A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when requested, and only for a duration of 15 minutes.
How can the developer meet these requirements?
A. Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
B. Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
C. Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download the documents using HTTPS.
D. Modify the S3 bucket policy to only allow specific users to download the documents. Revert the change after 15 minutes.
Show Answer
Correct Answer: B
Explanation: A presigned S3 URL provides time-limited, secure access to a private S3 object. By generating the URL with a 15-minute expiration using the AWS SDK, the application allows only authenticated users to download specific documents for the required duration without changing bucket policies or copying objects.
Question 52
A developer is updating an Amazon API Gateway REST API to have a mock endpoint. The developer wants to update the integration request mapping template so the endpoint will respond to mock integration requests with specific HTTP status codes based on various conditions.
Which statement will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: B
Explanation: In an API Gateway REST API with a MOCK integration, the HTTP status code is controlled in the integration response, and the integration request mapping template can set a value (for example, a variable in the request context or response body) that the integration response uses to select the status code. Option B correctly uses a Velocity Template Language (VTL) mapping template with conditional logic (#if / #else) to return different statusCode values for the mock response based on evaluated conditions, which is the documented and supported way to return specific HTTP status codes from a mock integration.
Question 53
A developer must cache dependent artifacts from Maven Central, a public package repository, as part of an application’s build pipeline. The build pipeline has an AWS CodeArtifact repository where artifacts of the build are published. The developer needs a solution that requires minimum changes to the build pipeline.
Which solution meets these requirements?
A. Modify the existing CodeAriifact repository to associate an upstream repository with the public package repository.
B. Create a new CodeAtfact repository that has an external connection to the public package repository.
C. Create a new CodeAifact domain that contains a new repository that has an external connection to the public package repository.
D. Modify the CodeAnifact repository resource policy to allow artifacts to be fetched from the public package repository.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact supports associating an existing repository with an upstream repository such as Maven Central. By adding Maven Central as an upstream to the current CodeArtifact repository, the build pipeline can transparently fetch and cache dependencies without changing repository endpoints or pipeline configuration. Creating new repositories or domains would require pipeline changes, and resource policies do not enable external package fetching.
Question 54
A large company has its application components distributed across multiple AWS accounts. The company needs to collect and visualize trace data across these accounts.
What should be used to meet these requirements?
A. AWS X-Ray
B. Amazon CloudWatch
C. Amazon VPC flow logs
D. Amazon OpenSearch Service
Show Answer
Correct Answer: A
Explanation: AWS X-Ray is designed to collect, trace, and visualize distributed application requests across multiple AWS accounts and services, making it the correct choice for cross-account trace data analysis. CloudWatch focuses on metrics and logs, VPC Flow Logs capture network traffic metadata, and OpenSearch is for search and log analytics rather than distributed tracing.
Question 55
A developer needs to write an AWS CloudFormation template on a local machine and deploy a CloudFormation stack to AWS.
What must the developer do to complete these tasks?
A. Install the AWS CLI. Configure the AWS CLI by using an IAM user name and password.
B. Install the AWS CLI. Configure the AWS CLI by using an SSH key.
C. Install the AWS CLI, Configure the AWS CLI by using an IAM user access key and secret key.
D. Install an AWS software development kit (SDK). Configure the SDK by using an X.509 certificate.
Show Answer
Correct Answer: C
Explanation: To deploy a CloudFormation stack from a local machine, the developer must use the AWS CLI. The AWS CLI authenticates using IAM credentials in the form of an access key ID and secret access key. Usernames/passwords and SSH keys are not used for AWS API authentication, and X.509 certificates are deprecated for this purpose.
Question 56
A developer is making changes to a custom application that uses AWS Elastic Beanstalk.
Which solutions will update the Elastic Beanstalk environment with the new application version after the developer completes the changes? (Choose two.)
A. Package the application code into a zip file. Use the AWS Management Console to upload the .zip file and deploy the packaged application.
B. Package the application code into a .tar file. Use the AWS Management Console to create a new application version from the .tar file. Update the environment by using the AWS CLI.
C. Package the application code into a .tar file. Use the AWS Management Console to upload the .tar file and deploy the packaged application.
D. Package the application code into a .zip file. Use the AWS CL to create a new application version from the .zip file and to update the environment.
E. Package the application code into a .zip file. Use the AWS Management Console to create a new application version from the .zip file. Rebuild the environment by using the AWS CLI.
Show Answer
Correct Answer: A, D
Explanation: Elastic Beanstalk application versions are uploaded as .zip files. You can deploy a new version either directly from the AWS Management Console by uploading and deploying the .zip, or by using the AWS CLI to create a new application version from the .zip and update the environment. .tar files are not supported for EB deployments, and rebuilding the environment is unnecessary for updating an application version.
Question 57
A developer is troubleshooting a three-tier application, which is deployed on Amazon EC2 instances. There is a connectivity problem between the application servers and the database servers.
Which AWS services or tools should be used to identity the faulty component? (Choose two.)
A. AWS CloudTrail
B. AWS Trusted Advisor
C. Amazon VPC Flow Logs
D. Network access control lists
E. AWS Config rules
Show Answer
Correct Answer: C, D
Explanation: Amazon VPC Flow Logs provide visibility into accepted and rejected network traffic between the application and database instances, helping pinpoint where connectivity is failing. Reviewing Network Access Control Lists helps identify whether subnet-level inbound or outbound rules are blocking the required traffic, which is a common cause of connectivity issues in multi-tier EC2 architectures.
Question 58
A company runs continuous integration/continuous delivery (CI/CD) pipelines for its application on AWS CodePipeline. A developer must write unit tests and run them as part of the pipelines before staging the artifacts for testing.
How should the developer incorporate unit tests as part of CI/CD pipelines?
A. Create a separate CodePipeline pipeline to run unit tests.
B. Update the AWS CodeBuild build specification to include a phase for running unit tests.
C. Install the AWS CodeDeploy agent on an Amazon EC2 instance to run unit tests.
D. Create a testing branch in a git repository for the pipelines to run unit tests.
Show Answer
Correct Answer: B
Explanation: In AWS CI/CD, unit tests are typically executed during the build stage. AWS CodeBuild supports defining multiple phases in the buildspec.yml file, including commands to run unit tests before packaging or staging artifacts. This integrates testing directly into the existing CodePipeline workflow without adding extra pipelines or services.
Question 59
A team has an Amazon API Gateway REST API that consists of a single resource and a GET method that is backed by an AWS Lambda integration.
A developer makes a change to the Lambda function and deploys the function as a new version. The developer needs to set up a process to test the new version of the function before using the new version in production. The tests must not affect the production REST API.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new resource in the REST API. Add a GET method to the new resource, and add a Lambda integration to the updated version of the Lambda function. Deploy the new version.
B. Create a new stage for the REST API. Create a stage variable. Assign the stage variable to the Lambda function. Set the API Gateway integrated Lambda function name to the stage variable. Deploy the new version.
C. Create a new REST API. Add a resource that has a single GET method that is integrated with the updated version of the Lambda function.
D. Update the Lambda integration of the existing GET method to point to the updated version of the Lambda function. Deploy the new version.
Show Answer
Correct Answer: B
Explanation: Creating a separate API Gateway stage allows testing without impacting production. By using a stage variable to reference the Lambda function (or alias/version), the same API configuration can route traffic to the new Lambda version in the test stage. This avoids duplicating resources or APIs and requires minimal operational overhead.
Question 60
A developer is testing an AWS Lambda function that has an event source of an Amazon Simple Queue Service (Amazon SQS) queue. The developer notices that some of the messages the Lambda function processes re-appear in the queue while the messages are being processed.
The developer must correct this behavior.
Which solution will meet this requirement?
A. Increase the timeout of the Lambda function.
B. Increase the visibility timeout of the SQS queue.
C. Increase the memory allocation of the Lambda function.
D. Increase the batch size in the event source mapping.
Show Answer
Correct Answer: B
Explanation: Messages reappear because their SQS visibility timeout expires before the Lambda function finishes processing them. Increasing the SQS queue’s visibility timeout prevents messages from becoming visible and being re-delivered while the Lambda invocation is still running.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.