A company is developing a new application that uses Amazon EC2, Amazon S3, and AWS Lambda resources. The company wants to allow employees to access the AWS Management Console by using existing credentials that the company stores and manages in an on-premises Microsoft Active Directory. Each employee must have a specific level of access to the AWS resources that is based on the employee’s role.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure AWS Directory Service to create an Active Directory in AWS Directory Service for Microsoft Active Directory. Establish a trust relationship with the on-premises Active Directory. Configure IAM roles and trust policies to give the employees access to the AWS resources.
B. Use LDAP to directly integrate the on-premises Active Directory with AWS Identity and Access Management (IAM). Map Active Directory groups to IAM roles to control access to AWS resources.
C. Implement a custom identity broker to authenticate users into the on-premises Active Directory. Configure the identity broker to use AWS Security Token Service (AWS STS) to grant authorized users IAM role based access to the AWS resources.
D. Configure Amazon Cognito to federate users into the on-premises Active Directory. Use Cognito user pools to manage user identities and to manage user access to the AWS resources.
Show Answer
Correct Answer: A
Explanation: The requirement is federated AWS Management Console access using existing on‑premises Microsoft Active Directory credentials with minimal operational overhead. AWS Directory Service for Microsoft Active Directory (or AD Connector) provides a managed, native integration with on‑prem AD, supports trust relationships, and works directly with IAM roles for role‑based access to AWS resources. This avoids custom development and ongoing maintenance. IAM does not natively support LDAP integration (eliminating B), a custom identity broker adds significant operational complexity (eliminating C), and Amazon Cognito is intended primarily for application user authentication rather than AWS Console access (eliminating D).
Question 42
A developer created an AWS Lambda function named ProcessMessages. The Lambda function is invoked asynchronously when a message is published to an Amazon Simple Notification Service (Amazon SNS) topic named InputTopic. The developer uses a second SNS topic named ErrorTopic to handle alerts of failures for other services.
The developer wants to receive notifications from the ErrorTopic SNS topic when the ProcessMessages Lambda function fails to process a message.
Which solution will meet this requirement?
A. Configure a subscription for the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the ProcessMessages Lambda function as the endpoint.
B. Configure a failure destination for the ProcessMessages Lambda function. Specify the Amazon Resource Name (ARN) of the ErrorTopic SNS topic as the destination ARN.
C. Configure a trigger for the ProcessMessages Lambda function. Specify the ErrorTopic SNS topic as the trigger topic. Configure a filter policy on the topic for failures
D. Configure a delivery policy on the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the Lambda function as the input endpoint.
Show Answer
Correct Answer: B
Explanation: For asynchronously invoked Lambda functions (such as those triggered by Amazon SNS), AWS Lambda supports failure destinations. By configuring a failure destination on the ProcessMessages Lambda function and specifying the ErrorTopic SNS ARN, Lambda will automatically publish a message to that topic whenever the function fails after retries. This directly satisfies the requirement to receive notifications on ErrorTopic when processing fails.
Question 43
A developer is creating an application that uses an AWS Lambda function to transform and load data from an Amazon S3 bucket. When the developer tests the application, the developer finds that some invocations of the Lambda function are slower than others.
The developer needs to update the Lambda function to have predictable invocation durations that run with low latency. Any initialization activities, such as loading libraries and instantiating clients, must run during allocation time rather than during actual function invocations.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.
B. Configure provisioned concurrency for the Lambda function to have the necessary number of execution environments.
C. Use the $LATEST version of the Lambda function.
D. Configure reserved concurrency for the Lambda function to have the necessary number of execution environments.
E. Deploy changes, and publish a new version of the Lambda function.
Show Answer
Correct Answer: B, E
Explanation: Provisioned concurrency keeps a specified number of Lambda execution environments initialized, eliminating cold starts and providing predictable, low-latency invocations. Provisioned concurrency can be applied only to a published version or alias, not $LATEST, so the function changes must be deployed and a new version published.
Question 44
A company is building an application to accept data from customers. The data must be encrypted at rest and in transit.
The application uses an Amazon API Gateway API that resolves to AWS Lambda functions. The Lambda functions store the data in an Amazon Aurora MySQL DB cluster. The application worked properly during testing.
A developer configured an Amazon CloudFront distribution with field-level encryption that uses an AWS Key Management Service (AWS KMS) key. After the configuration of the distribution, the application behaved unexpectedly. All the data in the database changed from plaintext to ciphertext.
The developer must ensure that the data is not stored in the database as the ciphertext from the CloudFront field-level encryption.
Which solution will meet this requirement?
A. Change the CloudFront Viewer protocol policy from “HTTP and HTTPS” to “HTTPS only.”
B. Add a Lambda function that uses the KMS key to decrypt the data fields before saving the data to the database.
C. Enable encryption on the DB cluster by using the same KMS key that is used in CloudFront.
D. Request and deploy a new SSL certificate to use with the CloudFront distribution.
Show Answer
Correct Answer: B
Explanation: CloudFront field-level encryption encrypts sensitive fields at the edge and forwards them encrypted to the origin. Because API Gateway and Lambda receive ciphertext, the data will be stored encrypted unless it is explicitly decrypted. To ensure plaintext is stored in the database while still encrypting data in transit, the application must decrypt the fields in Lambda using the appropriate KMS key before persisting them. Other options do not address field-level encryption behavior.
Question 45
A developer needs to build a workflow to handle messages that are sent to an Amazon Simple Queue Service (Amazon SQS) queue. When a message reaches the queue, the workflow must implement a delay before invoking an AWS Lambda function to process the message.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Create an AWS Step Functions state machine to process the SQS queue. Use a Wait state to delay the Lambda function’s processing for the required number of seconds after message delivery to the SQS queue. Use Amazon EventBridge to invoke the state machine every 5 minutes.
B. Configure the Lambda function to poll the SQS queue. Update the Lambda code to republish each message with a custom attribute that contains a future time when the message should be fully processed. Update the Lambda code to fully process messages when the custom attribute’s future time has passed.
C. Set the DelaySeconds value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
D. Set the Visibility Timeout value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
Show Answer
Correct Answer: C
Explanation: Amazon SQS natively supports message delivery delay through the DelaySeconds setting. By configuring this delay and using an event source mapping, AWS Lambda will automatically receive messages only after the delay expires, with no custom code or additional services required. This is the most operationally efficient solution compared to orchestrating workflows or managing delays in application code. Visibility Timeout does not delay initial delivery, and Step Functions or custom polling add unnecessary complexity.
Question 46
A video streaming company has a pipe in Amazon EventBridge Pipes that uses an Amazon Simple Queue Service (Amazon SQS) queue as an event source. The pipe publishes all source events to a target EventBridge event bus. Before events are published, the pipe uses an AWS Lambda function to retrieve the stream status of each event from a database and adds the stream status to each source event.
The company wants the pipe to publish events to the event bus only if the video stream has a status of ready.
Which solution will meet these requirements?
A. Add a filter step to the pipe that will match on a stream status of ready.
B. Update the Lambda function to return only video streams that have a status of ready.
C. Include a filter for a status of ready in all EventBridge rules that subscribe to the event bus.
D. Add an input transformer to the pipe output that filters streams that have a status of ready.
Show Answer
Correct Answer: A
Explanation: Amazon EventBridge Pipes supports an explicit filter step that evaluates the event payload after enrichment. Since the Lambda enrichment step adds the stream status to each event, the pipe can then filter on status = "ready" before sending events to the target event bus. This meets the requirement cleanly without modifying Lambda logic or pushing filtering responsibility downstream. Input transformers cannot filter, and filtering at EventBridge rules is too late because events would already be published to the bus.
Question 47
A development team has an Amazon API Gateway REST API that is backed by an AWS Lambda function.
Users have reported performance issues for the Lambda function. The development team identified the source of the issues as a cold start of the Lambda function. The development team needs to reduce the time needed for the Lambda function to initialize.
Which solution will meet this requirement?
A. Change the Lambda concurrency to reserved concurrency.
B. Increase the timeout of the Lambda function.
C. Increase the memory allocation of the Lambda function.
D. Configure provisioned concurrency for the Lambda function.
Show Answer
Correct Answer: D
Explanation: The performance issue is caused by Lambda cold starts, which occur when new execution environments must be initialized. Provisioned concurrency keeps a specified number of Lambda execution environments pre-initialized and ready to handle requests, effectively eliminating cold start latency. Reserved concurrency only limits scaling, increasing memory improves execution speed but does not reliably eliminate cold starts, and increasing timeout does not affect initialization time.
Question 48
A developer is building an application that includes an AWS Lambda function that is written in .NET Core. The Lambda function’s code needs to interact with Amazon DynamoDB tables and Amazon S3 buckets. The developer must minimize the Lambda function’s deployment time and invocation duration.
Which solution will meet these requirements?
A. Increase the Lambda function’s memory.
B. Include the entire AWS SDK for .NET in the Lambda function’s deployment package.
C. Include only the AWS SDK for .NET modules for DynamoDB and Amazon S3 in the Lambda function’s deployment package.
D. Configure the Lambda function to download the AWS SDK for .NET from an S3 bucket at runtime.
Show Answer
Correct Answer: C
Explanation: Including only the required AWS SDK for .NET modules (DynamoDB and Amazon S3) minimizes the deployment package size, which reduces cold start time, deployment time, and invocation duration. Including the full SDK or downloading it at runtime increases latency, and increasing memory does not address package size.
Question 49
A company’s application includes an Amazon DynamoDB table for product orders. The table has a primary partition key of orderId and has no sort key. The company is adding a new feature that requires the application to query the table by using the customerId attribute.
Which solution will provide this query functionality?
A. Change the existing primary key by setting customerId as the sort key.
B. Create a new global secondary index (GSI) on the table with a partition key of customerId.
C. Create a new local secondary index (LSI) on the table with a partition key of customerId.
D. Create a new local secondary index (LSI) on the table with a partition key of orderId and a sort key of customerId.
Show Answer
Correct Answer: B
Explanation: The table’s primary key cannot be changed after creation, and local secondary indexes must use the same partition key as the base table (orderId). To query efficiently by customerId, the correct approach is to add a global secondary index with customerId as the partition key, which allows queries across all items regardless of orderId.
Question 50
A company is developing a set of AWS Lambda functions to process data. The Lambda functions need to use a common third-party library as a dependency. The library is frequently updated with new features and bug fixes. The company wants to ensure that the Lambda functions always use the latest version of the library.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Store the dependency and the function code in an Amazon S3 bucket.
B. Create a Lambda layer that includes the library. Attach the layer to each Lambda function.
C. Install the dependency in an Amazon Elastic File System (Amazon EFS) file system. Attach the file system to each Lambda function.
D. Create a new Lambda function to load the library. Configure the existing Lambda functions to invoke the new Lambda function when the existing functions need to use the library.
Show Answer
Correct Answer: C
Explanation: Amazon EFS allows multiple Lambda functions to access a shared file system. When the third-party library is updated in EFS, all attached Lambda functions immediately use the latest version without redeploying code or updating layer versions. This best satisfies the requirement to always use the latest library with minimal operational effort. Lambda layers are immutable and require creating new versions and updating functions each time the library changes.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.