A developer supports an application that accesses data in an Amazon DynamoDB table. One of the item attributes is expirationDate in the timestamp format. The application uses this attribute to find items, archive them, and remove them from the table based on the timestamp value.
The application will be decommissioned soon, and the developer must find another way to implement this functionality. The developer needs a solution that will require the least amount of code to write.
Which solution will meet these requirements?
A. Enable TTL on the expirationDate attribute in the table. Create a DynamoDB stream. Create an AWS Lambda function to process the deleted items. Create a DynamoDB trigger for the Lambda function.
B. Create two AWS Lambda functions: one to delete the items and one to process the items. Create a DynamoDB stream. Use the DeleteItem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB stream and process them.
C. Create two AWS Lambda functions: one to delete the items and one to process the items. Create an Amazon EventBridge scheduled rule to invoke the Lambda functions. Use the DeleteItem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB table and process them.
D. Enable TTL on the expirationDate attribute in the table. Specify an Amazon Simple Queue Service (Amazon SQS) dead-letter queue as the target to delete the items. Create an AWS Lambda function to process the items.
Show Answer
Correct Answer: A
Explanation: DynamoDB Time to Live (TTL) can use the existing expirationDate timestamp attribute to automatically expire and delete items with minimal custom code. By enabling DynamoDB Streams and attaching an AWS Lambda trigger, the application can process/archive expired items when the TTL deletion event appears on the stream. The other options require custom scheduled deletion logic or describe unsupported integrations (such as TTL targeting SQS).
Question 263
A company is preparing to migrate an application to the company's first AWS environment. Before this migration, a developer is creating a proof-of-concept application to validate a model for building and deploying container-based applications on AWS.
Which combination of steps should the developer take to deploy the containerized proof-of-concept application with the LEAST operational effort? (Choose two.)
A. Package the application into a .zip file by using a command line tool. Upload the package to Amazon S3.
B. Package the application into a container image by using the Docker CLI. Upload the image to Amazon Elastic Container Registry (Amazon ECR).
C. Deploy the application to an Amazon EC2 instance by using AWS CodeDeploy.
D. Deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate.
E. Deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
Show Answer
Correct Answer: B, E
Explanation: For a container-based application, the application should be packaged as a Docker container image and pushed to Amazon ECR. To minimize operational effort, deploy the container on Amazon ECS with AWS Fargate, which is AWS's simplest managed container orchestration service and avoids managing EC2 instances or Kubernetes control planes. Amazon EKS on Fargate still requires Kubernetes and adds unnecessary operational complexity for a first AWS proof of concept.
Question 264
A company is building an application on AWS. The application's backend includes an Amazon API Gateway REST API. The company's frontend application developers cannot continue work until the backend API is ready for integration. The company needs a solution that will allow the frontend application developers to continue their work.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Configure mock integrations for API Gateway API methods.
B. Integrate a Lambda function with API Gateway and return a mocked response.
C. Add new API endpoints to the API Gateway stage and returns a mocked response.
D. Configure a proxy resource for API Gateway API methods.
Show Answer
Correct Answer: A
Explanation: API Gateway mock integrations are designed specifically to return predefined responses without invoking any backend. This allows frontend developers to integrate and test against the API contract before the backend is implemented, with minimal operational overhead. Using Lambda would require creating and maintaining code, adding endpoints is unnecessary, and a proxy resource still requires a backend integration.
Question 265
An Amazon Simple Queue Service (Amazon SQS) queue serves as an event source for an AWS Lambda function. In the SQS queue, each item corresponds to a video file that the Lambda function must convert to a smaller resolution. The Lambda function is timing out on longer video files, but the Lambda function's timeout is already configured to its maximum value.
What should a developer do to avoid the timeouts without additional code changes?
A. Increase the memory configuration of the Lambda function.
B. Increase the visibility timeout on the SQS queue.
C. Increase the instance size of the host that runs the Lambda function.
D. Use multi-threading for the conversion.
Show Answer
Correct Answer: A
Explanation: Increasing the Lambda function's memory also increases the CPU allocated to the function, which can significantly reduce processing time for CPU-intensive workloads such as video transcoding. Since the timeout is already at the maximum, increasing memory is the only configuration change listed that can help the function complete within the timeout without modifying code. Increasing the SQS visibility timeout does not extend Lambda execution time, Lambda runs on AWS-managed infrastructure so host instance size cannot be changed, and multithreading requires code changes.
Question 266
A company has an application that is hosted on Amazon EC2 instances. The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket. A developer turns on S3 Block Public Access for the S3 bucket. After this change, users report errors when they attempt to download objects. The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket.
Which combination of steps will meet these requirements in the MOST secure way? (Choose two.)
A. Create an EC2 instance profile and role with an appropriate policy. Associate the role with the EC2 instances.
B. Create an IAM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances.
C. Modify the application to use the S3 GeneratePresignedUrl API call.
D. Modify the application to use the S3 GetObject API call and to return the object handle to the user.
E. Modify the application to delegate requests to the S3 bucket.
Show Answer
Correct Answer: A, C
Explanation: Use an EC2 instance profile and IAM role so the application obtains temporary credentials securely without storing long-term access keys. Then have the application generate Amazon S3 pre-signed URLs for authenticated users, allowing direct, time-limited access to private S3 objects while keeping S3 Block Public Access enabled.
Question 267
A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.
The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.
Which solution will meet these requirements MOST securely?
A. Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
B. Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
C. Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
D. Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager is the AWS service designed for securely storing, retrieving, and automatically rotating secrets such as API credentials. It supports scheduled rotation (including quarterly) and applications can retrieve the secret at runtime via IAM-controlled access. AWS KMS only encrypts data and does not manage SaaS API secret rotation by itself. AWS STS issues temporary AWS credentials, not credentials for an external SaaS vendor. Systems Manager Parameter Store can store secrets, but automatic rotation is not a native feature like Secrets Manager's managed rotation.
Question 268
A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a RE ST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL.
Which solution will meet these requirements?
A. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish the API to the canary stage.
B. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy a new API Gateway stage.
C. Define an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish to the canary stage.
D. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy the API to the production API Gateway stage.
Show Answer
Correct Answer: A
Explanation: API Gateway REST API canary deployments work by deploying a canary configuration on the same stage (same URL) and overriding stage variables or integration settings for a percentage of traffic. Lambda aliases cannot point to $LATEST, making option C invalid. Creating a published version for the current production function, updating the integration to use a stable version, publishing the new code, and using an API Gateway canary deployment to send a small percentage of traffic to the new integration satisfies the requirement without changing the API Gateway URL.
Sources:
https://docs.aws.amazon.com/lambda/latest/dg/services-apigateway.html
Question 269
A developer is creating an AWS Lambda function that consumes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function processes some messages multiple times.
How should developer resolve this issue MOST cost-effectively?
A. Change the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.
B. Set up a dead-letter queue.
C. Set the maximum concurrency limit of the AWS Lambda function to 1.
D. Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.
Show Answer
Correct Answer: A
Explanation: Amazon SQS standard queues provide at-least-once delivery, so duplicate message delivery is expected. If the requirement is to prevent duplicate processing, using an SQS FIFO queue with message deduplication is the appropriate service-level solution. A dead-letter queue only captures failed messages, not duplicates. Limiting Lambda concurrency to 1 does not eliminate duplicate deliveries caused by SQS at-least-once semantics. Replacing SQS with Kinesis is unnecessary and more costly.
Question 270
A developer is updating the production version of an AWS Lambda function to fix a defect. The developer has tested the updated code in a test environment. The developer wants to slowly roll out the updates to a small subset of production users before rolling out the changes to all users. Only 10% of the users should be initially exposed to the new code in production.
Which solution will meet these requirements?
A. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function trigger. Configure the traffic weights in the trigger between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
B. Create a new Lambda function that uses the updated code. Create a Lambda alias for the production Lambda function. Configure the Lambda alias to send 90% of the traffic to the production Lambda function, and send 10% of the traffic to the test Lambda function.
C. Update the Lambda code and create a new version of the Lambda function. Create a Lambda proxy integration. Configure the Lambda proxy to split traffic between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
D. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function alias. Configure the traffic weights in the Lambda alias between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
Show Answer
Correct Answer: D
Explanation: AWS Lambda supports weighted traffic shifting by using aliases that point to two published function versions. After publishing a new version, configure a Lambda alias with routing weights so 90% of invocations go to the current production version and 10% go to the new version. Triggers and Lambda proxy integrations do not provide this version-weighting capability, and aliases route between versions of the same function, not different functions.
Question 271
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance.
Which solution will meet these requirements?
A. Configure the fleet of EC2 instances to use encrypted EBS volumes to store data.
B. Configure the application to write all data to an encrypted Amazon S3 bucket.
C. Configure a custom encryption algorithm for the application that will encrypt and decrypt all data.
D. Configure an Amazon Machine Image (AMI) that has an encrypted root volume and store the data to ephemeral disks.
Show Answer
Correct Answer: A
Explanation: Amazon EBS encryption provides transparent encryption at rest using AWS KMS and is handled by the underlying infrastructure, so applications do not need to implement encryption themselves and performance impact is minimal. Encrypted EBS volumes can be created at deployment time and directly satisfy the requirement to encrypt sensitive data stored on attached EBS volumes. Writing to Amazon S3 changes the storage architecture and adds network latency, custom application encryption adds CPU overhead, and ephemeral instance store disks are not a suitable replacement for the stated EBS-based design.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.