An application that runs on AWS receives messages from an Amazon Simple Queue Service (Amazon SQS) queue and processes the messages in batches. The application sends the data to another SQS queue to be consumed by another legacy application. The legacy system can take up to 5 minutes to process some transaction data.
A developer wants to ensure that there are no out-of-order updates in the legacy system. The developer cannot alter the behavior of the legacy system.
Which solution will meet these requirements?
A. Use an SQS FIFO queue. Configure the visibility timeout value.
B. Use an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the DelaySeconds values.
C. Use an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the visibility timeout value.
D. Use an SQS FIFO queue. Configure the DelaySeconds value.
Show Answer
Correct Answer: A
Explanation: The requirement is to prevent out-of-order updates in the legacy system, which cannot be modified. Amazon SQS FIFO queues guarantee strict message ordering within a message group, unlike standard queues. Because the legacy system can take up to 5 minutes to process a message, configuring the visibility timeout ensures that once a message is consumed, it will not be delivered to another consumer until processing completes, preventing concurrent or reordered processing. DelaySeconds does not control processing order, and standard queues do not guarantee ordering.
Question 273
A company is building a new application that runs on AWS and uses Amazon API Gateway to expose APIs. Teams of developers are working on separate components of the application in parallel. The company wants to publish an API without an integrated backend so that teams that depend on the application backend can continue the development work before the API backend development is complete.
Which solution will meet these requirements?
A. Create API Gateway resources and set the integration type value to MOCK. Configure the method integration request and integration response to associate a response with an HTTP status code. Create an API Gateway stage and deploy the API.
B. Create an AWS Lambda function that returns mocked responses and various HTTP status codes. Create API Gateway resources and set the integration type value to AWS_PROXY. Deploy the API.
C. Create an EC2 application that returns mocked HTTP responses. Create API Gateway resources and set the integration type value to AWS. Create an API Gateway stage and deploy the API.
D. Create API Gateway resources and set the integration type value set to HTTP_PROXY. Add mapping templates and deploy the API. Create an AWS Lambda layer that returns various HTTP status codes. Associate the Lambda layer with the API deployment.
Show Answer
Correct Answer: A
Explanation: API Gateway MOCK integrations allow publishing an API without any backend by returning predefined responses and HTTP status codes. This lets dependent teams develop against the API contract while the real backend is still under development. The other options require creating and operating backend components, which is unnecessary for this requirement.
Question 274
A developer manages three AWS accounts. Each account contains an Amazon RDS DB instance in a private subnet. The developer needs to define users in each database in a consistent way. The developer must ensure that the same users are created and updated later in all three accounts.
Which solution will meet these requirements with the MOST operational efficiency?
A. Create an AWS CloudFormation template. Declare the users in the template. Attach the users to the database. Deploy the template in each account.
B. Create an AWS CloudFormation template that contains a custom resource to create the users in the database. Deploy the template in each account.
C. Write a script that creates the users. Deploy an Amazon EC2 instance in each account to run the script on the databases. Run the script in each account.
D. Implement an AWS Lambda function that creates the users in the database. Provide the function with the details of all three accounts.
Show Answer
Correct Answer: B
Explanation: CloudFormation does not natively manage database-level objects such as RDS users. To ensure consistent creation and future updates of users across multiple AWS accounts with high operational efficiency, a CloudFormation custom resource can be used to run custom logic (for example, via Lambda) that connects to each RDS instance and manages users. This keeps user management declarative, repeatable, and centrally controlled through CloudFormation stacks deployed in each account. Other options either cannot manage DB users directly or require more manual operational overhead.
Question 275
A company wants to test its web application more frequently. The company deploys the application by using a separate AWS CloudFormation stack for each environment. The company deploys the same CloudFormation template to each stack as the application progresses through the development lifecycle.
A developer needs to build in notifications for the quality assurance (QA) team. The developer wants the notifications to occur for new deployments in the final preproduction environment.
Which solution will meet these requirements?
A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the QA team to the Amazon SNS topic. Update the CloudFormation stack options to point to the SNS topic in the pre-production environment.
B. Create an AWS Lambda function that notifies the QA team. Create an Amazon EventBridge rule to invoke the Lambda function on the default event bus. Filter the events on the CloudFormation service and on the CloudFormation stack Amazon Resource Name (ARN).
C. Create an Amazon CloudWatch alarm that monitors the metrics from CloudFormation. Filter the metrics on the stack name and the stack status. Configure the CloudWatch alarm to notify the QA team.
D. Create an AWS Lambda function that notifies the QA team. Configure the event source mapping to receive events from CloudFormation. Specify the filtering values to limit invocations to the desired CloudFormation stack.
Show Answer
Correct Answer: A
Explanation: AWS CloudFormation natively supports stack event notifications through SNS by specifying NotificationARNs on a stack. By configuring an SNS topic only on the preproduction stack and subscribing the QA team, they will receive notifications for new deployments in that environment without additional components. This directly meets the requirement with the simplest and most appropriate native integration.
Question 276
A developer is writing an application that will retrieve sensitive data from a third-party system. The application will format the data into a PDF file. The PDF file could be more than 1 MB. The application will encrypt the data to disk by using AWS Key Management Service (AWS KMS). The application will decrypt the file when a user requests to download it. The retrieval and formatting portions of the application are complete.
The developer needs to use the GenerateDataKey API to encrypt the PDF file so that the PDF file can be decrypted later. The developer needs to use an AWS KMS symmetric customer managed key for encryption.
Which solutions will meet these requirements?
A. Write the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.
B. Write the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.
C. Write the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API.
D. Write the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API.
Show Answer
Correct Answer: A
Explanation: For encrypting large data (such as a PDF >1 MB) with AWS KMS, the correct pattern is envelope encryption. The GenerateDataKey API returns a plaintext data key and an encrypted (ciphertext) data key. The application must use the plaintext data key locally with a symmetric encryption algorithm to encrypt the PDF file, then discard the plaintext key from memory. The encrypted data key should be stored alongside the encrypted file so it can be decrypted later using KMS. KMS Encrypt is not suitable for large files, and plaintext keys should never be written to disk. Therefore, option A meets all requirements.
Question 277
A developer is creating an application that reads and writes to multiple Amazon S3 buckets. The application will be deployed to an Amazon EC2 instance. The developer wants to make secure API requests from the EC2 instances without the need to manage the security credentials for the application. The developer needs to apply the principle of least privilege.
Which solution will meet these requirements?
A. Create an IAM user. Create access keys and secret keys for the user. Associate the user with an IAM policy that allows s3:* permissions.
B. Associate the EC2 instance with an IAM role that has an IAM policy that allows s3:ListBucket and s3:*Object permissions for specific S3 buckets.
C. Associate the EC2 instance with an IAM role that has an AmazonS3FullAccess AWS managed policy.
D. Create a bucket policy on the S3 bucket that allows s3:ListBucket and s3:*Object permissions to the EC2 instance.
Show Answer
Correct Answer: B
Explanation: The application runs on EC2 and must access S3 securely without managing credentials, which is best achieved by using an IAM role attached to the EC2 instance. Option B uses an IAM role with a custom policy that grants only the required S3 permissions (ListBucket and object-level actions) scoped to specific buckets, which satisfies both security best practices and the principle of least privilege. The other options either require managing credentials, grant overly broad permissions, or rely solely on bucket policies without an execution role.
Question 278
A developer is migrating an application to Amazon Elastic Kubernetes Service (Amazon EKS). The developer migrates the application to Amazon Elastic Container Registry (Amazon ECR) with an EKS cluster. As part of the application migration to a new backend, the developer creates a new AWS account. The developer makes configuration changes to the application to point the application to the new AWS account and to use new backend resources. The developer successfully tests the changes within the application by deploying the pipeline.
The Docker image build and the pipeline deployment are successful, but the application is still connecting to the old backend. The developer finds that the application's configuration is still referencing the original EKS cluster and not referencing the new backend resources.
Which reason can explain why the application is not connecting to the new resources?
A. The developer did not successfully create the new AWS account.
B. The developer added a new tag to the Docker image.
C. The developer did not update the Docker image tag to a new version.
D. The developer pushed the changes to a new Docker image tag.
Show Answer
Correct Answer: C
Explanation: If the Docker image tag was not updated, the EKS deployment will continue to pull and run the previously tagged image that contains the old configuration. Even though the pipeline succeeded, Kubernetes will not redeploy a new image if the tag is unchanged, so the application keeps connecting to the old backend.
Question 279
A company runs a batch processing application by using AWS Lambda functions and Amazon API Gateway APIs with deployment stages for development, user acceptance testing, and production. A development team needs to configure the APIs in the deployment stages to connect to third-party service endpoints.
Which solution will meet this requirement?
A. Store the third-party service endpoints in Lambda layers that correspond to the stage.
B. Store the third-party service endpoints in API Gateway stage variables that correspond to the stage.
C. Encode the third-party service endpoints as query parameters in the API Gateway request URL.
D. Store the third-party service endpoint for each environment in AWS AppConfig.
Show Answer
Correct Answer: B
Explanation: API Gateway stage variables are designed to hold stage-specific configuration values, such as third-party service endpoints, and can be referenced by the API integration or Lambda function at runtime. This allows each deployment stage (development, UAT, production) to connect to different endpoints without changing code. Lambda layers are for shared code, query parameters are not for configuration, and AWS AppConfig adds unnecessary complexity for simple endpoint differences.
Question 280
A company is using Amazon API Gateway to invoke a new AWS Lambda function. The company has Lambda function versions in its PROD and DEV environments. In each environment, there is a Lambda function alias pointing to the corresponding Lambda function version. API Gateway has one stage that is configured to point at the PROD alias.
The company wants to configure API Gateway to enable the PROD and DEV Lambda function versions to be simultaneously and distinctly available.
Which solution will meet these requirements?
A. Enable a Lambda authorizer for the Lambda function alias in API Gateway. Republish PROD and create a new stage for DEV. Create API Gateway stage variables for the PROD and DEV stages. Point each stage variable to the PROD Lambda authorizer to the DEV Lambda authorizer.
B. Set up a gateway response in API Gateway for the Lambda function alias. Republish PROD and create a new stage for DEV. Create gateway responses in API Gateway for PROD and DEV Lambda aliases.
C. Use an environment variable for the Lambda function alias in API Gateway. Republish PROD and create a new stage for development. Create API gateway environment variables for PROD and DEV stages. Point each stage variable to the PROD Lambda function alias to the DEV Lambda function alias.
D. Use an API Gateway stage variable to configure the Lambda function alias. Republish PROD and create a new stage for development. Create API Gateway stage variables for PROD and DEV stages. Point each stage variable to the PROD Lambda function alias and to the DEV Lambda function alias.
Show Answer
Correct Answer: D
Explanation: API Gateway can route to different Lambda versions or aliases by using stage variables. By defining a stage variable (for example, lambdaAlias) and referencing it in the Lambda integration ARN, each API Gateway stage (PROD and DEV) can point to a different Lambda alias. This allows the PROD and DEV Lambda function versions to be simultaneously and distinctly available using the same API configuration but different stages. The other options misuse authorizers, gateway responses, or environment variables, which do not control Lambda version routing in API Gateway.
Question 281
A company runs an application on AWS. The application stores data in an Amazon DynamoDB table. Some queries are taking a long time to run. These slow queries involve an attribute that is not the table's partition key or sort key.
The amount of data that the application stores in the DynamoDB table is expected to increase significantly. A developer must increase the performance of the queries.
Which solution will meet these requirements?
A. Increase the page size for each request by setting the Limit parameter to be higher than the default value. Configure the application to retry any request that exceeds the provisioned throughput.
B. Create a global secondary index (GSI). Set query attribute to be the partition key of the index.
C. Perform a parallel scan operation by issuing individual scan requests. In the parameters, specify the segment for the scan requests and the total number of segments for the parallel scan.
D. Turn on read capacity auto scaling for the DynamoDB table. Increase the maximum read capacity units (RCUs).
Show Answer
Correct Answer: B
Explanation: The slow queries filter on an attribute that is not part of the table’s primary key. As data volume grows, such queries require inefficient scans. Creating a global secondary index (GSI) with that attribute as the partition key enables efficient Query operations, significantly improving performance and scalability. The other options either do not address non-key access patterns or only add capacity without fixing the inefficient query design.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.