag/tag-key key. Configure the tag-key as the custom header name, and the value being matched is the header's value.
Show Answer
Correct Answer: A
Explanation: Use Amazon CloudFront Origin Access Control (OAC) so CloudFront can securely access the private S3 bucket while preventing direct public access to the bucket. Update the bucket policy to allow the CloudFront distribution (via OAC) to perform read access to the bucket objects. Option A is the only choice that uses the recommended mechanism, though in practice the bucket policy should grant read access rather than write access. Option B incorrectly focuses on write access and omits OAC/OAI. Option C requires the S3 website endpoint, which cannot be secured with OAC and requires public access. Option D is not how S3 bucket policies restrict CloudFront access.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.