Courseiva

AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 676724

724 questions total · 10pages · All types, answers revealed

Page 9

Page 10 of 10

676
Multi-Selecteasy

Which TWO approaches can be used to optimize costs for an Amazon DynamoDB table with predictable read/write patterns? (Select TWO.)

Select 2 answers
A.Increase the read capacity units to avoid throttling.
B.Use provisioned capacity with auto scaling.
C.Use DynamoDB global tables for multi-region replication.
D.Use DynamoDB Accelerator (DAX) to cache read results.
E.Use on-demand capacity mode.
AnswersB, D

Provisioned capacity with auto scaling is the most cost-effective approach for predictable workloads. DynamoDB uses CloudWatch alarms on utilization metrics (e.g., 70% of consumed capacity) to automatically increase or decrease your provisioned read and write capacity units, so you only pay for what your traffic actually requires. However, note that scaling happens gradually, so you must set sensible minimums and maximums to avoid both throttling and underused capacity.

Why this answer

Optimizing costs for DynamoDB with predictable workloads involves avoiding over-provisioning and reducing read/write consumption. Provisioned capacity with auto scaling (B) adjusts capacity based on actual usage, preventing unnecessary spending on unused capacity. DynamoDB Accelerator (DAX) (D) caches frequent reads, reducing read capacity unit consumption.

Option A (increasing RCU) leads to over-provisioning and higher costs. Option C (global tables) adds replication costs. Option E (on-demand) is more expensive than provisioned for predictable patterns.

677
MCQmedium

A developer has deployed an AWS Lambda function that is triggered by an Amazon S3 event. The function processes image files and stores metadata in an Amazon DynamoDB table. CloudWatch metrics show that the function's error count has increased. The developer checks CloudWatch Logs and sees errors related to insufficient memory. The function is configured with 128 MB of memory. What should the developer do to resolve the errors?

A.Increase the function's memory to 256 MB or higher.
B.Increase the function's timeout to 30 seconds.
C.Reduce the size of the images being uploaded to S3.
D.Move the DynamoDB write operation to an asynchronous invocation.
AnswerA

An "out-of-memory" error directly indicates that the allocated memory for the Lambda function is insufficient to perform its operations, such as image processing which can be memory-intensive. Increasing the memory allocation directly addresses this by providing more RAM for the function to utilize during execution. Furthermore, AWS Lambda's execution environment scales CPU power proportionally with memory allocation, meaning higher memory also grants more vCPUs, accelerating image processing and reducing overall execution time.

Why this answer

The error is caused by insufficient memory, which directly impacts the CPU and execution resources allocated to the Lambda function. Increasing the memory allocation to 256 MB or higher provides more CPU throughput and memory, resolving the out-of-memory errors without requiring code changes.

Exam trap

The trap here is that candidates confuse memory errors with timeout errors and incorrectly choose to increase the timeout, but the logs explicitly state insufficient memory, not duration limits.

How to eliminate wrong answers

Option B is wrong because increasing the timeout does not address memory exhaustion; timeout errors occur when execution duration exceeds the limit, not when memory is insufficient. Option C is wrong because reducing image sizes is a workaround that may not be feasible or controlled by the developer, and it does not fix the underlying resource allocation issue. Option D is wrong because moving the DynamoDB write to an asynchronous invocation does not reduce memory consumption during image processing; the function still needs enough memory to process the image in memory before any write occurs.

678
MCQmedium

An application running on EC2 needs to access an S3 bucket. The security team wants to avoid using long-term access keys. What is the most secure approach?

A.Generate an access key and secret key for an IAM user and store them on the instance.
B.Create a new IAM user and store the credentials in S3 with bucket policies.
C.Use AWS Systems Manager Parameter Store to store the credentials and retrieve them at runtime.
D.Launch the EC2 instance with an IAM role that grants S3 access.
AnswerD

Launching an EC2 instance with an attached IAM role is the most secure and recommended method for granting AWS resource access. This approach leverages the instance metadata service to provide temporary, frequently rotated credentials to applications running on the instance. These credentials are never stored directly on the instance, eliminating the risk associated with static access keys and simplifying credential management and rotation.

Why this answer

Assigning an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) automatically via the instance metadata service. This eliminates the need to store, rotate, or manage long-term access keys, adhering to the security team's requirement for a credential-less approach. The IAM role's permissions policy grants the EC2 instance access to the S3 bucket, and the credentials are automatically rotated by AWS before they expire.

Exam trap

The trap here is that candidates often confuse 'secure storage' (like Parameter Store or Secrets Manager) with 'no long-term credentials at all,' failing to recognize that an IAM role provides temporary credentials that are inherently more secure and require no key management on the instance.

How to eliminate wrong answers

Option A is wrong because storing an access key and secret key on the EC2 instance introduces long-term static credentials that can be compromised if the instance is breached, violating the security team's requirement to avoid long-term access keys. Option B is wrong because storing IAM user credentials in S3 with bucket policies still relies on long-term access keys and adds unnecessary complexity; bucket policies cannot securely protect the credentials themselves from unauthorized access. Option C is wrong because while Systems Manager Parameter Store can securely store secrets, the EC2 instance still needs a mechanism (such as an IAM role) to retrieve them at runtime, and using Parameter Store with long-term credentials stored as parameters does not eliminate the underlying risk of managing static keys.

679
MCQhard

A developer needs to deploy a serverless application using AWS CloudFormation. The application includes an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. The developer wants to create a stack that can be updated without downtime. Which CloudFormation feature should be used?

A.Drift detection
B.StackSets
C.Nested stacks
D.Change Sets
AnswerD

AWS CloudFormation Change Sets provide a powerful mechanism to preview the proposed changes to your stack before they are actually applied. By generating a Change Set, developers can review exactly which resources will be added, modified, or deleted, and understand the potential impact on existing resources. This foresight is crucial for planning updates that minimize or eliminate downtime, allowing for adjustments to the template or deployment strategy to ensure continuous service availability.

Why this answer

Change Sets allow you to preview how changes to your CloudFormation stack will affect your running resources before you apply them. By reviewing the change set, you can ensure that the update does not cause downtime, for example by replacing resources without interruptions. This makes Change Sets the appropriate feature for updating a stack without downtime.

680
Multi-Selecthard

A developer is designing a system that stores sensitive user data in DynamoDB. The data must be encrypted at rest and in transit. Which THREE actions should the developer take?

Select 3 answers
A.Enable DynamoDB encryption at rest using an AWS KMS managed key (SSE-KMS).
B.Enable DynamoDB encryption at rest using an AWS KMS customer managed key.
C.Use HTTPS for all API calls to DynamoDB.
D.Use TLS 1.2 for all connections.
E.Implement client-side encryption before writing items to DynamoDB.
AnswersA, B, C

DynamoDB encryption at rest with an AWS managed KMS key (aws/dynamodb) is enabled by default for all new tables, so specifying SSE-KMS with that key provides transparent AES-256 server-side encryption. Because the key is managed by AWS, you cannot control rotation or permissions, but it fully satisfies the at-rest encryption requirement without extra operational overhead.

Why this answer

Options A, B, and C are correct. DynamoDB supports encryption at rest using AWS KMS; both SSE-KMS (A) and customer managed keys (B) provide encrypted storage. Using HTTPS (C) ensures encryption in transit.

Option D is incorrect because DynamoDB already uses TLS 1.2 by default for all connections, so no explicit action is needed. Option E is unnecessary as server-side encryption and HTTPS provide the required protections.

681
MCQhard

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

A.Return a JSON object with 'status_code' and 'message' keys.
B.Throw an exception with a message that includes the HTTP status code.
C.Return a JSON object with 'errorMessage' and 'errorType' keys.
D.Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.
AnswerD

For API Gateway Lambda proxy integration, the Lambda function must return a JSON object with the exact structure `{ 'statusCode': <number>, 'headers': <object>, 'body': <string> }`. This specific format allows the Lambda function to fully control the HTTP response returned to the client, including the status code (e.g., 404 Not Found), custom headers, and the response body containing the error message. Adhering to this contract ensures API Gateway correctly maps the Lambda's output to the desired HTTP response.

Why this answer

With Lambda proxy integration in API Gateway, the Lambda function must return a response in the exact format that API Gateway expects: a JSON object with 'statusCode' (integer), 'headers' (object), and 'body' (string). This allows the developer to set a custom HTTP status code like 404 and include a custom error message in the body. API Gateway will then map this response directly to the HTTP response sent to the client.

Exam trap

The trap here is that candidates often confuse the Lambda proxy integration response format with the standard Lambda error response format (errorMessage/errorType) or assume that simply throwing an exception will propagate the status code, but AWS requires a specific structured success response to control the HTTP status code.

How to eliminate wrong answers

Option A is wrong because returning a JSON object with 'status_code' and 'message' keys does not match the required response format for Lambda proxy integration; API Gateway will not interpret these keys and will likely return a 502 Malformed Lambda Response. Option B is wrong because throwing an exception in Lambda causes the function to fail, and API Gateway will return a 502 Internal Server Error, not the custom status code or message. Option C is wrong because 'errorMessage' and 'errorType' are part of the standard error response format for Lambda invocations (used in non-proxy integrations or direct invocations), but with proxy integration, the Lambda must return a properly formatted success response, not an error object.

682
MCQmedium

A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?

A.AWS Secrets Manager
B.AWS Systems Manager Parameter Store (SecureString)
C.AWS Key Management Service (KMS)
D.AWS Identity and Access Management (IAM) roles
AnswerA

AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating sensitive application secrets, such as database credentials. It integrates directly with services like Amazon RDS to facilitate seamless, scheduled password rotation without requiring manual intervention, significantly enhancing security posture and reducing operational overhead. This capability directly addresses the requirement for automatic rotation.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (SecureString) with Secrets Manager, overlooking that Parameter Store lacks native automatic rotation, which is a key requirement in the question.

How to eliminate wrong answers

Option B is wrong because AWS Systems Manager Parameter Store (SecureString) can store encrypted secrets but does not natively support automatic rotation of credentials; rotation would require custom automation via AWS Lambda or other services. Option C is wrong because AWS Key Management Service (KMS) is a key management and encryption service that does not store or rotate secrets; it only provides encryption keys for protecting data. Option D is wrong because AWS Identity and Access Management (IAM) roles provide temporary credentials for AWS service access, not for storing or rotating database credentials; they cannot be used to retrieve static secrets like database passwords.

683
MCQhard

A company has multiple AWS accounts managed under AWS Organizations. The security team requires that all Amazon S3 buckets with bucket names containing 'logs' must be encrypted with a specific KMS key (key ID: alias/logs-key) at rest. A developer must enforce this using an SCP (Service Control Policy). Which SCP effect and condition key should be used to deny any PutObject request that does not use the required KMS key?

A.Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id
B.Deny effect with a Condition: StringEquals on s3:x-amz-server-side-encryption
C.Allow effect with a Condition: StringEquals on kms:RequestTag/key-id
D.Deny effect with a Condition: IpAddress on aws:SourceIp
AnswerA

This SCP will deny any PutObject request that specifies a KMS key that is not the required key. The StringNotEquals condition ensures that if the request does not use the specific key ID, the request is denied. This is the standard way to enforce encryption with a specific KMS key using SCPs.

Why this answer

SCPs use a Deny effect to block non-compliant requests. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` ensures that any PutObject request that does not specify the exact KMS key alias/logs-key is denied. This enforces encryption with the required key for all S3 buckets containing 'logs' in their name.

Exam trap

The trap here is that candidates confuse `s3:x-amz-server-side-encryption` (which only checks encryption type) with `s3:x-amz-server-side-encryption-aws-kms-key-id` (which checks the specific KMS key), leading them to choose Option B instead of A.

How to eliminate wrong answers

Option B is wrong because `s3:x-amz-server-side-encryption` only checks whether server-side encryption is enabled (e.g., AES256 or aws:kms), but does not verify the specific KMS key ID, so it cannot enforce the required key. Option C is wrong because Allow effects in SCPs are permissive and cannot deny non-compliant requests; also `kms:RequestTag/key-id` is not a valid condition key for S3 PutObject operations. Option D is wrong because `aws:SourceIp` restricts requests based on IP address, which is unrelated to encryption key enforcement.

684
MCQhard

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

A.Canary deployment.
B.In-place deployment.
C.Blue/green deployment.
D.Immutable deployment.
AnswerC

Blue/green deployment involves creating an entirely new, identical environment (the "green" environment) running the new version of the application alongside the existing "blue" environment. Traffic remains directed to the stable "blue" environment while the "green" environment is thoroughly tested. Once verified, traffic is seamlessly shifted from "blue" to "green" at the load balancer level. This approach ensures zero downtime and preserves existing user sessions on the "blue" environment until the switch is complete, making it ideal for stateful applications.

Why this answer

Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Exam trap

The trap here is that candidates often confuse 'immutable deployment' with a valid CodeDeploy option, but AWS CodeDeploy only supports blue/green and in-place deployments, while immutable deployments are a concept from Elastic Beanstalk or EC2 Auto Scaling with launch template versioning.

How to eliminate wrong answers

Option A is wrong because a canary deployment gradually shifts a small percentage of traffic to the new version, which can cause issues with stateful WebSocket connections that require session persistence and may not handle partial traffic shifts gracefully. Option B is wrong because an in-place deployment updates the existing EC2 instances one at a time, which terminates active WebSocket connections and disrupts real-time communication, leading to downtime. Option D is wrong because immutable deployment is not a standard AWS CodeDeploy deployment configuration; AWS CodeDeploy supports blue/green and in-place deployments, but immutable deployments are typically associated with AWS Elastic Beanstalk or EC2 Auto Scaling with launch templates, not CodeDeploy.

685
MCQhard

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

A.Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS
B.Use Amazon API Gateway and AWS Lambda
C.Use Amazon Route 53 private hosted zones and enable DNSSEC
D.Use an Application Load Balancer for each service and enable TLS termination
AnswerA

AWS Cloud Map provides robust service discovery, allowing microservices to dynamically locate each other using either DNS queries or an API. When combined with AWS App Mesh, a service mesh solution, it enables advanced traffic management and security features. App Mesh facilitates mutual TLS (mTLS) between services by injecting Envoy proxies, ensuring that both the client and server services authenticate each other with certificates, thus securing inter-service communication at the transport layer without requiring application code changes. This combination is the most suitable for secure, dynamic microservice interactions.

Why this answer

AWS Cloud Map provides service discovery by registering ECS service instances with DNS-based or API-based resolution, enabling dynamic routing between microservices. AWS App Mesh with mutual TLS (mTLS) encrypts traffic between services and enforces identity-based authentication, ensuring end-to-end encryption and secure communication. This combination directly addresses the requirements for service discovery and encrypted traffic.

Exam trap

The trap here is that candidates often confuse TLS termination at a load balancer (which only encrypts traffic from client to ALB) with mutual TLS between services, or assume DNS-based discovery alone (like Route 53) provides encryption, when it does not.

How to eliminate wrong answers

Option B is wrong because Amazon API Gateway and AWS Lambda are typically used for building serverless APIs, not for service-to-service communication within a microservices architecture on ECS; they lack native service discovery and mTLS encryption between ECS tasks. Option C is wrong because Route 53 private hosted zones provide DNS-based service discovery but DNSSEC only validates DNS responses, it does not encrypt traffic between services. Option D is wrong because an Application Load Balancer (ALB) terminates TLS at the load balancer, not between services, and does not provide service discovery or mTLS for inter-service communication.

686
MCQmedium

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The build stage runs successfully, but the deploy stage fails with an error: 'The deployment failed because no instances were found for the environment.' What is the most likely cause?

A.The CodeDeploy application is not configured correctly.
B.The IAM role for CodePipeline lacks permissions to describe EC2 instances.
C.The build artifact is not named correctly for Elastic Beanstalk.
D.The Elastic Beanstalk environment has no running instances due to a failed health check.
AnswerD

If an Elastic Beanstalk environment's instances consistently fail health checks (e.g., application not responding on the configured port, high resource utilization), the underlying Auto Scaling group will terminate them. If new instances launched by Auto Scaling also fail to become healthy, the environment can enter a degraded state with zero healthy, running instances. In this scenario, when CodePipeline attempts to deploy a new application version, it correctly reports "no instances found" because there are no available, healthy targets to receive the deployment.

Why this answer

The error 'no instances were found for the environment' directly indicates that the Elastic Beanstalk environment has no running EC2 instances. This typically occurs when the environment's health checks have failed, causing all instances to be terminated or remain in a degraded state. Without any healthy instances, CodePipeline cannot deploy the application, as Elastic Beanstalk requires at least one running instance to perform a deployment.

Exam trap

The trap here is that candidates often confuse the error with a permissions or artifact issue, but the specific wording 'no instances were found' points directly to the Elastic Beanstalk environment's instance count, not to IAM roles or build outputs.

How to eliminate wrong answers

Option A is wrong because CodeDeploy is not used with Elastic Beanstalk; Elastic Beanstalk uses its own deployment mechanism (e.g., rolling updates, immutable deployments) and does not rely on a CodeDeploy application. Option B is wrong because CodePipeline does not need permissions to describe EC2 instances for an Elastic Beanstalk deployment; the pipeline interacts with Elastic Beanstalk via the CreateApplicationVersion and UpdateEnvironment APIs, not directly with EC2. Option C is wrong because the build artifact name does not affect instance availability; Elastic Beanstalk accepts any valid artifact (e.g., .zip or .war) and the error message specifically mentions missing instances, not artifact naming issues.

687
MCQeasy

A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?

A.Use Amazon CloudFront to proxy requests to the S3 bucket.
B.Hardcode the AWS access keys in the application code.
C.Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.
D.Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.
AnswerD

Configuring the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access is the recommended and most secure method. An IAM instance profile attaches an IAM role to the underlying EC2 instances, allowing the application to obtain temporary, automatically rotated credentials from the instance metadata service. This enables the application to make authenticated AWS API calls to S3 without storing any long-term credentials directly within the application code or configuration.

Why this answer

Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.

Exam trap

The trap here is that candidates may confuse network-level controls (security groups) with identity-based controls (IAM roles) and incorrectly assume that an S3 bucket policy can reference a security group, when in fact S3 bucket policies support only principal, source IP, VPC, or source VPC endpoint conditions, not security group IDs.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that can cache and serve content from S3, but it does not grant the application itself the ability to read/write to the bucket; it only proxies requests from clients. Option B is wrong because hardcoding AWS access keys in application code violates security best practices, as keys can be exposed in version control or logs, and Elastic Beanstalk provides a more secure mechanism via instance profiles. Option C is wrong because S3 bucket policies can restrict access by source IP or VPC, but they cannot reference EC2 security groups directly; security groups are a network-level construct, not an identity-based one, and S3 does not evaluate security group IDs in bucket policies.

688
Matchingmedium

Match each AWS deployment strategy to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Switch between two environments

Gradual traffic shifting

Update instances incrementally

Immediate full deployment

Equal percentage increments

Why these pairings

Common deployment strategies include Rolling, Blue/Green, and Canary. Rolling deploys incrementally, Blue/Green switches between environments, and Canary tests with a small subset. Distractors often confuse these definitions.

689
MCQmedium

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

A.Add an S3 bucket policy allowing the Lambda function's ARN to write objects.
B.Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.
C.Add a KMS key policy to allow the Lambda function to use a customer managed key.
D.Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.
AnswerD

This is the correct solution as it precisely grants the necessary permissions while adhering to the principle of least privilege. Attaching a policy statement to the 'LambdaExecutionRole' is the standard method for providing a Lambda function with permissions to interact with other AWS services. The 's3:PutObject' action is the specific permission required to write objects, and 'arn:aws:s3:::my-app-bucket/*' correctly scopes this permission to all objects within the specified S3 bucket.

Why this answer

The Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Exam trap

The trap here is that candidates often confuse bucket-level ARNs with object-level ARNs, selecting overly permissive options like `s3:*` on the bucket ARN instead of scoping the exact action and resource, or incorrectly assuming an S3 bucket policy is needed for same-account Lambda access.

How to eliminate wrong answers

Option A is wrong because an S3 bucket policy is used to grant cross-account access or public access, not to grant permissions to a Lambda function within the same account; the Lambda function's execution role is the correct mechanism. Option B is wrong because it uses a wildcard `s3:*` action and the bucket-level ARN `arn:aws:s3:::my-app-bucket` instead of the object-level ARN `arn:aws:s3:::my-app-bucket/*`, which is overly permissive and does not correctly scope the `s3:PutObject` permission to objects within the bucket. Option C is wrong because there is no indication that the S3 bucket uses a customer managed KMS key; the question only states the Lambda function needs to write objects, and KMS key policy is only relevant if server-side encryption with KMS is enabled, which is not mentioned.

690
MCQmedium

A developer is using CloudFront to serve content from an S3 bucket. The bucket contains sensitive data and should only be accessible through CloudFront. How can the developer enforce this?

A.Set the bucket policy to allow access only from CloudFront IP addresses.
B.Set the bucket policy to allow access only from AWS services.
C.Set the bucket policy to allow public read access and use CloudFront signed URLs.
D.Create an origin access identity (OAI) and grant it read access in the bucket policy.
AnswerD

Creating an Origin Access Identity (OAI) and granting it read access in the S3 bucket policy is the recommended and most secure method. The OAI acts as a virtual user for your CloudFront distribution, allowing only that specific distribution to retrieve content from the S3 bucket. This prevents direct public access to the S3 bucket while enabling CloudFront to serve the content securely to end-users.

Why this answer

An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant read access only to that OAI, you ensure that content can only be retrieved via CloudFront, not directly from the S3 endpoint. This enforces the requirement that the bucket is accessible exclusively through CloudFront.

Exam trap

The trap here is that candidates often assume restricting by CloudFront IP addresses (Option A) is a valid approach, but AWS explicitly warns that CloudFront IP ranges are not static and should not be used for access control in bucket policies.

How to eliminate wrong answers

Option A is wrong because CloudFront IP addresses are not static and can change over time; using them in a bucket policy would require constant updates and is not a supported or reliable method for restricting access. Option B is wrong because there is no generic 'AWS services' principal in S3 bucket policies; you must specify a specific service principal or user, and this approach would not restrict access to CloudFront only. Option C is wrong because allowing public read access defeats the purpose of restricting access to CloudFront; signed URLs can control who accesses content via CloudFront, but the bucket itself would remain publicly accessible, violating the requirement.

691
Multi-Selectmedium

A developer is implementing S3 multipart upload for large files. Which two actions are required to complete the upload?

Select 2 answers
A.Enable S3 static website hosting
B.Upload all parts and keep their ETags/part numbers
C.Disable bucket encryption
D.Call CompleteMultipartUpload with the uploaded part list
AnswersB, D

After initiating a multipart upload, the core process involves uploading each individual part of the large file using the `UploadPart` API operation. For every successful part upload, Amazon S3 returns a unique ETag (entity tag) and the corresponding part number. It is critical to store these ETags and part numbers, as they are mandatory parameters for the subsequent `CompleteMultipartUpload` request, which reassembles the parts into the final object.

Why this answer

During an S3 multipart upload, each part must be uploaded individually, and the response includes an ETag (a hash of the part) and a part number. These must be recorded and provided in the final request to assemble the object. Option D is correct because the CompleteMultipartUpload API call is required to signal S3 to combine all uploaded parts into the final object, using the list of ETags and part numbers.

Exam trap

The trap here is that candidates may think uploading all parts is sufficient without calling CompleteMultipartUpload, or they may confuse the multipart upload process with other S3 features like static hosting or encryption settings.

692
MCQmedium

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

A.The Lambda function has a syntax error.
B.The S3 bucket's event notification still points to the old Lambda function.
C.The Lambda function alias is not pointing to the new version.
D.The S3 events are being throttled by Lambda.
AnswerB

When a new Lambda function version is deployed, S3 event notifications configured to invoke a specific Lambda function (by ARN) will continue to invoke the previously configured version or $LATEST if no specific version was specified. To direct S3 events to a new specific version, the S3 event notification configuration on the bucket must be explicitly updated with the new Lambda function version ARN. This is a common operational oversight when deploying new function versions.

Why this answer

After deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Exam trap

The trap here is that candidates assume deploying a new Lambda version automatically updates all event sources, but S3 event notifications are static ARN references that must be manually updated or use aliases to reflect the new version.

How to eliminate wrong answers

Option A is wrong because a syntax error would cause the Lambda function to fail during invocation, which would generate error logs in CloudWatch Logs, but the question states there are no errors. Option C is wrong because Lambda function aliases are optional; if the S3 event notification is configured to invoke the function directly without an alias (e.g., using the function ARN without a qualifier), the alias not pointing to the new version is irrelevant. Option D is wrong because Lambda throttling would produce a 'ThrottleReason' metric in CloudWatch and error logs (e.g., 429 TooManyRequestsException), but the question states no errors are present.

693
MCQhard

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

A.The Lambda function is not configured to use a VPC.
B.The IAM role does not have a trust policy that allows Lambda to assume it.
C.The IAM policy does not include logs:CreateLogStream.
D.The CloudWatch Logs log group does not exist.
AnswerC

For a Lambda function to successfully write logs to CloudWatch Logs, its execution role requires specific permissions. While `logs:PutLogEvents` is necessary to transmit the actual log data, the function also crucially needs `logs:CreateLogStream` to establish a new log stream within the designated log group if one does not already exist for that particular invocation or execution environment. Without this `CreateLogStream` permission, the function cannot initialize the required logging infrastructure, leading to a failure in log delivery, even if it possesses the permission to put events.

Why this answer

Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Exam trap

The trap here is that candidates assume `logs:CreateLogGroup` and `logs:PutLogEvents` are sufficient, overlooking the mandatory `logs:CreateLogStream` permission required for the log stream creation step between group creation and event writing.

How to eliminate wrong answers

Option A is wrong because Lambda functions can write logs to CloudWatch Logs without being in a VPC; VPC configuration affects network access but not log delivery. Option B is wrong because the Lambda function already has an IAM role attached, meaning the trust policy (which allows Lambda to assume the role) was already validated when the role was assigned to the function. Option D is wrong because CloudWatch Logs automatically creates the log group if it does not exist when the Lambda function first invokes, provided the IAM policy includes `logs:CreateLogGroup`.

694
MCQmedium

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer needs to identify the root cause. Which AWS service should the developer use to view detailed error logs from the failed deployment?

A.Amazon CloudWatch Logs (if configured) or the CodeDeploy agent log files on the EC2 instances
B.AWS X-Ray
C.AWS CloudTrail
D.AWS CodeDeploy console
AnswerA

The CodeDeploy agent, which runs on the target EC2 instances, generates detailed logs for every step of the deployment process, including lifecycle hook script execution and file transfers. These logs are stored locally on the instance (e.g., /var/log/aws/codedeploy-agent/codedeploy-agent.log on Linux) and provide the most granular information for troubleshooting. If configured, the agent can stream these logs to Amazon CloudWatch Logs, offering a centralized and easily accessible location for analysis without requiring direct SSH access to each instance.

Why this answer

When a CodeDeploy deployment fails due to instance-level errors, the most direct way to investigate is to examine the CodeDeploy agent logs located on each EC2 instance at `/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent.log`. If Amazon CloudWatch Logs has been configured to stream these logs, you can also view them centrally in the CloudWatch console. These logs contain detailed error messages from the `codedeploy-agent` process, including script failures, permission issues, or missing dependencies that caused the deployment to fail.

Exam trap

The trap here is that candidates assume the CodeDeploy console provides detailed error logs, but it only shows aggregated failure counts and high-level messages, while the actual root cause is buried in the agent logs on the EC2 instances or in CloudWatch Logs if configured.

How to eliminate wrong answers

Option B is wrong because AWS X-Ray is a distributed tracing service for analyzing and debugging request flows in microservices applications, not a log viewer for deployment errors. Option C is wrong because AWS CloudTrail records API calls made to AWS services (e.g., who triggered the deployment), but it does not capture the internal agent-level error logs from individual EC2 instances. Option D is wrong because the AWS CodeDeploy console only shows high-level deployment status and failure summaries (e.g., 'failed instances'), not the detailed per-instance error logs needed to diagnose root causes.

695
MCQeasy

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

A.AWS Lambda
B.Amazon Simple Email Service (SES)
C.Amazon Simple Notification Service (SNS)
D.Amazon Simple Queue Service (SQS)
AnswerB

Amazon Simple Email Service (SES) is a highly scalable, cost-effective, and flexible cloud-based email sending service designed for developers to send marketing, notification, and transactional emails from any application. It handles the underlying email infrastructure, including SMTP, deliverability, and reputation management, allowing applications to programmatically send emails via API, SDKs, or SMTP interface. This makes SES the ideal choice for applications requiring direct email sending capabilities.

Why this answer

Amazon Simple Email Service (SES) is specifically designed for sending transactional emails, such as order confirmations, password resets, and marketing communications. It provides a reliable, scalable SMTP interface or API to send high-deliverability emails, with features like dedicated IP addresses and feedback loops. This makes it the correct choice for an application that needs to send email notifications directly to users.

Exam trap

The trap here is that candidates often confuse Amazon SNS with SES because both can send notifications, but SNS is limited to push notifications (SMS, mobile push, HTTP) and cannot send rich transactional emails, while SES is the dedicated email service.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not a service for sending emails; it could be used to trigger email sending via SES, but it is not the email delivery service itself. Option C is wrong because Amazon Simple Notification Service (SNS) is a pub/sub messaging service designed for sending push notifications to endpoints like SMS, mobile apps, or HTTP/HTTPS, not for sending transactional emails with rich content or attachments. Option D is wrong because Amazon Simple Queue Service (SQS) is a fully managed message queuing service for decoupling application components, and it has no capability to send emails; it can only hold messages for processing by other services.

696
MCQeasy

A developer attaches the above bucket policy to an S3 bucket. An anonymous user tries to access https://my-bucket.s3.amazonaws.com/secret/key.txt. What is the result?

A.Access is denied because the explicit Deny overrides the Allow.
B.Access is allowed because the Allow statement covers all objects.
C.Access is allowed because anonymous requests are not affected by Deny statements.
D.Access is denied because the policy is invalid (two statements conflict).
AnswerA

AWS IAM policy evaluation uses an explicit deny as an absolute override: if a bucket policy contains an applicable Deny statement for the same principal, action, and resource, that Deny takes precedence over any Allow statement. This precedence rule holds regardless of whether the Allow appears in the same policy or in a different IAM policy attached to the requester, so the anonymous (unauthenticated) request is blocked even though the Allow statement would otherwise match S3:GetObject.

Why this answer

The explicit Deny statement for the 'secret/' prefix overrides the Allow statement that grants access to all objects. Even though the Allow grants access to all objects, the Deny specifically denies access to objects under 'secret/', and explicit Deny always takes precedence. Option B is incorrect because the Deny overrides the Allow for the specified prefix.

Option C is incorrect because Deny statements apply to all users, including anonymous users. Option D is incorrect because having two statements that conflict does not make the policy invalid; the explicit Deny simply takes precedence.

697
MCQmedium

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage that pulls from CodeCommit and a deploy stage that uses AWS Elastic Beanstalk. The developer wants to run unit tests automatically before deploying to Elastic Beanstalk. Which action should the developer add to the pipeline?

A.Add a test stage that uses an AWS CodeBuild project configured to run unit tests
B.Add a manual approval step before the deploy stage
C.Configure Elastic Beanstalk health checks to run tests
D.Replace Elastic Beanstalk with AWS CodeDeploy
AnswerA

AWS CodeBuild is specifically designed to run custom build and test commands as part of a CI/CD pipeline. By integrating a CodeBuild project into a dedicated test stage within AWS CodePipeline, developers can execute unit tests, integration tests, or even security scans against their application code in a managed compute environment. This ensures that code quality and functionality are validated automatically before proceeding to deployment, catching issues early in the development lifecycle.

Why this answer

AWS CodeBuild can be integrated as a test stage in CodePipeline to run unit tests automatically. By adding a CodeBuild project configured with a buildspec.yml file that executes unit tests, the pipeline will run tests after the source stage and before the deploy stage, ensuring only code that passes tests is deployed to Elastic Beanstalk.

Exam trap

The trap here is that candidates may confuse health checks (which monitor runtime health) with unit tests (which validate code logic), or think a manual approval step can substitute for automated testing, but AWS specifically tests the understanding that CodeBuild is the service designed for running custom build and test commands in a pipeline.

How to eliminate wrong answers

Option B is wrong because a manual approval step pauses the pipeline for human review, but does not execute unit tests automatically; it only gates deployment. Option C is wrong because Elastic Beanstalk health checks monitor the environment's operational status (e.g., HTTP response codes), not run unit tests on the application code. Option D is wrong because replacing Elastic Beanstalk with CodeDeploy does not add automated testing; CodeDeploy is a deployment service, not a test runner.

698
MCQmedium

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that the encryption keys be rotated every 90 days and that access to the keys be auditable. Which solution meets these requirements with the LEAST operational overhead?

A.Use SSE-S3 with default encryption enabled.
B.Use client-side encryption with the AWS Encryption SDK.
C.Use SSE-C with keys stored in AWS Secrets Manager.
D.Use SSE-KMS with a customer managed key and enable automatic key rotation.
AnswerD

KMS automatic rotation meets the 90-day requirement and provides auditing.

Why this answer

SSE-KMS with a customer managed key and automatic key rotation meets the requirements with the least operational overhead. SSE-KMS provides auditable access to keys via AWS CloudTrail, and automatic key rotation satisfies the 90-day rotation requirement without manual intervention. Option A (SSE-S3) is incorrect because S3-managed keys cannot be rotated on a schedule.

Option B (client-side encryption) adds significant operational overhead for key management and rotation. Option C (SSE-C) requires the company to manage and rotate its own encryption keys, increasing complexity.

699
MCQeasy

A developer is using AWS CodePipeline to deploy a web application. The pipeline has stages: Source, Build, Staging Deploy, Staging Test, and Prod Deploy. The developer wants to ensure that if the Staging Test stage fails, the pipeline automatically stops and does not proceed to Prod Deploy. Which action should the developer take?

A.No action is needed; CodePipeline automatically stops on stage failure
B.Add a manual approval step before Prod Deploy
C.Disable the transition from Staging Test to Prod Deploy
D.Configure the pipeline execution mode to 'Superseded'
AnswerA

AWS CodePipeline is inherently designed to halt execution when any action within a stage fails, causing the entire stage to be marked as failed. This default behavior prevents the pipeline from automatically transitioning to subsequent stages, ensuring that faulty code or configurations do not progress further into environments like staging or production. Therefore, no explicit configuration is needed to stop the pipeline on stage failure; it is a built-in safety mechanism.

Why this answer

AWS CodePipeline's default behavior is to stop execution when a stage fails, preventing the pipeline from proceeding to subsequent stages. When the Staging Test stage fails, the pipeline transitions to a 'Failed' status and does not automatically continue to Prod Deploy. No additional configuration is required for this behavior.

Exam trap

The trap here is that candidates may overthink the solution and assume additional configuration is needed, when in fact CodePipeline's default behavior already stops on stage failure, making options like manual approval or disabling transitions unnecessary.

How to eliminate wrong answers

Option B is wrong because adding a manual approval step before Prod Deploy would require human intervention to proceed, but it does not automatically stop the pipeline on Staging Test failure; the pipeline would still wait for approval even if the test failed, which is not the desired behavior. Option C is wrong because disabling the transition from Staging Test to Prod Deploy would prevent any execution to Prod Deploy, even if the Staging Test stage succeeds, which is overly restrictive and not conditional on failure. Option D is wrong because configuring the pipeline execution mode to 'Superseded' controls how multiple pipeline executions are handled (e.g., canceling a running execution when a new one starts), not how the pipeline responds to stage failures.

700
MCQeasy

A development team wants to automatically deploy a web application to Amazon EC2 instances when new code is pushed to the master branch of an AWS CodeCommit repository. Which AWS service should the team use to orchestrate the build, test, and deployment phases?

A.AWS CloudFormation
B.AWS CodeBuild
C.AWS CodePipeline
D.AWS CodeDeploy
AnswerC

AWS CodePipeline is a fully managed continuous delivery service that automates release pipelines for rapid and reliable application and infrastructure updates. It orchestrates the entire CI/CD workflow, seamlessly integrating with various AWS services like CodeCommit for source, CodeBuild for build and test, and CodeDeploy for deployment. This comprehensive orchestration capability makes it the ideal choice for automatically deploying a web application through a defined, multi-stage pipeline.

Why this answer

AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire build, test, and deployment phases as a pipeline. It can be configured to automatically trigger on code pushes to the master branch of an AWS CodeCommit repository, then invoke AWS CodeBuild for building and testing, and finally deploy to EC2 instances via AWS CodeDeploy, providing end-to-end automation.

Exam trap

The trap here is that candidates often confuse AWS CodeBuild with CodePipeline because both can be triggered by CodeCommit pushes, but CodeBuild alone cannot orchestrate multiple sequential phases like testing and deployment, which is the key requirement in the question.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation is an infrastructure-as-code service for provisioning and managing AWS resources, not for orchestrating build, test, and deployment phases triggered by code pushes. Option B is wrong because AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages, but it does not orchestrate the entire pipeline or trigger on repository events by itself. Option D is wrong because AWS CodeDeploy is a deployment service that automates application deployments to EC2 instances or other compute services, but it does not handle the build or test phases or orchestrate a multi-stage pipeline.

701
Multi-Selecthard

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Select 3 answers
A.Add a second pipeline for the approval step.
B.Configure the approval action to use an SNS topic for notifications.
C.Use AWS CodeBuild to run a script that waits for manual approval.
D.Create an IAM role that allows the pipeline to publish to the SNS topic.
E.Add an approval action to the pipeline before the deploy stage.
AnswersB, D, E

When a manual approval action is configured in AWS CodePipeline, it can be integrated with Amazon SNS to send notifications to designated approvers. Upon reaching the approval stage, CodePipeline publishes a message to the specified SNS topic, which can then trigger email subscriptions or other endpoints to alert approvers. This ensures timely communication and allows approvers to access the approval console link directly from the notification, facilitating a prompt decision.

Why this answer

AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Exam trap

The trap here is that candidates may think a separate pipeline or a custom script is needed for manual approval, but AWS CodePipeline provides a built-in approval action that integrates directly with SNS and IAM, making those external workarounds incorrect.

702
MCQmedium

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

A.The task IAM role does not have permissions to access DynamoDB.
B.The security group of the tasks does not allow outbound traffic to DynamoDB.
C.The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.
D.The task definition does not have a network mode that supports DynamoDB.
AnswerC

When an ECS task runs in a private subnet, it lacks a direct route to the internet, which is necessary to reach public AWS service endpoints like DynamoDB. Without a NAT Gateway to provide outbound internet access or a VPC endpoint for DynamoDB (a Gateway Endpoint for DynamoDB specifically), the task has no network path to communicate with the DynamoDB service. This configuration prevents any successful API calls from the private subnet.

Why this answer

ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Exam trap

The trap here is that candidates often assume IAM permissions (Option A) are the sole cause of access failures, overlooking the network-layer requirement that private subnets need a route to public AWS services via a NAT gateway or VPC endpoint.

How to eliminate wrong answers

Option A is wrong because the task IAM role controls permissions to DynamoDB actions (e.g., GetItem, PutItem), but if the tasks cannot reach the DynamoDB endpoint at the network level, permissions are irrelevant—the request never arrives. Option B is wrong because security groups are stateful; outbound traffic is allowed by default unless explicitly denied, and DynamoDB does not require a specific outbound rule for HTTPS (port 443) since the default outbound rule allows all traffic. Option D is wrong because the network mode (e.g., awsvpc, bridge, host) does not affect the ability to reach DynamoDB; Fargate requires the awsvpc mode, which assigns an elastic network interface to each task, but this does not block outbound traffic to DynamoDB.

703
MCQeasy

A developer has written an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has 10,000 messages waiting to be processed. What will happen when the Lambda function is invoked?

A.Lambda will automatically increase reserved concurrency to handle the load.
B.Lambda will reject the invocation because reserved concurrency is too low.
C.Lambda will scale up to 20 concurrent executions to process all messages quickly.
D.Lambda will process messages with a maximum of 5 concurrent executions, each processing a batch of messages.
AnswerD

This statement accurately describes the behavior of a Lambda function configured with reserved concurrency. The function will scale up to, but not exceed, the specified limit of 5 concurrent executions. Each of these concurrent executions will then process a batch of messages from the event source, ensuring that the processing adheres strictly to the defined concurrency constraint.

Why this answer

AWS Lambda integrates with Amazon SQS to poll the queue and invoke the function with batches of messages. The reserved concurrency of 5 caps the maximum number of concurrent executions, so Lambda will process messages with up to 5 concurrent invocations, each receiving a batch of up to 10 messages (default batch size). The remaining messages remain in the queue until they are processed or the visibility timeout expires.

Exam trap

The trap here is that candidates assume Lambda will automatically scale to handle the queue depth, but reserved concurrency is a hard limit that prevents scaling beyond the configured value, leading to throttling rather than rejection or automatic scaling.

How to eliminate wrong answers

Option A is wrong because reserved concurrency is a hard limit that Lambda cannot automatically increase; it must be manually adjusted or removed. Option B is wrong because Lambda does not reject invocations due to low reserved concurrency; it simply throttles the function, and unprocessed messages remain in the SQS queue. Option C is wrong because Lambda cannot scale beyond the reserved concurrency of 5, regardless of the number of messages in the queue.

704
Multi-Selecthard

A company is deploying a microservices architecture using AWS Lambda and Amazon API Gateway. The developer wants to implement a canary release deployment for the API. Which THREE steps should the developer take? (Choose THREE.)

Select 3 answers
A.Configure stage variables to point the canary stage to a different Lambda function alias.
B.Enable canary by setting the traffic percentage in the API Gateway stage.
C.Use API Gateway canary release settings to create a canary stage.
D.Use Amazon CloudFront to distribute traffic between two API Gateway stages.
E.Use Lambda canary releases to gradually shift traffic.
AnswersA, B, C

Configuring stage variables within the API Gateway canary stage is the precise mechanism to direct a portion of incoming requests to a specific Lambda function alias, representing the new version of the backend service. This allows the canary stage to dynamically resolve the target Lambda version, ensuring that only the designated traffic percentage interacts with the updated code. It's fundamental for separating the base deployment from the experimental one.

Why this answer

Stage variables in API Gateway can be configured to point the canary stage to a different Lambda function alias, enabling the canary to invoke a separate version of the function for testing. This allows the canary to route a percentage of traffic to a new Lambda version while the main stage continues using the stable alias, supporting gradual rollouts.

Exam trap

The trap here is that candidates may confuse Lambda alias weighted routing (Option E) with API Gateway canary releases, but the question explicitly asks for API-level canary deployment, which requires API Gateway's native canary settings, not just Lambda-level traffic shifting.

705
MCQeasy

A developer is deploying a Docker container to Amazon ECS using the Fargate launch type. The developer wants to ensure the container has access to an Amazon RDS database. What is the best way to securely pass the database credentials to the container?

A.Pass the credentials as plain text environment variables in the task definition.
B.Store the credentials in an Amazon S3 bucket and download them at container startup.
C.Store the credentials in the container image as environment variables.
D.Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store the credentials and reference them in the task definition.
AnswerD

Utilizing AWS Systems Manager Parameter Store or AWS Secrets Manager for credential storage is the recommended secure practice for Amazon ECS. Both services encrypt secrets at rest and in transit, provide robust IAM-based access control, and integrate seamlessly with ECS task definitions to inject secrets at runtime. This method ensures credentials are never exposed in plain text within the task definition or container image, leveraging the task's IAM role for secure, on-demand retrieval and supporting features like automatic rotation with Secrets Manager.

Why this answer

AWS Systems Manager Parameter Store and AWS Secrets Manager are designed to securely store and manage sensitive information like database credentials. In Amazon ECS with Fargate, you can reference these secrets directly in the task definition using the 'secrets' parameter, which injects them as environment variables at runtime without exposing them in plain text or requiring additional code to fetch them. This approach adheres to the principle of least privilege and integrates natively with IAM roles for secure access.

Exam trap

The trap here is that candidates may think environment variables are inherently secure or that storing credentials in S3 is a safe alternative, overlooking the native integration and security guarantees of AWS Secrets Manager and Parameter Store for ECS tasks.

How to eliminate wrong answers

Option A is wrong because passing credentials as plain text environment variables in the task definition exposes them in the ECS console, API responses, and logs, violating security best practices. Option B is wrong because downloading credentials from an S3 bucket at container startup requires storing AWS access keys in the container or granting broad S3 permissions, and the credentials could be exposed in transit or logs; it also adds unnecessary complexity and latency. Option C is wrong because embedding credentials in the container image as environment variables makes them accessible to anyone with access to the image registry and prevents rotation without rebuilding the image, violating immutable infrastructure principles.

706
MCQmedium

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

A.AWS CodeBuild
B.AWS CodePipeline
C.AWS Lambda
D.AWS CodeDeploy
AnswerB

AWS CodePipeline is a fully managed continuous delivery service that automates release pipelines for fast and reliable application and infrastructure updates. It seamlessly integrates with AWS CodeCommit as a primary source stage, automatically detecting code changes (e.g., pushes to a specific branch) and initiating the entire pipeline workflow. CodePipeline orchestrates subsequent stages like build, test, and deploy using other AWS services, making it the ideal choice for end-to-end CI/CD.

Why this answer

AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Exam trap

The trap here is that candidates confuse individual services (CodeBuild for building, CodeDeploy for deploying) with the orchestration service (CodePipeline) needed to chain them together in response to a source code event.

How to eliminate wrong answers

Option A is wrong because AWS CodeBuild is a build service that compiles source code and runs tests, but it does not have native event-driven triggers to automatically start on a CodeCommit push; it requires an external trigger like CodePipeline or a webhook. Option C is wrong because AWS Lambda can be used to react to CodeCommit events via CloudWatch Events or SNS, but it is not a purpose-built CI/CD service and would require custom code to orchestrate build and deployment steps, making it less suitable than CodePipeline. Option D is wrong because AWS CodeDeploy is a deployment service that automates application deployments to compute services like EC2 or Lambda, but it cannot directly listen to CodeCommit push events or orchestrate a build step; it relies on a pipeline or other trigger to initiate deployments.

707
MCQmedium

A developer is building a REST API using Amazon API Gateway and wants to transform the request data before sending it to the backend Lambda function. The transformation includes mapping query string parameters to a JSON body. Which API Gateway feature should be used?

A.Velocity Template Language (VTL) mapping templates
B.Lambda authorizer
C.Request validator
D.CORS configuration
AnswerA

Velocity Template Language (VTL) mapping templates are a core feature within API Gateway's integration request and response stages. They enable the transformation of incoming client request payloads and outgoing backend responses into formats compatible with the integration. This includes converting query string parameters, path parameters, or headers into a structured JSON body, or vice-versa, making them essential for adapting data formats between client and backend services.

Why this answer

API Gateway uses Velocity Template Language (VTL) mapping templates to transform incoming request data, such as mapping query string parameters into a JSON body before passing it to the backend Lambda function. This feature allows you to define a template that extracts values from the request's query string parameters (e.g., `$input.params('paramName')`) and constructs a new JSON payload, enabling seamless integration with Lambda without modifying the client request.

Exam trap

The trap here is that candidates often confuse request validation (Option C) with data transformation, assuming that validating the request structure also implies the ability to reshape the data, but validation only checks for presence and format, not mapping or transformation.

How to eliminate wrong answers

Option B is wrong because a Lambda authorizer is used for custom authentication and authorization of API requests, not for transforming request data or mapping parameters to a JSON body. Option C is wrong because a request validator only validates that the request adheres to the API's defined schema (e.g., required parameters, types), but it does not perform any data transformation or mapping. Option D is wrong because CORS configuration manages cross-origin resource sharing headers (e.g., Access-Control-Allow-Origin) to allow browser-based clients from different domains, and it has no role in transforming request payloads or mapping query string parameters.

708
Multi-Selecthard

A developer is building a real-time chat application using WebSocket APIs in API Gateway and Lambda. The application must handle thousands of concurrent connections. Which TWO actions should the developer take to ensure the application scales properly?

Select 2 answers
A.Use CloudFront to distribute the WebSocket endpoints.
B.Place the Lambda function in a VPC to improve security.
C.Enable API Gateway caching to reduce Lambda invocations.
D.Set the Lambda function's reserved concurrency to a high enough value.
E.Use a DynamoDB table to store connection IDs and handle connection state.
AnswersD, E

For a real-time chat application, sudden bursts of user activity can lead to a large volume of concurrent Lambda invocations. Setting a high enough reserved concurrency guarantees that a specified number of execution environments are always available exclusively for this specific Lambda function, preventing it from being throttled by the account's unreserved concurrency pool. This ensures the function can consistently process messages and maintain responsiveness even during peak load, which is critical for delivering a smooth and reliable real-time chat experience.

Why this answer

Setting reserved concurrency ensures the Lambda function has enough allocated capacity to handle the high volume of concurrent WebSocket connections without being throttled by the account-level concurrency limit. Without reserved concurrency, the function could experience throttling errors (HTTP 429) during traffic spikes, causing dropped connections and poor user experience.

Exam trap

A common pitfall is assuming CloudFront can help scale WebSocket APIs for concurrent connections. While CloudFront does support WebSocket connections, it does not address the backend Lambda scaling or state management required for thousands of connections. The correct scaling actions are setting reserved concurrency for the Lambda function and storing connection IDs in DynamoDB for state management.

Similarly, enabling API Gateway caching or placing Lambda in a VPC do not solve the concurrency scaling issue.

709
MCQeasy

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

A.Amazon EC2 instance store
B.Amazon EFS file system
C.Amazon S3 bucket
D.Amazon EBS volume
AnswerB

Amazon EFS (Elastic File System) provides scalable, elastic, shared file storage that can be accessed concurrently by multiple AWS Fargate tasks. It offers persistent storage, ensuring data remains available even if containers are stopped, replaced, or scaled. This makes EFS an excellent choice for containerized applications requiring shared state, persistent data, or a common file system across different application instances running on Fargate.

Why this answer

Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes cannot be attached to multiple Fargate containers or tasks simultaneously, making EFS the only correct choice for shared persistent storage in this context.

How to eliminate wrong answers

Option A is wrong because Amazon EC2 instance store provides ephemeral block storage that is tied to the lifecycle of an EC2 instance, not a Fargate task, and cannot be shared across multiple containers. Option C is wrong because Amazon S3 is an object storage service accessed via HTTP/HTTPS APIs, not a file system mountable via NFS, and does not provide the POSIX-compliant shared file system required for concurrent container access. Option D is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time (unless using multi-attach EBS, which is not supported with Fargate), and cannot be shared across multiple containers in the same Fargate task.

710
MCQmedium

A developer is using AWS Elastic Beanstalk to deploy a web application. The application needs to store session state. Which configuration is MOST cost-effective and scalable?

A.Use S3 to store session state
B.Use an ElastiCache Memcached cluster
C.Use an RDS database to store session state
D.Store session state in the local file system of each EC2 instance
AnswerB

An ElastiCache Memcached cluster provides a highly scalable, in-memory key-value store perfectly suited for transient session state. Its distributed nature allows multiple EC2 instances in an Elastic Beanstalk environment to access shared session data with very low latency. This ensures user sessions persist even if requests are routed to different instances by a load balancer, enhancing application scalability and user experience.

Why this answer

ElastiCache Memcached is the most cost-effective and scalable solution for storing session state because it is an in-memory cache designed for low-latency access, which is ideal for session data that must be frequently read and written. It scales horizontally by adding nodes, and its distributed nature ensures that session data persists across EC2 instance replacements, unlike local storage. This avoids the higher cost and overhead of RDS or the latency and eventual consistency issues of S3 for session management.

Exam trap

The trap here is that candidates often choose local file system storage (D) because it seems simplest and free, overlooking that it fails in auto-scaling environments where instances are ephemeral and session data is not shared.

How to eliminate wrong answers

Option A is wrong because S3 is an object store with higher latency and eventual consistency, making it unsuitable for session state that requires fast, consistent reads and writes; it also incurs per-request costs that can become expensive under high traffic. Option C is wrong because RDS is a relational database with higher cost and operational overhead (e.g., provisioning, scaling, backups) compared to an in-memory cache, and it is overkill for simple key-value session data. Option D is wrong because storing session state in the local file system of each EC2 instance breaks when instances are replaced or scaled out, as session data is not shared across instances, leading to data loss and poor scalability.

711
Multi-Selecthard

A Lambda function processes messages from an SQS standard queue and writes results to DynamoDB. Duplicate writes occasionally occur after retries. Which two changes best make the processing idempotent?

Select 2 answers
A.Use a deterministic idempotency key stored with a conditional write in DynamoDB
B.Increase the Lambda timeout to 15 minutes
C.Treat the SQS message ID or business transaction ID as a processed-record key
D.Disable SQS visibility timeout
AnswersA, C

SQS Standard queues provide at-least-once delivery, meaning messages can be delivered multiple times. Implementing idempotency is crucial to prevent duplicate processing side effects. By generating a deterministic key (e.g., from the SQS message ID or a business transaction ID) and storing it in DynamoDB with a conditional write (e.g., using `attribute_not_exists`), the Lambda function ensures that the operation only proceeds if the key hasn't been recorded before, making the operation safe for retries and preventing unintended state changes.

Why this answer

Using a deterministic idempotency key (e.g., a business transaction ID) combined with a conditional write in DynamoDB ensures that if the same message is processed more than once, the second write attempt will fail because the item already exists. This prevents duplicate records even when Lambda retries after a failure or timeout, making the processing idempotent at the database level.

Exam trap

The trap here is that candidates often confuse idempotency with simply increasing timeouts or disabling visibility timeouts, not realizing that idempotency requires a deterministic key and a conditional check at the storage layer.

712
MCQeasy

A developer wants to store session state for a web application that runs on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to store the session state in a centralized, highly available location?

A.Amazon RDS
B.Amazon S3
C.Amazon ElastiCache
D.AWS Lambda
AnswerC

Amazon ElastiCache is a fully managed in-memory caching service, offering high-performance, low-latency data retrieval using Redis or Memcached engines. It is specifically designed for use cases like session state management, where rapid access to frequently changing, ephemeral key-value data is critical. Its in-memory nature significantly reduces I/O latency compared to disk-based solutions, ensuring a responsive user experience and easily scaling to handle high request volumes.

Why this answer

Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that supports Redis or Memcached, which are ideal for storing session state in a centralized, highly available manner. Session data requires low-latency reads and writes, and ElastiCache offers sub-millisecond performance, replication across multiple Availability Zones, and automatic failover, making it suitable for stateless web applications behind an Application Load Balancer.

Exam trap

The trap here is that candidates mistakenly choose Amazon RDS for session storage due to its familiarity with databases, overlooking that session state is transient and requires low-latency access, which ElastiCache's in-memory architecture provides far more efficiently.

How to eliminate wrong answers

Option A is wrong because Amazon RDS is a relational database service designed for persistent, structured data with ACID compliance, not for transient session state; its higher latency and connection overhead make it suboptimal for frequent session reads/writes. Option B is wrong because Amazon S3 is an object storage service with eventual consistency for read-after-write in some cases, and its higher latency (typically tens of milliseconds) and lack of native session expiration mechanisms make it unsuitable for real-time session state management. Option D is wrong because AWS Lambda is a serverless compute service for running code in response to events, not a data store; it cannot natively persist session state across invocations without an external storage layer like ElastiCache or DynamoDB.

713
MCQeasy

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

A.aws cloudformation deploy
B.aws cloudformation create-change-set
C.aws cloudformation validate-template
D.aws cloudformation update-stack
AnswerB

Correct. The aws cloudformation create-change-set command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes.

Why this answer

The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Exam trap

The trap here is that candidates often confuse `aws cloudformation update-stack` with a preview command, but it directly applies changes, whereas `create-change-set` is the correct command for reviewing changes before execution.

How to eliminate wrong answers

Option A is wrong because `aws cloudformation deploy` is used to deploy a stack or update an existing stack directly, but it does not provide a preview of changes before execution; it applies changes immediately. Option C is wrong because `aws cloudformation validate-template` only checks the syntax and structure of a CloudFormation template, not the impact of changes on an existing stack. Option D is wrong because `aws cloudformation update-stack` directly updates the stack without offering a preview of the changes, making it unsuitable for reviewing changes beforehand.

714
MCQmedium

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails during the 'BeforeInstall' lifecycle event. Which file should the developer check to debug the failure?

A.index.js
B.appspec.yml
C.taskdef.json
D.buildspec.yml
AnswerB

The appspec.yml file is central to AWS CodeDeploy, serving as the deployment specification. It explicitly defines the source files to be deployed, their destination on the target instance, and, critically, the lifecycle event hooks. Within these hooks, the appspec.yml specifies which scripts CodeDeploy should execute at each stage, such as BeforeInstall, AfterInstall, ApplicationStart, and ValidateService. Failures during these script executions directly manifest as lifecycle hook failures, making appspec.yml the primary configuration for managing deployment scripts and their outcomes.

Why this answer

The 'BeforeInstall' lifecycle event in AWS CodeDeploy is a hook defined in the appspec.yml file. This file specifies the deployment lifecycle hooks, including scripts to run before installation. When a deployment fails during this event, the appspec.yml is the primary file to inspect for misconfigured scripts, incorrect permissions, or missing script paths.

Exam trap

The trap here is that candidates confuse the deployment configuration file (appspec.yml) with build configuration files (buildspec.yml) or application code files (index.js), leading them to check the wrong file for deployment lifecycle failures.

How to eliminate wrong answers

Option A is wrong because index.js is a JavaScript application file, not a deployment configuration file; CodeDeploy does not read index.js for lifecycle events. Option C is wrong because taskdef.json is used by Amazon ECS to define task definitions, not by CodeDeploy for EC2/on-premises deployments. Option D is wrong because buildspec.yml is used by AWS CodeBuild to define build commands, not by CodeDeploy for deployment lifecycle hooks.

715
MCQhard

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

A.The caller must be allowed to use the KMS key for decrypt operations
B.The caller must own the destination VPC
C.The bucket must enable static website hosting
D.The object key must end with .kms
AnswerA

When an S3 object is encrypted using Server-Side Encryption with AWS KMS (SSE-KMS), the requesting principal requires explicit kms:Decrypt permissions on the associated KMS key. Even if the S3 bucket policy grants s3:GetObject to another account, the cross-account caller cannot retrieve the object's plaintext data without the necessary KMS key usage permissions. This dual authorization ensures robust data protection by separating storage access from encryption key access.

Why this answer

When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Exam trap

The trap here is that candidates assume a bucket policy granting s3:GetObject is sufficient for all objects, forgetting that SSE-KMS adds a separate authorization layer via KMS key policies that must explicitly allow the decrypt operation.

How to eliminate wrong answers

Option B is wrong because VPC ownership is irrelevant to S3 object access; S3 bucket policies and KMS permissions control cross-account access, not network ownership. Option C is wrong because static website hosting is a feature for serving public content and has no bearing on KMS-encrypted object access or cross-account authorization. Option D is wrong because the object key suffix has no effect on KMS authorization; SSE-KMS encryption is determined by the object's encryption settings, not its filename.

716
Multi-Selecteasy

Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)

Select 2 answers
A.Encrypt S3 objects automatically
B.Monitor network traffic
C.Define fine-grained permissions with policies
D.Manage EC2 instance lifecycle
E.Create and manage IAM users and groups
AnswersC, E

IAM policies are the core mechanism for defining fine-grained permissions. You can craft JSON-based identity policies that specify exactly which actions are allowed or denied on which resources, under what conditions (e.g., source IP, MFA presence, time of day). This allows least-privilege access control at the resource and API-action level, central to IAM's purpose.

Why this answer

Options C and E are correct. IAM allows you to define fine-grained permissions using policies (C) and create and manage users and groups (E). Option A is incorrect because encrypting S3 objects is a feature of S3, not IAM.

Option B is incorrect because monitoring network traffic is typically done by VPC flow logs or CloudTrail, not IAM. Option D is incorrect because managing EC2 instance lifecycle is an EC2 function, not IAM.

717
MCQeasy

A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?

A.Request validation using models and request validators
B.Usage plans with API keys
C.WAF (AWS WAF) integration
D.Custom authorizer (Lambda authorizer)
AnswerA

API Gateway's request validation feature directly addresses the need to validate the structure and data types of incoming request payloads. By defining a Model, which is essentially a JSON schema, and associating it with a Method's request body, API Gateway automatically checks the request against this schema. Invalid requests, such as those with missing required fields or incorrect data types, are rejected with a 400 Bad Request error *before* the request reaches the backend integration, significantly reducing unnecessary Lambda invocations and operational costs.

Why this answer

API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.

Exam trap

The trap here is that candidates confuse request validation (payload structure checking) with authorization (who can call the API) or security filtering (WAF), leading them to pick a wrong option like custom authorizer or WAF integration.

How to eliminate wrong answers

Option B is wrong because usage plans with API keys control rate limiting and quota management for API consumers, not payload structure validation. Option C is wrong because AWS WAF integration protects against web exploits like SQL injection or cross-site scripting at the HTTP layer, not JSON schema validation. Option D is wrong because a custom authorizer (Lambda authorizer) authenticates and authorizes the caller (e.g., via OAuth or JWT), but does not validate the request body's structure or content.

718
Multi-Selectmedium

Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)

Select 3 answers
A.A security group rule allowing inbound traffic on port 443
B.An SSL/TLS certificate from ACM or uploaded to IAM
C.A listener configured on port 443 with the certificate
D.Server Name Indication (SNI) support
E.An HTTP to HTTPS redirect rule
AnswersA, B, C

To enable encryption, the Application Load Balancer (ALB) must be able to receive incoming encrypted traffic from clients. A security group rule allowing inbound traffic on port 443 (HTTPS) is fundamental, as it acts as a virtual firewall, explicitly permitting the necessary TLS communication to reach the ALB. Without this rule, client connections attempting to establish an encrypted session would be blocked at the network layer, preventing any encryption from occurring.

Why this answer

A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.

Exam trap

The trap here is that candidates often confuse optional features like SNI or redirect rules as mandatory requirements, when in fact only the security group rule, the certificate, and the listener on port 443 are strictly necessary for encryption in transit.

719
MCQhard

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

A.The bucket policy denies access to the error.html object.
B.The Error document field in the static website hosting configuration is not set to error.html.
C.The index.html is missing from the bucket.
D.The error.html object has incorrect permissions.
AnswerB

This is the correct answer because the 'Error document' field within the S3 static website hosting configuration explicitly tells S3 which HTML file to serve when a 4xx error occurs. Without this field being correctly set to `error.html`, S3 will not know to redirect error requests to your custom page, even if `error.html` exists and has appropriate permissions. This configuration acts as the crucial routing instruction for custom error handling, ensuring a branded user experience during errors.

Why this answer

When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Exam trap

The trap here is that candidates often confuse a permission issue (like a bucket policy or object ACL) with a configuration issue, assuming a 403 error always means 'access denied' rather than a missing Error Document setting.

How to eliminate wrong answers

Option A is wrong because a bucket policy denying access to error.html would cause a 403 error for that specific object, but the scenario describes a generic 403 error when accessing a missing object, not a permission issue on the error page itself. Option C is wrong because if index.html were missing, users would get a 403 or 404 error on the root, but the question specifically states the error occurs when accessing a missing object, not the main page. Option D is wrong because incorrect permissions on error.html would prevent it from being served, but the generic 403 error when accessing a missing object is controlled by the Error Document configuration, not the object's permissions.

720
MCQeasy

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

A.EC2 user data
B.Amazon S3 with server-side encryption
C.AWS CloudFormation template parameters
D.AWS Systems Manager Parameter Store with SecureString
AnswerD

AWS Systems Manager Parameter Store, specifically when utilizing the SecureString data type, provides a highly secure and scalable solution for storing sensitive application configuration and secrets. SecureString encrypts parameter values using AWS Key Management Service (KMS) customer master keys, ensuring data is protected at rest and in transit. It offers fine-grained IAM access control, versioning, and seamless integration with EC2 instances and other AWS services for secure runtime retrieval without hardcoding credentials.

Why this answer

AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Exam trap

The trap here is that candidates confuse EC2 user data (which is easy to use but insecure) with a proper secrets management service, overlooking that Parameter Store provides encryption, access control, and audit logging essential for production security.

How to eliminate wrong answers

Option A is wrong because EC2 user data is unencrypted plaintext accessible via the instance metadata service (IMDS) and is intended for startup scripts, not secure storage of secrets. Option B is wrong because while Amazon S3 with server-side encryption protects data at rest, it lacks native integration for programmatic retrieval from EC2 with IAM roles and does not support automatic rotation or versioning of secrets. Option C is wrong because AWS CloudFormation template parameters are used for passing values during stack creation and are not designed for runtime secret retrieval; they can expose secrets in plaintext in the console or logs if not handled carefully.

721
MCQhard

A developer is using AWS Elastic Beanstalk to deploy a Node.js application. The developer wants to run a custom script to set environment variables before the application starts. Which configuration file and location should the developer use?

A.Add a configuration file in the .ebextensions directory that uses container_commands.
B.Add a Procfile to the application root.
C.Place a shell script in the .ebextensions/scripts directory.
D.Add a cron.yaml file to the .ebextensions directory.
AnswerA

Elastic Beanstalk configuration files placed in the `.ebextensions` directory provide a robust mechanism for customizing the environment. `container_commands` are specifically designed to execute custom commands on the EC2 instances after the application source code has been deployed and dependencies installed, but critically, before the application server starts processing requests. This execution phase makes them ideal for running custom scripts, performing database migrations, or setting up application-specific configurations that depend on the deployed code.

Why this answer

`.ebextensions` configuration files with `container_commands` allow you to run custom commands before the application starts. `container_commands` execute after the application and web server have been set up but before the application is deployed, making them ideal for setting environment variables or running setup scripts. The files must be in YAML or JSON format and placed in the `.ebextensions` directory at the root of your source bundle.

Exam trap

The trap here is that candidates confuse `container_commands` with `commands` (which run before the application setup) or assume a Procfile is used in Elastic Beanstalk, when in fact Elastic Beanstalk uses platform-specific hooks like `.platform/hooks/prebuild` or `.ebextensions` for custom scripts.

How to eliminate wrong answers

Option B is wrong because a Procfile is used by Heroku, not AWS Elastic Beanstalk; Elastic Beanstalk uses its own platform hooks and configuration files. Option C is wrong because placing a shell script in `.ebextensions/scripts` is not a recognized configuration method; Elastic Beanstalk does not automatically execute scripts from that path. Option D is wrong because `cron.yaml` is used for periodic tasks (cron jobs) in Elastic Beanstalk worker environments, not for running pre-deployment setup scripts.

722
MCQmedium

A developer is building a serverless application that uses Amazon S3 event notifications to trigger an AWS Lambda function for thumbnail generation. The developer wants to ensure that duplicate S3 events do not cause the same image to be processed multiple times. Which approach should the developer implement to ensure idempotent processing?

A.Store the object key and event ID in a DynamoDB table and check for duplicates before processing
B.Set the Lambda function's concurrency to 1 to prevent concurrent executions
C.Use an Amazon SQS FIFO queue as the event destination
D.Enable S3 event notification filtering based on object size
AnswerA

Amazon S3 event notifications operate on an "at least once" delivery model, meaning duplicate events can occur. By storing a unique identifier, such as a combination of the S3 object key and the event's `eventTime` or a generated `eventId`, in a DynamoDB table, the Lambda function can implement idempotency. Before processing, the function attempts a conditional write to DynamoDB; if the item already exists, it signifies a duplicate event that has been processed or is currently being handled, preventing redundant work and ensuring each object is processed exactly once.

Why this answer

Storing the S3 object key and event ID in a DynamoDB table with a TTL attribute allows the Lambda function to perform a conditional write (or check for an existing item) before processing. This ensures that even if duplicate S3 events are delivered (e.g., due to S3's at-least-once delivery guarantee), the same image is only processed once, achieving idempotency.

Exam trap

The trap here is that candidates often assume S3 event notifications are exactly-once, but the exam tests that they are at-least-once, requiring explicit idempotency handling via an external store like DynamoDB.

How to eliminate wrong answers

Option B is wrong because setting concurrency to 1 only prevents concurrent executions but does not prevent duplicate events from being processed sequentially; the same image could still be processed multiple times if duplicate events arrive one after another. Option C is wrong because SQS FIFO queues provide exactly-once processing within the queue, but S3 event notifications cannot directly send to a FIFO queue (S3 only supports standard SQS queues as event destinations), and even if you manually route through a FIFO queue, the deduplication ID would need to be based on the event ID, which is not automatically handled. Option D is wrong because filtering based on object size only reduces the number of events triggered (e.g., for small or large objects) but does not address duplicate events for the same object; duplicates can still occur regardless of size.

723
MCQeasy

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function that needs to access an Amazon DynamoDB table. The developer wants to grant the Lambda function the minimum required permissions to read and write items in the table. Which resource should the developer use to define the IAM permissions?

A.AWS::DynamoDB::Table
B.AWS::IAM::Role
C.AWS::Serverless::Function Policies property
D.AWS::Lambda::Permission
AnswerC

The Policies property within an AWS::Serverless::Function resource in a SAM template is the designated and most efficient way to attach IAM permissions to the Lambda function's execution role. This property allows developers to specify predefined SAM policy templates (e.g., DynamoDBReadPolicy) or define custom inline IAM policy statements, granting the function the necessary permissions to interact with other AWS services like DynamoDB. It directly modifies the function's execution role to allow specific actions.

Why this answer

The AWS::Serverless::Function resource's Policies property allows you to attach IAM policies directly to the Lambda function's execution role in a declarative manner. By specifying a policy statement with dynamodb:GetItem, dynamodb:PutItem, etc., and the ARN of the DynamoDB table, you grant the minimum required permissions for read and write access without manually creating an IAM role. SAM automatically creates and associates the IAM role with the function, simplifying permission management.

Exam trap

The trap here is that candidates confuse AWS::Lambda::Permission (which controls who can invoke the Lambda) with the IAM permissions needed for the Lambda to access other services, leading them to select Option D instead of the correct Policies property.

How to eliminate wrong answers

Option A is wrong because AWS::DynamoDB::Table defines the DynamoDB table resource itself, not IAM permissions; it cannot grant access to Lambda functions. Option B is wrong because AWS::IAM::Role is a generic CloudFormation resource that requires you to manually define the role, trust policy, and attach policies, which is more verbose and error-prone than using SAM's Policies property. Option D is wrong because AWS::Lambda::Permission is used to grant other AWS services or accounts permission to invoke the Lambda function, not to grant the Lambda function permissions to access other resources like DynamoDB.

724
MCQeasy

A developer is using the AWS CLI to upload a file to an S3 bucket with server-side encryption. The bucket is configured with default encryption (SSE-S3). The developer wants to ensure the object is encrypted with SSE-KMS instead. What should the developer do?

A.Use the --kms-key-id parameter with a KMS key ARN
B.Use the --sse aws:kms parameter when uploading
C.No action needed; the bucket default encryption will apply
D.Change the bucket policy to require SSE-KMS
AnswerB

This is the correct action. To ensure a file is encrypted with Server-Side Encryption with AWS KMS (SSE-KMS) during an AWS CLI upload, the --sse aws:kms parameter must be explicitly specified. This parameter instructs S3 to use KMS for encryption. If a specific KMS key is desired, it can be combined with the --kms-key-id parameter; otherwise, S3 will use the default AWS managed key for S3 in the account.

Why this answer

The developer must explicitly specify the server-side encryption method at the time of upload using the `--sse aws:kms` parameter in the AWS CLI. This overrides the bucket's default SSE-S3 encryption, ensuring the object is encrypted with SSE-KMS. Without this parameter, the object inherits the bucket's default encryption (SSE-S3), regardless of any other settings.

Exam trap

The trap here is that candidates assume bucket default encryption always applies to all objects, but in reality, request-level encryption parameters take precedence over bucket defaults, and the developer must explicitly specify SSE-KMS to override SSE-S3.

How to eliminate wrong answers

Option A is wrong because the `--kms-key-id` parameter is used to specify a specific KMS key ARN when SSE-KMS is already selected, but it does not enable SSE-KMS by itself; the `--sse aws:kms` parameter must also be provided. Option C is wrong because the bucket's default encryption (SSE-S3) will apply automatically, which does not meet the developer's requirement for SSE-KMS; the default is not overridden without explicit request-level parameters. Option D is wrong because changing the bucket policy to require SSE-KMS only enforces that objects must be encrypted with SSE-KMS at the bucket level, but the developer still needs to specify `--sse aws:kms` in the upload command to comply with that policy and achieve the desired encryption.

Page 9

Page 10 of 10

All pages