A developer is writing an application in AWS Lambda. To simplify testing and deployments, the developer needs the database connection string to be easily changed without modifying the Lambda code.
How can this requirement be met?
A. Store the connection string as a secret in AWS Secrets Manager.
B. Store the connection string in an IAM user account.
C. Store the connection string in AWS KMS.
D. Store the connection string as a Lambda layer.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is designed to store and manage sensitive configuration values such as database connection strings. A Lambda function can read the secret at runtime, allowing the connection string to be updated without changing or redeploying the Lambda code. IAM users do not store application configuration, AWS KMS provides encryption rather than secret storage, and Lambda layers are for shared code and dependencies, not runtime configuration.
Question 32
A company is launching a photo sharing application on AWS. Users use the application to upload images to an Amazon S3 bucket. When users upload images, an AWS Lambda function creates thumbnail versions of the images and stores the thumbnail versions in another S3 bucket.
During development, a developer notices that the Lambda function takes more than 2 minutes to complete the thumbnail process. The company needs alll images to be processed in less than 30 seconds.
What should the developer do to meet these requirements?
A. Increase the virtual CPUs (vCPUs) for the Lambda function to use 10 vCPUs.
B. Change Lambda function instance type to use m6a.4xlarge.
C. Configure the Lambda function to increase the amount of memory.
D. Configure burstable performance for the Lambda function.
Show Answer
Correct Answer: C
Explanation: AWS Lambda allocates CPU power proportionally to the configured memory. Increasing the function's memory also increases available CPU, which can significantly reduce CPU-intensive image processing time. Lambda does not allow selecting vCPU counts directly, changing to EC2 instance types, or configuring burstable performance.
Question 33
An application that is running on Amazon EC2 instances stores data in an Amazon S3 bucket. All the data must be encrypted in transit.
How can a developer ensure that all traffic to the S3 bucket is encrypted?
A. Install certificates on the EC2 instances.
B. Create a private VPC endpoint.
C. Configure the S3 bucket with server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
D. Create an S3 bucket policy that denies traffic when the value for the aws:SecureTransport condition key is false.
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure encryption in transit. The aws:SecureTransport condition key evaluates whether the request uses HTTPS (SSL/TLS). A bucket policy that denies requests when aws:SecureTransport is false enforces encrypted transport for all access. Installing certificates on EC2 is not how S3 TLS is enforced, a VPC endpoint does not by itself require TLS, and SSE-KMS encrypts data at rest, not in transit.
Question 34
Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon DynamoDB table.
How can each microservice be granted the minimum privileges?
A. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
B. Set ECS_ENABLE_TASK_IAM ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoD
C. Set ECS_ENABLE_TASK_IAM ROLE to true on EC2 instance boot in the ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
D. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
Show Answer
Correct Answer: C
Explanation: On Amazon ECS with the EC2 launch type, enabling task IAM roles (ECS_ENABLE_TASK_IAM_ROLE=true) allows each task/containerized microservice to assume its own IAM role. This supports least-privilege access by giving the Aurora-reading service only the permissions it needs and the DynamoDB-reading service only DynamoDB read permissions. Granting permissions to the EC2 instance profile would share permissions across all tasks, violating least privilege. Disabling task IAM roles prevents using per-task IAM roles.
Question 35
An AWS Lambda function that handles application requests uses the default Lambda logging mechanism to log the timestamp, processing time, and status of requests.
A developer needs to create Amazon CloudWatch metrics based on the logs. The developer needs to write the metrics to a custom CloudWatch metrics namespace.
Which solution will meet these requirements?
A. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
B. Use Amazon CloudWatch RUM to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
C. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using JSON format.
D. Use the CloudWatch embedded metric format (EMF) for the structure of the log statements to generate custom CloudWatch metrics.
Show Answer
Correct Answer: D
Explanation: CloudWatch Embedded Metric Format (EMF) lets a Lambda function write specially structured log entries that CloudWatch automatically extracts into custom CloudWatch metrics in the specified namespace. Logs Insights is a query service and does not itself generate metrics from standard logs, and CloudWatch RUM is unrelated to Lambda log metric extraction.
Question 36
A developer is building a three-tier web application that should be able to handle a minimum of 5000 requests per minute. Requirements state that the web tier should be completely stateless while the application maintains session state for the users.
How can session data be externalized, keeping latency at the LOWEST possible value?
A. Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.
B. Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.
C. Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for session data storage.
D. Create an Amazon DynamoDB table, then implement session handling at the application level to leverage the table for session data storage.
Show Answer
Correct Answer: C
Explanation: Amazon ElastiCache for Memcached provides an in-memory, distributed cache with very low latency, making it well suited for externalizing session state while keeping the web tier stateless and supporting high request rates. RDS and DynamoDB add higher latency than an in-memory cache for session lookups, and a shared file system is not an appropriate low-latency session store.
Question 37
A company is building a social media application. A developer is modifying an AWS Lambda function that updates a database with data that tracks each user's online activity. A web application server uses the AWS SDK to invoke the Lambda function.
The developer has tested the new Lambda code and is ready to deploy the code into production. However, the developer wants to allow only a small percentage of the invocations from the AWS SDK to call the new code.
Which solution will meet these requirements?
A. Configure a Lambda version that has a specific weight value for the updated Lambda function.
B. Create an alias for the Lambda function. Configure a specific weight value for the updated version.
C. Create an Application Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
D. Create a Network Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
Show Answer
Correct Answer: B
Explanation: Use AWS Lambda versions with an alias configured for weighted routing. Publish the new code as a new version, point an alias to the stable version, and configure the alias routing configuration to send only a small percentage of invocations to the new version (canary deployment). The application continues invoking the alias through the AWS SDK, and Lambda splits traffic according to the configured weights. Lambda versions themselves do not have weights; aliases do. Load balancers are unnecessary for direct Lambda SDK invocations.
Question 38
An application is experiencing performance issues based on increased demand. This increased demand is on read-only historical records pulled from an Amazon RDS-hosted database with custom views and queries. A developer must improve performance without changing the database structure.
Which approach will improve performance and MINIMIZE management overhead?
A. Deploy Amazon DynamoDB, move all the data, and point to DynamoDB.
B. Deploy Amazon ElastiCache (Redis OSS) and cache the data for the application.
C. Deploy Memcached on Amazon EC2 and cache the data for the application.
D. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve cache performance.
Show Answer
Correct Answer: B
Explanation: Amazon ElastiCache for Redis is a fully managed in-memory cache that can cache frequently accessed read-only historical query results from Amazon RDS without changing the database schema. It minimizes management overhead compared with self-managed Memcached on EC2. Moving data to DynamoDB would require significant application and data model changes, and DynamoDB Accelerator (DAX) only accelerates DynamoDB, not Amazon RDS.
Question 39
A developer published a change to a new version of an AWS Lambda function. To test the change, the developer must route 50% of the traffic to the new version and 60% of the traffic to the current version.
What is the MOST operationally efficient way to meet this requirement?
A. Create two Amazon Route 53 records that use a simple routing policy to route traffic to the different versions of the Lambda function. Create another Route 53 record that uses a weighted routing policy to route 50% of the traffic to each simple routing record. Test the Lambda function by using the weighted routing record.
B. Create an Amazon API Gateway API with a POST method that is integrated with the Lambda function. Add a stage variable that includes the version of the Lambda function. Add a canary release that will override the version variable 50% of the time. Deploy and test the Lambda function through the API Gateway stage.
C. Create a Lambda function alias. Set the weight to 50% for the current version and 50% for the new version. Set the event source mappings for the Lambda function to point to the alias.
D. Update the event source mappings for the Lambda function. In the mappings, set the weight to 50% for the current version and 50% for the new version.
Show Answer
Correct Answer: C
Explanation: AWS Lambda aliases support weighted routing between two published function versions, allowing a percentage of invocations to go to the new version while the remainder goes to the current version. Pointing event sources or clients to the alias provides the most operationally efficient way to perform a canary-style test. Route 53 does not route directly between Lambda versions, API Gateway canary releases are unnecessary for this requirement, and event source mappings do not support weighted version routing.
Question 40
A company has an Amazon DynamoDB table that contains records of users that have signed up for a trial of the company’s product. The company is using a spreadsheet to track data about the product trial. The company needs to ensure the spreadsheet is automatically updated with the latest information when individual trials begin, are updated, or finish.
Which solution will meet these requirements?
A. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to old image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
B. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to new image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
C. Enable a DynamoDB stream for the table. Set the view type to new image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
D. Enable a DynamoDB stream for the table. Set the view type to old image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
Show Answer
Correct Answer: C
Explanation: DynamoDB Streams capture item-level changes (inserts, updates, and deletes) and can directly trigger AWS Lambda. Using the stream with the view type set to New image provides the updated item after creates and updates, allowing the Lambda function to synchronize the spreadsheet with the latest trial information. DAX is an in-memory cache and does not provide change event subscriptions.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.