A company is launching a feature that uses an HTTP API built with Amazon API Gateway and AWS Lambda. An API Gateway endpoint performs several independent tasks that run in a Lambda function. The independent tasks can take up to 10 minutes in total to finish running.
Users report that the endpoint sometimes returns an HTTP 604 status code. The Lambda function invocations are successful.
Which solution will stop the endpoint from returning the HTTP 504 status cade?
A. Increase the Lambda function’s timeout value.
B. Increase the reserved concurrency of the Lambda function.
C. Increase the memory that is available to the Lambda function.
D. Refactor the Lambda function to start an AWS Step Functions state machine.
Show Answer
Correct Answer: D
Explanation: API Gateway has a hard integration timeout (about 29 seconds for REST/HTTP APIs). Even though the Lambda function can run longer (up to 15 minutes) and completes successfully, API Gateway times out first and returns an HTTP 504 error. Increasing Lambda timeout, memory, or concurrency does not change the API Gateway timeout limit. Refactoring the Lambda to start an AWS Step Functions state machine allows the API call to return quickly while the long-running tasks continue asynchronously, preventing the 504 error.
Question 62
A company runs an application on Amazon EC2 instances in an Auto Scaling group. The application experiences variable loads throughout each day.
The company needs to collect detailed metrics from the EC2 instances to right-size the instances. The company also wants to monitor custom application metrics to ensure the application is performing efficiently.
Which solution will meet these requirements?
A. Install the AWS X-Ray agent on the instances. Configure the agent to collect the EC2 instance metrics and the custom application metrics.
B. Install the Amazon CloudWatch agent on the instances. Configure the agent to collect the EC2 instance metrics and the custom application metrics.
C. Install the AWS SDK in the application’s cade. Update the application to use the AWS SDK to collect and publish the EC2 instance metrics and the custom application metrics.
D. Configure AWS CloudTrail to capture and analyze the EC2 instance metrics and the custom application metrics.
Show Answer
Correct Answer: B
Explanation: The Amazon CloudWatch agent can collect detailed EC2 instance metrics (such as memory, disk, and CPU beyond basic metrics) and publish custom application metrics to CloudWatch without changing application code. This supports right-sizing Auto Scaling instances and monitoring application performance. AWS X-Ray is for tracing, CloudTrail is for API auditing, and using the SDK would require code changes and is unnecessary.
Question 63
A developer compiles an AWS Lambda function and packages the result as a .zip file. The developer uses the Functions page on the Lambda console to attempt to upload the local packaged .zip file. When pushing the package ta Lambda, the console returns the following error:
Which solutions can the developer use to publish the code? (Choose two.)
A. Upload the package to Amazon 3. Use the Functions page on the Lambda console to upload the package from the S3 location.
B. Create an AWS Support ticket to increase the maximum package size.
C. Use the update-function-code AWS CLI command. Pass the --publish parameter.
D. Repackage the Lambda function as a Docker container image. Upload the image to Amazon Elastic Container Registry (Amazon ECR). Create a new Lambda function by using the Lambda console. Reference the image that is deployed to Amazon ECR.
E. Sign the .zip file digitally. Create a new Lambda function by using the Lambda console. Update the configuration of the new Lambda function to include the Amazon Resource Name (ARN) of the code signing configuration.
Show Answer
Correct Answer: A, D
Explanation: The Lambda console has a size limit for direct .zip uploads. Uploading the deployment package to Amazon S3 and referencing it from the console bypasses the local upload limit. Alternatively, packaging the function as a container image and deploying it via Amazon ECR supports much larger artifacts and avoids .zip size constraints. Creating a support ticket or signing the code does not address package size limits, and the CLI does not bypass the underlying size restriction.
Question 64
In a move toward using microservices, a company’s management team has asked all development teams to build their services so that API requests depend only on that service’s data store. One team is building a Payments service which has its own database; the service needs data that originates in the Accounts database. Both are using Amazon DynamoDB.
What approach will result in the simplest, decoupled, and reliable method to get near-real time updates from the Accounts database?
A. Use AWS Glue to perform frequent ETL updates from the Accounts database to the Payments database.
B. Use Amazon ElastiCache in Payments, with the cache updated by triggers in the Accounts database.
C. Use Amazon Data Firehose to deliver all changes from the Accounts database to the Payments database.
D. Use Amazon DynamoDB Streams to deliver all changes from the Accounts database to the Payments database.
Show Answer
Correct Answer: D
Explanation: Amazon DynamoDB Streams provides near-real-time, ordered change data capture for DynamoDB tables. By enabling Streams on the Accounts table and processing the stream (for example, with AWS Lambda), the Payments service can be updated reliably without directly coupling to the Accounts database. This approach is simple, event-driven, highly scalable, and designed specifically for propagating DynamoDB data changes. The other options add unnecessary complexity or are not intended for low-latency database change propagation.
Question 65
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company’s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notification Service (Amazon SNS) topic that has the security team’s email address as a subscriber.
Which solution will provide the security team with the required notification about certificates?
A. Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule’s target.
B. Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
C. Create an AWS Step Functions workflow that is invoked by each certificate’s expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
D. Configure AWS Config with the acm-certificate-expiration-check managed rule to run every 24 hours. Create an Amazon EventBridge rule that includes an event pattern that specifies the Config Rules Compliance Change detail type and the configured rule. Set the SNS topic as the EventBridge rule’s target.
Show Answer
Correct Answer: D
Explanation: The certificates are imported into ACM, and the ACM Certificate Approaching Expiration EventBridge event is generated only for ACM-issued certificates, not imported ones, so option A would not work. The AWS Config managed rule acm-certificate-expiration-check evaluates imported ACM certificates and can detect when they are within the specified expiration window (such as 90 days). An EventBridge rule can then react to the compliance change and notify the security team via SNS, fulfilling the requirement with a managed, automated solution.
Question 66
A developer has an application that uses AWS Security Token Service (AWS STS). The application calls the STS AssumeRole API operation to provide trusted users with temporary security credentials. The application calls AWS STS at the service's default endpoint: https://sts.amazonaws.com.
The application is deployed in an Asia Pacific AWS Region. The application is experiencing errors that are related to intermittent latency when the application calls AWS STS.
What should the developer do to resolve this issue?
A. Update the application to use the GetSessionToken API operation.
B. Update the application to use the AssumeRoleWithSAML API operation.
C. Update the application to use a Regional STS endpoint that is closer to the application deployment.
D. Update the application to use the AssumeRoleWithWebldentity API operation. Move the STS endpoint to a global endpoint.
Show Answer
Correct Answer: C
Explanation: The application is calling the global STS endpoint (https://sts.amazonaws.com), which can introduce additional network latency for workloads running in Asia Pacific regions. Using a Regional STS endpoint that is geographically closer reduces latency and avoids intermittent connectivity issues. Changing the AssumeRole variant (GetSessionToken, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity) does not address latency, and the global endpoint is the cause rather than the solution.
Question 67
A developer is building a three-tier application with an Application Load Balancer (ALB), Amazon EC2 instances, and Amazon RDS. There is an alias record in Amazon Route 53 that points to the ALB. When the developer tries to access the ALB from a laptop, the request times out.
Which logs should the developer investigate to verify that the request is reaching the AWS network?
A. VPC Flow Logs
B. Amazon Route 53 logs
C. AWS Systems Manager Agent logs
D. Amazon CloudWatch agent logs
Show Answer
Correct Answer: A
Explanation: VPC Flow Logs capture IP traffic metadata for network interfaces in the VPC, allowing verification that inbound requests from the laptop are reaching the AWS network and the ALB’s subnets. Route 53 logs show DNS queries only, and Systems Manager or CloudWatch agent logs are host-level and do not verify network reachability to the ALB.
Question 68
A developer is troubleshooting the permissions of an application that needs to make changes to an Amazon RDS database. The developer has access to the IAM role that the application is using.
Which command structure should the developer use to test the role permissions?
A. aws sts assume-role
B. aws iam attach-role-policy
C. aws ssm resume-session
D. aws rds add-role-to-db-cluster
Show Answer
Correct Answer: A
Explanation: To test whether an IAM role has the required permissions, the developer must assume the role and attempt actions using its temporary credentials. The aws sts assume-role command allows the developer to obtain those credentials and verify what the role is permitted to do. The other commands modify resources or manage sessions rather than testing role permissions.
Question 69
A developer has implemented an AWS Lambda function that inserts new customers into an Amazon RDS database. The function is expected to run hundreds of times each hour. The function and RDS database are in the same VPC. The function is configured to use 512 MB of RAM and is based on the following pseudo code:
After successfully testing the function multiple times, the developer notices that the execution time is longer than expected.
What should the developer do to improve performance?
A. Increase the reserved concurrency of the Lambda function.
B. Increase the size of the RDS database to facilitate an increased number of database connections each hour.
C. Move the database connection and close statement out of the handler. Place the connection in the global space.
D. Replace Amazon RDS with Amazon DynamoDB to implement control over the number of writes per second.
Show Answer
Correct Answer: C
Explanation: The primary performance issue is the overhead of creating and tearing down a database connection on every Lambda invocation. By moving the database connection initialization outside the handler (global scope), the connection can be reused across warm invocations within the same Lambda execution environment, significantly reducing latency. Increasing concurrency does not reduce per-invocation execution time, resizing RDS is unrelated to connection setup overhead, and switching to DynamoDB is an unnecessary architectural change.
Question 70
A developer is designing a game that stores data in an Amazon DynamoDB table. The partition key of the table is the country of the player. After a sudden increase in the number of players in a specific country, the developer notices ProvisionedThroughputExceededException errors.
What should the developer do to resolve these errors?
A. Use strongly consistent table reads.
B. Revise the primary key to use more unique identifiers.
C. Use pagination to reduce the size of the items that the queries return.
D. Use the Scan operation to retrieve the data.
Show Answer
Correct Answer: B
Explanation: The errors are caused by a hot partition: using country as the partition key concentrates read/write traffic when many players come from the same country, exceeding per-partition throughput. Revising the primary key to include a more unique or higher-cardinality attribute (for example, adding a user ID or a sharding suffix) distributes traffic across partitions and resolves the ProvisionedThroughputExceededException. The other options do not address partition hot-spotting and may worsen throughput usage.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.