A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when requested, and only for a duration of 15 minutes.
How can the developer meet these requirements?
A. Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
B. Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
C. Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download the documents using HTTPS.
D. Modify the S3 bucket policy to only allow specific users to download the documents. Revert the change after 15 minutes.
Show Answer
Correct Answer: B
Explanation: A presigned Amazon S3 URL grants time-limited access to a specific object in a private bucket without making the bucket public or changing bucket policies. The application can authenticate the user, then generate a presigned URL with a 15-minute expiration using the AWS SDK. This satisfies the requirement for authenticated, temporary access.
Question 52
A developer is updating an Amazon API Gateway REST API to have a mock endpoint. The developer wants to update the integration request mapping template so the endpoint will respond to mock integration requests with specific HTTP status codes based on various conditions.
Which statement will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: B
Explanation: For API Gateway REST API mock integrations, the integration request mapping template can set a `statusCode` field conditionally (using Velocity Template Language such as `#if/#else`). API Gateway then uses that value to select the corresponding integration response and return the desired HTTP status code. This matches the documented mock integration pattern.
Question 53
A developer must cache dependent artifacts from Maven Central, a public package repository, as part of an application’s build pipeline. The build pipeline has an AWS CodeArtifact repository where artifacts of the build are published. The developer needs a solution that requires minimum changes to the build pipeline.
Which solution meets these requirements?
A. Modify the existing CodeAriifact repository to associate an upstream repository with the public package repository.
B. Create a new CodeAtfact repository that has an external connection to the public package repository.
C. Create a new CodeAifact domain that contains a new repository that has an external connection to the public package repository.
D. Modify the CodeAnifact repository resource policy to allow artifacts to be fetched from the public package repository.
Show Answer
Correct Answer: A
Explanation: AWS CodeArtifact supports associating an existing repository with an upstream repository. For Maven packages, configuring the existing CodeArtifact repository with an upstream (ultimately backed by an external connection to Maven Central) allows dependencies from Maven Central to be fetched and cached while keeping the same repository endpoint for the build pipeline, requiring minimal or no pipeline changes. Creating a new repository or domain would require pipeline reconfiguration, and a resource policy does not enable fetching from public repositories.
Question 54
A large company has its application components distributed across multiple AWS accounts. The company needs to collect and visualize trace data across these accounts.
What should be used to meet these requirements?
A. AWS X-Ray
B. Amazon CloudWatch
C. Amazon VPC flow logs
D. Amazon OpenSearch Service
Show Answer
Correct Answer: A
Explanation: AWS X-Ray is the AWS distributed tracing service designed to collect, analyze, and visualize trace data across distributed application components, including applications spanning multiple AWS accounts. Amazon CloudWatch provides metrics, logs, and monitoring rather than distributed request tracing. VPC Flow Logs capture network traffic metadata, and Amazon OpenSearch Service is a search and analytics engine, not a tracing service.
Question 55
A developer needs to write an AWS CloudFormation template on a local machine and deploy a CloudFormation stack to AWS.
What must the developer do to complete these tasks?
A. Install the AWS CLI. Configure the AWS CLI by using an IAM user name and password.
B. Install the AWS CLI. Configure the AWS CLI by using an SSH key.
C. Install the AWS CLI, Configure the AWS CLI by using an IAM user access key and secret key.
D. Install an AWS software development kit (SDK). Configure the SDK by using an X.509 certificate.
Show Answer
Correct Answer: C
Explanation: To deploy an AWS CloudFormation stack from a local machine, the developer should install the AWS CLI and configure it with IAM credentials consisting of an access key ID and secret access key (or equivalent supported credentials). IAM usernames/passwords are not used for CLI authentication, SSH keys are unrelated, and X.509 certificates are obsolete for this purpose.
Question 56
A developer is making changes to a custom application that uses AWS Elastic Beanstalk.
Which solutions will update the Elastic Beanstalk environment with the new application version after the developer completes the changes? (Choose two.)
A. Package the application code into a zip file. Use the AWS Management Console to upload the .zip file and deploy the packaged application.
B. Package the application code into a .tar file. Use the AWS Management Console to create a new application version from the .tar file. Update the environment by using the AWS CLI.
C. Package the application code into a .tar file. Use the AWS Management Console to upload the .tar file and deploy the packaged application.
D. Package the application code into a .zip file. Use the AWS CL to create a new application version from the .zip file and to update the environment.
E. Package the application code into a .zip file. Use the AWS Management Console to create a new application version from the .zip file. Rebuild the environment by using the AWS CLI.
Show Answer
Correct Answer: A, D
Explanation: Elastic Beanstalk application versions are typically uploaded as .zip bundles (or .war for Java). You can deploy directly from the Elastic Beanstalk console by uploading a .zip archive, or use the AWS CLI to create a new application version from a .zip archive and then update the environment. .tar is not the standard supported application bundle format for these workflows, and rebuilding an environment is not the correct way to deploy a new application version.
Question 57
A developer is troubleshooting a three-tier application, which is deployed on Amazon EC2 instances. There is a connectivity problem between the application servers and the database servers.
Which AWS services or tools should be used to identity the faulty component? (Choose two.)
A. AWS CloudTrail
B. AWS Trusted Advisor
C. Amazon VPC Flow Logs
D. Network access control lists
E. AWS Config rules
Show Answer
Correct Answer: C, D
Explanation: Amazon VPC Flow Logs help diagnose connectivity by showing accepted and rejected traffic between application and database instances. Reviewing Network ACLs can identify whether subnet-level stateless filtering is blocking the traffic. CloudTrail, Trusted Advisor, and Config are not primary tools for identifying network connectivity faults between EC2 tiers.
Question 58
A company runs continuous integration/continuous delivery (CI/CD) pipelines for its application on AWS CodePipeline. A developer must write unit tests and run them as part of the pipelines before staging the artifacts for testing.
How should the developer incorporate unit tests as part of CI/CD pipelines?
A. Create a separate CodePipeline pipeline to run unit tests.
B. Update the AWS CodeBuild build specification to include a phase for running unit tests.
C. Install the AWS CodeDeploy agent on an Amazon EC2 instance to run unit tests.
D. Create a testing branch in a git repository for the pipelines to run unit tests.
Show Answer
Correct Answer: B
Explanation: AWS CodeBuild is the build and test service integrated with CodePipeline. Unit tests are typically executed during the build stage by defining the appropriate commands in the buildspec.yml file, such as in the build or post_build phases. If the tests fail, the pipeline stops before artifacts are promoted to later stages. A separate pipeline, CodeDeploy agent, or a dedicated Git branch are not the standard mechanisms for incorporating unit tests into a CodePipeline workflow.
Question 59
A team has an Amazon API Gateway REST API that consists of a single resource and a GET method that is backed by an AWS Lambda integration.
A developer makes a change to the Lambda function and deploys the function as a new version. The developer needs to set up a process to test the new version of the function before using the new version in production. The tests must not affect the production REST API.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create a new resource in the REST API. Add a GET method to the new resource, and add a Lambda integration to the updated version of the Lambda function. Deploy the new version.
B. Create a new stage for the REST API. Create a stage variable. Assign the stage variable to the Lambda function. Set the API Gateway integrated Lambda function name to the stage variable. Deploy the new version.
C. Create a new REST API. Add a resource that has a single GET method that is integrated with the updated version of the Lambda function.
D. Update the Lambda integration of the existing GET method to point to the updated version of the Lambda function. Deploy the new version.
Show Answer
Correct Answer: B
Explanation: Creating a separate API Gateway stage and using a stage variable to reference the Lambda function version (or alias) allows the test stage to invoke the new Lambda version while the production stage continues using the existing version. This isolates testing from production and avoids duplicating resources or APIs, resulting in the least operational overhead.
Question 60
A developer is testing an AWS Lambda function that has an event source of an Amazon Simple Queue Service (Amazon SQS) queue. The developer notices that some of the messages the Lambda function processes re-appear in the queue while the messages are being processed.
The developer must correct this behavior.
Which solution will meet this requirement?
A. Increase the timeout of the Lambda function.
B. Increase the visibility timeout of the SQS queue.
C. Increase the memory allocation of the Lambda function.
D. Increase the batch size in the event source mapping.
Show Answer
Correct Answer: B
Explanation: When Lambda polls an SQS queue, a message is hidden only for the queue's visibility timeout. If the Lambda function takes longer than the visibility timeout to process the message, the message becomes visible again and can be delivered again while processing is still in progress. Increasing the SQS visibility timeout prevents the message from reappearing before processing completes. Increasing the Lambda timeout only allows the function to run longer but does not change SQS message visibility.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.