A developer is using AWS Step Functions to automate a workflow. The workflow defines each step as an AWS Lambda function task. The developer notices that runs of the Step Functions state machine fail in the GetResource task with either an IllegalArgumentException error or a TooManyRequestsException error.
The developer wants the state machine to stop running when the state machine encounters an IllegalArgumentException error. The state machine needs to retry the GetResource task one additional time after 10 seconds if the state machine encounters a TooManyRequestsException error. If the second attempt fails, the developer wants the state machine to stop running.
How can the developer implement the Lambda retry functionality without adding unnecessary complexity to the state machine?
A. Add a Delay task after the GetResource task. Add a catcher to the GetResource task. Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be the Delay task. Configure the Delay task to wait for an interval of 10 seconds. Configure the next step to be the GetResource task.
B. Add a catcher to the GetResource task. Configure the catcher with an error type of TooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of 1. Configure the next step to be the GetResource task.
C. Add a retrier to the GetResource task. Configure the retrier with an error type of TooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of 1.
D. Duplicate the GetResource task. Rename the new GetResource task to TryAgain. Add a catcher to the original GetResource task. Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be TryAgain.
Show Answer
Correct Answer: C
Explanation: AWS Step Functions provides native Retry configuration on Task states, which is designed exactly for this use case. By adding a Retry block to the GetResource task for the TooManyRequestsException error, the state machine can automatically retry the task after a specified interval (10 seconds) and limit retries to one additional attempt. If the retry fails, the execution stops. IllegalArgumentException is not included in the Retry configuration, so it will immediately fail the state machine as required. This approach avoids adding extra states or complexity.
Question 253
An AWS Lambda function requires read access to an Amazon S3 bucket and requires read/write access to an Amazon DynamoDB table. The correct IAM policy already exists.
What is the MOST secure way to grant the Lambda function access to the S3 bucket and the DynamoDB table?
A. Attach the existing IAM policy to the Lambda function.
B. Create an IAM role for the Lambda function. Attach the existing IAM policy to the role. Attach the role to the Lambda function.
C. Create an IAM user with programmatic access. Attach the existing IAM policy to the user. Add the user access key ID and secret access key as environment variables in the Lambda function.
D. Add the AWS account root user access key ID and secret access key as encrypted environment variables in the Lambda function.
Show Answer
Correct Answer: B
Explanation: The most secure approach is to use an IAM role assumed by the Lambda function. Attaching the existing IAM policy to a dedicated Lambda execution role follows AWS best practices: it provides temporary credentials, enforces least privilege, avoids long‑term access keys, and integrates natively with Lambda. Directly attaching policies to Lambda is not supported, and using IAM users or root credentials with stored access keys is insecure.
Question 254
A developer designed an application on an Amazon EC2 instance. The application makes API requests to objects in an Amazon S3 bucket.
Which combination of steps will ensure that the application makes the API requests in the MOST secure manner? (Choose two.)
A. Create an IAM user that has permissions to the S3 bucket. Add the user to an IAM group.
B. Create an IAM role that has permissions to the S3 bucket.
C. Add the IAM role to an instance profile. Attach the instance profile to the EC2 instance.
D. Create an IAM role that has permissions to the S3 bucket. Assign the role to an IAM group.
E. Store the credentials of the IAM user in the environment variables on the EC2 instance.
Show Answer
Correct Answer: B, C
Explanation: The most secure approach is to use an IAM role with the required S3 permissions and attach it to the EC2 instance via an instance profile. IAM roles provide temporary credentials that are automatically rotated and avoid hardcoding or storing credentials on the instance. Creating an IAM user and storing its credentials (options A and E) is less secure, and IAM roles cannot be assigned to IAM groups (option D).
Question 255
A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account.
Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?
A. AssumeRoleWithWebIdentity
B. GetFederationToken
C. AssumeRoleWithSAML
D. AssumeRole
Show Answer
Correct Answer: D
Explanation: For cross-account access with MFA, the correct AWS STS operation is AssumeRole. AssumeRole supports passing MFA information (SerialNumber and TokenCode), and the target role’s trust policy can require MFA via conditions. The other options are for web identity federation, SAML federation, or temporary credentials without assuming a role, and are not appropriate for this scenario.
Question 256
A developer is testing a RESTful application that is deployed by using Amazon API Gateway and AWS Lambda. When the developer tests the user login by using credentials that are not valid, the developer receives an HTTP 405: METHOD_NOT_ALLOWED error. The developer has verified that the test is sending the correct request for the resource.
Which HTTP error should the application return in response to the request?
A. HTTP 401
B. HTTP 404
C. HTTP 503
D. HTTP 505
Show Answer
Correct Answer: A
Explanation: When a login request is made with invalid credentials, the request syntax and HTTP method are valid, but authentication fails. The correct RESTful response is HTTP 401 (Unauthorized), which indicates that authentication is required or has failed. HTTP 405 relates to an unsupported HTTP method, which is not the case here, and the other options do not apply to authentication failures.
Question 257
A developer creates a static website for their department. The developer deploys the static assets for the website to an Amazon S3 bucket and serves the assets with Amazon CloudFront. The developer uses origin access control (OAC) on the CloudFront distribution to access the S3 bucket.
The developer notices users can access the root URL and specific pages but cannot access directories without specifying a file name. For example, /products/index.html works, but /products/ returns an error. The developer needs to enable accessing directories without specifying a file name without exposing the S3 bucket publicly.
Which solution will meet these requirements?
A. Update the CloudFront distribution's settings to index.html as the default root object is set.
B. Update the Amazon S3 bucket settings and enable static website hosting. Specify index.html as the Index document. Update the S3 bucket policy to enable access. Update the CloudFront distribution's origin to use the S3 website endpoint.
C. Create a CloudFront function that examines the request URL and appends index.html when directories are being accessed. Add the function as a viewer request CloudFront function to the CloudFront distribution's behavior.
D. Create a custom error response on the CloudFront distribution with the HTTP error code set to the HTTP 404 Not Found response code and the response page path to /index.html. Set the HTTP response code to the HTTP 200 OK response code.
Show Answer
Correct Answer: C
Explanation: CloudFront with an S3 origin using Origin Access Control does not support directory index resolution. Setting a default root object only applies to the distribution root, not subdirectories. Enabling S3 static website hosting would require using the S3 website endpoint, which does not work with OAC and would expose the bucket publicly. A CloudFront Function on viewer request can rewrite directory requests (for example, /products/) to /products/index.html at the edge, enabling directory access while keeping the S3 bucket private.
Question 258
A company has built an AWS Lambda function to convert large image files into output files that can be used in a third-party viewer application. The company recently added a new module to the function to improve the output of the generated files. However, the new module has increased the bundle size and has increased the time that is needed to deploy changes to the function code.
How can a developer increase the speed of the Lambda function deployment?
A. Use AWS CodeDeploy to deploy the function code.
B. Use Lambda layers to package and load dependencies.
C. Increase the memory size of the function.
D. Use Amazon S3 to host the function dependencies.
Show Answer
Correct Answer: B
Explanation: The deployment slowdown is caused by the increased bundle size from added dependencies. Using Lambda layers allows large modules and libraries to be packaged separately from the function code, so subsequent deployments only upload the smaller function package. This significantly speeds up deployment. Other options do not reduce deployment package size.
Question 259
A photo sharing application uses Amazon S3 to store image files. All user images are manually audited for inappropriate content by a third-party company. The audits are completed 1-24 hours after user upload and the results are written to an Amazon DynamoDB table, which uses the S3 object key as a primary key. The database items can be queried by using a REST API created by the third-party company.
An application developer needs to implement an automated process to tag all S3 objects with the results of the content audit.
What should the developer do to meet these requirements in the MOST operationally efficient way?
A. Create an AWS Lambda function to run in response to the s3:ObjectCreated event type. Write the S3 key to an Amazon Simple Queue Service (Amazon SQS) queue with a visibility timeout of 24 hours. Create and configure a second Lambda function to read items from the queue. Retrieve the results for each item from the DynamoDB table. Tag each S3 object accordingly.
B. Create an AWS Lambda function to run in response to the s3:ObjectCreated event type. Integrate the function into an AWS Step Functions standard workflow. Define an AWS Step Functions Wait state and set the value to 24 hours. Create and configure a second Lambda function to retrieve the audit results and tag the S3 objects accordingly after the Wait state is over.
C. Create an AWS Lambda function to load all untagged S3 objects. Retrieve the results for each item from the REST API and tag each S3 object accordingly. Create and configure an Amazon EventBridge rule to run at regular intervals. Set the Lambda function as a target for the EventBridge rule.
D. Launch an Amazon EC2 instance. Deploy a script to the EC2 instance to use the external database results to tag the S3 objects accordingly. Configure a crontab file to run the script at regular intervals.
Show Answer
Correct Answer: B
Explanation: The key requirement is to automatically tag each S3 object after a manual audit that completes asynchronously within 1–24 hours, with maximum operational efficiency. Option B uses an event-driven, serverless design: the S3 upload triggers a workflow, Step Functions handles the long wait natively without polling or infrastructure, and a Lambda function tags the object after the wait. This avoids managing servers, cron jobs, queues, or repeated scans of untagged objects. Option A is invalid because SQS visibility timeout cannot reach 24 hours. Option C requires periodic polling and scanning, which is less efficient and can result in unnecessary executions. Option D is the least efficient due to EC2 management overhead.
Question 260
A developer is designing a serverless application for a game in which users register and log in through a web browser. The application makes requests on behalf of users to a set of AWS Lambda functions that run behind an Amazon API Gateway HTTP API.
The developer needs to implement a solution to register and log in users on the application's sign-in page. The solution must minimize operational overhead and must minimize ongoing management of user identities.
Which solution will meet these requirements?
A. Create Amazon Cognito user pools for external social identity providers. Configure IAM roles for the identity pools.
B. Program the sign-in page to create users' IAM groups with the IAM roles attached to the groups.
C. Create an Amazon RDS for SQL Server DB instance to store the users and manage the permissions to the backend resources in AWS.
D. Configure the sign-in page to register and store the users and their passwords in an Amazon DynamoDB table with an attached IAM policy.
Show Answer
Correct Answer: A
Explanation: Amazon Cognito user pools provide a fully managed, serverless way to handle user registration and authentication for web applications with minimal operational overhead. Cognito natively integrates with API Gateway and Lambda and can federate with external social identity providers, eliminating the need to manage user credentials directly. The other options require custom identity management, IAM user/group handling, or database-based credential storage, all of which increase operational and security overhead.
Question 261
A developer needs to implement a custom machine learning (ML) library in an application. The size of the library is 15 GB. The size of the library is increasing. The application uses AWS Lambda functions. All the Lambda functions must have access to the library.
Which solution will meet these requirements?
A. Save the library in Lambda layers. Attach the layers to all Lambda functions.
B. Save the library in Amazon S3. Download the library from Amazon S3 inside the Lambda function.
C. Save the library as a Lambda container image. Redeploy the Lambda functions with the new image.
D. Save the library in an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in all the Lambda functions.
Show Answer
Correct Answer: D
Explanation: The ML library is 15 GB and growing, which exceeds Lambda layer size limits (250 MB per layer, limited number of layers) and container image limits for practical use. Downloading from S3 at runtime would significantly increase cold start time and is inefficient. Amazon EFS can store large, growing libraries and be mounted by multiple Lambda functions, allowing all functions to access the library without packaging size constraints.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.