An application includes an Amazon DynamoDB table that is named orders. The table has a primary partition key of id and a global secondary index (GSI) that is named an accountIndex. The GSI has a partition key of accountId and a sort key of orderDateTime.
A developer needs to create an AWS Lambda function to retrieve the orders that have an accountId of 100.
Which solution will meet this requirement by using the LEAST read capacity?
A. Define a DynamoDB API request for the GetItem action with the following parameters:
B. Define a DynamoDB API request for the BatchGetItem action with the following parameters:
C. Define a DynamoDB API request for the Scan action with the following parameters:
D. Define a DynamoDB API request for the Query action with the following parameters:
Show Answer
Correct Answer: D
Explanation: To retrieve all orders for a specific accountId, the most efficient operation is a Query against the global secondary index (accountIndex) using accountId as the partition key. Query operations are optimized for key-based access and consume the least read capacity compared to a Scan. GetItem and BatchGetItem cannot be used because they require the table’s primary key (id), which is not known. Therefore, querying the GSI with accountId = 100 uses the least read capacity.
Question 72
A developer created several AWS Lambda functions that write data to a single Amazon S3 bucket. The developer configured all the Lambda functions to send logs and metrics to Amazon CloudWatch.
The developer receives reports that one of the Lambda functions writes data to the bucket very slowly. The developer needs to measure the latency between the problematic Lambda function and the S3 bucket.
Which solution will meet this requirement?
A. Enable AWS X-Ray on the Lambda function. In the generated trace map, select the line between Lambda and Amazon S3.
B. Query the Lambda function’s log file in Amazon CloudWatch Logs Insights. Return the average of the auto-discovered @duration field.
C. Enable CloudWatch Lambda Insights on the function. View the latency graph that CloudWatch Lambda Insights provides.
D. Enable AWS X-Ray on the Lambda function. Select Amazon S3 in the latency graph to view the latency histogram.
Show Answer
Correct Answer: A
Explanation: AWS X-Ray provides distributed tracing for Lambda and downstream AWS services such as Amazon S3. By enabling X-Ray on the Lambda function, the generated service/trace map shows the dependency between Lambda and S3. Selecting the connection (or S3 segment) displays detailed timing information, allowing direct measurement of the latency of S3 calls made by that specific Lambda function. Other options provide only function execution duration or high-level metrics, not end-to-end service-to-service latency.
Question 73
A developer is building the authentication mechanism for a new mobile app. Users need to be able to sign up, sign in, and access secured backend AWS resources.
Which solution will meet these requirements?
A. Use AWS Identity and Access Management Access Analyzer to generate IAM policies. Create an IAM role. Attach the policies to the role. Integrate the IAM role with an identity provider that the mobile app uses.
B. Create an IAM policy that grants access to the backend resources. Create an IAM role. Attach the policy to the role. Create an Amazon API Gateway endpoint. Attach the role to the endpoint. Integrate the endpoint with the mobile app.
C. Create an Amazon Cognito identity pool. Configure permissions by choosing a default IAM role for authenticated users or guest users in the identity pool. Associate the identity pool with an identity provider. Integrate the identity pool with the mobile app.
D. Create an Amazon Cognito user pool. Configure the security requirements by choosing a password policy, multi-factor authentication (MFA) requirements, and user account recovery options. Create an app client. Integrate the app client with the mobile app.
Show Answer
Correct Answer: D
Explanation: Amazon Cognito user pools provide a fully managed authentication service with built-in user sign-up and sign-in, password policies, MFA, and account recovery, and integrate easily with mobile apps. The app can then use the issued tokens to access secured backend AWS resources. Identity pools alone do not handle user sign-up/sign-in, and the other options do not provide a complete mobile authentication solution.
Question 74
A developer is creating a new application that will give users the ability to upload documents to Amazon S3. The contents of the documents must not be accessible to any third party.
Which type of encryption will meet this requirement?
A. Client-side encryption by using the S3 Encryption Client with a Raw RSA wrapping key that is stored on the user’s device
B. Server-side encryption with S3 managed keys (SSE-S3)
C. Server-side encryption with AWS KMS keys (SSE-KMS)
D. Dual-layer server-side encryption with AWS KMS keys (DSSE-KMS)
Show Answer
Correct Answer: A
Explanation: The requirement states that the document contents must not be accessible to any third party. Server-side encryption options (SSE-S3, SSE-KMS, DSSE-KMS) still allow AWS to decrypt data when authorized, making AWS a potential third party. Client-side encryption ensures data is encrypted before it is uploaded, with encryption keys kept entirely under the user’s control. Using the S3 Encryption Client with a raw RSA wrapping key stored on the user’s device provides true end-to-end encryption, preventing any third party, including AWS, from accessing the plaintext.
Question 75
A developer is creating an AWS Step Functions state machine to handle an order processing workflow. When the state machine receives an order, the state machine pauses until the order has been confirmed. A record that is added to an Amazon DynamoDB table by another service confirms each order.
The developer must complete the order processing workflow.
Which solution will meet this requirement?
A. Update the state machine to query the DynamoDB table by using the DynamoDB GetItem state to determine whether a record exists. If the record does exist, continue to the next state. If the record does not exist, wait 5 minutes and check again.
B. Subscribe an AWS Lambda function to a DynamoDB table stream. Configure the Lambda function to run when a new record is added to the table. When the Lambda function receives the appropriate record, run the redrive execution command on the running state machine.
C. Subscribe an AWS Lambda function to the DynamoDB table stream. Configure the Lambda function to run when a new record is added to the table. When the Lambda function receives the appropriate record, stop the current state machine invocation and start a new invocation.
D. Invoke an AWS Lambda function from the state machine. Configure the Lambda function to continuously poll the DynamoDB table for the appropriate record and to return when a record exists. Continue the state machine invocation when the Lambda function returns. If the Lambda function times out, then fail the state machine.
Show Answer
Correct Answer: A
Explanation: The workflow needs to pause and then continue the same execution once a confirmation record exists. Using Step Functions with a Wait state followed by a DynamoDB GetItem check is a supported and reliable pattern that preserves execution state. Redriving executions is meant for failed workflows and cannot resume a waiting execution, stopping and restarting loses state, and continuously polling inside Lambda is inefficient and an anti-pattern.
Question 76
A company wants to send notifications to customers to advertise a sale on the company’s products. The company needs to use Amazon Simple Notification Service (Amazon SNS) FIFO topics.
The company needs to examine the rate at which the topics send notifications and the latency with which the topics send notifications.
Which solution will meet these requirements with the MOST operational efficiency?
A. Use AWS X-Ray. Enable active tracing for Amazon SNS.
B. Use the Amazon CloudWatch NumberOfNotificationsFailed metric.
C. Use AWS CloudTrail to log all Amazon SNS API calls.
D. Use Amazon GuardDuty. Enable runtime monitoring.
Show Answer
Correct Answer: A
Explanation: Amazon SNS FIFO topics can emit detailed performance traces to AWS X-Ray when active tracing is enabled. X-Ray provides end-to-end visibility into request throughput (rate of notifications) and latency for publishing and delivery, with minimal setup and high operational efficiency. The other options do not provide latency analysis or are unrelated to performance monitoring.
Question 77
A developer is working on an ecommerce application that stores data in an Amazon RDS for MySQL cluster. The developer needs to implement a caching layer for the application to retrieve information about the most viewed products.
Which solution will meet these requirements?
A. Edit the RDS for MySQL cluster by adding a cache node. Configure the cache endpoint instead of the cluster endpoint in the application.
B. Create an Amazon ElastiCache for Redis cluster. Update the application code to use the ElastiCache for Redis cluster endpoint.
C. Create an Amazon DynamoDB Accelerator (DAX) cluster in front of the RDS for MySQL cluster. Configure the application to connect to the DAX endpoint instead of the RDS endpoint.
D. Configure the RDS for MySQL cluster to add a standby instance in a different Availability Zone. Configure the application to read the data from the standby instance.
Show Answer
Correct Answer: B
Explanation: A caching layer for frequently accessed data such as the most viewed products should use a fast, in-memory data store. Amazon ElastiCache for Redis is specifically designed for this purpose and integrates well with applications to offload read traffic from an RDS for MySQL database. The application can query Redis for cached product data instead of hitting the database each time, improving performance and scalability. The other options either do not provide a caching service (standby instance), are not applicable to MySQL (DAX is only for DynamoDB), or describe functionality that does not exist for RDS (adding a cache node).
Question 78
A developer is building an application that will process messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The application needs to process the messages in an Amazon Elastic Container Service (Amazon ECS) task.
Which actions will result in the MOST cost-effective processing of the messages? (Choose two.)
A. Use long polling to query the queue for new messages.
B. Use short polling to query the queue for new messages.
C. Use message batching to retrieve messages from the queue.
D. Use Amazon ElastiCache to cache messages in the queue.
E. Use an SQS FIFO queue to manage the messages.
Show Answer
Correct Answer: A, C
Explanation: Long polling reduces empty receive requests and lowers SQS API call costs compared to short polling. Message batching retrieves multiple messages per request, further reducing the number of API calls and improving cost efficiency. Other options do not reduce SQS request costs or are not relevant.
Question 79
A company offers a business-to-business software service that runs on dedicated infrastructure deployed in each customer’s AWS account. Before a feature release, the company needs to run integration tests on real AWS test infrastructure. The test infrastructure consists of Amazon EC2 instances and an Amazon RDS database.
A developer must set up a continuous delivery process that will provision the test infrastructure across the different AWS accounts. The developer then must run the integration tests.
Which solution will meet these requirements with the LEAST administrative effort?
A. Use AWS CodeDeploy with AWS CloudFormation StackSets to deploy the infrastructure. Use Amazon CodeGuru to run the tests.
B. Use AWS CodePipeline with AWS CloudFormation StackSets to deploy the infrastructure. Use AWS CodeBuild to run the tests.
C. Use AWS CodePipeline with AWS CloudFormation change sets to deploy the infrastructure. Use a CloudFormation custom resource to run the tests.
D. Use AWS Serverless Application Model (AWS SAM) templates with AWS CloudFormation change sets to deploy the infrastructure. Use AWS CodeDeploy to run the tests.
Show Answer
Correct Answer: B
Explanation: The solution must provision identical test infrastructure across multiple AWS accounts and then run integration tests with minimal administrative overhead. AWS CloudFormation StackSets are designed specifically for deploying and managing infrastructure consistently across multiple accounts. AWS CodePipeline provides a fully managed CI/CD orchestration service, and AWS CodeBuild is a managed service well suited for running integration tests on real AWS resources. Together, they require minimal custom setup and integrate natively. Other options either add unnecessary complexity (change sets, custom resources), use less appropriate services (CodeGuru for testing), or target serverless use cases that do not match EC2/RDS infrastructure.
Question 80
A company has an Amazon API Gateway REST API that integrates with an AWS Lambda function. The API’s development stage references a development alias of the Lambda function named dev.
A developer needs make a production alias of the Lambda function named prod available through the API.
Which solution meets these requirements?
A. Create a new method on the API. Name the method production. Configure the method to include a stage variable that points to the prod Lambda function alias.
B. Create a new method on the API. Name the method production. Configure an integration request on the API’s development stage that points to the prod Lambda function alias.
C. Deploy the API to a new stage named production. Configure the stage to include a stage variable that points to the prod Lambda function alias.
D. Deploy the API to a new stage named production. Configure an integration request on the API’s production stage that points to the prod Lambda function alias.
Show Answer
Correct Answer: C
Explanation: To expose a different Lambda alias through API Gateway, the correct pattern is to deploy the API to a separate stage (for example, production) and use stage variables to reference the appropriate Lambda alias (prod). This cleanly separates environments, avoids duplicating methods, and allows the same integration configuration to dynamically resolve to different Lambda aliases per stage. Methods are not environments, and directly hard‑wiring the integration per stage reduces flexibility.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.