A company is developing a new application that uses Amazon EC2, Amazon S3, and AWS Lambda resources. The company wants to allow employees to access the AWS Management Console by using existing credentials that the company stores and manages in an on-premises Microsoft Active Directory. Each employee must have a specific level of access to the AWS resources that is based on the employee’s role.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure AWS Directory Service to create an Active Directory in AWS Directory Service for Microsoft Active Directory. Establish a trust relationship with the on-premises Active Directory. Configure IAM roles and trust policies to give the employees access to the AWS resources.
B. Use LDAP to directly integrate the on-premises Active Directory with AWS Identity and Access Management (IAM). Map Active Directory groups to IAM roles to control access to AWS resources.
C. Implement a custom identity broker to authenticate users into the on-premises Active Directory. Configure the identity broker to use AWS Security Token Service (AWS STS) to grant authorized users IAM role based access to the AWS resources.
D. Configure Amazon Cognito to federate users into the on-premises Active Directory. Use Cognito user pools to manage user identities and to manage user access to the AWS resources.
Show Answer
Correct Answer: A
Explanation: AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) can establish a trust with the existing on-premises Active Directory, allowing employees to sign in with existing credentials and use IAM roles for role-based access to the AWS Management Console and AWS resources. This is the managed approach with the least operational overhead. IAM does not directly integrate with LDAP (eliminating B), a custom identity broker with STS requires significantly more development and maintenance (C), and Amazon Cognito is intended primarily for application user authentication rather than workforce access to the AWS Management Console (D).
Question 42
A developer created an AWS Lambda function named ProcessMessages. The Lambda function is invoked asynchronously when a message is published to an Amazon Simple Notification Service (Amazon SNS) topic named InputTopic. The developer uses a second SNS topic named ErrorTopic to handle alerts of failures for other services.
The developer wants to receive notifications from the ErrorTopic SNS topic when the ProcessMessages Lambda function fails to process a message.
Which solution will meet this requirement?
A. Configure a subscription for the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the ProcessMessages Lambda function as the endpoint.
B. Configure a failure destination for the ProcessMessages Lambda function. Specify the Amazon Resource Name (ARN) of the ErrorTopic SNS topic as the destination ARN.
C. Configure a trigger for the ProcessMessages Lambda function. Specify the ErrorTopic SNS topic as the trigger topic. Configure a filter policy on the topic for failures
D. Configure a delivery policy on the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the Lambda function as the input endpoint.
Show Answer
Correct Answer: B
Explanation: For asynchronous Lambda invocations (such as from Amazon SNS), you can configure an asynchronous invocation failure destination. When the Lambda function exhausts its retry attempts and still fails, Lambda sends an invocation record to the configured destination. Setting the failure destination of the ProcessMessages function to the ErrorTopic SNS topic ensures notifications are published there. The other options misuse SNS subscriptions, triggers, or delivery policies, which do not configure Lambda asynchronous failure handling.
Question 43
A developer is creating an application that uses an AWS Lambda function to transform and load data from an Amazon S3 bucket. When the developer tests the application, the developer finds that some invocations of the Lambda function are slower than others.
The developer needs to update the Lambda function to have predictable invocation durations that run with low latency. Any initialization activities, such as loading libraries and instantiating clients, must run during allocation time rather than during actual function invocations.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.
B. Configure provisioned concurrency for the Lambda function to have the necessary number of execution environments.
C. Use the $LATEST version of the Lambda function.
D. Configure reserved concurrency for the Lambda function to have the necessary number of execution environments.
E. Deploy changes, and publish a new version of the Lambda function.
Show Answer
Correct Answer: B, E
Explanation: Provisioned concurrency pre-initializes Lambda execution environments so initialization code runs during allocation rather than on request, reducing cold starts and providing predictable low-latency invocations. Provisioned concurrency can be configured only on a published version or alias, not on $LATEST, so the function must be deployed and a new version published before enabling it.
Question 44
A company is building an application to accept data from customers. The data must be encrypted at rest and in transit.
The application uses an Amazon API Gateway API that resolves to AWS Lambda functions. The Lambda functions store the data in an Amazon Aurora MySQL DB cluster. The application worked properly during testing.
A developer configured an Amazon CloudFront distribution with field-level encryption that uses an AWS Key Management Service (AWS KMS) key. After the configuration of the distribution, the application behaved unexpectedly. All the data in the database changed from plaintext to ciphertext.
The developer must ensure that the data is not stored in the database as the ciphertext from the CloudFront field-level encryption.
Which solution will meet this requirement?
A. Change the CloudFront Viewer protocol policy from “HTTP and HTTPS” to “HTTPS only.”
B. Add a Lambda function that uses the KMS key to decrypt the data fields before saving the data to the database.
C. Enable encryption on the DB cluster by using the same KMS key that is used in CloudFront.
D. Request and deploy a new SSL certificate to use with the CloudFront distribution.
Show Answer
Correct Answer: B
Explanation: CloudFront field-level encryption encrypts designated fields at the edge before forwarding the request to the origin. The origin application must decrypt those fields before processing or storing them. Adding decryption logic in a Lambda function using the appropriate KMS-backed key/material before writing to Aurora ensures data is stored as plaintext while remaining encrypted in transit and at rest where applicable.
Question 45
A developer needs to build a workflow to handle messages that are sent to an Amazon Simple Queue Service (Amazon SQS) queue. When a message reaches the queue, the workflow must implement a delay before invoking an AWS Lambda function to process the message.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Create an AWS Step Functions state machine to process the SQS queue. Use a Wait state to delay the Lambda function’s processing for the required number of seconds after message delivery to the SQS queue. Use Amazon EventBridge to invoke the state machine every 5 minutes.
B. Configure the Lambda function to poll the SQS queue. Update the Lambda code to republish each message with a custom attribute that contains a future time when the message should be fully processed. Update the Lambda code to fully process messages when the custom attribute’s future time has passed.
C. Set the DelaySeconds value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
D. Set the Visibility Timeout value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
Show Answer
Correct Answer: C
Explanation: Use Amazon SQS queue delay (DelaySeconds) to delay message delivery before Lambda receives the message through an event source mapping. This is the simplest managed solution with no custom polling or orchestration. Visibility timeout delays redelivery after receipt, not initial delivery. Step Functions and custom republishing add unnecessary operational complexity.
Question 46
A video streaming company has a pipe in Amazon EventBridge Pipes that uses an Amazon Simple Queue Service (Amazon SQS) queue as an event source. The pipe publishes all source events to a target EventBridge event bus. Before events are published, the pipe uses an AWS Lambda function to retrieve the stream status of each event from a database and adds the stream status to each source event.
The company wants the pipe to publish events to the event bus only if the video stream has a status of ready.
Which solution will meet these requirements?
A. Add a filter step to the pipe that will match on a stream status of ready.
B. Update the Lambda function to return only video streams that have a status of ready.
C. Include a filter for a status of ready in all EventBridge rules that subscribe to the event bus.
D. Add an input transformer to the pipe output that filters streams that have a status of ready.
Show Answer
Correct Answer: B
Explanation: EventBridge Pipes applies filtering before the optional enrichment step. Because the stream status is retrieved and added by the Lambda enrichment function, the pipe's filter cannot match on that field. To ensure only events with a stream status of 'ready' are published to the target event bus, the Lambda enrichment should return only qualifying events (or effectively drop non-ready ones). Filtering in EventBridge rules happens after the event has already been published to the bus, and an input transformer reshapes data rather than filtering events.
Question 47
A development team has an Amazon API Gateway REST API that is backed by an AWS Lambda function.
Users have reported performance issues for the Lambda function. The development team identified the source of the issues as a cold start of the Lambda function. The development team needs to reduce the time needed for the Lambda function to initialize.
Which solution will meet this requirement?
A. Change the Lambda concurrency to reserved concurrency.
B. Increase the timeout of the Lambda function.
C. Increase the memory allocation of the Lambda function.
D. Configure provisioned concurrency for the Lambda function.
Show Answer
Correct Answer: D
Explanation: Provisioned concurrency keeps Lambda execution environments initialized and ready to serve requests, significantly reducing or eliminating cold-start latency. Reserved concurrency only guarantees available concurrency but does not pre-initialize execution environments. Increasing timeout does not affect initialization time, and increasing memory may improve execution speed and sometimes reduce init duration, but it does not address cold starts as effectively as provisioned concurrency.
Question 48
A developer is building an application that includes an AWS Lambda function that is written in .NET Core. The Lambda function’s code needs to interact with Amazon DynamoDB tables and Amazon S3 buckets. The developer must minimize the Lambda function’s deployment time and invocation duration.
Which solution will meet these requirements?
A. Increase the Lambda function’s memory.
B. Include the entire AWS SDK for .NET in the Lambda function’s deployment package.
C. Include only the AWS SDK for .NET modules for DynamoDB and Amazon S3 in the Lambda function’s deployment package.
D. Configure the Lambda function to download the AWS SDK for .NET from an S3 bucket at runtime.
Show Answer
Correct Answer: C
Explanation: Using only the required AWS SDK for .NET service modules (DynamoDB and Amazon S3) minimizes the deployment package size, which reduces deployment time and can improve Lambda cold-start initialization. Including the full SDK increases package size unnecessarily, increasing memory does not reduce package size, and downloading the SDK at runtime adds latency and complexity.
Question 49
A company’s application includes an Amazon DynamoDB table for product orders. The table has a primary partition key of orderId and has no sort key. The company is adding a new feature that requires the application to query the table by using the customerId attribute.
Which solution will provide this query functionality?
A. Change the existing primary key by setting customerId as the sort key.
B. Create a new global secondary index (GSI) on the table with a partition key of customerId.
C. Create a new local secondary index (LSI) on the table with a partition key of customerId.
D. Create a new local secondary index (LSI) on the table with a partition key of orderId and a sort key of customerId.
Show Answer
Correct Answer: B
Explanation: A Global Secondary Index (GSI) with customerId as its partition key allows efficient queries by customerId on an existing DynamoDB table. The table's primary key cannot be modified in place. A Local Secondary Index (LSI) must share the table's partition key (orderId), so it cannot use customerId as the partition key and does not support querying solely by customerId.
Question 50
A company is developing a set of AWS Lambda functions to process data. The Lambda functions need to use a common third-party library as a dependency. The library is frequently updated with new features and bug fixes. The company wants to ensure that the Lambda functions always use the latest version of the library.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Store the dependency and the function code in an Amazon S3 bucket.
B. Create a Lambda layer that includes the library. Attach the layer to each Lambda function.
C. Install the dependency in an Amazon Elastic File System (Amazon EFS) file system. Attach the file system to each Lambda function.
D. Create a new Lambda function to load the library. Configure the existing Lambda functions to invoke the new Lambda function when the existing functions need to use the library.
Show Answer
Correct Answer: B
Explanation: Lambda layers are the AWS-recommended mechanism for sharing common libraries across multiple Lambda functions. You package the dependency once and attach the layer to each function. When the library is updated, publish a new layer version and update the functions to use that version. This is more operationally efficient than duplicating code, using EFS for a simple dependency, or invoking another Lambda just to access a library.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.