A developer is building a three-tier web application that should be able to handle a minimum of 5000 requests per minute. Requirements state that the web tier should be completely stateless while the application maintains session state for the users.
How can session data be externalized, keeping latency at the LOWEST possible value?
A. Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.
B. Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.
C. Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for session data storage.
D. Create an Amazon DynamoDB table, then implement session handling at the application level to leverage the table for session data storage.
Show Answer
Correct Answer: C
Explanation: Amazon ElastiCache for Memcached provides an in-memory, distributed cache with very low latency, making it well suited for externalizing session state while keeping the web tier stateless and supporting high request rates. RDS and DynamoDB add higher latency than an in-memory cache for session lookups, and a shared file system is not an appropriate low-latency session store.
Question 37
A company is building a social media application. A developer is modifying an AWS Lambda function that updates a database with data that tracks each user's online activity. A web application server uses the AWS SDK to invoke the Lambda function.
The developer has tested the new Lambda code and is ready to deploy the code into production. However, the developer wants to allow only a small percentage of the invocations from the AWS SDK to call the new code.
Which solution will meet these requirements?
A. Configure a Lambda version that has a specific weight value for the updated Lambda function.
B. Create an alias for the Lambda function. Configure a specific weight value for the updated version.
C. Create an Application Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
D. Create a Network Load Balancer. Specify weighted target groups for the original Lambda function and the updated Lambda function.
Show Answer
Correct Answer: B
Explanation: Use AWS Lambda versions with an alias configured for weighted routing. Publish the new code as a new version, point an alias to the stable version, and configure the alias routing configuration to send only a small percentage of invocations to the new version (canary deployment). The application continues invoking the alias through the AWS SDK, and Lambda splits traffic according to the configured weights. Lambda versions themselves do not have weights; aliases do. Load balancers are unnecessary for direct Lambda SDK invocations.
Question 39
A developer published a change to a new version of an AWS Lambda function. To test the change, the developer must route 50% of the traffic to the new version and 60% of the traffic to the current version.
What is the MOST operationally efficient way to meet this requirement?
A. Create two Amazon Route 53 records that use a simple routing policy to route traffic to the different versions of the Lambda function. Create another Route 53 record that uses a weighted routing policy to route 50% of the traffic to each simple routing record. Test the Lambda function by using the weighted routing record.
B. Create an Amazon API Gateway API with a POST method that is integrated with the Lambda function. Add a stage variable that includes the version of the Lambda function. Add a canary release that will override the version variable 50% of the time. Deploy and test the Lambda function through the API Gateway stage.
C. Create a Lambda function alias. Set the weight to 50% for the current version and 50% for the new version. Set the event source mappings for the Lambda function to point to the alias.
D. Update the event source mappings for the Lambda function. In the mappings, set the weight to 50% for the current version and 50% for the new version.
Show Answer
Correct Answer: C
Explanation: AWS Lambda aliases support weighted routing between two published function versions, allowing a percentage of invocations to go to the new version while the remainder goes to the current version. Pointing event sources or clients to the alias provides the most operationally efficient way to perform a canary-style test. Route 53 does not route directly between Lambda versions, API Gateway canary releases are unnecessary for this requirement, and event source mappings do not support weighted version routing.
Question 40
A company has an Amazon DynamoDB table that contains records of users that have signed up for a trial of the company’s product. The company is using a spreadsheet to track data about the product trial. The company needs to ensure the spreadsheet is automatically updated with the latest information when individual trials begin, are updated, or finish.
Which solution will meet these requirements?
A. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to old image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
B. Create a DynamoDB Accelerator (DAX) cluster from the table. Set the view type to new image. Create an AWS Lambda function that uses the cluster data to update the spreadsheet. Subscribe the Lambda function to the cluster.
C. Enable a DynamoDB stream for the table. Set the view type to new image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
D. Enable a DynamoDB stream for the table. Set the view type to old image. Create an AWS Lambda function that uses the stream data to update the spreadsheet. Subscribe the Lambda function to the stream.
Show Answer
Correct Answer: C
Explanation: DynamoDB Streams capture item-level changes (inserts, updates, and deletes) and can directly trigger AWS Lambda. Using the stream with the view type set to New image provides the updated item after creates and updates, allowing the Lambda function to synchronize the spreadsheet with the latest trial information. DAX is an in-memory cache and does not provide change event subscriptions.
Question 41
A company is developing a new application that uses Amazon EC2, Amazon S3, and AWS Lambda resources. The company wants to allow employees to access the AWS Management Console by using existing credentials that the company stores and manages in an on-premises Microsoft Active Directory. Each employee must have a specific level of access to the AWS resources that is based on the employee’s role.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure AWS Directory Service to create an Active Directory in AWS Directory Service for Microsoft Active Directory. Establish a trust relationship with the on-premises Active Directory. Configure IAM roles and trust policies to give the employees access to the AWS resources.
B. Use LDAP to directly integrate the on-premises Active Directory with AWS Identity and Access Management (IAM). Map Active Directory groups to IAM roles to control access to AWS resources.
C. Implement a custom identity broker to authenticate users into the on-premises Active Directory. Configure the identity broker to use AWS Security Token Service (AWS STS) to grant authorized users IAM role based access to the AWS resources.
D. Configure Amazon Cognito to federate users into the on-premises Active Directory. Use Cognito user pools to manage user identities and to manage user access to the AWS resources.
Show Answer
Correct Answer: A
Explanation: AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) can establish a trust with the existing on-premises Active Directory, allowing employees to sign in with existing credentials and use IAM roles for role-based access to the AWS Management Console and AWS resources. This is the managed approach with the least operational overhead. IAM does not directly integrate with LDAP (eliminating B), a custom identity broker with STS requires significantly more development and maintenance (C), and Amazon Cognito is intended primarily for application user authentication rather than workforce access to the AWS Management Console (D).
Question 42
A developer created an AWS Lambda function named ProcessMessages. The Lambda function is invoked asynchronously when a message is published to an Amazon Simple Notification Service (Amazon SNS) topic named InputTopic. The developer uses a second SNS topic named ErrorTopic to handle alerts of failures for other services.
The developer wants to receive notifications from the ErrorTopic SNS topic when the ProcessMessages Lambda function fails to process a message.
Which solution will meet this requirement?
A. Configure a subscription for the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the ProcessMessages Lambda function as the endpoint.
B. Configure a failure destination for the ProcessMessages Lambda function. Specify the Amazon Resource Name (ARN) of the ErrorTopic SNS topic as the destination ARN.
C. Configure a trigger for the ProcessMessages Lambda function. Specify the ErrorTopic SNS topic as the trigger topic. Configure a filter policy on the topic for failures
D. Configure a delivery policy on the ErrorTopic SNS topic. Configure a filter policy for failures. Specify the Lambda function as the input endpoint.
Show Answer
Correct Answer: B
Explanation: For asynchronous Lambda invocations (such as from Amazon SNS), you can configure an asynchronous invocation failure destination. When the Lambda function exhausts its retry attempts and still fails, Lambda sends an invocation record to the configured destination. Setting the failure destination of the ProcessMessages function to the ErrorTopic SNS topic ensures notifications are published there. The other options misuse SNS subscriptions, triggers, or delivery policies, which do not configure Lambda asynchronous failure handling.
Question 43
A developer is creating an application that uses an AWS Lambda function to transform and load data from an Amazon S3 bucket. When the developer tests the application, the developer finds that some invocations of the Lambda function are slower than others.
The developer needs to update the Lambda function to have predictable invocation durations that run with low latency. Any initialization activities, such as loading libraries and instantiating clients, must run during allocation time rather than during actual function invocations.
Which combination of steps will meet these requirements? (Choose two.)
A. Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.
B. Configure provisioned concurrency for the Lambda function to have the necessary number of execution environments.
C. Use the $LATEST version of the Lambda function.
D. Configure reserved concurrency for the Lambda function to have the necessary number of execution environments.
E. Deploy changes, and publish a new version of the Lambda function.
Show Answer
Correct Answer: B, E
Explanation: Provisioned concurrency pre-initializes Lambda execution environments so initialization code runs during allocation rather than on request, reducing cold starts and providing predictable low-latency invocations. Provisioned concurrency can be configured only on a published version or alias, not on $LATEST, so the function must be deployed and a new version published before enabling it.
Question 44
A company is building an application to accept data from customers. The data must be encrypted at rest and in transit.
The application uses an Amazon API Gateway API that resolves to AWS Lambda functions. The Lambda functions store the data in an Amazon Aurora MySQL DB cluster. The application worked properly during testing.
A developer configured an Amazon CloudFront distribution with field-level encryption that uses an AWS Key Management Service (AWS KMS) key. After the configuration of the distribution, the application behaved unexpectedly. All the data in the database changed from plaintext to ciphertext.
The developer must ensure that the data is not stored in the database as the ciphertext from the CloudFront field-level encryption.
Which solution will meet this requirement?
A. Change the CloudFront Viewer protocol policy from “HTTP and HTTPS” to “HTTPS only.”
B. Add a Lambda function that uses the KMS key to decrypt the data fields before saving the data to the database.
C. Enable encryption on the DB cluster by using the same KMS key that is used in CloudFront.
D. Request and deploy a new SSL certificate to use with the CloudFront distribution.
Show Answer
Correct Answer: B
Explanation: CloudFront field-level encryption encrypts designated fields at the edge before forwarding the request to the origin. The origin application must decrypt those fields before processing or storing them. Adding decryption logic in a Lambda function using the appropriate KMS-backed key/material before writing to Aurora ensures data is stored as plaintext while remaining encrypted in transit and at rest where applicable.
Question 45
A developer needs to build a workflow to handle messages that are sent to an Amazon Simple Queue Service (Amazon SQS) queue. When a message reaches the queue, the workflow must implement a delay before invoking an AWS Lambda function to process the message.
Which solution will meet this requirement in the MOST operationally efficient way?
A. Create an AWS Step Functions state machine to process the SQS queue. Use a Wait state to delay the Lambda function’s processing for the required number of seconds after message delivery to the SQS queue. Use Amazon EventBridge to invoke the state machine every 5 minutes.
B. Configure the Lambda function to poll the SQS queue. Update the Lambda code to republish each message with a custom attribute that contains a future time when the message should be fully processed. Update the Lambda code to fully process messages when the custom attribute’s future time has passed.
C. Set the DelaySeconds value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
D. Set the Visibility Timeout value of the SQS queue to be the number of seconds required to delay delivery of the messages. Add an event source mapping for the Lambda function. Specify the SQS queue as a source.
Show Answer
Correct Answer: C
Explanation: Use Amazon SQS queue delay (DelaySeconds) to delay message delivery before Lambda receives the message through an event source mapping. This is the simplest managed solution with no custom polling or orchestration. Visibility timeout delays redelivery after receipt, not initial delivery. Step Functions and custom republishing add unnecessary operational complexity.
Question 46
A video streaming company has a pipe in Amazon EventBridge Pipes that uses an Amazon Simple Queue Service (Amazon SQS) queue as an event source. The pipe publishes all source events to a target EventBridge event bus. Before events are published, the pipe uses an AWS Lambda function to retrieve the stream status of each event from a database and adds the stream status to each source event.
The company wants the pipe to publish events to the event bus only if the video stream has a status of ready.
Which solution will meet these requirements?
A. Add a filter step to the pipe that will match on a stream status of ready.
B. Update the Lambda function to return only video streams that have a status of ready.
C. Include a filter for a status of ready in all EventBridge rules that subscribe to the event bus.
D. Add an input transformer to the pipe output that filters streams that have a status of ready.
Show Answer
Correct Answer: B
Explanation: EventBridge Pipes applies filtering before the optional enrichment step. Because the stream status is retrieved and added by the Lambda enrichment function, the pipe's filter cannot match on that field. To ensure only events with a stream status of 'ready' are published to the target event bus, the Lambda enrichment should return only qualifying events (or effectively drop non-ready ones). Filtering in EventBridge rules happens after the event has already been published to the bus, and an input transformer reshapes data rather than filtering events.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.