A developer is building an event-driven application by using AWS Lambda and Amazon EventBridge. The Lambda function needs to push events to an EventBridge event bus. The developer uses an SDK to run the PutEvents EventBridge action and specifies no credentials in the code. After deploying the Lambda function, the developer notices that the function is failing and there are AccessDeniedException errors in the logs.
How should the developer resolve this issue?
A. Configure a VPC peering connection between the Lambda function and EventBridge.
B. Modify their AWS credentials to include permissions for the PutEvents EventBridge action.
C. Modify the Lambda function execution role to include permissions for the PutEvents EventBridge action.
D. Add a resource-based policy to the Lambda function to include permissions for the PutEvents EventBridge action.
Show Answer
Correct Answer: C
Explanation: The Lambda function uses the AWS SDK without explicit credentials, so it relies on its execution role for authorization. The AccessDeniedException indicates that this role lacks permission to call events:PutEvents. Granting the PutEvents permission to the Lambda execution role allows the function to publish events to EventBridge. VPC peering and resource-based policies on Lambda are not relevant for initiating EventBridge API calls.
Question 223
A company is using AWS CloudFormation templates to deploy AWS resources. The company needs to update one of its AWS CloudFormation stacks.
What can the company do to find out how the changes will impact the resources that are running?
A. Investigate the change sets.
B. Investigate the stack policies.
C. Investigate the Metadata section.
D. Investigate the Resources section.
Show Answer
Correct Answer: A
Explanation: AWS CloudFormation change sets let you preview the proposed changes to a stack before executing an update. They show which resources will be added, modified, or replaced and how running resources will be impacted, making them the correct way to assess the effects of an update.
Question 224
A developer is using an AWS CodePipeline pipeline to provide continuous integration and continuous delivery (CI/CD) support for a Java application. The developer needs to update the pipeline to support the introduction of a new application dependency .jar file. The pipeline must start a build when a new version of the .jar file becomes available.
Which solution will meet these requirements?
A. Create an Amazon S3 bucket to store the dependency .jar file. Publish the dependency .jar file to the S3 bucket. Use an Amazon Simple Notification Service (Amazon SNS) notification to start a CodePipeline pipeline build.
B. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use an ECR source action to start a CodePipeline pipeline build.
C. Create an Amazon Elastic Container Registry (Amazon ECR) private repository. Publish the dependency .jar file to the repository. Use an Amazon Simple Notification Service (Amazon SNS) notification to start a CodePipeline pipeline build.
D. Create an AWS CodeArtifact repository. Publish the dependency .jar file to the repository. Use an Amazon EventBridge rule to start a CodePipeline pipeline build.
Show Answer
Correct Answer: D
Explanation: The requirement is to trigger the CI/CD pipeline when a new version of a dependency .jar becomes available. AWS CodeArtifact is the purpose-built service for storing and managing software dependencies such as Java .jar files. CodeArtifact integrates with Amazon EventBridge and can emit events when a new package version is published, which can directly trigger an AWS CodePipeline execution. S3 and SNS are not native dependency management solutions, and Amazon ECR is designed for container images, not Java libraries. Therefore, using CodeArtifact with an EventBridge rule best meets the requirements.
Question 225
A company's application has an AWS Lambda function that processes messages from IoT devices. The company wants to monitor the Lambda function to ensure that the Lambda function is meeting its required service level agreement (SLA).
A developer must implement a solution to determine the application's throughput in near real time. The throughput must be based on the number of messages that the Lambda function receives and processes in a given time period. The Lambda function performs initialization and post-processing steps that must not factor into the throughput measurement.
What should the developer do to meet these requirements?
A. Use the Lambda function's ConcurrentExecutions metric in Amazon CloudWatch to measure the throughput.
B. Modify the application to log the calculated throughput to Amazon CloudWatch Logs. Use Amazon EventBridge to invoke a separate Lambda function to process the logs on a schedule.
C. Modify the application to publish custom Amazon CloudWatch metrics when the Lambda function receives and processes each message. Use the metrics to calculate the throughput.
D. Use the Lambda function's Invocations metric and Duration metric to calculate the throughput in Amazon CloudWatch.
Show Answer
Correct Answer: C
Explanation: The requirement defines throughput as the number of messages the Lambda function receives and processes, excluding initialization and post-processing. Built-in Lambda metrics (Invocations, Duration, ConcurrentExecutions) cannot isolate only the message-processing portion. Publishing custom CloudWatch metrics at the exact points where messages are received and successfully processed provides near real-time, precise counts that align with the SLA definition and allow accurate throughput calculation.
Question 226
A company recently deployed a new serverless user portal. Users have reported that part of the portal is slow. The initial analysis found a single Amazon API Gateway endpoint that is responsible for the performance issues. The endpoint integrates with an AWS Lambda function. However, the Lambda function interacts with other APIs and AWS services.
How can a developer find the source of the increased response time by using operational best practices?
A. Update the Lambda function by adding logging statements with high-precision timestamps before and after each external request. Deploy the updated Lambda function. After accumulating enough usage data, examine the Amazon CloudWatch logs for the Lambda function to determine the likely sources for the increased response time.
B. Instrument the Lambda function with the AWS X-Ray SDK. Add HTTP and HTTPS interceptors and SDK client handlers. Deploy the updated Lambda function. Turn on X-Ray tracing. After accumulating enough usage data, use the X-Ray service map to examine the average response times to determine the likely sources.
C. Review the Lambda function's Amazon CloudWatch metrics by using the metrics explorer. Apply anomaly detection to the Duration metric and the Throttles metric. Review the anomalies to determine the likely sources.
D. Use Amazon CloudWatch Synthetics to create a new canary. Turn on AWS X-Ray tracing on the canary. Configure the canary to scan the user portal. After accumulating enough usage data, use the CloudWatch Synthetics canary dashboard to view the metrics from the canary.
Show Answer
Correct Answer: B
Explanation: AWS X-Ray provides distributed tracing across API Gateway, Lambda, and downstream AWS services and external APIs. By instrumenting the Lambda function with the X-Ray SDK and enabling tracing, the developer can see end-to-end request paths, segment-level latencies, and service maps that clearly identify which dependency is causing increased response time. This aligns with operational best practices for diagnosing performance issues in serverless architectures.
Question 227
A company uses Amazon Simple Queue Service (Amazon SQS) to decouple its microservices architecture. Some messages in an SQS queue contain sensitive information. A developer must implement a solution that encrypts all the data at rest.
Which solution will meet this requirement?
A. Enable server-side encryption for the SQS queue by using an SQS managed encryption key (SSE-SQS).
B. Use the aws:SecureTransport condition in the queue policy to ensure that only HTTPS (TLS) is used for all requests to the SQS queue.
C. Use AWS Certificate Manager (ACM) to generate an SSL/TLS certificate. Reference the certificate when messages are sent to the queue.
D. Set a message attribute in the SQS SendMessage request for messages that are sent to the queue. Set the Name to ENCRYPT. Set the Value to TRUE.
Show Answer
Correct Answer: A
Explanation: The requirement is to encrypt SQS message data at rest. Amazon SQS provides native server-side encryption (SSE) that automatically encrypts all messages stored in the queue using SQS-managed keys (SSE-SQS) or AWS KMS keys. Enabling SSE-SQS directly fulfills the requirement. The other options address encryption in transit (HTTPS/TLS) or have no effect on actual data encryption at rest.
Question 228
A company deploys a new application to AWS. The company is streaming application logs to Amazon CloudWatch Logs. The company's development team must receive notification by email when the word "ERROR" appears in any log lines. A developer sets up an Amazon Simple Notification Service (Amazon SNS) topic and subscribes the development team to the topic.
What should the developer do next to meet the requirements?
A. Select the appropriate log group. Create a CloudWatch metric filter with "ERROR" as the search term. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
B. In CloudWatch Logs Insights, select the appropriate log group. Create a metric query to search for the term "ERROR" in the logs. Create an alarm on this metric that notifies the SNS topic when the metric is 1 or higher.
C. Select the appropriate log group. Create an SNS subscription filter with "ERROR" as the filter pattern. Select the SNS topic as the destination.
D. Create a CloudWatch alarm that includes "ERROR" as a filter pattern, a log group dimension that defines the appropriate log group, and a destination that notifies the SNS topic.
Show Answer
Correct Answer: A
Explanation: CloudWatch Logs itself cannot directly send email notifications. The correct pattern is to create a CloudWatch Logs metric filter on the log group that matches the term "ERROR" and emits a custom metric whenever it appears. Then, create a CloudWatch alarm on that metric with a threshold of 1 or more and configure the alarm to notify the SNS topic. The other options are incorrect because Logs Insights queries do not create alarmable metrics, SNS subscription filtering does not work on CloudWatch Logs, and CloudWatch alarms cannot directly filter log content without an underlying metric.
Question 229
A developer is storing many objects in a single Amazon S3 bucket. The developer needs to optimize the S3 bucket for high request rates.
How should the developer store the objects to meet this requirement?
A. Store the objects by using S3 Intelligent-Tiering.
B. Store the objects at the root of the S3 bucket.
C. Store the objects by using object key names distributed across multiple prefixes.
D. Store each object with an object tag named "prefix" that contains a unique value.
Show Answer
Correct Answer: C
Explanation: Amazon S3 achieves high request rates by partitioning data internally based on object key prefixes. Distributing object key names across multiple prefixes spreads requests across many partitions, avoiding hot spots and maximizing throughput. Storage classes, root placement, or object tags do not influence request-rate partitioning.
Question 230
A developer is working on an ecommerce platform that communicates with several third-party payment processing APIs. The third-party payment services do not provide a test environment.
The developer needs to validate the ecommerce platform's integration with the third-party payment processing APIs. The developer must test the API integration code without invoking the third-party payment processing APIs.
Which solution will meet these requirements?
A. Set up an Amazon API Gateway REST API with a gateway response configured for status code 200. Add response templates that contain sample responses captured from the real third-party API.
B. Set up an AWS AppSync GraphQL API with a data source configured for each third-party API. Specify an integration type of Mock. Configure integration responses by using sample responses captured from the real third-party API.
C. Create an AWS Lambda function for each third-party API. Embed responses captured from the real third-party API. Configure Amazon Route 53 Resolver with an inbound endpoint for each Lambda function's Amazon Resource Name (ARN).
D. Set up an Amazon API Gateway REST API for each third-party API. Specify an integration request type of Mock. Configure integration responses by using sample responses captured from the real third-party API.
Show Answer
Correct Answer: D
Explanation: Amazon API Gateway REST APIs support Mock integrations that return predefined responses without calling a backend. By configuring a mock integration and defining integration responses with sample payloads from the real third-party APIs, the developer can fully test request/response handling and error cases without invoking the external payment services. Gateway responses (A) are for API Gateway–generated errors, not normal backend behavior; AppSync (B) is unnecessary and not suited for REST payment APIs; Route 53 with Lambda (C) is incorrect and overly complex.
Question 231
A developer is creating a publicly accessible enterprise website consisting of only static assets. The developer is hosting the website in Amazon S3 and serving the website to users through an Amazon CloudFront distribution. The users of this application must not be able to access the application content directly from an S3 bucket. All content must be served through the Amazon CloudFront distribution.
Which solution will meet these requirements?
A. Create a new origin access control (OAC) in CloudFront. Configure the CloudFront distribution's origin to use the new OAC. Update the S3 bucket policy to allow CloudFront OAC with read and write access to access Amazon S3 as the origin.
B. Update the S3 bucket settings. Enable the block all public access setting in Amazon S3. Configure the CloudFront distribution's with Amazon S3 as the origin. Update the S3 bucket policy to allow CloudFront write access.
C. Update the S3 bucket's static website settings. Enable static website hosting and specifying index and error documents. Update the CloudFront origin to use the S3 bucket's website endpoint.
D. Update the CloudFront distribution's origin to send a custom header. Update the S3 bucket policy with a condition by using the aws:RequestTag/tag-key key. Configure the tag-key as the custom header name, and the value being matched is the header's value.
Show Answer
Correct Answer: A
Explanation: To ensure users cannot access content directly from the S3 bucket and that all access goes through CloudFront, the S3 bucket must be private and only CloudFront should be authorized to read objects. Using a CloudFront Origin Access Control (OAC) is the current AWS-recommended approach for this. OAC securely signs requests from CloudFront to S3, and the S3 bucket policy explicitly allows access only from that CloudFront distribution. Other options either require public access to S3, grant incorrect permissions (such as write access), or rely on mechanisms that do not properly restrict direct S3 access.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.