A company is preparing to migrate an application to the company's first AWS environment. Before this migration, a developer is creating a proof-of-concept application to validate a model for building and deploying container-based applications on AWS.
Which combination of steps should the developer take to deploy the containerized proof-of-concept application with the LEAST operational effort? (Choose two.)
A. Package the application into a .zip file by using a command line tool. Upload the package to Amazon S3.
B. Package the application into a container image by using the Docker CLI. Upload the image to Amazon Elastic Container Registry (Amazon ECR).
C. Deploy the application to an Amazon EC2 instance by using AWS CodeDeploy.
D. Deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate.
E. Deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate.
Show Answer
Correct Answer: B, E
Explanation: For a container-based application, the application should be packaged as a Docker container image and pushed to Amazon ECR. To minimize operational effort, deploy the container on Amazon ECS with AWS Fargate, which is AWS's simplest managed container orchestration service and avoids managing EC2 instances or Kubernetes control planes. Amazon EKS on Fargate still requires Kubernetes and adds unnecessary operational complexity for a first AWS proof of concept.
Question 264
A company is building an application on AWS. The application's backend includes an Amazon API Gateway REST API. The company's frontend application developers cannot continue work until the backend API is ready for integration. The company needs a solution that will allow the frontend application developers to continue their work.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Configure mock integrations for API Gateway API methods.
B. Integrate a Lambda function with API Gateway and return a mocked response.
C. Add new API endpoints to the API Gateway stage and returns a mocked response.
D. Configure a proxy resource for API Gateway API methods.
Show Answer
Correct Answer: A
Explanation: API Gateway mock integrations are designed specifically to return predefined responses without invoking any backend. This allows frontend developers to integrate and test against the API contract before the backend is implemented, with minimal operational overhead. Using Lambda would require creating and maintaining code, adding endpoints is unnecessary, and a proxy resource still requires a backend integration.
Question 265
An Amazon Simple Queue Service (Amazon SQS) queue serves as an event source for an AWS Lambda function. In the SQS queue, each item corresponds to a video file that the Lambda function must convert to a smaller resolution. The Lambda function is timing out on longer video files, but the Lambda function's timeout is already configured to its maximum value.
What should a developer do to avoid the timeouts without additional code changes?
A. Increase the memory configuration of the Lambda function.
B. Increase the visibility timeout on the SQS queue.
C. Increase the instance size of the host that runs the Lambda function.
D. Use multi-threading for the conversion.
Show Answer
Correct Answer: A
Explanation: Increasing the Lambda function's memory also increases the CPU allocated to the function, which can significantly reduce processing time for CPU-intensive workloads such as video transcoding. Since the timeout is already at the maximum, increasing memory is the only configuration change listed that can help the function complete within the timeout without modifying code. Increasing the SQS visibility timeout does not extend Lambda execution time, Lambda runs on AWS-managed infrastructure so host instance size cannot be changed, and multithreading requires code changes.
Question 266
A company has an application that is hosted on Amazon EC2 instances. The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket. A developer turns on S3 Block Public Access for the S3 bucket. After this change, users report errors when they attempt to download objects. The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket.
Which combination of steps will meet these requirements in the MOST secure way? (Choose two.)
A. Create an EC2 instance profile and role with an appropriate policy. Associate the role with the EC2 instances.
B. Create an IAM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances.
C. Modify the application to use the S3 GeneratePresignedUrl API call.
D. Modify the application to use the S3 GetObject API call and to return the object handle to the user.
E. Modify the application to delegate requests to the S3 bucket.
Show Answer
Correct Answer: A, C
Explanation: Use an EC2 instance profile and IAM role so the application obtains temporary credentials securely without storing long-term access keys. Then have the application generate Amazon S3 pre-signed URLs for authenticated users, allowing direct, time-limited access to private S3 objects while keeping S3 Block Public Access enabled.
Question 267
A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.
The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.
Which solution will meet these requirements MOST securely?
A. Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
B. Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
C. Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
D. Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.
Show Answer
Correct Answer: C
Explanation: AWS Secrets Manager is the AWS service designed for securely storing, retrieving, and automatically rotating secrets such as API credentials. It supports scheduled rotation (including quarterly) and applications can retrieve the secret at runtime via IAM-controlled access. AWS KMS only encrypts data and does not manage SaaS API secret rotation by itself. AWS STS issues temporary AWS credentials, not credentials for an external SaaS vendor. Systems Manager Parameter Store can store secrets, but automatic rotation is not a native feature like Secrets Manager's managed rotation.
Question 269
A developer is creating an AWS Lambda function that consumes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function processes some messages multiple times.
How should developer resolve this issue MOST cost-effectively?
A. Change the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.
B. Set up a dead-letter queue.
C. Set the maximum concurrency limit of the AWS Lambda function to 1.
D. Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.
Show Answer
Correct Answer: A
Explanation: Amazon SQS standard queues provide at-least-once delivery, so duplicate message delivery is expected. If the requirement is to prevent duplicate processing, using an SQS FIFO queue with message deduplication is the appropriate service-level solution. A dead-letter queue only captures failed messages, not duplicates. Limiting Lambda concurrency to 1 does not eliminate duplicate deliveries caused by SQS at-least-once semantics. Replacing SQS with Kinesis is unnecessary and more costly.
Question 270
A developer is updating the production version of an AWS Lambda function to fix a defect. The developer has tested the updated code in a test environment. The developer wants to slowly roll out the updates to a small subset of production users before rolling out the changes to all users. Only 10% of the users should be initially exposed to the new code in production.
Which solution will meet these requirements?
A. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function trigger. Configure the traffic weights in the trigger between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
B. Create a new Lambda function that uses the updated code. Create a Lambda alias for the production Lambda function. Configure the Lambda alias to send 90% of the traffic to the production Lambda function, and send 10% of the traffic to the test Lambda function.
C. Update the Lambda code and create a new version of the Lambda function. Create a Lambda proxy integration. Configure the Lambda proxy to split traffic between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
D. Update the Lambda code and create a new version of the Lambda function. Create a Lambda function alias. Configure the traffic weights in the Lambda alias between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
Show Answer
Correct Answer: D
Explanation: AWS Lambda supports weighted traffic shifting by using aliases that point to two published function versions. After publishing a new version, configure a Lambda alias with routing weights so 90% of invocations go to the current production version and 10% go to the new version. Triggers and Lambda proxy integrations do not provide this version-weighting capability, and aliases route between versions of the same function, not different functions.
Question 271
A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance.
Which solution will meet these requirements?
A. Configure the fleet of EC2 instances to use encrypted EBS volumes to store data.
B. Configure the application to write all data to an encrypted Amazon S3 bucket.
C. Configure a custom encryption algorithm for the application that will encrypt and decrypt all data.
D. Configure an Amazon Machine Image (AMI) that has an encrypted root volume and store the data to ephemeral disks.
Show Answer
Correct Answer: A
Explanation: Amazon EBS encryption provides transparent encryption at rest using AWS KMS and is handled by the underlying infrastructure, so applications do not need to implement encryption themselves and performance impact is minimal. Encrypted EBS volumes can be created at deployment time and directly satisfy the requirement to encrypt sensitive data stored on attached EBS volumes. Writing to Amazon S3 changes the storage architecture and adds network latency, custom application encryption adds CPU overhead, and ephemeral instance store disks are not a suitable replacement for the stated EBS-based design.
Question 272
An application that runs on AWS receives messages from an Amazon Simple Queue Service (Amazon SQS) queue and processes the messages in batches. The application sends the data to another SQS queue to be consumed by another legacy application. The legacy system can take up to 5 minutes to process some transaction data.
A developer wants to ensure that there are no out-of-order updates in the legacy system. The developer cannot alter the behavior of the legacy system.
Which solution will meet these requirements?
A. Use an SQS FIFO queue. Configure the visibility timeout value.
B. Use an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the DelaySeconds values.
C. Use an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the visibility timeout value.
D. Use an SQS FIFO queue. Configure the DelaySeconds value.
Show Answer
Correct Answer: A
Explanation: A FIFO queue guarantees message ordering, which prevents out-of-order updates in the legacy system. The visibility timeout should be configured to exceed the maximum processing time (up to 5 minutes) so that a message is not made available to another consumer before processing completes. DelaySeconds delays initial delivery and does not ensure ordered processing or prevent concurrent reprocessing. Standard queues do not guarantee ordering.
Question 273
A company is building a new application that runs on AWS and uses Amazon API Gateway to expose APIs. Teams of developers are working on separate components of the application in parallel. The company wants to publish an API without an integrated backend so that teams that depend on the application backend can continue the development work before the API backend development is complete.
Which solution will meet these requirements?
A. Create API Gateway resources and set the integration type value to MOCK. Configure the method integration request and integration response to associate a response with an HTTP status code. Create an API Gateway stage and deploy the API.
B. Create an AWS Lambda function that returns mocked responses and various HTTP status codes. Create API Gateway resources and set the integration type value to AWS_PROXY. Deploy the API.
C. Create an EC2 application that returns mocked HTTP responses. Create API Gateway resources and set the integration type value to AWS. Create an API Gateway stage and deploy the API.
D. Create API Gateway resources and set the integration type value set to HTTP_PROXY. Add mapping templates and deploy the API. Create an AWS Lambda layer that returns various HTTP status codes. Associate the Lambda layer with the API deployment.
Show Answer
Correct Answer: A
Explanation: API Gateway supports a MOCK integration specifically for creating endpoints that return configured responses without requiring any backend integration. This is intended for API-first development, allowing dependent teams to continue development before the backend is implemented. The other options require a backend (Lambda or EC2) or misuse integration types and Lambda layers.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.