A developer supports an application that accesses data in an Amazon DynamoDB table. One of the item attributes is expirationDate in the timestamp format. The application uses this attribute to find items, archive them, and remove them from the table based on the timestamp value.
The application will be decommissioned soon, and the developer must find another way to implement this functionality. The developer needs a solution that will require the least amount of code to write.
Which solution will meet these requirements?
A. Enable TTL on the expirationDate attribute in the table. Create a DynamoDB stream. Create an AWS Lambda function to process the deleted items. Create a DynamoDB trigger for the Lambda function.
B. Create two AWS Lambda functions: one to delete the items and one to process the items. Create a DynamoDB stream. Use the DeleteItem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB stream and process them.
C. Create two AWS Lambda functions: one to delete the items and one to process the items. Create an Amazon EventBridge scheduled rule to invoke the Lambda functions. Use the DeleteItem API operation to delete the items based on the expirationDate attribute. Use the GetRecords API operation to get the items from the DynamoDB table and process them.
D. Enable TTL on the expirationDate attribute in the table. Specify an Amazon Simple Queue Service (Amazon SQS) dead-letter queue as the target to delete the items. Create an AWS Lambda function to process the items.
Show Answer
Correct Answer: A
Explanation: Enabling DynamoDB Time to Live (TTL) on the expirationDate attribute automatically deletes items when they expire, eliminating the need for custom deletion logic. By enabling DynamoDB Streams and attaching a Lambda trigger, the application can process or archive items as they are deleted with minimal additional code. This approach relies on managed AWS features and requires the least amount of custom implementation compared to manually scanning, scheduling, or deleting items.
Question 263
A company is preparing to migrate an application to the company's first AWS environment. Before this migration, a developer is creating a proof-of-concept application to validate a model for building and deploying container-based applications on AWS.
Which combination of steps should the developer take to deploy the containerized proof-of-concept application with the LEAST operational effort? (Choose two.)
A. Package the application into a .zip file by using a command line tool. Upload the package to Amazon S3.
B. Package the application into a container image by using the Docker CLI. Upload the image to Amazon Elastic Container Registry (Amazon ECR).
C. Deploy the application to an Amazon EC2 instance by using AWS CodeDeploy.
D. Deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate.
E. Deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
Show Answer
Correct Answer: B, E
Explanation: To minimize operational effort for a container-based proof of concept on AWS, the application should be packaged as a container image and stored in a managed registry, then run on a fully managed container service. Packaging the app with Docker and pushing it to Amazon ECR is the standard, low-effort approach for container images. Deploying the container on Amazon ECS with AWS Fargate removes the need to manage servers or Kubernetes control planes, making it simpler and faster than EC2-based deployments or EKS for a first AWS environment.
Question 264
A company is building an application on AWS. The application's backend includes an Amazon API Gateway REST API. The company's frontend application developers cannot continue work until the backend API is ready for integration. The company needs a solution that will allow the frontend application developers to continue their work.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Configure mock integrations for API Gateway API methods.
B. Integrate a Lambda function with API Gateway and return a mocked response.
C. Add new API endpoints to the API Gateway stage and returns a mocked response.
D. Configure a proxy resource for API Gateway API methods.
Show Answer
Correct Answer: A
Explanation: Mock integrations in Amazon API Gateway can return static or predefined responses without invoking any backend service. This allows frontend developers to integrate against the API contract immediately while the real backend is still under development. It requires no Lambda functions, no additional infrastructure, and minimal configuration, making it the most operationally efficient solution.
Question 265
An Amazon Simple Queue Service (Amazon SQS) queue serves as an event source for an AWS Lambda function. In the SQS queue, each item corresponds to a video file that the Lambda function must convert to a smaller resolution. The Lambda function is timing out on longer video files, but the Lambda function's timeout is already configured to its maximum value.
What should a developer do to avoid the timeouts without additional code changes?
A. Increase the memory configuration of the Lambda function.
B. Increase the visibility timeout on the SQS queue.
C. Increase the instance size of the host that runs the Lambda function.
D. Use multi-threading for the conversion.
Show Answer
Correct Answer: A
Explanation: Increasing the Lambda function’s memory allocation also proportionally increases the available CPU power. This can significantly reduce execution time for compute-intensive tasks like video transcoding, allowing longer video files to complete within the existing maximum timeout. This change requires no code modifications. Increasing SQS visibility timeout does not prevent Lambda execution timeouts, and the other options are not applicable or would require code changes.
Question 266
A company has an application that is hosted on Amazon EC2 instances. The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket. A developer turns on S3 Block Public Access for the S3 bucket. After this change, users report errors when they attempt to download objects. The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket.
Which combination of steps will meet these requirements in the MOST secure way? (Choose two.)
A. Create an EC2 instance profile and role with an appropriate policy. Associate the role with the EC2 instances.
B. Create an IAM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances.
C. Modify the application to use the S3 GeneratePresignedUrl API call.
D. Modify the application to use the S3 GetObject API call and to return the object handle to the user.
E. Modify the application to delegate requests to the S3 bucket.
Show Answer
Correct Answer: A, C
Explanation: The most secure solution uses temporary credentials and does not expose the S3 bucket publicly. Associating an IAM role with the EC2 instances (A) allows the application to access S3 using temporary credentials managed by AWS, avoiding hard-coded access keys and following least privilege. Using S3 pre-signed URLs (C) allows the application to grant time-limited, controlled access to specific objects only to authenticated users, while keeping S3 Block Public Access enabled. Other options either rely on long-term credentials or are less secure or inefficient.
Question 267
A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.
The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.
Which solution will meet these requirements MOST securely?
A. Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
B. Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
C. Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
D. Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager is designed to securely store sensitive credentials, provides fine-grained IAM access control, encrypts secrets at rest automatically, and natively supports automatic rotation on a defined schedule (such as quarterly). Applications can retrieve secrets securely at runtime without embedding them in configuration files. AWS KMS alone does not manage secrets or rotation, STS is for AWS IAM credentials (not external SaaS API keys), and Systems Manager Parameter Store does not provide native, managed rotation comparable to Secrets Manager.
Question 268
A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a RE ST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL.
Which solution will meet these requirements?
A. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish the API to the canary stage.
B. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy a new API Gateway stage.
C. Define an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish to the canary stage.
D. Define a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy the API to the production API Gateway stage.
Show Answer
Correct Answer: A
Explanation: The requirement is to test changes in production on a small percentage of traffic without changing the API Gateway URL. API Gateway supports canary releases at the stage level, which route a percentage of traffic to a canary deployment of the same stage. For Lambda integrations, this is typically done by invoking different published Lambda *versions* via stage variables. Option A correctly uses a published Lambda version and an API Gateway canary release on the existing production stage, meeting the requirement. Option C is incorrect because Lambda aliases cannot be created on $LATEST; aliases must point to published versions, making that approach invalid.
Question 269
A developer is creating an AWS Lambda function that consumes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function processes some messages multiple times.
How should developer resolve this issue MOST cost-effectively?
A. Change the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.
B. Set up a dead-letter queue.
C. Set the maximum concurrency limit of the AWS Lambda function to 1.
D. Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.
Show Answer
Correct Answer: A
Explanation: Amazon SQS standard queues provide at-least-once delivery, so duplicate message processing is expected behavior. Using an SQS FIFO queue with message deduplication IDs ensures exactly-once processing within the deduplication window, directly addressing duplicate processing. This is more appropriate and cost-effective than limiting Lambda concurrency, adding a DLQ, or replacing SQS with another service.
Question 270
A developer is updating the production version of an AWS Lambda function to fix a defect. The developer has tested the updated code in a test environment. The developer wants to slowly roll out the updates to a small subset of production users before rolling out the changes to all users. Only 10% of the users should be initially exposed to the new code in production.
Which solution will meet these requirements?
A. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function trigger. Configure the traffic weights in the trigger between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
B. Create a new Lambda function that uses the updated code. Create a Lambda alias for the production Lambda function. Configure the Lambda alias to send 90% of the traffic to the production Lambda function, and send 10% of the traffic to the test Lambda function.
C. Update the Lambda code and create a new version of the Lambda function. Create a Lambda proxy integration. Configure the Lambda proxy to split traffic between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
D. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function alias. Configure the traffic weights in the Lambda alias between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
Show Answer
Correct Answer: D
Explanation: AWS Lambda aliases support weighted routing between versions, enabling gradual (canary) deployments. By publishing a new version and configuring an alias to route 10% of traffic to the new version and 90% to the existing production version, the developer can safely expose only a subset of users before a full rollout. Other options describe unsupported mechanisms (triggers or proxy integration) or misuse aliases across separate functions.
Question 271
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance.
Which solution will meet these requirements?
A. Configure the fleet of EC2 instances to use encrypted EBS volumes to store data.
B. Configure the application to write all data to an encrypted Amazon S3 bucket.
C. Configure a custom encryption algorithm for the application that will encrypt and decrypt all data.
D. Configure an Amazon Machine Image (AMI) that has an encrypted root volume and store the data to ephemeral disks.
Show Answer
Correct Answer: A
Explanation: Using encrypted Amazon EBS volumes provides encryption at rest that is transparent to the application and managed by AWS KMS. Because encryption and decryption are handled by the EBS service and underlying hardware, there is no meaningful performance impact. This directly satisfies the requirements for sensitive data encryption on EC2-attached storage created at deployment time, without redesigning the application or adding latency.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.