A company is launching a feature that uses an HTTP API built with Amazon API Gateway and AWS Lambda. An API Gateway endpoint performs several independent tasks that run in a Lambda function. The independent tasks can take up to 10 minutes in total to finish running.
Users report that the endpoint sometimes returns an HTTP 604 status code. The Lambda function invocations are successful.
Which solution will stop the endpoint from returning the HTTP 504 status cade?
A. Increase the Lambda function’s timeout value.
B. Increase the reserved concurrency of the Lambda function.
C. Increase the memory that is available to the Lambda function.
D. Refactor the Lambda function to start an AWS Step Functions state machine.
Show Answer
Correct Answer: D
Explanation: Amazon API Gateway has a maximum integration timeout that is much shorter than 10 minutes. Even if the Lambda function completes successfully, API Gateway will return a 504 Gateway Timeout when the integration exceeds its timeout. Refactoring the Lambda function to quickly start an AWS Step Functions state machine allows the API to respond immediately while the long-running workflow continues asynchronously. Increasing Lambda timeout, reserved concurrency, or memory does not remove the API Gateway integration timeout.
Question 62
A company runs an application on Amazon EC2 instances in an Auto Scaling group. The application experiences variable loads throughout each day.
The company needs to collect detailed metrics from the EC2 instances to right-size the instances. The company also wants to monitor custom application metrics to ensure the application is performing efficiently.
Which solution will meet these requirements?
A. Install the AWS X-Ray agent on the instances. Configure the agent to collect the EC2 instance metrics and the custom application metrics.
B. Install the Amazon CloudWatch agent on the instances. Configure the agent to collect the EC2 instance metrics and the custom application metrics.
C. Install the AWS SDK in the application’s cade. Update the application to use the AWS SDK to collect and publish the EC2 instance metrics and the custom application metrics.
D. Configure AWS CloudTrail to capture and analyze the EC2 instance metrics and the custom application metrics.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch Agent can collect detailed system-level metrics from EC2 instances (such as memory, disk, and processes) and publish custom application metrics to CloudWatch. This supports instance right-sizing and application performance monitoring. AWS X-Ray is for distributed tracing, CloudTrail records API activity, and the AWS SDK alone does not collect EC2 host metrics without implementing custom publishing.
Question 63
A developer compiles an AWS Lambda function and packages the result as a .zip file. The developer uses the Functions page on the Lambda console to attempt to upload the local packaged .zip file. When pushing the package ta Lambda, the console returns the following error:
Which solutions can the developer use to publish the code? (Choose two.)
A. Upload the package to Amazon 3. Use the Functions page on the Lambda console to upload the package from the S3 location.
B. Create an AWS Support ticket to increase the maximum package size.
C. Use the update-function-code AWS CLI command. Pass the --publish parameter.
D. Repackage the Lambda function as a Docker container image. Upload the image to Amazon Elastic Container Registry (Amazon ECR). Create a new Lambda function by using the Lambda console. Reference the image that is deployed to Amazon ECR.
E. Sign the .zip file digitally. Create a new Lambda function by using the Lambda console. Update the configuration of the new Lambda function to include the Amazon Resource Name (ARN) of the code signing configuration.
Show Answer
Correct Answer: A, D
Explanation: The Lambda console has a direct upload size limit for local .zip files. Uploading the deployment package to Amazon S3 and then updating the function from the S3 object avoids the console upload limit. Alternatively, packaging the function as a container image, pushing it to Amazon ECR, and creating or updating a Lambda function to use that image supports much larger deployment artifacts. AWS Support cannot increase the deployment package size limit, the CLI does not bypass Lambda package size limits, and code signing is a security feature rather than a solution for oversized packages.
Question 64
In a move toward using microservices, a company’s management team has asked all development teams to build their services so that API requests depend only on that service’s data store. One team is building a Payments service which has its own database; the service needs data that originates in the Accounts database. Both are using Amazon DynamoDB.
What approach will result in the simplest, decoupled, and reliable method to get near-real time updates from the Accounts database?
A. Use AWS Glue to perform frequent ETL updates from the Accounts database to the Payments database.
B. Use Amazon ElastiCache in Payments, with the cache updated by triggers in the Accounts database.
C. Use Amazon Data Firehose to deliver all changes from the Accounts database to the Payments database.
D. Use Amazon DynamoDB Streams to deliver all changes from the Accounts database to the Payments database.
Show Answer
Correct Answer: D
Explanation: Amazon DynamoDB Streams is the native mechanism to capture item-level changes from a DynamoDB table in near real time. A consumer such as AWS Lambda can process stream records and update the Payments service's DynamoDB table, keeping services decoupled and providing reliable propagation of changes. AWS Glue is ETL-oriented rather than near real time, ElastiCache is a cache rather than a persistent data synchronization solution, and Amazon Data Firehose is designed for streaming data delivery to analytics/storage destinations, not DynamoDB-to-DynamoDB replication.
Question 65
A company generates SSL certificates from a third-party provider. The company imports the certificates into AWS Certificate Manager (ACM) to use with public web applications.
A developer must implement a solution to notify the company’s security team 90 days before an imported certificate expires. The company already has configured an Amazon Simple Queue Service (Amazon SQS) queue. The company also has configured an Amazon Simple Notification Service (Amazon SNS) topic that has the security team’s email address as a subscriber.
Which solution will provide the security team with the required notification about certificates?
A. Create an Amazon EventBridge rule that specifies the ACM Certificate Approaching Expiration event type. Set the SNS topic as the EventBridge rule’s target.
B. Create an AWS Lambda function to search for all certificates that are expiring within 90 days. Program the Lambda function to send each identified certificate’s Amazon Resource Name (ARN) in a message to the SQS queue.
C. Create an AWS Step Functions workflow that is invoked by each certificate’s expiration notification from AWS CloudTrail. Create an AWS Lambda function to send each certificate's Amazon Resource Name (ARN) in a message to the SQS queue.
D. Configure AWS Config with the acm-certificate-expiration-check managed rule to run every 24 hours. Create an Amazon EventBridge rule that includes an event pattern that specifies the Config Rules Compliance Change detail type and the configured rule. Set the SNS topic as the EventBridge rule’s target.
Show Answer
Correct Answer: D
Explanation: The ACM 'Certificate Approaching Expiration' EventBridge event applies to ACM-issued certificates, not imported third-party certificates. For imported certificates, AWS Config's managed rule 'acm-certificate-expiration-check' evaluates certificate expiration (including configurable threshold), and an EventBridge rule can forward compliance change events to the SNS topic to notify the security team.
Question 66
A developer has an application that uses AWS Security Token Service (AWS STS). The application calls the STS AssumeRole API operation to provide trusted users with temporary security credentials. The application calls AWS STS at the service's default endpoint: https://sts.amazonaws.com.
The application is deployed in an Asia Pacific AWS Region. The application is experiencing errors that are related to intermittent latency when the application calls AWS STS.
What should the developer do to resolve this issue?
A. Update the application to use the GetSessionToken API operation.
B. Update the application to use the AssumeRoleWithSAML API operation.
C. Update the application to use a Regional STS endpoint that is closer to the application deployment.
D. Update the application to use the AssumeRoleWithWebldentity API operation. Move the STS endpoint to a global endpoint.
Show Answer
Correct Answer: C
Explanation: The application is using the global AWS STS endpoint (sts.amazonaws.com), which can introduce additional latency for workloads deployed far from the endpoint. AWS recommends using Regional STS endpoints (for example, sts.ap-southeast-1.amazonaws.com or the endpoint for the application's Region) to reduce latency and improve resiliency. Changing to GetSessionToken, AssumeRoleWithSAML, or AssumeRoleWithWebIdentity does not address endpoint latency; those APIs are intended for different authentication scenarios.
Question 67
A developer is building a three-tier application with an Application Load Balancer (ALB), Amazon EC2 instances, and Amazon RDS. There is an alias record in Amazon Route 53 that points to the ALB. When the developer tries to access the ALB from a laptop, the request times out.
Which logs should the developer investigate to verify that the request is reaching the AWS network?
A. VPC Flow Logs
B. Amazon Route 53 logs
C. AWS Systems Manager Agent logs
D. Amazon CloudWatch agent logs
Show Answer
Correct Answer: A
Explanation: VPC Flow Logs capture information about IP traffic to and from network interfaces in a VPC, including the network interfaces used by an Application Load Balancer. They help verify whether traffic from the client is reaching the AWS network and the ALB. Route 53 does not provide request logs for DNS queries in this context, and Systems Manager Agent and CloudWatch agent logs are unrelated to inbound network connectivity.
Question 68
A developer is troubleshooting the permissions of an application that needs to make changes to an Amazon RDS database. The developer has access to the IAM role that the application is using.
Which command structure should the developer use to test the role permissions?
A. aws sts assume-role
B. aws iam attach-role-policy
C. aws ssm resume-session
D. aws rds add-role-to-db-cluster
Show Answer
Correct Answer: A
Explanation: The correct command structure is `aws sts assume-role`. It allows the developer to assume the IAM role and obtain temporary credentials to verify whether the role has the permissions required to perform the intended Amazon RDS operations. The other options either modify role policies, manage SSM sessions, or attach an IAM role to an RDS cluster rather than test the role's permissions.
Question 69
A developer has implemented an AWS Lambda function that inserts new customers into an Amazon RDS database. The function is expected to run hundreds of times each hour. The function and RDS database are in the same VPC. The function is configured to use 512 MB of RAM and is based on the following pseudo code:
After successfully testing the function multiple times, the developer notices that the execution time is longer than expected.
What should the developer do to improve performance?
A. Increase the reserved concurrency of the Lambda function.
B. Increase the size of the RDS database to facilitate an increased number of database connections each hour.
C. Move the database connection and close statement out of the handler. Place the connection in the global space.
D. Replace Amazon RDS with Amazon DynamoDB to implement control over the number of writes per second.
Show Answer
Correct Answer: C
Explanation: The main performance overhead is repeatedly creating and closing a new database connection on every Lambda invocation. Initializing the database connection in the global scope allows execution environments that are reused across warm invocations to reuse the existing connection, reducing connection setup latency. Increasing reserved concurrency does not reduce per-invocation execution time, increasing RDS size does not address connection setup overhead, and replacing RDS with DynamoDB is an unnecessary architectural change rather than a performance optimization.
Question 70
A developer is designing a game that stores data in an Amazon DynamoDB table. The partition key of the table is the country of the player. After a sudden increase in the number of players in a specific country, the developer notices ProvisionedThroughputExceededException errors.
What should the developer do to resolve these errors?
A. Use strongly consistent table reads.
B. Revise the primary key to use more unique identifiers.
C. Use pagination to reduce the size of the items that the queries return.
D. Use the Scan operation to retrieve the data.
Show Answer
Correct Answer: B
Explanation: The table uses country as the partition key, so a surge of players from one country creates a hot partition that exceeds the provisioned throughput for that partition key. Revising the primary key to use a more uniformly distributed identifier (or otherwise increasing partition key cardinality) spreads traffic across partitions and alleviates hot spots. Strongly consistent reads increase throughput consumption, pagination does not solve hot partitions, and Scan is less efficient and consumes more throughput than targeted queries.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.