A developer is writing an application in AWS Lambda. To simplify testing and deployments, the developer needs the database connection string to be easily changed without modifying the Lambda code.
How can this requirement be met?
A. Store the connection string as a secret in AWS Secrets Manager.
B. Store the connection string in an IAM user account.
C. Store the connection string in AWS KMS.
D. Store the connection string as a Lambda layer.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is designed to store and manage sensitive configuration values such as database connection strings. The secret can be updated independently of the Lambda code, allowing easy changes across environments without redeploying the function. IAM users, KMS, and Lambda layers are not appropriate mechanisms for managing mutable configuration values.
Question 32
A company is launching a photo sharing application on AWS. Users use the application to upload images to an Amazon S3 bucket. When users upload images, an AWS Lambda function creates thumbnail versions of the images and stores the thumbnail versions in another S3 bucket.
During development, a developer notices that the Lambda function takes more than 2 minutes to complete the thumbnail process. The company needs alll images to be processed in less than 30 seconds.
What should the developer do to meet these requirements?
A. Increase the virtual CPUs (vCPUs) for the Lambda function to use 10 vCPUs.
B. Change Lambda function instance type to use m6a.4xlarge.
C. Configure the Lambda function to increase the amount of memory.
D. Configure burstable performance for the Lambda function.
Show Answer
Correct Answer: C
Explanation: In AWS Lambda, CPU and network performance scale proportionally with the amount of memory allocated. Increasing the memory allocation gives the function more CPU power, which can significantly reduce processing time for CPU‑intensive tasks like image resizing. The other options are invalid because Lambda does not allow selecting instance types, vCPU counts, or burstable performance settings.
Question 33
An application that is running on Amazon EC2 instances stores data in an Amazon S3 bucket. All the data must be encrypted in transit.
How can a developer ensure that all traffic to the S3 bucket is encrypted?
A. Install certificates on the EC2 instances.
B. Create a private VPC endpoint.
C. Configure the S3 bucket with server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
D. Create an S3 bucket policy that denies traffic when the value for the aws:SecureTransport condition key is false.
Show Answer
Correct Answer: D
Explanation: Encryption in transit to Amazon S3 is achieved by using HTTPS (TLS). An S3 bucket policy that denies requests when aws:SecureTransport is false enforces HTTPS-only access, ensuring all traffic to the bucket is encrypted in transit. Other options do not guarantee encryption in transit for all access.
Question 34
Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon DynamoDB table.
How can each microservice be granted the minimum privileges?
A. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
B. Set ECS_ENABLE_TASK_IAM ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoD
C. Set ECS_ENABLE_TASK_IAM ROLE to true on EC2 instance boot in the ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
D. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
Show Answer
Correct Answer: C
Explanation: To grant minimum privileges, each ECS task (microservice) must have its own IAM task role rather than sharing the EC2 instance profile. Setting ECS_ENABLE_TASK_IAM_ROLE to true enables task IAM roles. Then the first microservice can assume a task role with read-only access to Aurora, and the second can assume a different task role with read-only access to DynamoDB. This follows the principle of least privilege and avoids over-permissioning the EC2 instance role.
Question 35
An AWS Lambda function that handles application requests uses the default Lambda logging mechanism to log the timestamp, processing time, and status of requests.
A developer needs to create Amazon CloudWatch metrics based on the logs. The developer needs to write the metrics to a custom CloudWatch metrics namespace.
Which solution will meet these requirements?
A. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
B. Use Amazon CloudWatch RUM to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
C. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using JSON format.
D. Use the CloudWatch embedded metric format (EMF) for the structure of the log statements to generate custom CloudWatch metrics.
Show Answer
Correct Answer: D
Explanation: CloudWatch Embedded Metric Format (EMF) allows a Lambda function to write structured log entries that automatically generate custom CloudWatch metrics in a specified custom namespace. By formatting the log statements in EMF, CloudWatch extracts the metric values directly from the logs without requiring CloudWatch Logs Insights queries, JSON-only parsing, or services like CloudWatch RUM, which is intended for frontend monitoring.
Question 36
A developer is building a three-tier web application that should be able to handle a minimum of 5000 requests per minute. Requirements state that the web tier should be completely stateless while the application maintains session state for the users.
How can session data be externalized, keeping latency at the LOWEST possible value?
A. Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.
B. Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.
C. Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for session data storage.
D. Create an Amazon DynamoDB table, then implement session handling at the application level to leverage the table for session data storage.
Show Answer
Correct Answer: C
Explanation: To keep the web tier stateless while maintaining session state with the lowest possible latency, session data should be stored in an in-memory data store. Amazon ElastiCache (Memcached) provides sub-millisecond latency and is designed for high-throughput, ephemeral session storage. RDS, shared file systems, and DynamoDB all introduce higher latency compared to in-memory caching, making them less optimal for this requirement.
Question 37
A company is building a social media application. A developer is modifying an AWS Lambda function that updates a database with data that tracks each user's online activity. A web application server uses the AWS SDK to invoke the Lambda function.
The developer has tested the new Lambda code and is ready to deploy the code into production. However, the developer wants to allow only a small percentage of the invocations from the AWS SDK to call the new code.
Which solution will meet these requirements?
A. Configure a Lambda version that has a specific weight value for the updated Lambda function.
B. Create an alias for the Lambda function. Configure a specific weight value for the updated version.
C. Create an Application Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
D. Create a Network Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
Show Answer
Correct Answer: B
Explanation: AWS Lambda supports traffic shifting by using versions and aliases. An alias can be configured with a routing configuration that sends a small, specified percentage of invocations to a new version while the rest continue to use the existing version. This enables gradual or canary deployments directly when the function is invoked via the AWS SDK. Versions alone cannot receive traffic without an alias, and load balancers are unnecessary and not appropriate for SDK-based Lambda invocations.
Question 38
An application is experiencing performance issues based on increased demand. This increased demand is on read-only historical records pulled from an Amazon RDS-hosted database with custom views and queries. A developer must improve performance without changing the database structure.
Which approach will improve performance and MINIMIZE management overhead?
A. Deploy Amazon DynamoDB, move all the data, and point to DynamoDB.
B. Deploy Amazon ElastiCache (Redis OSS) and cache the data for the application.
C. Deploy Memcached on Amazon EC2 and cache the data for the application.
D. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve cache performance.
Show Answer
Correct Answer: B
Explanation: The workload is read-only historical data with increased read demand, and the database structure cannot be changed. Using Amazon ElastiCache (Redis OSS) adds a managed, in-memory cache in front of Amazon RDS to offload read traffic and improve performance with minimal operational overhead. Redis is fully managed by AWS, highly available, and well-suited for caching query results. Running Memcached on EC2 adds management and availability overhead, DynamoDB would require data migration and schema changes, and DAX is only for DynamoDB—not RDS.
Question 39
A developer published a change to a new version of an AWS Lambda function. To test the change, the developer must route 50% of the traffic to the new version and 60% of the traffic to the current version.
What is the MOST operationally efficient way to meet this requirement?
A. Create two Amazon Route 53 records that use a simple routing policy to route traffic to the different versions of the Lambda function. Create another Route 53 record that uses a weighted routing policy to route 50% of the traffic to each simple routing record. Test the Lambda function by using the weighted routing record.
B. Create an Amazon API Gateway API with a POST method that is integrated with the Lambda function. Add a stage variable that includes the version of the Lambda function. Add a canary release that will override the version variable 50% of the time. Deploy and test the Lambda function through the API Gateway stage.
C. Create a Lambda function alias. Set the weight to 50% for the current version and 50% for the new version. Set the event source mappings for the Lambda function to point to the alias.
D. Update the event source mappings for the Lambda function. In the mappings, set the weight to 50% for the current version and 50% for the new version.
Show Answer
Correct Answer: C
Explanation: The operationally efficient and correct approach is to use a Lambda alias with weighted routing between versions. Lambda aliases natively support traffic shifting (for example, 50/50) without additional infrastructure. Event source mappings do not support weighting, Route 53 cannot directly route to Lambda versions, and API Gateway canaries add unnecessary complexity. Although the percentages in the question are inconsistent (50% + 60%), the intent is clearly to split traffic between versions, which is best achieved with an alias.
Question 40
A company has an Amazon DynamoDB table that contains records of users that have signed up for a trial of the company’s product. The company is using a spreadsheet to track data about the product trial. The company needs to ensure the spreadsheet is automatically updated with the latest information when individual trials begin, are updated, or finish.
Which solution will meet these requirements?
A. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to old image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
B. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to new image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
C. Enable a DynamoDB stream for the table. Set the view type to new image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
D. Enable a DynamoDB stream for the table. Set the view type to old image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
Show Answer
Correct Answer: C
Explanation: DynamoDB Streams is designed to capture item-level changes (inserts, updates, deletes) in near real time and can trigger AWS Lambda automatically. Using the stream with the view type set to NEW_IMAGE provides the latest version of each record whenever a trial begins, is updated, or ends, allowing the Lambda function to update the spreadsheet accordingly. DAX is a caching service and does not provide change notifications, so options using DAX are incorrect.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.