A developer is creating an AWS Lambda function that needs network access to private resources in a VPC.
Which solution will provide this access with the LEAST operational overhead?
A. Attach the Lambda function to the VPC through private subnets. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function.
B. Configure the Lambda function to route traffic through a VPN connection. Create a security group that allows network access to the private resources. Associate the security group with the Lambda function.
C. Configure a VPC endpoint connection for the Lambda function. Set up the VPC endpoint to route traffic through a NAT gateway.
D. Configure an AWS PrivateLink endpoint for the private resources. Configure the Lambda function to reference the PrivateLink endpoint.
Show Answer
Correct Answer: A
Explanation: To allow an AWS Lambda function to access private resources in a VPC with the least operational overhead, attach the Lambda function to the VPC by selecting private subnets and an appropriate security group. Lambda natively supports VPC networking through Hyperplane-managed ENIs, making this the standard and simplest approach. VPN routing is unnecessary for resources already in the VPC, a VPC endpoint does not provide general VPC access for Lambda, and AWS PrivateLink is for exposing specific services rather than enabling Lambda access to arbitrary private VPC resources.
Question 27
A developer is deploying an application on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The developer is using a Docker container with an Ubuntu image.
The developer needs to implement a solution to store application data that is available from multiple ECS tasks. The application data must remain accessible after the container is terminated.
Which solution will meet these requirements?
A. Attach an Amazon FSx for Windows File Server volume to the container definition.
B. Specify the DockerVolumeConfiguration parameter in the ECS task definition to attach a Docker volume.
C. Create an Amazon Elastic File System (Amazon EFS) file system. Specify the mountPoints attribute and the efsVolumeConfiguration attribute in the ECS task definition.
D. Create an Amazon Elastic Block Store (Amazon EBS) volume. Specify the mount point configuration in the ECS task definition.
Show Answer
Correct Answer: C
Explanation: AWS Fargate supports Amazon EFS for persistent shared storage across multiple ECS tasks. Configure an EFS file system and reference it in the ECS task definition using efsVolumeConfiguration, then mount it into the container with mountPoints. Docker volumes are not suitable for shared persistent storage across Fargate tasks, FSx for Windows File Server is intended for Windows workloads, and EBS volumes are not the appropriate shared storage solution for multiple Fargate tasks.
Question 28
A team deploys an AWS CloudFormation template to update a stack that already included an Amazon DynamoDB table. However, before the deployment of the update, the team changed the name of the DynamoDB table on the template by mistake. The DeletionPolicy attribute for all resources has the default value.
What will be the result of this mistake?
A. CloudFormation will create a new table and will delete the existing table.
B. CloudFormation will create a new table and will keep the existing table.
C. CloudFormation will overwrite the existing table and will rename the existing table.
D. CloudFormation will keep the existing table and will not create a new table.
Show Answer
Correct Answer: A
Explanation: Changing the DynamoDB table Name property causes a resource replacement because the table name is an immutable property. During the stack update, CloudFormation creates a new table with the new name and, because the DeletionPolicy is the default (Delete), deletes the old table after successful replacement.
Question 29
A developer has an application container, an AWS Lambda function, and an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function uses the SQS queue as an event source. The Lambda function makes a call to a third-party machine learning API when the function is invoked. The response from the third-party API can take up to 60 seconds to return.
The Lambda function's timeout value is currently 65 seconds. The developer has noticed that the Lambda function sometimes processes duplicate messages from the SQS queue.
What should the developer do to ensure that the Lambda function does not process duplicate messages?
A. Configure the Lambda function with a larger amount of memory.
B. Configure an increase in the Lambda function’s timeout value.
C. Configure the SQS queue’s delivery delay value to be greater than the maximum time it takes to call the third-party API.
D. Configure the SQS queue’s visibility timeout value to be greater than the maximum time it takes to call the third-party API.
Show Answer
Correct Answer: D
Explanation: When Lambda polls SQS, received messages remain hidden only for the queue's visibility timeout. If processing takes longer than the visibility timeout, the message can become visible again and be delivered a second time, causing duplicate processing. Since the third-party API can take up to 60 seconds, the SQS visibility timeout should be configured to exceed the maximum processing time (and in practice should also account for Lambda execution time). Increasing Lambda memory or timeout does not prevent SQS redelivery, and delivery delay only postpones initial delivery of new messages.
Question 30
A developer is building an image-processing application that includes an AWS Lambda function. The Lambda function moves images from one AWS service to another AWS service for image processing. For images that are larger than 2 MB, the Lambda function returns the following error: “Task timed out after 3.01 seconds.”
The developer needs to resolve the error without modifying the Lambda function code.
Which solution will meet these requirements?
A. Increase the Lambda function’s timeout value.
B. Configure the Lambda function to not move images that are larger than 2 M
C. Request a concurrency quota increase for the Lambda function.
D. Configure provisioned concurrency for the Lambda function.
Show Answer
Correct Answer: A
Explanation: The error explicitly indicates the Lambda execution exceeded its configured timeout of about 3 seconds. Larger images take longer to move between AWS services, so increasing the Lambda function timeout resolves the issue without changing the code. Increasing concurrency or using provisioned concurrency does not extend execution time, and skipping larger images does not satisfy the requirement to process them.
Question 31
A developer is writing an application in AWS Lambda. To simplify testing and deployments, the developer needs the database connection string to be easily changed without modifying the Lambda code.
How can this requirement be met?
A. Store the connection string as a secret in AWS Secrets Manager.
B. Store the connection string in an IAM user account.
C. Store the connection string in AWS KMS.
D. Store the connection string as a Lambda layer.
Show Answer
Correct Answer: A
Explanation: AWS Secrets Manager is designed to store and manage sensitive configuration values such as database connection strings. A Lambda function can read the secret at runtime, allowing the connection string to be updated without changing or redeploying the Lambda code. IAM users do not store application configuration, AWS KMS provides encryption rather than secret storage, and Lambda layers are for shared code and dependencies, not runtime configuration.
Question 32
A company is launching a photo sharing application on AWS. Users use the application to upload images to an Amazon S3 bucket. When users upload images, an AWS Lambda function creates thumbnail versions of the images and stores the thumbnail versions in another S3 bucket.
During development, a developer notices that the Lambda function takes more than 2 minutes to complete the thumbnail process. The company needs alll images to be processed in less than 30 seconds.
What should the developer do to meet these requirements?
A. Increase the virtual CPUs (vCPUs) for the Lambda function to use 10 vCPUs.
B. Change Lambda function instance type to use m6a.4xlarge.
C. Configure the Lambda function to increase the amount of memory.
D. Configure burstable performance for the Lambda function.
Show Answer
Correct Answer: C
Explanation: AWS Lambda allocates CPU power proportionally to the configured memory. Increasing the function's memory also increases available CPU, which can significantly reduce CPU-intensive image processing time. Lambda does not allow selecting vCPU counts directly, changing to EC2 instance types, or configuring burstable performance.
Question 33
An application that is running on Amazon EC2 instances stores data in an Amazon S3 bucket. All the data must be encrypted in transit.
How can a developer ensure that all traffic to the S3 bucket is encrypted?
A. Install certificates on the EC2 instances.
B. Create a private VPC endpoint.
C. Configure the S3 bucket with server-side encryption with AWS KMS managed encryption keys (SSE-KMS).
D. Create an S3 bucket policy that denies traffic when the value for the aws:SecureTransport condition key is false.
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure encryption in transit. The aws:SecureTransport condition key evaluates whether the request uses HTTPS (SSL/TLS). A bucket policy that denies requests when aws:SecureTransport is false enforces encrypted transport for all access. Installing certificates on EC2 is not how S3 TLS is enforced, a VPC endpoint does not by itself require TLS, and SSE-KMS encrypts data at rest, not in transit.
Question 34
Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon DynamoDB table.
How can each microservice be granted the minimum privileges?
A. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
B. Set ECS_ENABLE_TASK_IAM ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoD
C. Set ECS_ENABLE_TASK_IAM ROLE to true on EC2 instance boot in the ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
D. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
Show Answer
Correct Answer: C
Explanation: On Amazon ECS with the EC2 launch type, enabling task IAM roles (ECS_ENABLE_TASK_IAM_ROLE=true) allows each task/containerized microservice to assume its own IAM role. This supports least-privilege access by giving the Aurora-reading service only the permissions it needs and the DynamoDB-reading service only DynamoDB read permissions. Granting permissions to the EC2 instance profile would share permissions across all tasks, violating least privilege. Disabling task IAM roles prevents using per-task IAM roles.
Question 35
An AWS Lambda function that handles application requests uses the default Lambda logging mechanism to log the timestamp, processing time, and status of requests.
A developer needs to create Amazon CloudWatch metrics based on the logs. The developer needs to write the metrics to a custom CloudWatch metrics namespace.
Which solution will meet these requirements?
A. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
B. Use Amazon CloudWatch RUM to generate custom metrics from the logs by using CloudWatch embedded metric format (EMF).
C. Use Amazon CloudWatch Logs Insights to generate custom metrics from the logs by using JSON format.
D. Use the CloudWatch embedded metric format (EMF) for the structure of the log statements to generate custom CloudWatch metrics.
Show Answer
Correct Answer: D
Explanation: CloudWatch Embedded Metric Format (EMF) lets a Lambda function write specially structured log entries that CloudWatch automatically extracts into custom CloudWatch metrics in the specified namespace. Logs Insights is a query service and does not itself generate metrics from standard logs, and CloudWatch RUM is unrelated to Lambda log metric extraction.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.