Courseiva

AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 301375

724 questions total · 10pages · All types, answers revealed

Page 4

Page 5 of 10

Page 6
301
MCQhard

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

A.Check that the application is using HTTPS instead of HTTP.
B.Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.
C.Check that the EC2 instance has permissions to decrypt the KMS key used by S3.
D.Check that the EC2 instance is in the same VPC as the S3 bucket.
AnswerB

AWS IAM policy evaluation logic dictates that an explicit deny statement always overrides any allow statements, regardless of where they are defined. If the S3 bucket policy contains an explicit deny that matches the EC2 instance's IAM role or the request's attributes, access will be blocked. This powerful mechanism ensures that specific access restrictions are enforced even if broader permissions are granted elsewhere, making it a critical check.

Why this answer

Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Exam trap

The trap here is that candidates assume an IAM role with an allow policy is sufficient, overlooking that S3 bucket policies can contain explicit deny statements that override the role's permissions.

How to eliminate wrong answers

Option A is wrong because S3 supports both HTTP and HTTPS, and using HTTP does not cause access denied errors; HTTPS is recommended for encryption in transit but not a requirement for authorization. Option C is wrong because the question does not mention S3 server-side encryption with KMS, and without a KMS key being used, KMS permissions are irrelevant to the access denied error. Option D is wrong because S3 buckets are global resources and do not reside in a VPC; EC2 instances can access S3 over the internet or via a VPC endpoint, but being in the same VPC is not a requirement for access.

302
Multi-Selectmedium

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Select 3 answers
A.Read the connection string from Amazon RDS tags.
B.Use AWS Secrets Manager.
C.Use Elastic Beanstalk environment properties.
D.Store the connection string in a configuration file in the application bundle.
E.Use AWS Systems Manager Parameter Store.
AnswersB, C, E

AWS Secrets Manager is purpose-built for this task: it stores the connection string as a secret encrypted by a KMS key, provides fine-grained access control through IAM policies, and natively supports automatic rotation for Amazon RDS credentials. The application can retrieve the secret at runtime using the AWS SDK, and you can even integrate it with Elastic Beanstalk via a custom resource or startup script. This minimizes human exposure and lets you change credentials without rebuilding or redeploying the application.

Why this answer

To pass the database connection string securely without hard-coding it, developers can use AWS Secrets Manager (B) to store and retrieve secrets programmatically, Elastic Beanstalk environment properties (C) to inject configuration into the application environment, and AWS Systems Manager Parameter Store (E) to securely store strings and secrets. Option A is incorrect because RDS tags are not designed for sensitive data like connection strings. Option D is incorrect because storing the connection string in a configuration file within the application bundle would expose it in the source code and deployment package.

303
MCQeasy

A developer wants to upload a large file (5 GB) to an Amazon S3 bucket using the AWS SDK. Which approach is MOST efficient and resilient?

A.Generate a presigned URL and use a third-party tool to upload.
B.Invoke an AWS Lambda function to upload the file.
C.Use the Multipart Upload API to upload the file in parts.
D.Use the PutObject API call with the entire file.
AnswerC

The Amazon S3 Multipart Upload API is the recommended and most efficient method for uploading large objects, specifically designed for files up to 5 TB. It allows a 5 GB file to be broken into smaller, independently uploaded parts, significantly improving throughput and resilience. This approach enables parallel uploads, easy resumption of failed parts, and enhanced fault tolerance against network issues, making it ideal for this scenario.

Why this answer

The Multipart Upload API is specifically designed for large objects (over 100 MB, recommended for 5 GB). It allows uploading a file in parallel parts, which improves throughput and resilience by enabling retries of individual failed parts without restarting the entire upload. This approach also supports pausing and resuming uploads, making it the most efficient and resilient method for a 5 GB file.

Exam trap

The trap here is that candidates may assume the PutObject API (Option D) is sufficient for large files because it supports up to 5 GB, but they overlook the lack of parallel uploads and partial failure recovery, which the Multipart Upload API provides and is explicitly recommended by AWS for files over 100 MB.

How to eliminate wrong answers

Option A is wrong because generating a presigned URL delegates the upload to a third-party tool, which introduces external dependencies and does not inherently provide the parallel upload or retry capabilities of the Multipart Upload API, reducing resilience and control. Option B is wrong because invoking an AWS Lambda function to upload the file is inefficient; Lambda has a maximum execution timeout of 15 minutes and a deployment package size limit of 250 MB (unzipped), making it unsuitable for handling a 5 GB upload directly, and it adds unnecessary complexity and latency. Option D is wrong because the PutObject API call has a maximum object size limit of 5 GB in a single PUT operation, but it does not support parallel uploads or partial retries; if the upload fails, the entire file must be re-uploaded, making it less resilient and efficient for large files compared to Multipart Upload.

304
MCQeasy

A developer has an Amazon S3 bucket containing private user documents. The application must generate a time-limited URL for users to download their own documents without requiring the users to have AWS credentials. Which solution should the developer use?

A.Use CloudFront signed URLs with an origin access identity (OAI) to restrict access to the S3 bucket.
B.Create a pre-signed URL for each object using the AWS SDK with an appropriate expiration time.
C.Set a bucket policy that allows public read access for the specific users based on their IP addresses.
D.Provide the users with IAM user credentials that have read access to the bucket.
AnswerB

Creating a pre-signed URL for each object using the AWS SDK is the most secure and efficient method for granting temporary access to private S3 objects. This URL, generated with the developer's AWS credentials and a specified expiration time, allows any recipient to perform a specific action (e.g., GET) on the object directly from S3 without needing their own AWS credentials. It provides granular, time-limited access, perfectly aligning with the need for secure access to private user documents.

Why this answer

Pre-signed URLs allow temporary, time-limited access to private S3 objects without requiring the user to have AWS credentials. The developer generates the URL server-side using the AWS SDK, embedding an expiration time, and the user can download the object directly via HTTP GET. This meets the requirement of granting ephemeral access to specific documents for unauthenticated users.

Exam trap

The trap here is that candidates often confuse pre-signed URLs with CloudFront signed URLs, thinking the CDN is required for time-limited access, but pre-signed URLs work directly with S3 and are simpler for single-object, time-limited downloads without needing CloudFront.

How to eliminate wrong answers

Option A is wrong because CloudFront signed URLs with OAI are used to control access at the CDN edge, but they still require the developer to manage CloudFront distributions and signing keys; the question asks for a simpler, direct S3 solution without requiring users to have AWS credentials. Option C is wrong because setting a bucket policy for public read access based on IP addresses would expose the bucket to all users from those IPs, violating the requirement for per-user, per-document private access and not providing time-limited URLs. Option D is wrong because providing IAM user credentials to end users is a security anti-pattern; it would require distributing long-term credentials, violating the principle of least privilege and the requirement that users not have AWS credentials.

305
MCQmedium

A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?

A.Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.
B.Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.
C.Hardcode the credentials as environment variables in the Lambda function configuration.
D.Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.
AnswerD

Secrets Manager provides secure storage and automatic rotation.

Why this answer

AWS Secrets Manager provides a secure, auditable, and automated way to store and retrieve database credentials. The Lambda function can assume an IAM role with permissions to access the secret, and retrieve the credentials at runtime using the AWS SDK, avoiding hardcoding or insecure storage. This approach also supports automatic rotation of credentials, enhancing security.

Exam trap

The trap here is that candidates may believe IAM database authentication (Option B) is not supported for RDS MySQL, but it is actually supported for MySQL 5.7 and 8.0. However, the question asks for the 'MOST secure' method. While IAM database authentication is secure, AWS Secrets Manager provides additional benefits such as automatic credential rotation, fine-grained access control, and audit logging, making it the most secure and recommended approach for managing database credentials in a serverless application.

How to eliminate wrong answers

Option A is wrong because storing credentials in an S3 bucket, even with server-side encryption, introduces additional complexity and risk: the Lambda function must manage decryption, and S3 access policies must be carefully configured, but more critically, this approach does not provide native secret rotation or fine-grained audit logging like Secrets Manager. Option B is wrong because IAM database authentication for MySQL is not supported by Amazon RDS MySQL; it is only supported for Amazon RDS Aurora MySQL and Amazon RDS PostgreSQL. Option C is wrong because hardcoding credentials as environment variables exposes them in plaintext in the Lambda function configuration, which can be viewed by anyone with access to the Lambda console or API, and they are not automatically rotated.

306
Multi-Selecthard

An API backed by Lambda returns high p95 latency after deployment. Which two telemetry sources are most useful first?

Select 2 answers
A.AWS Billing console only
B.CloudWatch Lambda duration/init duration/logs
C.S3 Inventory reports
D.X-Ray traces across API Gateway and Lambda
AnswersB, D

CloudWatch provides critical metrics like `Duration` and `Init Duration` for Lambda functions, directly revealing execution and cold start times. Analyzing the p95 percentile of these metrics pinpoints specific latency bottlenecks. Furthermore, detailed CloudWatch Logs offer granular insights into the function's internal execution flow, external service calls, and potential code-level inefficiencies contributing to high latency.

Why this answer

CloudWatch Lambda duration and init duration metrics directly measure the time your function spends executing and initializing, which are the primary drivers of p95 latency. Logs can reveal cold starts, timeouts, or inefficient code paths that cause high latency. These are the most immediate telemetry sources to identify performance bottlenecks in the Lambda function itself.

Exam trap

The trap here is that candidates often overlook the combination of CloudWatch metrics and X-Ray traces, mistakenly thinking that only one telemetry source (like CloudWatch logs) is sufficient, or they confuse billing data with performance monitoring.

307
MCQmedium

A developer is building a serverless application using AWS Step Functions. The workflow must execute hundreds of thousands of short-lived tasks per day, each taking less than 30 seconds. The tasks need to run in parallel, and a small number of duplicate executions are acceptable. Which type of Step Functions workflow should the developer choose?

A.Standard Workflow
B.Express Workflow
C.AWS Lambda function with synchronous invocation
D.Amazon Simple Workflow Service (SWF)
AnswerB

Express Workflows are optimized for high-volume, short-duration executions (under 5 minutes) with at-least-once delivery. They can handle hundreds of thousands of executions per second at a lower cost, making them suitable for this use case.

Why this answer

Express Workflows are designed for high-volume, short-duration (under 5 minutes) event-processing workloads, executing hundreds of thousands of state transitions per second with at-least-once semantics. Since the tasks are short-lived (under 30 seconds), run in parallel, and tolerate a small number of duplicate executions, Express Workflow is the correct choice because it offers lower cost and higher throughput than Standard Workflow, which guarantees exactly-once execution and is better suited for long-running, auditable workflows.

Exam trap

The trap here is that candidates often assume Standard Workflow is always the default choice for Step Functions, overlooking the specific requirements for high throughput, short duration, and tolerance for duplicates that make Express Workflow the correct answer.

How to eliminate wrong answers

Option A is wrong because Standard Workflow is designed for long-running, durable workflows with exactly-once execution and a maximum execution duration of one year, making it over-provisioned and more expensive for high-volume, short-lived tasks where duplicate executions are acceptable. Option C is wrong because AWS Lambda synchronous invocation is not a Step Functions workflow type; it is a compute invocation pattern that lacks the orchestration, state management, and parallel execution capabilities provided by Step Functions. Option D is wrong because Amazon Simple Workflow Service (SWF) is a legacy service for long-running, human-in-the-loop workflows, not optimized for high-throughput, short-lived automated tasks, and it requires managing workers and deciders, adding operational overhead.

308
Multi-Selecteasy

A developer is deploying an application using AWS Elastic Beanstalk. The developer wants to ensure that the application is highly available and can recover from an AZ failure. Which TWO configurations should be applied? (Choose TWO.)

Select 2 answers
A.Configure the environment to use multiple Availability Zones.
B.Select a larger EC2 instance type.
C.Enable Multi-AZ for the application's Amazon RDS database.
D.Attach an Elastic Load Balancer to the environment.
E.Use a single EC2 instance for simplicity.
AnswersA, D

Setting the Elastic Beanstalk environment to span multiple Availability Zones ensures that EC2 instances are distributed across physically separate data centers within the region. If one Availability Zone experiences an outage, instances in the other zones remain healthy and continue serving traffic, eliminating the risk of a single-AZ failure. Elastic Beanstalk automatically handles this distribution when you configure the environment with subnets in multiple AZs, providing a foundational layer of application-tier redundancy.

Why this answer

Options A and D are correct. A: Deploying to multiple Availability Zones ensures that if one AZ fails, the application remains available. D: An Elastic Load Balancer distributes traffic across instances in multiple AZs, improving fault tolerance.

Option B is incorrect because selecting a larger EC2 instance type increases compute capacity but does not provide AZ redundancy. Option C is incorrect because enabling Multi-AZ for an RDS database improves database availability, but the question asks about application-level high availability; it does not address the compute tier. Option E is incorrect because using a single EC2 instance creates a single point of failure and does not ensure high availability.

309
MCQeasy

A developer needs to analyze real-time streaming data from thousands of devices. The data consists of JSON messages that must be processed and stored in Amazon S3. Which AWS service should the developer use to ingest and buffer the streaming data?

A.Amazon S3
B.AWS Lambda
C.Amazon Simple Queue Service (SQS)
D.Amazon Kinesis Data Streams
AnswerD

Amazon Kinesis Data Streams is a fully managed, scalable service specifically engineered for real-time ingestion, processing, and analysis of large streams of data records. It provides the necessary throughput and low latency to capture continuous data from various sources, making it ideal for real-time analytics, log processing, and live dashboards. Multiple applications can concurrently consume data from a stream, enabling diverse real-time use cases.

Why this answer

Amazon Kinesis Data Streams is designed for real-time ingestion and buffering of large-scale streaming data, such as JSON messages from thousands of devices. It can capture and store data in shards for up to 365 days, allowing downstream consumers (e.g., Lambda, Kinesis Data Analytics) to process the data before storing it in Amazon S3. This makes it the correct choice for ingesting and buffering the streaming data before persistent storage.

Exam trap

The trap here is that candidates often confuse Amazon SQS with Kinesis Data Streams, but SQS is a pull-based queue for decoupling microservices, not a streaming data platform with shard-based parallelism and long-term retention, which is required for ingesting high-throughput real-time data from thousands of devices.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a streaming ingestion or buffer service; it cannot ingest real-time streaming data directly without an intermediary like Kinesis or API Gateway. Option B is wrong because AWS Lambda is a serverless compute service that can process streaming data but is not designed to ingest or buffer data; it runs on demand and has a maximum execution timeout of 15 minutes, making it unsuitable as a primary ingestion buffer. Option C is wrong because Amazon SQS is a message queue service for decoupling applications, but it is not optimized for real-time streaming from thousands of devices; it lacks shard-level parallelism, has a maximum message size of 256 KB, and does not support ordered replay or long-term buffering like Kinesis Data Streams.

310
Multi-Selecteasy

A developer is tasked with securing a legacy application that stores secrets in environment variables. Which THREE AWS services can be used to improve the security posture?

Select 3 answers
A.AWS Key Management Service (KMS)
B.AWS Certificate Manager
C.AWS CloudHSM
D.AWS Systems Manager Parameter Store
E.AWS Secrets Manager
AnswersA, D, E

AWS KMS is the correct answer because it provides the encryption key management that secures secrets at rest. KMS creates and protects Customer Master Keys (CMKs) that can encrypt data keys via envelope encryption, and both Systems Manager Parameter Store and Secrets Manager rely on KMS to encrypt their stored secret values. While KMS itself is not a secrets repository, it is the foundational service that makes secure secret storage possible. For this legacy application, using KMS to encrypt secrets either directly or through integration with other AWS services satisfies the security requirement.

Why this answer

Secrets Manager, Parameter Store, and KMS can all help manage and encrypt secrets.

311
MCQeasy

A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?

A.Use a bucket policy that denies s3:PutObject if the encryption condition is not met.
B.Configure default encryption on the bucket with SSE-KMS.
C.Enable S3 Object Lock.
D.Use a CloudTrail trail to monitor uploads.
AnswerA

A bucket policy with a Deny effect on the s3:PutObject action can explicitly check for the presence of server-side encryption headers. By using a condition like StringNotEquals on s3:x-amz-server-side-encryption or Null for its absence, the policy will reject any upload that does not specify the required encryption. This mechanism directly enforces the company's encryption mandate at the point of ingestion, preventing non-compliant data from being stored.

Why this answer

An S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.

Exam trap

The trap here is that candidates often confuse default encryption (which silently applies encryption but does not deny non-compliant uploads) with a bucket policy that actively denies requests, leading them to choose Option B as a simpler but ineffective solution.

How to eliminate wrong answers

Option B is wrong because configuring default encryption on the bucket with SSE-KMS only applies encryption to objects uploaded without an explicit encryption header; it does not deny uploads that omit the header, so objects can still be uploaded without the required `x-amz-server-side-encryption` header. Option C is wrong because S3 Object Lock is designed to prevent object deletion or overwrites for compliance or retention purposes, not to enforce encryption requirements during upload. Option D is wrong because CloudTrail trails only log API calls for auditing and monitoring; they cannot enforce or deny S3 PutObject operations based on encryption headers.

312
MCQeasy

A developer wants to deploy a serverless application using AWS CloudFormation. The application consists of an API Gateway, Lambda functions, and DynamoDB tables. The developer wants to ensure that the stack can be updated without resource interruption when possible. Which CloudFormation feature should the developer use?

A.Use a Lambda alias with a DeploymentPreference update policy
B.Use a ChangeSet to review changes before applying them
C.Use a StackPolicy to protect critical resources
D.Use a Custom Resource to manage updates
AnswerA

CloudFormation's `AWS::Lambda::Alias` resource, when combined with a `DeploymentPreference` update policy, facilitates controlled, gradual traffic shifting between a Lambda function's current version and a newly deployed version. This strategy leverages AWS CodeDeploy to manage the rollout, allowing for canary deployments or linear shifts, which ensures that updates are applied without service interruption by routing traffic incrementally and automatically rolling back if issues are detected.

Why this answer

The `DeploymentPreference` update policy on a Lambda alias enables canary, linear, or all-at-once traffic shifting during stack updates. This allows the developer to update Lambda function versions without interrupting existing invocations, as traffic is gradually routed to the new version while the old version continues to serve requests until the transition completes.

Exam trap

The trap here is that candidates often confuse ChangeSets (which only preview changes) with the actual update mechanism, or they mistakenly think StackPolicies or Custom Resources can control update behavior, when in fact only the `DeploymentPreference` update policy on a Lambda alias provides the traffic-shifting capability needed for uninterrupted updates.

How to eliminate wrong answers

Option B is wrong because a ChangeSet only provides a preview of the changes that will be applied to the stack; it does not prevent resource interruption during the update itself. Option C is wrong because a StackPolicy is used to prevent accidental updates or deletions of specific resources by denying update/delete actions, but it does not control how updates are rolled out to avoid interruption. Option D is wrong because a Custom Resource is used to handle provisioning of resources not natively supported by CloudFormation, not to manage update strategies for Lambda functions.

313
MCQmedium

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

A.Create an IAM role with the required permissions and attach it to the EC2 instance.
B.Generate an IAM user access key and store it in the application configuration.
C.Hardcode the AWS credentials in the application code.
D.Add the DynamoDB table ARN to the EC2 instance's security group.
AnswerA

Attaching an IAM role to an EC2 instance is the recommended and most secure method for granting AWS service permissions. This approach leverages temporary credentials automatically provided to the instance via the EC2 instance metadata service, eliminating the need to store static, long-term credentials on the instance itself. The role defines specific permissions, such as dynamodb:GetItem or dynamodb:Query, allowing the EC2 instance to interact with DynamoDB securely and with the principle of least privilege.

Why this answer

The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Exam trap

The trap here is that candidates may confuse security groups (network-level access control) with IAM policies (identity-based access control) and incorrectly think adding a DynamoDB table ARN to a security group can grant data access, when in fact security groups only control network traffic and cannot authorize API calls to DynamoDB.

How to eliminate wrong answers

Option B is wrong because storing an IAM user access key in the application configuration introduces long-term static credentials that must be manually rotated, increasing the risk of exposure and violating AWS best practices for EC2. Option C is wrong because hardcoding AWS credentials in application code is a severe security risk, as the credentials can be exposed through version control, logs, or decompilation, and it also prevents automatic rotation. Option D is wrong because security groups are stateful firewalls that control network traffic at the instance level, not IAM permissions; they cannot grant access to DynamoDB, which operates over HTTPS and requires identity-based authentication.

314
Multi-Selecteasy

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Select 2 answers
A.Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.
B.Make sure the source artifact is a valid zip file containing the application code and environment configuration.
C.Confirm that the S3 object key does not contain special characters.
D.Verify that the S3 bucket name is exactly as specified in the pipeline.
E.Check that the IAM role for CodePipeline has permissions to read from the S3 bucket and deploy to Elastic Beanstalk.
AnswersA, E

Cross-region deployments require additional configuration.

Why this answer

CodePipeline and Elastic Beanstalk must be in the same AWS region for the pipeline to locate the application version. When the Source stage stores the artifact in an S3 bucket in a different region, the Deploy stage cannot find the version in Elastic Beanstalk, which expects the artifact to be in the same region. This cross-region mismatch causes the 'version of the application to be deployed could not be found' error.

Option E is also correct because the IAM role for CodePipeline must have permissions to read from the S3 bucket and to deploy to Elastic Beanstalk. Without these permissions, the pipeline cannot access the artifact or perform the deployment, leading to the 'could not be found' error.

Exam trap

The trap here is that candidates focus on artifact validity or permissions, but the error message 'could not be found' specifically points to a region mismatch or missing version, not a file format or IAM issue.

315
MCQmedium

A developer needs to grant temporary access to an Amazon S3 bucket for a user from a different AWS account. The developer wants to use the most secure method that does not require sharing long-term credentials. Which approach should the developer take?

A.Create an IAM user in the developer's account and share the access keys
B.Use S3 bucket policy with a condition for the external account's IAM user
C.Use cross-account IAM roles with STS AssumeRole
D.Use S3 access control lists (ACLs) with the external user's canonical user ID
AnswerC

Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole is the most secure and recommended method for granting temporary access. The external user's identity assumes a pre-defined role in the developer's account, which then issues temporary, time-limited credentials (access key ID, secret access key, and session token). This approach eliminates the need to share long-term keys, provides fine-grained control over permissions, and automatically revokes access after the session duration expires.

Why this answer

Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole allows the external user to obtain temporary, limited-privilege credentials without sharing any long-term access keys. This approach follows the principle of least privilege and eliminates the risk of exposed static credentials, as the temporary credentials automatically expire after a configurable duration (default 1 hour, max 12 hours).

Exam trap

The trap here is that candidates often confuse S3 bucket policies with cross-account access, thinking a bucket policy alone can grant temporary credentials, when in fact bucket policies only authorize access based on the requester's existing (long-term) credentials and do not issue temporary tokens.

How to eliminate wrong answers

Option A is wrong because sharing IAM user access keys exposes long-term credentials that never expire, violating the requirement for temporary access and increasing the risk of credential leakage. Option B is wrong because an S3 bucket policy with a condition for an external account's IAM user still requires that external user to use their own long-term IAM credentials to sign requests, which does not grant temporary access and does not eliminate long-term credential sharing. Option D is wrong because S3 ACLs use canonical user IDs (the account's AWS-assigned identifier) and require the external user to authenticate with their own long-term credentials; ACLs also do not provide temporary credentials and are considered a legacy access control mechanism that is less secure and less flexible than IAM roles.

316
MCQmedium

A REST API requires request validation before invoking Lambda to reduce unnecessary function executions for malformed payloads. Where should validation be configured?

A.Inside the Lambda timeout setting
B.In the IAM execution role
C.In the S3 bucket policy
D.In API Gateway request models and validators
AnswerD

API Gateway provides built-in request validation capabilities through the use of request models and validators. Developers can define JSON Schema models for the request body, headers, and query parameters. When enabled for a specific API method, API Gateway automatically validates incoming requests against these defined models *before* invoking the backend integration, such as a Lambda function, returning a 400 Bad Request error for invalid payloads.

Why this answer

API Gateway provides built-in request validation using models (JSON Schema) and validators. By configuring validation at the API Gateway layer, malformed payloads are rejected before they reach the Lambda function, reducing unnecessary invocations and associated costs. This is the correct approach because API Gateway acts as the entry point for REST APIs and can enforce payload structure without invoking the backend.

Exam trap

The trap here is that candidates may confuse Lambda's execution role or timeout settings with request validation, not realizing that API Gateway is the correct layer to filter malformed payloads before they trigger Lambda.

How to eliminate wrong answers

Option A is wrong because the Lambda timeout setting controls how long a function can run, not whether it is invoked; it cannot prevent invocation for malformed payloads. Option B is wrong because the IAM execution role defines permissions for the Lambda function to access other AWS services, not request validation. Option C is wrong because S3 bucket policies control access to S3 objects, not API request validation; they are unrelated to REST API payload checking.

317
MCQmedium

A developer is using Amazon S3 to host a static website. The website uses JavaScript to fetch data from an API Gateway endpoint. Users report that the website loads but API calls fail with HTTP 403 errors. The developer checks the S3 bucket policy and finds it allows public read access. What is the most likely cause?

A.The S3 bucket policy blocks access from the API Gateway domain.
B.The S3 bucket is not configured for static website hosting.
C.The API Gateway API key is not included in the JavaScript code.
D.The S3 bucket does not have CORS configuration to allow cross-origin requests from the API Gateway domain.
AnswerC

When an API Gateway method is configured to require an API key, every incoming request must include a valid `x-api-key` header. If the JavaScript code making the API call omits this essential header, or provides an incorrect or expired key, API Gateway will reject the request with a `403 Forbidden` status code. This indicates that the request reached API Gateway but was denied due to a lack of proper authentication credentials.

Why this answer

The website loads from S3, but the API calls to API Gateway fail with 403. This is often due to missing API key. If the API Gateway endpoint requires an API key and the JavaScript code does not include it in the request headers, API Gateway returns a 403 Forbidden error.

Option C is correct because the most likely cause is that the API key is not included in the JavaScript code, leading to the 403 response.

Exam trap

Candidates often confuse CORS issues with API key requirements. While CORS can cause errors, a 403 Forbidden error from API Gateway often indicates that an API key is required but not provided. The trap is to assume it is a CORS problem without checking the API key requirement.

How to eliminate wrong answers

Option A is wrong because the S3 bucket policy controls access to S3 objects, not outbound API calls from JavaScript; the 403 error originates from the browser's CORS enforcement, not from S3 blocking the API Gateway domain. Option B is wrong because the website loads successfully, confirming static website hosting is already enabled; the issue is with cross-origin API calls, not S3 hosting configuration. Option C is wrong because API keys are optional for API Gateway and, if required, would cause a 403 from API Gateway itself (e.g., 'Missing Authentication Token'), not a browser-level CORS 403; the error is due to missing CORS headers, not missing API keys.

318
MCQmedium

A team is using AWS CodeBuild to compile and test code. The build takes longer than expected. The team wants to reduce build times by caching dependencies. Which option should the team use to cache dependencies in CodeBuild?

A.Amazon DynamoDB
B.Amazon EFS
C.Amazon ECR
D.Local caching or Amazon S3 caching
AnswerD

AWS CodeBuild natively supports both local caching and Amazon S3 caching to significantly speed up build times. Local caching stores a cache directory on the build host's file system, reusing dependencies across subsequent builds on the same host. Amazon S3 caching, a more scalable option, uploads and downloads a compressed cache archive to and from an S3 bucket, making the cache available across different build hosts and providing durability and shareability for build dependencies and artifacts.

Why this answer

AWS CodeBuild supports two caching modes: local caching and Amazon S3 caching. Local caching stores dependencies on the build host's local file system, while S3 caching stores them in an S3 bucket. Both options reduce build times by reusing previously downloaded dependencies across builds, avoiding redundant downloads.

Exam trap

The trap here is that candidates may confuse caching mechanisms with storage services like DynamoDB or EFS, or assume that ECR (used for container images) can cache dependencies, when CodeBuild specifically supports only local and S3 caching for dependency reuse.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL database service, not a caching mechanism for build dependencies; it is used for storing structured data, not for caching build artifacts or dependency files. Option B is wrong because Amazon EFS is a scalable file system for use with AWS services and on-premises resources, but it is not a caching option supported by CodeBuild for build dependencies; CodeBuild does not natively integrate with EFS for caching. Option C is wrong because Amazon ECR is a container image registry, used for storing and managing Docker images, not for caching build dependencies; it is unrelated to dependency caching in CodeBuild.

319
MCQmedium

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

A.The S3 bucket's object ownership is set to BucketOwnerPreferred.
B.The KMS key policy does not grant the IAM user/role permissions to use the key.
C.The KMS key is in a different AWS Region than the S3 bucket.
D.The S3 bucket policy denies PutObject without encryption.
AnswerB

When an IAM user or role attempts to upload an object to S3 using server-side encryption with AWS KMS (SSE-KMS), S3 makes a request to AWS KMS on behalf of the uploader to generate a data key. This operation specifically requires the IAM principal to have `kms:GenerateDataKey` permissions on the specified AWS KMS key. If the KMS key policy does not explicitly allow or implicitly denies this action for the calling principal, the `PutObject` request will fail with an `Access Denied` error because S3 cannot obtain the necessary encryption key from KMS.

Why this answer

When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.

Exam trap

The trap here is that candidates often assume enabling default encryption on the bucket is sufficient, overlooking that the IAM principal must also be explicitly authorized to use the KMS key via the key policy or IAM policy.

How to eliminate wrong answers

Option A is wrong because S3 bucket object ownership (BucketOwnerPreferred) controls whether objects uploaded by other AWS accounts are owned by the bucket owner, not encryption permissions; it does not cause 'Access Denied' on PUT requests when using a CMK. Option C is wrong because KMS keys are regional resources, and S3 buckets can only use KMS keys from the same region as the bucket; if the key were in a different region, the bucket configuration would fail at setup, not cause intermittent PUT failures. Option D is wrong because a bucket policy denying PutObject without encryption would cause failures for unencrypted requests, but the developer has already enabled default encryption with the CMK, so requests are encrypted; the error is due to KMS key permissions, not encryption enforcement.

320
Multi-Selecthard

A developer needs to securely distribute temporary AWS credentials to authenticated mobile users. Which two components are commonly involved?

Select 2 answers
A.Amazon Cognito identity pools
B.AWS root access keys
C.IAM roles with scoped permissions
D.An unrestricted S3 bucket policy
AnswersA, C

Amazon Cognito identity pools are specifically designed to provide temporary, limited-privilege AWS credentials to users authenticated through various identity providers, including Cognito User Pools, social logins, or SAML. Upon successful authentication, an identity pool exchanges the user's token for a set of temporary AWS credentials, allowing mobile or web applications to directly access specified AWS services with fine-grained permissions defined by an associated IAM role. This mechanism ensures secure, temporary access without embedding long-lived credentials in client applications.

Why this answer

Amazon Cognito identity pools allow you to exchange identity tokens (from a user pool or external IdP) for temporary AWS credentials via the AWS Security Token Service (STS). These credentials are scoped to an IAM role with fine-grained permissions, enabling secure, least-privilege access to AWS resources from mobile apps without embedding long-term keys.

Exam trap

The trap here is that candidates confuse Cognito user pools (which handle authentication and issue JWTs) with identity pools (which provide temporary AWS credentials), or mistakenly think root keys or open bucket policies are acceptable for mobile distribution.

321
MCQmedium

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift 10% of traffic to the new version for 5 minutes before routing all traffic. Which configuration should the developer add to the SAM template?

A.DeploymentPreference with Type: Canary10Percent5Minutes
B.Add a CodeDeploy application and deployment group manually
C.DeploymentPreference with Type: Linear10PercentEvery1Minute
D.DeploymentPreference with Type: AllAtOnce
AnswerA

For serverless applications deployed with AWS SAM, `DeploymentPreference` integrates with AWS CodeDeploy to manage traffic shifting. A `Canary10Percent5Minutes` strategy first routes 10% of traffic to the new Lambda function version for 5 minutes. If no alarms are triggered during this period, CodeDeploy automatically shifts the remaining 90% of traffic to the new version, providing a controlled rollout and minimizing impact from potential issues. This phased approach is ideal for validating new deployments in a production environment.

Why this answer

The `DeploymentPreference` property with `Type: Canary10Percent5Minutes` instructs AWS SAM to use AWS CodeDeploy to shift 10% of traffic to the new Lambda version for 5 minutes, then automatically route the remaining 90% after the canary period ends. This matches the requirement exactly, leveraging SAM's built-in integration with CodeDeploy for canary deployments.

Exam trap

The trap here is that candidates confuse `Canary10Percent5Minutes` with `Linear10PercentEvery1Minute`, thinking both are canary deployments, but only the former holds traffic at 10% for a fixed duration before shifting all at once, while the latter shifts incrementally every minute.

How to eliminate wrong answers

Option B is wrong because manually adding a CodeDeploy application and deployment group is unnecessary and error-prone; AWS SAM automatically creates and manages the CodeDeploy resources when you specify `DeploymentPreference` in the template. Option C is wrong because `Linear10PercentEvery1Minute` shifts traffic in 10% increments every minute, which does not match the requirement of a single 10% shift for 5 minutes before routing all traffic. Option D is wrong because `AllAtOnce` routes 100% of traffic to the new version immediately, bypassing any canary or gradual deployment strategy.

322
Multi-Selecteasy

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Select 2 answers
A.Configure automatic rollback based on CloudWatch alarms.
B.Use a canary deployment to shift traffic gradually.
C.Disable health checks to prevent false positives.
D.Require a manual approval step before deployment.
E.Deploy to all instances at once to ensure consistency.
AnswersA, B

When a deployment causes performance degradation or errors, CloudWatch alarms can detect these issues by monitoring key metrics such as error rates, latency, or CPU utilization. Configuring automatic rollback to trigger upon these alarm states ensures that the application quickly reverts to a stable previous version, minimizing the blast radius and user impact of a faulty deployment. This proactive measure significantly reduces the duration of service disruption and enhances reliability.

Why this answer

AWS CodeDeploy can automatically trigger a rollback when a CloudWatch alarm is breached, such as when error rates or latency exceed a threshold. This reduces the risk of a failed deployment by reverting to the last known good state without manual intervention. Option B is correct because a canary deployment shifts a small percentage of traffic to the new version first, allowing you to monitor for issues before routing all traffic, minimizing blast radius.

Exam trap

The trap here is that candidates often confuse manual approval (a pre-deployment gate) with a rollback mechanism, or they mistakenly think disabling health checks reduces false positives, when in fact health checks are critical for detecting failures during deployment.

323
MCQhard

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

A.The source port number
B.The CloudWatch log stream name
C.The HMAC or digital signature over the payload using the shared/public key material
D.The API Gateway request ID only
AnswerC

An HMAC (Hash-based Message Authentication Code) or a digital signature provides cryptographic proof of both the sender's identity (authentication) and the message's integrity (non-tampering). The sender computes this value over the webhook payload using either a shared secret key (for HMAC) or their private key (for a digital signature). The receiver then independently computes the expected value using the same shared secret or the sender's public key, verifying that the request originated from the legitimate partner and that the data has not been altered in transit.

Why this answer

Webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Exam trap

The trap here is that candidates confuse request metadata (like source port or request ID) with cryptographic verification mechanisms, assuming any unique identifier can prove authenticity, when only HMAC or digital signatures provide integrity and sender verification.

How to eliminate wrong answers

Option A is wrong because the source port number is a transient network-layer attribute that can be spoofed or changed by NAT/firewalls, and it provides no cryptographic proof of authenticity or integrity. Option B is wrong because a CloudWatch log stream name is an AWS-specific logging resource identifier unrelated to request signing or payload integrity verification. Option D is wrong because an API Gateway request ID is a unique identifier for debugging and tracing, not a cryptographic mechanism to verify the sender's identity or detect payload tampering.

324
Multi-Selectmedium

A DynamoDB table shows throttling on one partition key value. Which two signs point to a hot partition problem?

Select 2 answers
A.Most traffic targets the same partition key
B.The table has point-in-time recovery enabled
C.Consumed capacity is uneven despite total table capacity being available
D.CloudTrail is enabled in all regions
AnswersA, C

DynamoDB distributes data across partitions based on the partition key. When a disproportionate amount of read or write traffic targets a small subset of partition key values, those specific partitions become 'hot.' Each partition has a maximum throughput limit, typically 3000 RCU and 1000 WCU. Exceeding this limit on a single partition, even if the overall table capacity is sufficient, results in throttling requests directed at that hot partition.

Why this answer

A hot partition occurs when a single partition key value receives a disproportionate share of read/write traffic, causing throttling on that partition even if the table's total provisioned capacity is not fully utilized. This imbalance means the partition's capacity is exhausted while other partitions remain underutilized, leading to request throttling for that specific key.

Exam trap

The trap here is that candidates confuse overall table capacity with partition-level capacity, assuming throttling only happens when total consumed capacity exceeds provisioned capacity, rather than recognizing that uneven key distribution can cause throttling on a single partition.

325
MCQhard

A developer wants to enforce that all requests to an Amazon S3 bucket must use HTTPS (TLS). The bucket is used for static website hosting. Which bucket policy condition should be used to deny requests that do not use HTTPS?

A."aws:SecureTransport": "false"
B."aws:SecureTransport": "true"
C."aws:SourceVpc": "true"
D."aws:Referer": "https"
AnswerA

This option correctly enforces HTTPS. When used in a Deny statement within an S3 bucket policy, the condition `"aws:SecureTransport": "false"` explicitly blocks any request that is *not* using HTTPS. By denying all unencrypted requests, the policy effectively mandates that all successful interactions with the S3 bucket must utilize HTTPS (TLS) for data in transit, ensuring secure communication.

Why this answer

The `aws:SecureTransport` condition key evaluates to `false` when the request is not sent over HTTPS (TLS). By using a Deny effect with this condition set to `false`, the policy blocks any HTTP requests to the S3 bucket, ensuring all traffic uses encrypted connections. This is a standard approach for enforcing TLS on S3 buckets, including those used for static website hosting.

Exam trap

The trap here is that candidates often confuse `aws:SecureTransport` with `aws:SourceVpc` or `aws:Referer`, or mistakenly think setting the condition to `true` in a Deny statement will block non-HTTPS traffic, when in fact it would block HTTPS traffic instead.

How to eliminate wrong answers

Option B is wrong because setting `aws:SecureTransport` to `true` would allow only HTTPS requests, but the question requires denying non-HTTPS requests; a Deny policy with `true` would block HTTPS traffic, which is the opposite of the desired outcome. Option C is wrong because `aws:SourceVpc` is used to restrict requests to those originating from a specific VPC, not to enforce HTTPS; setting it to `true` is invalid as this condition key expects a VPC ID, not a boolean. Option D is wrong because `aws:Referer` is used to restrict requests based on the HTTP Referer header (e.g., to prevent hotlinking), not to enforce HTTPS; the value `https` is a protocol scheme, not a valid referer pattern, and this condition does not check transport security.

326
MCQmedium

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

A.Static credentials committed to Git
B.A credentials file copied into the AMI
C.The root account access key
D.Temporary credentials from the instance profile role
AnswerD

Attaching an IAM role to an EC2 instance via an instance profile is the recommended and most secure method for granting AWS API access to applications running on that instance. This mechanism automatically provides temporary, frequently rotated credentials to the instance metadata service, which applications can retrieve without needing to store any long-term static keys. This significantly enhances security, simplifies credential management, and adheres to the principle of least privilege by allowing granular permissions.

Why this answer

The AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Exam trap

The trap here is that candidates may think manually embedding credentials (via a file or environment variable) is acceptable, but the AWS SDK on EC2 is designed to use the instance profile role by default, and any static credential source is both insecure and not the default behavior.

How to eliminate wrong answers

Option A is wrong because committing static credentials to Git is a severe security risk and violates AWS best practices; the SDK does not default to Git-stored credentials. Option B is wrong because copying a credentials file into the AMI embeds long-term credentials in the image, which can be exposed if the AMI is shared or reused, and the SDK does not default to an AMI-embedded file. Option C is wrong because root account access keys are highly privileged, static, and should never be used in application code; the SDK does not default to root keys.

327
Multi-Selecteasy

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Select 3 answers
A.The function's reserved concurrency is set to 0.
B.The function has a dead-letter queue configured.
C.The function is configured to access a VPC without a NAT gateway.
D.The function experiences a cold start.
E.The function's deployment package is larger than 50 MB.
AnswersC, D, E

When a Lambda function is configured to access a VPC but lacks a NAT gateway, outbound internet traffic fails. If the function makes external calls (e.g., to DynamoDB or external APIs), these requests will hang until the function times out.

Why this answer

Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts.

Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Exam trap

Candidates may mistakenly think reserved concurrency of 0 causes a timeout, but it actually causes immediate throttling. The real trap is that cold starts and large deployment packages can both contribute to timeouts, especially when the timeout is short.

328
MCQeasy

A developer wants to invoke an AWS Lambda function every hour to perform a maintenance task. Which AWS service should be used to schedule the invocation?

A.Amazon Simple Queue Service (SQS)
B.AWS Step Functions
C.Amazon CloudWatch Events (EventBridge)
D.Amazon Simple Notification Service (SNS)
AnswerC

Amazon CloudWatch Events, now largely integrated into Amazon EventBridge, is the definitive AWS service for triggering Lambda functions on a schedule. It enables developers to create rules that define specific time-based patterns, such as cron expressions or fixed-rate intervals, to directly invoke target Lambda functions. This provides a robust, serverless, and highly scalable solution for automating periodic tasks and time-driven events within the AWS ecosystem.

Why this answer

Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service for scheduling periodic invocations of AWS Lambda functions. It allows you to create a rule with a cron or rate expression (e.g., `rate(1 hour)`) that triggers the Lambda function on a defined schedule. This is the native, serverless way to run code on a recurring timer without managing any infrastructure.

Exam trap

The trap here is that candidates often confuse 'scheduling' with 'messaging' and pick SQS or SNS, not realizing that only EventBridge (CloudWatch Events) provides native cron/rate-based triggers for Lambda.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue service for decoupling application components; it does not have a built-in scheduler to invoke Lambda on a recurring schedule. Option B is wrong because AWS Step Functions is a workflow orchestration service that can invoke Lambda, but it is designed for stateful, multi-step processes, not for simple time-based scheduling (it lacks native cron/rate triggers). Option D is wrong because Amazon SNS is a pub/sub notification service; it can trigger Lambda from messages, but it cannot generate scheduled events on its own.

329
MCQeasy

A developer is building a serverless application and wants to invoke an AWS Lambda function every hour to perform a cleanup task. Which AWS service should the developer use to schedule the invocation?

A.AWS Step Functions
B.Amazon SNS
C.Amazon SQS
D.Amazon EventBridge (CloudWatch Events)
AnswerD

Amazon EventBridge, which evolved from CloudWatch Events, is a serverless event bus service that makes it easy to connect applications together using data from your own applications, integrated SaaS applications, and AWS services. It excels at creating rules that match incoming events and route them to targets, including Lambda functions. Crucially, EventBridge supports cron-like expressions and fixed-rate schedules, making it the ideal service for invoking Lambda functions at specified times or recurring intervals.

Why this answer

Amazon EventBridge (formerly CloudWatch Events) is the correct service for scheduling AWS Lambda invocations on a recurring basis. It provides a cron or rate expression to trigger a Lambda function at a defined interval, such as every hour, without the need for managing any servers or additional infrastructure.

Exam trap

The trap here is that candidates often confuse Amazon EventBridge with Amazon CloudWatch Logs or assume Step Functions is needed for any time-based workflow, but Step Functions is for stateful orchestration, not simple scheduled invocations.

How to eliminate wrong answers

Option A is wrong because AWS Step Functions is a workflow orchestration service designed to coordinate multiple AWS services into state machines, not for scheduling standalone recurring events. Option B is wrong because Amazon SNS is a pub/sub messaging service for sending notifications or fan-out messages, not a scheduler for invoking Lambda on a time-based trigger. Option C is wrong because Amazon SQS is a message queue service for decoupling application components; it cannot initiate Lambda invocations based on a time schedule.

330
MCQmedium

A developer is monitoring an AWS Lambda function that is triggered by an Amazon SQS queue. The function's CloudWatch metrics show a high number of throttles. The function has a reserved concurrency of 10 and the SQS queue has a large backlog of messages. The function processes each message in about 2 seconds and has a timeout of 60 seconds. Which action will most effectively reduce the throttles and increase throughput?

A.Increase the reserved concurrency of the Lambda function to 50
B.Increase the batch size in the SQS event source mapping to 100
C.Increase the function timeout to 120 seconds
D.Decrease the reserved concurrency to 5
AnswerA

Increasing the reserved concurrency for a Lambda function dedicates a specific number of concurrent execution slots exclusively to that function. This action guarantees that the function can scale up to 50 simultaneous invocations, preventing it from being throttled by the account's general unreserved concurrency pool. For an SQS-triggered Lambda, this directly enables more parallel processing of messages, significantly improving throughput and reducing the backlog in the queue.

Why this answer

The high throttles indicate that the Lambda function's reserved concurrency of 10 is insufficient to handle the incoming messages from the SQS queue. By increasing reserved concurrency to 50, you allow more concurrent executions, which reduces throttling and increases throughput. The function's 2-second processing time and 60-second timeout are not the bottleneck; the concurrency limit is.

Exam trap

The trap here is that candidates may think increasing batch size or timeout will help, but they overlook that the root cause is the reserved concurrency cap, which directly limits the number of concurrent executions and is the primary driver of throttles.

How to eliminate wrong answers

Option B is wrong because increasing the batch size to 100 would cause the function to receive more messages per invocation, but with a reserved concurrency of 10, the function can only process 10 batches concurrently, so throttles would persist and latency could increase due to longer processing per batch. Option C is wrong because increasing the timeout to 120 seconds does not address the concurrency limit; the function already completes in 2 seconds, so a longer timeout has no effect on throttles. Option D is wrong because decreasing reserved concurrency to 5 would reduce the number of concurrent executions, worsening throttles and decreasing throughput.

331
MCQeasy

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?

A.Configure a VPC endpoint policy that allows only API Gateway.
B.Add a resource-based policy with 'aws:SourceAccount' condition.
C.Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.
D.Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.
AnswerD

Adding a resource-based policy with an `aws:SourceArn` condition set to the specific API Gateway ARN is the most effective and secure method to restrict Lambda function invocation. This policy ensures that only requests originating from that particular API Gateway instance (e.g., `arn:aws:execute-api:region:account-id:api-id/*/*`) are authorized to invoke the Lambda function. This fine-grained control prevents unauthorized direct invocations of the Lambda function, enforcing that all traffic must flow through the API Gateway.

Why this answer

Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.

Exam trap

The trap here is that candidates confuse resource-based policies with VPC-based controls, often selecting `aws:SourceVpce` (Option C) thinking API Gateway invokes Lambda through a VPC endpoint, but API Gateway uses a public endpoint or private integration without a VPC endpoint for Lambda invocation.

How to eliminate wrong answers

Option A is wrong because a VPC endpoint policy controls traffic through a VPC endpoint, not invocation permissions for Lambda; it does not restrict which service can invoke the function. Option B is wrong because `aws:SourceAccount` condition only checks the AWS account ID of the caller, not the specific resource (API Gateway), so any service in the same account could still invoke the function. Option C is wrong because `aws:SourceVpce` condition checks for a VPC endpoint ID, but API Gateway does not use a VPC endpoint for invocation; it uses a public endpoint or a private integration, making this condition ineffective.

332
MCQhard

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

A.The application revision is missing from the S3 bucket.
B.The BeforeInstall script has a bug that causes it to exit with a non-zero status.
C.The IAM instance profile does not have permissions to call CodeDeploy APIs.
D.The CodeDeploy agent is not running on the instances.
AnswerB

CodeDeploy strictly interprets any non-zero exit status from a lifecycle event script, such as BeforeInstall, as a critical failure. This indicates that the script, intended to prepare the environment or install prerequisites, did not complete successfully. Consequently, the deployment on that specific instance is immediately halted, and the overall deployment is marked as failed, preventing further potentially problematic steps.

Why this answer

The error message explicitly states that the CodeDeploy agent logs show the BeforeInstall lifecycle event script returned a non-zero exit code. This directly indicates that the script itself failed during execution, which is the most likely cause of the deployment failure. The BeforeInstall script is a custom script run by the CodeDeploy agent on each instance, and a non-zero exit code signals an error condition that halts the deployment for that instance.

Exam trap

The trap here is that candidates often confuse a script failure (non-zero exit code) with infrastructure or permission issues, but the question explicitly provides the agent log detail pointing to the BeforeInstall script, making the script bug the direct and most likely cause.

How to eliminate wrong answers

Option A is wrong because if the application revision were missing from the S3 bucket, the error would occur earlier in the process (during the download phase) and the CodeDeploy agent logs would show a different error, such as 'Failed to download revision' or a 403/404 HTTP status code, not a non-zero exit code from the BeforeInstall script. Option C is wrong because insufficient IAM instance profile permissions to call CodeDeploy APIs would prevent the agent from registering with the service or pulling deployment instructions, resulting in errors like 'Unable to register instance' or 'AccessDeniedException', not a script exit code failure. Option D is wrong because if the CodeDeploy agent were not running, the instances would not appear in the deployment at all, and the error would be 'No instances found' or 'Instance not available', not a script execution failure with a non-zero exit code.

333
Matchingmedium

Match each HTTP status code to its meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

OK

Created

Bad Request

Forbidden

Internal Server Error

Why these pairings

Correct matches: 200 OK, 404 Not Found, 500 Internal Server Error. Common confusions include mixing 200 and 201, or 404 and 403.

334
MCQmedium

A developer is building a RESTful API using Amazon API Gateway and Lambda. The API should support CORS for a specific origin (https://example.com) and allow only GET and POST methods. Which configuration in the OPTIONS method response will satisfy these requirements?

A.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST
B.Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET,POST,OPTIONS
C.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST,OPTIONS
D.Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Headers: Content-Type
AnswerA

This configuration correctly specifies `https://example.com` as the only permitted origin, adhering to the principle of least privilege for cross-origin requests. By listing `GET,POST` in `Access-Control-Allow-Methods`, the server explicitly informs the browser which actual HTTP methods are allowed for the resource, satisfying the preflight request's requirements without exposing unnecessary methods like `OPTIONS` itself.

Why this answer

The OPTIONS method response must include the `Access-Control-Allow-Origin` header set to the specific origin `https://example.com` to restrict CORS access, and the `Access-Control-Allow-Methods` header must list only the allowed HTTP methods (`GET,POST`). The OPTIONS method itself is a preflight request and does not need to be listed in the allowed methods; it is automatically handled by the browser. This configuration satisfies the requirement of supporting CORS for a single origin and only GET and POST methods.

Exam trap

The trap here is that candidates often mistakenly include `OPTIONS` in the `Access-Control-Allow-Methods` header, thinking it must be listed because the preflight request uses that method, but the correct behavior is to only list the actual HTTP methods (GET, POST) that the API supports for the main request.

How to eliminate wrong answers

Option B is wrong because it uses a wildcard origin (`*`), which does not satisfy the requirement for a specific origin (`https://example.com`), and it incorrectly includes `OPTIONS` in the allowed methods list, which is unnecessary and could cause confusion. Option C is wrong because it includes `OPTIONS` in the `Access-Control-Allow-Methods` header; the OPTIONS method is the preflight request itself and should not be listed as an allowed method in the response. Option D is wrong because it specifies `Access-Control-Allow-Headers` instead of `Access-Control-Allow-Methods`, and it omits the required `Access-Control-Allow-Methods` header entirely, so the browser would not know which HTTP methods are permitted.

335
MCQeasy

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

A.Use AWS Lambda to update the API Gateway configuration.
B.Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.
C.Use AWS CloudFormation to define and deploy the API Gateway.
D.Use AWS CodeBuild to compile and deploy the API Gateway configuration.
AnswerC

AWS CloudFormation is the recommended and most robust service for defining and deploying AWS resources, including API Gateway, as Infrastructure as Code (IaC). It allows developers to declaratively specify the entire API Gateway configuration in a template, enabling automated, repeatable, and version-controlled deployments with built-in rollback capabilities, which is crucial for maintaining consistency and reliability in CI/CD pipelines.

Why this answer

AWS CloudFormation provides infrastructure as code (IaC) capabilities that allow you to define the entire API Gateway configuration, including resources, methods, integrations, and deployment stages, in a template. When integrated with CodePipeline, CloudFormation can automatically create or update the API Gateway and trigger a deployment as part of the CI/CD pipeline, ensuring consistent and repeatable deployments without manual intervention.

Exam trap

The trap here is that candidates often assume CodeBuild or a custom Lambda function is needed for deployment, but the exam tests whether you recognize that CloudFormation is the native, fully managed IaC service that integrates seamlessly with CodePipeline for deploying API Gateway updates.

How to eliminate wrong answers

Option A is wrong because using a Lambda function to update API Gateway configuration directly via API calls is not a recommended or scalable CI/CD practice; it bypasses infrastructure as code, lacks versioning, and makes rollbacks and auditing difficult. Option B is wrong because simply storing a Swagger file in S3 does not automatically trigger a deployment; you would need additional automation (e.g., a Lambda function or CloudFormation) to import the Swagger definition and create a deployment, making this an incomplete solution. Option D is wrong because CodeBuild is designed to compile source code and run tests, not to deploy API Gateway configurations; it lacks the native capability to manage API Gateway resources and deployments, which is better handled by CloudFormation or the AWS CLI.

336
MCQmedium

A developer is deploying a web application on AWS Elastic Beanstalk. The application requires a fixed IP address for outbound traffic to a third-party API. What is the MOST cost-effective solution?

A.Launch the environment in a VPC with a NAT Gateway in a public subnet.
B.Attach an Internet Gateway to the VPC.
C.Use a VPC endpoint for the third-party API.
D.Assign an Elastic IP to each EC2 instance.
AnswerA

This is the correct approach for instances in private subnets needing outbound internet access to third-party APIs while maintaining private IP addresses. A NAT Gateway, deployed in a public subnet, allows instances in private subnets to initiate outbound connections to the internet. All outbound traffic from these private instances will appear to originate from the NAT Gateway's Elastic IP address, providing a consistent and fixed public IP for the third-party API to whitelist, which is crucial for security policies.

Why this answer

A NAT Gateway in a public subnet provides a fixed public IP address for outbound traffic from private subnets, enabling the web application to communicate with the third-party API while remaining secure. Elastic Beanstalk environments are typically launched in private subnets, and the NAT Gateway is the most cost-effective managed service for this purpose compared to a NAT instance or assigning Elastic IPs to each EC2 instance.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, thinking the latter provides outbound IPs, or they incorrectly assume a VPC endpoint can be used for any external API, when it is limited to AWS services.

How to eliminate wrong answers

Option B is wrong because an Internet Gateway only allows inbound and outbound traffic to and from the internet for resources with public IPs; it does not provide a fixed outbound IP for instances in private subnets. Option C is wrong because a VPC endpoint is used for private connectivity to AWS services (e.g., S3, DynamoDB) via the AWS network, not for accessing third-party APIs over the internet. Option D is wrong because assigning an Elastic IP to each EC2 instance is not cost-effective (each Elastic IP incurs charges when not associated with a running instance) and does not scale well; it also exposes instances directly to the internet, increasing security risks.

337
MCQeasy

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

A.The message is sent to a dead-letter queue (DLQ).
B.The message is deleted from the queue to prevent duplicate processing.
C.Lambda automatically retries the function with a 1-minute delay.
D.The message remains in the queue and becomes visible after the visibility timeout expires.
AnswerD

When an AWS Lambda function fails to process a message from an SQS queue, the Lambda service does not delete the message. Instead, the message remains in the SQS queue, but it stays hidden from other consumers due to the in-flight visibility timeout that was initiated when Lambda received it. Upon the expiration of this visibility timeout, the message automatically becomes visible again in the queue, making it available for another Lambda invocation attempt or consumption by another service.

Why this answer

When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing.

The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Exam trap

The trap here is that candidates often assume Lambda automatically deletes failed messages or immediately sends them to a DLQ, but the actual behavior is that the message remains in the queue and becomes visible again after the visibility timeout expires, allowing for retries.

How to eliminate wrong answers

Option A is wrong because a message is only sent to a dead-letter queue (DLQ) after the maximum number of retries specified in the queue's redrive policy is exhausted, not on the first error. Option B is wrong because Lambda does not delete a message from the queue on error; deletion only occurs after successful processing to prevent duplicate processing. Option C is wrong because Lambda does not automatically retry with a fixed 1-minute delay; the retry timing is controlled by the SQS visibility timeout, which is configurable and not set to 1 minute by default.

338
MCQhard

A developer is deploying a microservices architecture on Amazon ECS using Fargate launch type. The services need to communicate with each other. The developer wants to use service discovery so that services can find each other by name. Which AWS service should the developer use?

A.Amazon Route 53 private hosted zones
B.Amazon ECR
C.Application Load Balancer
D.AWS Cloud Map
AnswerD

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to locate each other dynamically. It integrates natively with Amazon ECS, automatically registering and deregistering service instances as they scale up or down. This enables applications to discover service endpoints using either API calls or DNS queries, simplifying inter-service communication in a dynamic containerized environment.

Why this answer

AWS Cloud Map is the correct choice because it is a cloud resource discovery service that allows microservices to register their DNS names and health checks, enabling dynamic service discovery. With Amazon ECS and Fargate, services can use AWS Cloud Map namespaces (either API-based or DNS-based) to resolve each other by logical service names, which is essential for inter-service communication in a microservices architecture.

Exam trap

The trap here is that candidates often confuse Route 53 private hosted zones with AWS Cloud Map, not realizing that Cloud Map provides the dynamic registration and health check integration needed for ephemeral containers, whereas Route 53 alone requires manual record management.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 private hosted zones provide DNS resolution within a VPC but lack the dynamic service registration, health checking, and API-based discovery features that AWS Cloud Map offers for ephemeral Fargate tasks. Option B is wrong because Amazon ECR is a container image registry used for storing and retrieving Docker images, not for service discovery or DNS resolution. Option C is wrong because an Application Load Balancer distributes incoming traffic to targets but does not provide service discovery by name; it is a load balancing layer, not a naming or registration service.

339
MCQeasy

A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?

A.An S3 bucket policy in Account B that allows the IAM user's ARN.
B.An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.
C.An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.
D.Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.
AnswerB

This is the correct and most direct combination for granting cross-account S3 access to an IAM user. The IAM policy attached to the user in Account A provides the necessary identity-based permissions for the user to initiate S3 actions. Concurrently, the S3 bucket policy in Account B, a resource-based policy, explicitly grants permission to the specific IAM user's ARN from Account A, overriding the default deny for cross-account access. Both policies must grant permission for the request to be authorized successfully.

Why this answer

Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.

Exam trap

The trap here is that candidates often think a bucket policy alone is sufficient for cross-account access (Option A), forgetting that the IAM user's own account must also explicitly authorize the action through an IAM policy.

How to eliminate wrong answers

Option A is wrong because an S3 bucket policy alone in Account B that allows the IAM user's ARN is insufficient — the IAM user in Account A still needs an IAM policy that explicitly grants permission to perform the S3 action, otherwise the request is denied by the source account's implicit deny. Option C is wrong because bucket ACLs do not support granting access to IAM users from another AWS account; ACLs only support AWS accounts or predefined groups, not individual IAM user ARNs. Option D is wrong because while creating an IAM role in Account B and allowing the user to assume it is a valid cross-account access pattern, the question specifically asks for granting access to an IAM user directly, not via role assumption; additionally, the bucket policy would need to allow the role's ARN, not the user's ARN, making this a different mechanism than what the question describes.

340
MCQhard

A company uses a customer managed AWS KMS key to encrypt sensitive data stored in DynamoDB. A Lambda function reads from the DynamoDB table and needs to decrypt the data. The Lambda function's execution role has an IAM policy that allows kms:Decrypt on the key. However, access is denied. What must the developer add to the KMS key policy to resolve the issue?

A.Add a statement granting kms:Decrypt to the Lambda function's execution role.
B.Add a statement granting kms:Decrypt to the Lambda function's resource-based policy.
C.Add a statement granting kms:Decrypt to the Lambda service principal.
D.Add a statement granting kms:Decrypt to the account root user with a condition for the Lambda function.
AnswerA

When a Lambda function needs to interact with a customer-managed AWS KMS key, the key policy associated with that KMS key must explicitly grant permissions to the entity making the request. The Lambda function assumes an IAM execution role, and it is this role that makes API calls to KMS. Therefore, the KMS key policy must include a statement allowing the kms:Decrypt action for the specific ARN of the Lambda function's execution role, ensuring direct access control and adherence to the principle of least privilege.

Why this answer

KMS key policies are resource-based policies that control access to the key itself. Even if the Lambda execution role has an IAM policy granting kms:Decrypt, the KMS key policy must explicitly allow the role (or the user/account) to perform that action. Without this statement in the key policy, the IAM permission is ineffective, resulting in an access denied error.

Exam trap

The trap here is that candidates often assume IAM permissions alone are sufficient for KMS operations, forgetting that KMS key policies act as an additional layer of access control that must explicitly allow the principal.

How to eliminate wrong answers

Option B is wrong because Lambda functions do not have resource-based policies that can grant KMS permissions; KMS actions must be authorized via the key policy or IAM, not a Lambda resource policy. Option C is wrong because granting kms:Decrypt to the Lambda service principal would allow any Lambda function in the account to decrypt using the key, which is overly permissive and not the correct way to grant access to a specific function. Option D is wrong because granting kms:Decrypt to the account root user with a condition for the Lambda function is unnecessarily complex and not a standard pattern; the root user already has full control over the key, and conditions cannot directly reference a Lambda function's identity in a reliable way.

341
MCQmedium

A CodePipeline source stage should start when code is pushed to a repository, without scheduled polling. Which integration pattern should be used?

A.Manual approval only
B.Event-based trigger from the source provider/EventBridge integration
C.A cron job on an EC2 instance
D.CloudWatch Logs Insights
AnswerB

AWS CodePipeline natively supports event-based triggers from integrated source providers such as AWS CodeCommit, GitHub, and Amazon S3. For CodeCommit, a push to a repository branch generates an event that is published to Amazon EventBridge. An EventBridge rule can then be configured to detect this specific event and automatically invoke the CodePipeline, ensuring the pipeline starts immediately upon a code push, which is the most direct and efficient solution.

Why this answer

AWS CodePipeline can integrate with Amazon EventBridge to listen for repository events (e.g., push events from CodeCommit, GitHub, or Bitbucket) and automatically start the pipeline. This event-driven pattern eliminates the need for scheduled polling, providing near-instantaneous execution when code changes are detected.

Exam trap

The trap here is that candidates may confuse manual approval (a pipeline action) with a trigger mechanism, or assume that CloudWatch Logs Insights can initiate pipeline executions, when in fact only EventBridge or webhook-based integrations provide the required event-driven, polling-free source trigger.

How to eliminate wrong answers

Option A is wrong because manual approval is a gate that pauses pipeline execution for human review, not a mechanism to trigger the pipeline on code push. Option C is wrong because a cron job on an EC2 instance would require custom scripting, polling the repository periodically, and introduces unnecessary complexity, latency, and maintenance overhead compared to a native event-driven integration. Option D is wrong because CloudWatch Logs Insights is a query tool for analyzing log data, not a trigger mechanism for CodePipeline source stages.

342
MCQhard

A developer notices that an AWS Lambda function, which uses Amazon RDS Proxy to connect to an Aurora MySQL database, is experiencing increased latency and occasional connection timeouts. The function is configured with a reserved concurrency of 100 and is deployed in a VPC. The RDS Proxy's maximum connections is set to 1000. CloudWatch metrics show that the DatabaseConnections metric for the proxy is consistently at 1000. What is the most likely cause of the increased latency and timeouts?

A.The Lambda function is not reusing database connections properly, exhausting the proxy connection pool
B.The RDS Proxy target group is not configured with the correct DB instance
C.The Lambda function's execution role is missing the rds-db:connect permission
D.The VPC does not have a NAT Gateway for outbound traffic
AnswerA

Lambda functions are inherently stateless and often short-lived. Without explicit connection pooling implemented within the Lambda function's code (e.g., by declaring the connection object in a global scope), each new invocation will attempt to establish a fresh connection to the RDS Proxy. This rapid creation of new client connections, especially under high concurrency, quickly exhausts the limited connection pool managed by the RDS Proxy, leading to connection failures and increased latency as requests wait for available connections.

Why this answer

The RDS Proxy's DatabaseConnections metric is consistently at 1000, which equals the proxy's maximum connections setting. This indicates the proxy connection pool is fully saturated. When all connections are in use, new connection requests from Lambda invocations must wait, causing increased latency, and if the wait exceeds the timeout, connection timeouts occur.

The most likely cause is that the Lambda function is not reusing database connections (e.g., not using connection pooling or keeping connections open across invocations), exhausting the pool.

Exam trap

The trap here is that candidates may focus on the reserved concurrency (100) versus proxy max connections (1000) and assume the numbers are fine, missing that the real issue is connection reuse per invocation, not the total count.

How to eliminate wrong answers

Option B is wrong because if the target group were misconfigured, the proxy would fail to connect to the database entirely, not just experience latency and timeouts while the connection pool is full. Option C is wrong because missing the rds-db:connect permission would cause immediate authentication failures (e.g., 'Access denied') for all connection attempts, not gradual pool exhaustion. Option D is wrong because Lambda functions in a VPC use Elastic Network Interfaces (ENIs) for outbound traffic to RDS Proxy within the same VPC; a NAT Gateway is only needed for internet-bound traffic, not for connecting to RDS Proxy in the same VPC.

343
MCQhard

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

A.The Lambda function is in a VPC without a VPC endpoint for DynamoDB.
B.The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.
C.The S3 bucket is in a different region, causing cross-region access issues.
D.The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.
AnswerB

AWS evaluates both identity-based policies (attached to the Lambda function's IAM role) and resource-based policies (attached directly to the DynamoDB table) to determine access. An explicit "Deny" statement in *any* applicable policy, including a resource-based policy, always takes precedence over any "Allow" statements. Therefore, even if the Lambda role has an "Allow" policy, an explicit "Deny" on the DynamoDB table itself will result in an "AccessDenied" error.

Why this answer

DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Exam trap

The trap here is that candidates often assume IAM role permissions alone guarantee access, forgetting that resource-based policies on DynamoDB tables can explicitly deny access, which overrides any allow in identity-based policies.

How to eliminate wrong answers

Option A is wrong because a Lambda function in a VPC without a VPC endpoint for DynamoDB would cause a network timeout or connectivity error, not an AccessDenied error, as DynamoDB calls go over HTTPS and the error would be a timeout or connection failure, not an IAM permission denial. Option C is wrong because S3 and DynamoDB are both global services; cross-region access is fully supported and does not cause AccessDenied errors—the error would be a different type like a timeout or throttling if there were latency issues. Option D is wrong because while KMS permissions are needed for encrypted tables, the error message would be a KMS AccessDenied or a 400 error, not a generic AccessDenied on PutItem, and the question states the function fails specifically when trying to put items, not during encryption/decryption.

344
Multi-Selectmedium

A developer is using AWS Lambda and needs to ensure that the function can access an RDS database securely. Which THREE steps should be taken?

Select 3 answers
A.Place the Lambda function inside a VPC.
B.Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda code.
C.Attach an IAM role to the Lambda function that grants rds:* permissions.
D.Configure the RDS instance to require client certificates.
E.Configure the security group of the RDS instance to allow inbound traffic from the Lambda function's security group.
AnswersA, B, E

By default, Lambda functions run in an AWS-owned VPC and cannot connect to resources in your private subnets. Attaching the function to the same VPC provisions elastic network interfaces in your subnets, giving it private IP connectivity to the RDS instance. This is the foundational step required before any TCP connection to RDS can be established.

Why this answer

Options A, B, and E are correct. Option A: Placing the Lambda function inside a VPC allows it to communicate with the RDS database privately over the network. Option B: Storing database credentials in AWS Secrets Manager and retrieving them in the Lambda code is a secure practice, as it avoids hardcoding credentials and allows rotation.

Option E: Configuring the security group of the RDS instance to allow inbound traffic from the Lambda function's security group ensures that only the Lambda function can connect. Option C is incorrect because granting rds:* permissions does not enable Lambda to authenticate to the database; IAM roles are for AWS API actions, not for database user authentication. Option D is incorrect because client certificates are not typically used for Lambda-to-RDS connections; authentication is done via database credentials.

345
MCQhard

A service publishes order events to SNS. Several consumers need different filtered subsets of events without changing publisher code. What should the developer configure?

A.Separate AWS accounts for each consumer
B.Lambda code that discards unwanted events after invocation
C.SNS subscription filter policies
D.SQS long polling only
AnswerC

SNS subscription filter policies are the most direct and efficient solution for this requirement. These policies allow each subscriber to define specific rules based on message attributes or the message body. Only messages that fully match a subscriber's defined filter policy are delivered to that particular endpoint, ensuring consumers receive only the relevant "order events" they need. This prevents unnecessary message delivery and optimizes downstream processing by filtering at the source.

Why this answer

SNS subscription filter policies allow each consumer to define a JSON policy on their subscription that selectively delivers only messages matching specified attributes (e.g., event type, region). This enables multiple consumers to receive different filtered subsets of the same SNS topic without modifying the publisher's code, as the filtering happens server-side at the SNS service level.

Exam trap

The trap here is that candidates often confuse client-side filtering (Option B) with server-side filtering, or assume that SQS long polling (Option D) can filter messages, when in fact SNS subscription filter policies are the only native AWS mechanism for server-side message subsetting without publisher changes.

How to eliminate wrong answers

Option A is wrong because separate AWS accounts do not provide message filtering; they would require duplicating the SNS topic and publisher logic across accounts, adding complexity without solving the subset requirement. Option B is wrong because discarding unwanted events in Lambda after invocation wastes compute resources and incurs unnecessary costs, as the Lambda function is still triggered for every message, defeating the purpose of server-side filtering. Option D is wrong because SQS long polling only controls how often the consumer polls for messages, not which messages are delivered; it does not filter message content or attributes.

346
Multi-Selecteasy

Which TWO are valid deployment strategies supported by AWS CodeDeploy? (Choose TWO.)

Select 2 answers
A.Immutable deployment
B.In-place deployment
C.Canary deployment
D.All at once deployment
E.Blue/Green deployment
AnswersB, E

In-place deployment is a valid deployment strategy supported by AWS CodeDeploy, where the application on the existing set of EC2 instances or on-premises servers is directly updated. During this process, CodeDeploy stops the application on each instance, deploys the new application revision, and then restarts the application. Traffic is not shifted between different environments; instead, the application files on the active servers are modified in place, potentially causing brief service interruptions on individual instances as they are updated.

Why this answer

AWS CodeDeploy supports in-place deployments (option B) where the application is updated on the existing instances without provisioning new ones. This is a valid deployment strategy that updates the current fleet by stopping and starting the application, and it is one of the two core strategies explicitly documented by AWS.

Exam trap

The trap here is that candidates confuse deployment strategies (in-place and blue/green) with deployment configuration options (like AllAtOnce) or with strategies from other AWS services (like immutable deployments in Elastic Beanstalk), leading them to select 'All at once' or 'Immutable' as valid CodeDeploy strategies.

347
Multi-Selecthard

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Select 2 answers
A.Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.
B.Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.
C.Update the API Gateway integration to point to the Lambda alias instead of a specific version.
D.Update the Lambda function code and publish a new version.
E.Create a new API Gateway stage for the new version and update DNS.
AnswersA, C

An AWS Lambda alias provides a stable endpoint for your function while allowing you to manage traffic distribution across different versions. By configuring the alias to point to both the current and the new Lambda versions with a weighted routing strategy, a developer can gradually shift a small percentage of traffic to the new version. This enables a controlled canary deployment, allowing for real-time monitoring and quick rollback if issues arise, minimizing impact on users.

Why this answer

Lambda aliases support traffic shifting for canary deployments by allowing you to route a percentage of incoming requests to a new function version while the majority continues to the current version. This is done by configuring the alias's routing configuration with a `RoutingConfig` that specifies the new version and the weight (e.g., 5%) of traffic it should receive. This enables gradual, controlled rollouts without modifying the API Gateway integration endpoint.

Option C is also necessary because the API Gateway integration must point to the Lambda alias (rather than a fixed version) so that the routing configuration on the alias can take effect. Without updating the integration to use the alias, API Gateway would continue to invoke a specific version directly, bypassing the canary routing.

Exam trap

The trap here is that candidates often think canary deployments require separate infrastructure (like CloudFront or multiple stages), but AWS Lambda aliases with routing configuration provide a built-in, serverless-native mechanism for percentage-based traffic shifting without additional services.

348
MCQeasy

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API will be consumed by a web application hosted on a different domain. The developer needs to enable Cross-Origin Resource Sharing (CORS) for all HTTP methods. What is the most efficient way to achieve this?

A.Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.
B.In the Lambda function code, add the 'Access-Control-Allow-Origin' header to every response.
C.Configure Amazon CloudFront in front of API Gateway to handle CORS.
D.Set a bucket policy on the S3 bucket that hosts the web application to allow cross-origin requests.
AnswerA

Enabling CORS directly on the API Gateway resource is the correct and most efficient solution. API Gateway's built-in CORS feature automatically configures the necessary preflight OPTIONS method for the resource. It also injects the required Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers into the method responses and integration responses, ensuring browsers can successfully make cross-origin requests to your API.

Why this answer

API Gateway's 'Enable CORS' feature automatically creates an OPTIONS method for the selected resource and configures the necessary response headers (e.g., Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to handle preflight requests. This is the most efficient approach as it centralizes CORS configuration at the API Gateway layer, eliminating the need for manual header management in Lambda or additional infrastructure.

Exam trap

The trap here is that candidates assume adding CORS headers only in the Lambda function code is sufficient, overlooking the mandatory preflight OPTIONS request that API Gateway must handle separately.

How to eliminate wrong answers

Option B is wrong because while adding headers in Lambda is necessary for the actual response, it does not handle the preflight OPTIONS request that browsers send before cross-origin requests; without a proper OPTIONS response, CORS will fail. Option C is wrong because CloudFront does not natively handle CORS preflight requests; it can pass through headers but still requires the origin (API Gateway) to be properly configured for CORS, making it an unnecessary extra layer. Option D is wrong because S3 bucket policies control access to S3 objects, not API Gateway endpoints; CORS for the API must be configured on the API Gateway resource itself, not on the web application's hosting bucket.

349
MCQhard

A developer is building an application that uses Amazon DynamoDB as a data store. The application reads the same item frequently but writes rarely. The developer wants to reduce read costs. Which DynamoDB feature should the developer use?

A.DynamoDB Accelerator (DAX)
B.DynamoDB Global Tables
C.DynamoDB Auto Scaling
D.Time to Live (TTL)
AnswerA

DynamoDB Accelerator (DAX) is an in-memory cache designed to provide microsecond response times for read-heavy workloads, significantly reducing the number of read capacity units (RCUs) consumed from the underlying DynamoDB table. When an application reads data through DAX, if the item is in the cache, it's served directly, bypassing DynamoDB and incurring no RCU cost. This makes DAX highly effective for applications requiring low-latency access to frequently read data, directly lowering operational costs associated with read throughput.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Since the application reads the same item frequently but writes rarely, DAX can serve repeated read requests from its cache, significantly reducing the number of read capacity units consumed against the DynamoDB table and thus lowering read costs.

Exam trap

The trap here is that candidates often confuse DAX with ElastiCache or assume that Auto Scaling reduces costs, but DAX is the only DynamoDB-native service that directly reduces read costs by caching frequently accessed items.

How to eliminate wrong answers

Option B is wrong because Global Tables provide multi-region replication for disaster recovery and low-latency writes, not read cost reduction. Option C is wrong because Auto Scaling adjusts provisioned throughput based on traffic patterns but does not reduce per-read costs; it only prevents throttling. Option D is wrong because Time to Live (TTL) automatically expires old items to reduce storage costs, not read costs.

350
Drag & Dropmedium

Drag and drop the steps to set up a custom domain for an API Gateway API in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First have a domain, get a certificate, create custom domain in API Gateway, map to stage, and update DNS.

351
MCQhard

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

A.Attach an Amazon EBS volume to the task.
B.Use the ephemeral storage provided by Fargate.
C.Mount an Amazon EFS file system to the container.
D.Create a Docker volume using the 'tmpfs' driver.
AnswerB

Fargate tasks are provisioned with a certain amount of ephemeral storage, typically 20 GB by default, which is local to the task's underlying compute environment. This storage is designed for temporary data, such as application logs, caches, or scratch space, and persists for the entire lifecycle of the Fargate task. While it is deleted once the task stops, it remains available and consistent across restarts of individual containers within that same task, making it suitable for short-lived data that doesn't require long-term persistence.

Why this answer

Fargate provides ephemeral storage (up to 20 GB by default) that persists data across container restarts within the same task but is automatically deleted when the task stops. This matches the requirement for temporary data that does not need to be shared across tasks and is cleaned up upon task termination.

Exam trap

The trap here is that candidates confuse 'persist across container restarts' with 'persist across task stops,' leading them to choose Amazon EFS or EBS, which are designed for long-term persistence, while Fargate's ephemeral storage perfectly meets the temporary, task-scoped requirement.

How to eliminate wrong answers

Option A is wrong because Amazon EBS volumes cannot be directly attached to Fargate tasks; EBS volumes are only supported with EC2 launch type and require instance-level attachment, not task-level. Option C is wrong because Amazon EFS provides persistent, shared file storage that persists beyond the task lifecycle and is designed for multi-task sharing, which contradicts the requirement for data to be automatically deleted when the task stops. Option D is wrong because Docker volumes using the 'tmpfs' driver store data in memory, not on disk, and do not persist across container restarts; they are ephemeral and lost when the container stops.

352
MCQhard

A developer is deploying a web application on Amazon EKS. The application needs to read configuration data from an Amazon S3 bucket at startup. The developer wants to ensure that the configuration is securely accessed without embedding AWS credentials in the application code. Which solution should the developer use?

A.Use IAM roles for service accounts (IRSA) to assign an IAM role to the pod.
B.Store the AWS credentials in AWS Secrets Manager and retrieve them at startup.
C.Assign an IAM instance profile to the EC2 instances running the EKS nodes.
D.Embed the AWS access key and secret key in a Kubernetes ConfigMap.
AnswerA

IAM roles for service accounts (IRSA) is the recommended and most secure method for granting AWS permissions to applications running in EKS pods. It leverages an OpenID Connect (OIDC) provider associated with the EKS cluster to allow Kubernetes service accounts to assume specific IAM roles. This mechanism provides fine-grained, pod-level permissions, ensuring that each pod receives only the necessary temporary AWS credentials, thereby adhering strictly to the principle of least privilege and enhancing overall security.

Why this answer

IAM roles for service accounts (IRSA) allows you to associate an IAM role with a Kubernetes service account, which the pod can assume to obtain temporary AWS credentials via the AWS STS endpoint. This eliminates the need to embed long-term credentials in the application code or environment variables, and the credentials are automatically rotated by the AWS SDK. The pod retrieves the configuration from S3 using the assumed role's permissions, ensuring secure access.

Exam trap

The trap here is that candidates may confuse IRSA with IAM instance profiles, thinking that assigning a role to the node is sufficient, but IRSA is the correct method for pod-level IAM permissions in EKS.

How to eliminate wrong answers

Option B is wrong because storing AWS credentials in AWS Secrets Manager still requires the application to retrieve them at startup, which introduces a credential management overhead and a potential attack surface if the retrieval itself is not secured; it does not eliminate the need to handle long-term credentials. Option C is wrong because assigning an IAM instance profile to the EC2 nodes grants permissions to all pods running on those nodes, violating the principle of least privilege and potentially allowing unintended access to the S3 bucket. Option D is wrong because embedding AWS access keys in a Kubernetes ConfigMap exposes the credentials in plaintext within the cluster, which is a severe security risk and violates AWS best practices.

353
MCQhard

A developer needs to grant a user in another AWS account (Account B) read-only access to objects in an Amazon S3 bucket owned by Account A. The developer has already added a bucket policy that grants s3:GetObject access to the IAM user in Account B. However, the user in Account B still gets Access Denied when trying to read objects. What additional configuration is required?

A.The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN
B.The bucket must be made public by unchecking 'Block all public access'
C.The developer must create a new IAM role in Account A and have the user in Account B assume that role
D.The user in Account B must use the S3 console instead of the AWS CLI
AnswerA

Cross-account access requires both a bucket policy that grants the user permissions and an IAM policy in the user's account that allows the action. The IAM policy is necessary because the default is to deny all actions.

Why this answer

The bucket policy in Account A grants s3:GetObject access to the IAM user in Account B, but this alone is insufficient. For cross-account access, the IAM user in Account B must also have an IAM policy attached that explicitly allows s3:GetObject on the bucket ARN. Without this, the user’s own account denies the request before it reaches Account A’s bucket policy, resulting in Access Denied.

Exam trap

The trap here is that candidates assume a bucket policy alone is sufficient for cross-account access, overlooking the requirement for an explicit IAM policy in the requesting account to allow the action.

How to eliminate wrong answers

Option B is wrong because making the bucket public by unchecking 'Block all public access' would grant anonymous access to everyone, which violates the principle of least privilege and is not required for a specific cross-account user. Option C is wrong because while creating an IAM role in Account A and having the user in Account B assume it is a valid alternative approach, it is not the additional configuration required here—the developer has already chosen a bucket policy approach, and the missing piece is the IAM policy in Account B. Option D is wrong because the S3 console and AWS CLI both enforce the same IAM permissions; the issue is a lack of permissions, not the tool used.

354
MCQeasy

An e-commerce platform uses AWS CodePipeline to deploy a web application to an Auto Scaling group behind an Application Load Balancer. The deployment strategy must minimize downtime and allow immediate rollback if the new version fails health checks. Which deployment configuration meets these requirements?

A.Use blue/green deployment with an immutable infrastructure.
B.Use all-at-once deployment to the Auto Scaling group.
C.Use canary deployment shifting 10% traffic for 5 minutes.
D.Use in-place rolling update with a batch size of 50%.
AnswerA

Blue/green deployment with immutable infrastructure creates an entirely new, identical environment (green) with the updated application version, leaving the existing production environment (blue) untouched. Once the green environment passes all health checks and tests, traffic is atomically shifted from blue to green. This strategy ensures zero downtime during deployment and provides an instant rollback capability by simply reverting traffic back to the healthy, unchanged blue environment if any issues arise with the new version.

Why this answer

Blue/green deployment with immutable infrastructure minimizes downtime by running the new version (green) alongside the old (blue) and switching traffic only after health checks pass. If the new version fails, rollback is immediate by routing traffic back to the blue environment without redeploying. AWS CodePipeline supports this via CodeDeploy with a blue/green configuration, ensuring zero-downtime deployments and instant rollback capability.

Exam trap

The trap here is that candidates confuse canary or rolling updates with immediate rollback capability, but only blue/green provides an instant traffic switch without redeployment, as the old environment remains intact.

How to eliminate wrong answers

Option B is wrong because all-at-once deployment replaces all instances simultaneously, causing downtime during the deployment and no ability to rollback without redeploying the old version. Option C is wrong because canary deployment shifts only 10% traffic for 5 minutes, which does not guarantee immediate rollback of the entire fleet if the new version fails; it requires manual or automated traffic shifting back, which is not instantaneous. Option D is wrong because in-place rolling update with a batch size of 50% replaces instances gradually but still causes partial downtime and requires a full redeployment to rollback, as the old instances are terminated during the update.

355
Multi-Selectmedium

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Select 2 answers
A.Set the '--on-failure' parameter to 'ROLLBACK' during stack update.
B.Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.
C.Use a change set to review the changes before updating.
D.Apply a stack policy that denies updates to critical resources.
E.Set the '--disable-rollback' parameter to 'false' during stack update.
AnswersB, E

Specifying a CloudWatch alarm within the '--rollback-configuration' parameter during a stack update is a powerful mechanism for enabling automatic rollback. This configuration allows CloudFormation to monitor the specified alarm(s) for a defined period after the update completes. If any of these alarms transition into an ALARM state, CloudFormation will automatically initiate a rollback of the stack to its previous stable state, ensuring operational stability.

Why this answer

The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Exam trap

The trap here is that candidates confuse the `--on-failure` parameter (which only applies to stack creation) with stack update rollback, or they assume that a stack policy or change set can trigger automatic rollback, when in fact only `--rollback-configuration` and `--disable-rollback` control automatic rollback behavior during updates.

356
MCQeasy

A developer stores database credentials for an application running on Amazon EC2. The security team requires that the credentials be automatically rotated every 30 days to reduce the risk of compromise. Which AWS service should the developer use to store and automatically rotate the credentials?

A.AWS Systems Manager Parameter Store
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.IAM Roles for EC2
AnswerB

AWS Secrets Manager is purpose-built for managing, retrieving, and rotating database credentials, API keys, and other secrets throughout their lifecycle. It provides native, automatic rotation capabilities for various services, including Amazon RDS, Amazon Redshift, and Amazon DocumentDB, with configurable schedules (e.g., every 30 days). This eliminates the need for manual rotation or complex custom solutions, significantly enhancing security posture by regularly changing credentials.

Why this answer

AWS Secrets Manager is the correct choice because it is specifically designed to securely store database credentials and other secrets, and it provides built-in, configurable automatic rotation (e.g., every 30 days) using AWS Lambda. This meets the security team's requirement without custom scripting or infrastructure management.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native automatic rotation) with AWS Secrets Manager, leading them to choose Parameter Store for its lower cost or familiarity, despite the explicit rotation requirement.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store can store credentials but does not natively support automatic rotation; rotation would require custom automation with Lambda or other services, making it less suitable for this requirement. Option C is wrong because AWS Key Management Service (KMS) is a key management service for encryption keys, not for storing or rotating database credentials; it can encrypt secrets but does not manage rotation of the credentials themselves. Option D is wrong because IAM Roles for EC2 provide temporary credentials for AWS API access, not for storing or rotating database credentials; they cannot be used to store or rotate application-level database passwords.

357
MCQeasy

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'ScriptMissing' during the BeforeInstall lifecycle event. What is the most likely cause?

A.The BeforeInstall lifecycle event is not defined in the appspec.yml
B.The script file specified in the appspec.yml for the BeforeInstall hook is not present on the instance
C.The CodeDeploy agent on the instance is not running
D.The instance does not have the necessary permissions to execute the script
AnswerB

This is the correct explanation. When CodeDeploy executes a deployment, it first downloads the application revision to the instance. If the appspec.yml specifies a script for the BeforeInstall hook, and the CodeDeploy agent cannot locate that script file at the specified path within the downloaded revision on the target instance, it will explicitly fail with a "ScriptMissing" error. This error precisely indicates that the expected script file is physically absent from the instance's file system where the agent is looking.

Why this answer

The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment failed because a script file referenced in the appspec.yml for a lifecycle event (in this case, BeforeInstall) could not be found on the EC2 instance. CodeDeploy expects the script to be present at the specified path after the archive is extracted; if the file is missing or the path is incorrect, the agent reports this error. Option B correctly identifies that the script file is not present on the instance.

Exam trap

The trap here is that candidates confuse 'ScriptMissing' with permission issues or agent connectivity problems, but AWS CodeDeploy has distinct error codes for each failure mode, and 'ScriptMissing' specifically points to a missing file, not execution or agent status.

How to eliminate wrong answers

Option A is wrong because if the BeforeInstall lifecycle event is not defined in the appspec.yml, CodeDeploy would simply skip that event and not produce a 'ScriptMissing' error — the error specifically occurs when a hook is defined but its script is absent. Option C is wrong because if the CodeDeploy agent were not running, the deployment would fail with an 'AgentNotRunning' or 'InstanceUnreachable' error, not a 'ScriptMissing' error. Option D is wrong because insufficient permissions to execute the script would result in a 'ScriptFailed' error (e.g., exit code 126 or 127), not a 'ScriptMissing' error — the agent first checks for the file's existence before attempting execution.

358
Multi-Selectmedium

Which TWO are best practices for securing an AWS account? (Choose 2)

Select 2 answers
A.Disable AWS CloudTrail to reduce costs
B.Disable password rotation to avoid user inconvenience
C.Use the root user for daily administrative tasks
D.Enable multi-factor authentication (MFA) for privileged users
E.Use IAM roles for applications that run on EC2 instances
AnswersD, E

MFA adds a second authentication factor, such as a time-based one-time password (TOTP) from a hardware or virtual device, significantly reducing the risk of unauthorized access even if a password is compromised. For privileged users with access to sensitive resources, MFA is a critical control defined in the AWS Well-Architected Framework. It protects against credential theft and phishing attacks.

Why this answer

The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture.

Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Exam trap

This question tests knowledge of AWS security best practices. A common trap is to assume that disabling CloudTrail saves costs without considering security implications, or that password rotation should be disabled for convenience.

359
MCQmedium

An AWS Lambda function processes messages from an Amazon SQS queue and writes results to an Amazon DynamoDB table. The function is configured with a reserved concurrency of 5 and a batch size of 10. CloudWatch metrics show high throttling and a growing queue backlog. The function's execution time averages 1 second per message. What is the MOST effective action to reduce throttling while improving throughput?

A.Increase the reserved concurrency to 20.
B.Increase the batch size to 100.
C.Decrease the reserved concurrency to 2.
D.Increase the provisioned write capacity of the DynamoDB table.
AnswerA

Increasing reserved concurrency allows Lambda to scale and invoke more function instances concurrently. This directly reduces throttling and allows the function to process more messages from the SQS queue simultaneously, improving throughput and reducing backlog.

Why this answer

The Lambda function is throttling because its reserved concurrency of 5 limits it to 5 concurrent executions. With a batch size of 10 and 1-second execution time, the function can process at most 5 * 10 = 50 messages per second. Increasing reserved concurrency to 20 allows 20 concurrent executions, raising throughput to 200 messages per second, which directly reduces throttling and clears the backlog.

Exam trap

The trap here is that candidates may confuse Lambda throttling with downstream resource throttling (like DynamoDB) and choose to increase write capacity, or they may think increasing batch size alone will solve the problem without considering the concurrency bottleneck.

How to eliminate wrong answers

Option B is wrong because increasing batch size to 100 would cause each invocation to process more messages, but with only 5 concurrent executions, the function would still be limited to 5 invocations at a time, and the 1-second execution time per message would scale linearly, likely causing timeouts or increased latency without addressing the root cause of throttling. Option C is wrong because decreasing reserved concurrency to 2 would reduce throughput to 20 messages per second, worsening throttling and backlog. Option D is wrong because increasing DynamoDB write capacity addresses potential write throttling from DynamoDB, but the CloudWatch metrics show Lambda throttling, not DynamoDB throttling; the bottleneck is Lambda concurrency, not the database.

360
MCQmedium

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

A.Amazon Simple Email Service (SES)
B.AWS Lambda
C.Amazon Simple Notification Service (SNS)
D.Amazon CloudWatch Logs
AnswerC

Amazon Simple Notification Service (SNS) is a highly scalable, fully managed pub/sub messaging service that enables you to send messages to a large number of subscribers or endpoints. CodePipeline natively integrates with SNS, allowing developers to configure notifications for pipeline state changes, approval actions, or execution failures to an SNS topic. This topic can then reliably deliver these alerts via various protocols, including email, SMS, or to other AWS services, making it the direct and most efficient solution for email notifications.

Why this answer

Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Exam trap

The trap here is that candidates may confuse Amazon SES with SNS because both can send emails, but SES is a dedicated email-sending service requiring manual integration, whereas SNS is the native event notification service that directly integrates with CodePipeline's approval actions.

How to eliminate wrong answers

Option A is wrong because Amazon Simple Email Service (SES) is a platform for sending transactional and marketing emails, but it is not integrated with CodePipeline's event-driven notifications; SES requires explicit API calls or SMTP configuration and does not natively subscribe to CodePipeline events. Option B is wrong because AWS Lambda is a compute service that can process events, but it is not a notification delivery service; while Lambda could be used to send emails via SES, it adds unnecessary complexity and is not the direct service for sending email notifications from a CodePipeline approval action. Option D is wrong because Amazon CloudWatch Logs is a service for storing, monitoring, and accessing log files; it does not send notifications and is not designed for real-time alerting to email endpoints.

361
Multi-Selecteasy

A developer is using AWS Step Functions to orchestrate a workflow. The developer wants to handle errors and retries for a task. Which TWO fields can be used in a state definition to configure error handling? (Choose TWO.)

Select 2 answers
A.Retry
B.Catch
C.FailureState
D.ErrorOutput
E.ErrorAction
AnswersA, B

In AWS Step Functions, the "Retry" field within a state definition allows a developer to specify a retry policy for transient errors. It defines which errors ("ErrorEquals"), how many times ("MaxAttempts"), and with what delay ("IntervalSeconds" and "BackoffRate") the state should be re-executed before failing. This mechanism is crucial for building resilient workflows that can automatically recover from temporary issues without manual intervention.

Why this answer

The `Retry` field in an AWS Step Functions state definition defines an array of retry policies, specifying which errors to retry, the maximum number of retry attempts, the interval between retries, and the backoff rate. Option B is correct because the `Catch` field defines an array of fallback states or state machine transitions that are executed when a specific error occurs after all retry attempts are exhausted, allowing the workflow to handle errors gracefully.

Exam trap

The trap here is that candidates often confuse the `Retry` and `Catch` fields with non-existent fields like `FailureState` or `ErrorAction`, or they mistakenly think `ErrorOutput` is used to capture error details, when in fact Step Functions uses `ResultPath` to include error information in the state output.

362
MCQmedium

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to improve performance. The application periodically experiences high latency during peak hours. The developer checks the ElastiCache metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster has a single node with a cache.t3.small instance type. Which action will most likely improve the cache hit rate and reduce latency?

A.Scale up to a larger node type (e.g., cache.t3.medium) to increase available memory.
B.Enable cluster mode and distribute data across multiple shards to reduce memory pressure.
C.Change the eviction policy to 'allkeys-lfu' to better manage which keys are evicted.
D.Add a read replica for the Redis cluster to offload read traffic.
AnswerA

Scaling up to a larger node type directly increases the available RAM for the Redis instance. This additional memory allows the cache to store more data, significantly reducing the frequency of key evictions caused by memory pressure. Consequently, the cache hit rate improves, as more requested data is found in cache, leading to lower latency and better application performance by minimizing database lookups.

Why this answer

The high 'Evictions' and low 'CacheHitRate' metrics indicate that the Redis node is running out of memory, forcing it to evict keys to make room for new data. Scaling up to a larger node type (cache.t3.medium) increases the available memory, allowing more data to be cached and reducing evictions, which directly improves the cache hit rate and reduces latency.

Exam trap

The trap here is that candidates may focus on optimizing eviction policies or adding replicas, but the core issue is insufficient memory capacity, which only scaling up can resolve.

How to eliminate wrong answers

Option B is wrong because enabling cluster mode and distributing data across multiple shards does not increase the total memory per node; it only partitions data, and if the total memory across shards is insufficient, evictions will still occur. Option C is wrong because changing the eviction policy to 'allkeys-lfu' only changes which keys are evicted (least frequently used) but does not address the root cause of insufficient memory; evictions will continue at the same rate. Option D is wrong because adding a read replica offloads read traffic but does not increase the primary node's memory, so evictions and low cache hit rate will persist on the primary node.

363
Multi-Selecteasy

A developer is using AWS X-Ray to trace requests through a microservices application. The developer notices that some traces are incomplete. Which TWO actions can help ensure complete traces?

Select 2 answers
A.Use the X-Ray SDK to instrument the application code.
B.Open port 2000 on the security groups for TCP traffic.
C.Deploy the X-Ray daemon as a centralized service in a separate instance.
D.Install the CloudWatch agent on all instances.
E.Ensure the X-Ray daemon is running on all EC2 instances.
AnswersA, E

The X-Ray SDK must be integrated directly into the application code because it is what creates trace data in the first place. For supported web frameworks, middleware or interceptors automatically capture incoming HTTP requests, generate a trace ID, manage segments and subsegments, and propagate the X-Amzn-Trace-Id header to downstream services. The SDK then sends completed segments to the local X-Ray daemon over UDP port 2000 for eventual upload to the X-Ray API. Without this code-level instrumentation, a request never becomes a trace, regardless of daemon status or network configuration.

Why this answer

The X-Ray SDK instruments application code to generate trace segments and sends them to the X-Ray daemon. Option E is correct because the X-Ray daemon must be running on each EC2 instance to receive trace data from the SDK and forward it to the X-Ray service. Without both, traces may be incomplete.

Option B is incorrect because the X-Ray daemon communicates over UDP, not TCP, and port 2000 is UDP; opening TCP 2000 does not help. Option C is incorrect because the X-Ray daemon is designed to run locally on each instance, not as a centralized service. Option D is incorrect because the CloudWatch agent does not handle X-Ray traces; it is used for CloudWatch metrics and logs.

364
MCQeasy

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?

A.Use AWS KMS to encrypt the log data and grant permissions.
B.Attach an IAM execution role with CloudWatch Logs permissions.
C.Create a resource-based policy on the Lambda function.
D.Store AWS access keys in environment variables.
AnswerB

Attaching an IAM execution role to the Lambda function is the standard and most secure method for granting it permissions to interact with other AWS services. When the Lambda function executes, it assumes this role, which dictates its authorized actions. To enable the function to write logs to CloudWatch, the attached IAM role must include policies explicitly granting permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`.

Why this answer

AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.

Exam trap

The trap here is that candidates often confuse resource-based policies (which control who can invoke the function) with execution roles (which control what the function can do), leading them to incorrectly select option C.

How to eliminate wrong answers

Option A is wrong because AWS KMS is used for encryption key management, not for granting permissions; it does not provide IAM-level access control for writing logs. Option C is wrong because resource-based policies on a Lambda function control who can invoke the function, not what the function itself can do (like writing to CloudWatch Logs); permissions for the function's actions are defined in its execution role. Option D is wrong because storing AWS access keys in environment variables is a security anti-pattern; Lambda should never use long-term credentials, and instead relies on the IAM execution role to provide temporary, automatically rotated credentials.

365
Multi-Selecteasy

A company uses AWS CodeBuild to compile and test a Java application. The build process takes a long time because dependencies are downloaded every time. Which TWO actions can reduce build time? (Choose TWO.)

Select 2 answers
A.Increase the compute type of the build environment to have more CPU and memory.
B.Change the build runtime to a language that compiles faster.
C.Configure the build project to run builds in parallel.
D.Enable local caching in the CodeBuild project to reuse dependency files between builds.
E.Use Amazon S3 to cache dependencies and restore them at the start of each build.
AnswersD, E

Local caching in CodeBuild stores specific directories, such as /root/.m2 for Maven or /root/.gradle for Gradle, on the build instance's local disk, keyed by the project and optionally by a custom cache key. On subsequent builds, if the same instance is reused, downloaded dependency JARs are restored from the local cache instead of being fetched from the internet, eliminating the network latency that dominates a cold build. To make it effective, you must configure a cache key that changes only when dependencies actually change, so identical builds skip the download entirely.

Why this answer

Options D and E are correct. Both local caching (D) and S3 caching (E) allow CodeBuild to reuse previously downloaded dependencies, reducing build time. Option A (increasing compute type) improves CPU/memory but does not affect dependency download time.

Option B (changing runtime language) is unrelated to dependency caching. Option C (parallel builds) runs multiple builds concurrently but does not reduce the time for a single build's dependency download.

366
MCQmedium

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet without internet access. Which method should be used to grant the instance access to DynamoDB securely?

A.Store AWS credentials in a file on the instance and use them in the application
B.Configure security group rules to allow outbound traffic to DynamoDB
C.Attach a NAT gateway to the private subnet and use IAM user credentials
D.Create a VPC endpoint for DynamoDB and attach an IAM role to the instance
AnswerD

Creating a VPC endpoint for DynamoDB establishes a private, secure connection directly from the VPC to the DynamoDB service, bypassing the public internet and enhancing data security and network performance. Concurrently, attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials that the application can assume, adhering to the principle of least privilege and eliminating the need to store static credentials on the instance. This combination offers both secure network access and robust authentication.

Why this answer

A VPC Gateway Endpoint for DynamoDB allows EC2 instances in a private subnet to access DynamoDB without traversing the internet or requiring a NAT gateway. By attaching an IAM role to the EC2 instance, the application can securely obtain temporary credentials via the instance metadata service, eliminating the need to store long-term credentials on the instance.

Exam trap

The trap here is that candidates often confuse security groups with network routing, assuming that allowing outbound traffic to DynamoDB's IP range is sufficient, but without a VPC endpoint or internet gateway, the traffic has no route to reach the DynamoDB service.

How to eliminate wrong answers

Option A is wrong because storing AWS credentials in a file on the instance is a security risk and violates the principle of least privilege; it also requires managing long-term keys, which can be rotated or compromised. Option B is wrong because security groups control network traffic at the instance level, but DynamoDB is a managed service outside the VPC; without a VPC endpoint or internet access, security group rules alone cannot route traffic to DynamoDB. Option C is wrong because a NAT gateway would provide internet access, but it introduces additional cost and complexity, and using IAM user credentials on the instance still requires managing long-term keys; the recommended approach is to use an IAM role with a VPC endpoint.

367
MCQhard

A Lambda function using a Kinesis event source repeatedly retries one bad record and blocks progress in the shard. Which feature helps isolate failed records after retry limits?

A.Increase memory to 10 GB only
B.Disable batch processing
C.Configure failure handling with bisect batch on error and an on-failure destination where supported
D.Convert the stream to an S3 bucket
AnswerC

Configuring `ReportBatchItemFailures` (often referred to as "bisect batch on error" in the console) for a Kinesis event source allows the Lambda function to return a partial success, indicating which specific records within a batch failed. Lambda then automatically retries only the failed records, potentially splitting the batch further to isolate the problematic items. Combining this with an on-failure destination, such as an SQS queue or SNS topic, ensures that records that ultimately cannot be processed are sent to a dead-letter queue for analysis and manual intervention, preventing them from indefinitely blocking the stream processing.

Why this answer

Lambda's Kinesis event source mapping supports a 'bisect batch on error' feature that splits a failed batch into two smaller batches, allowing the bad record to be isolated and retried separately. Additionally, configuring an on-failure destination (e.g., an SQS queue or SNS topic) sends the record to a dead-letter destination after the retry limit is exhausted, preventing the shard from blocking progress.

Exam trap

The trap here is that candidates often think increasing memory or disabling batch processing will solve the blocking issue, but they fail to recognize that only explicit failure handling with bisect and a dead-letter destination can isolate and remove the bad record without manual intervention.

How to eliminate wrong answers

Option A is wrong because increasing memory to 10 GB only allocates more CPU and memory to the function, but does not address the root cause of a single bad record blocking the shard; it does not provide any mechanism to isolate or skip failed records. Option B is wrong because disabling batch processing (setting batch size to 1) would still cause the same blocking behavior—each record would be processed individually, but a persistent bad record would still be retried indefinitely, blocking the shard. Option D is wrong because converting the stream to an S3 bucket is not a direct replacement for Kinesis event processing; S3 does not support the same record-level retry and failure handling semantics, and this would require a complete architectural change, not a simple configuration fix.

368
MCQeasy

A developer is building a web application that requires user authentication. The application will run on Amazon EC2 instances behind an Application Load Balancer. The developer wants to offload authentication to a managed service that supports social login providers. Which AWS service should the developer use?

A.AWS Identity and Access Management (IAM)
B.Amazon Cognito
C.AWS Directory Service
D.AWS Single Sign-On
AnswerB

Amazon Cognito is the correct choice because it is specifically engineered to provide secure and scalable user directories for web and mobile applications. Cognito User Pools enable easy sign-up, sign-in, and access control for application users, supporting multi-factor authentication and integration with social identity providers like Google, Facebook, and Apple. It offloads the complexity of user management and authentication from your application backend.

Why this answer

Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications, providing user authentication, authorization, and support for social login providers (e.g., Google, Facebook, Amazon) via OAuth 2.0 and OpenID Connect. It offloads the entire authentication workflow from the EC2 instances and ALB, integrating seamlessly with the ALB's authentication action to validate tokens before traffic reaches the application.

Exam trap

The trap here is that candidates often confuse IAM's role-based access control with user authentication, overlooking that IAM cannot handle social login providers or external user identity federation for customer-facing apps.

How to eliminate wrong answers

Option A is wrong because AWS IAM is for managing AWS service access and permissions for users and roles, not for external user authentication with social login providers; it lacks built-in support for social identity federation. Option C is wrong because AWS Directory Service provides managed Microsoft Active Directory or LDAP-based directories for enterprise identity, which does not natively support social login providers like Google or Facebook. Option D is wrong because AWS Single Sign-On (now AWS IAM Identity Center) is designed for workforce identity and SSO across AWS accounts and business applications, not for customer-facing web app authentication with social logins.

369
MCQmedium

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group of EC2 instances. The developer wants to minimize the number of instances that are taken out of service at any given time during the deployment. Which predefined deployment configuration should the developer use?

A.AllAtOnce
B.OneAtATime
C.HalfAtATime
D.Custom with 50% at a time
AnswerB

The OneAtATime deployment configuration updates instances sequentially, taking only one instance out of service at any given moment while the remaining instances continue to serve traffic. This rolling update strategy ensures that the application maintains high availability throughout the deployment process, significantly minimizing the impact on end-users. It is the most effective method for ensuring continuous service and reducing downtime in an Auto Scaling environment.

Why this answer

The OneAtATime deployment configuration shifts traffic to one new instance at a time, ensuring that only a single instance is taken out of service during the deployment. This minimizes the number of instances removed from the Auto Scaling group at any given moment, which directly meets the developer's requirement to reduce service disruption.

Exam trap

The trap here is that candidates might think 'HalfAtATime' is not a predefined configuration, but AWS CodeDeploy does offer 'HalfAtATime' as a predefined option. However, 'HalfAtATime' takes half the instances out of service at once, which does not minimize the number. The correct choice to minimize instances taken out of service is 'OneAtATime'.

How to eliminate wrong answers

Option A (AllAtOnce) is wrong because it deploys to all instances simultaneously, taking the entire fleet out of service at once, which maximizes disruption. Option C (HalfAtATime) is wrong because it is not a predefined deployment configuration in AWS CodeDeploy; the correct predefined option for deploying to half the instances is 'HalfAtATime' but it would take 50% of instances out of service at a time, which is more than the single instance the developer wants. Option D (Custom with 50% at a time) is wrong because while custom configurations are possible, the developer specifically asked for a predefined configuration, and using a custom one would not be the simplest or most direct solution; moreover, deploying 50% at a time would still take more instances out of service than the desired minimum.

370
MCQhard

A company requires that all API calls to create an Amazon S3 bucket must include a specific tag (e.g., 'CostCenter'). Which IAM policy condition key should a developer use to enforce this requirement?

A.aws:RequestTag
B.aws:ResourceTag
C.s3:ExistingObjectTag
D.aws:TagKeys
AnswerA

This condition key checks tags that are included in the API request. You can require a specific tag key and value to be present on the CreateBucket request, ensuring that all buckets are tagged at creation.

Why this answer

The `aws:RequestTag` condition key evaluates the tags that are included in the API request itself. When a developer attempts to create an S3 bucket, the IAM policy can use `aws:RequestTag` to require that a specific tag key (e.g., 'CostCenter') is present in the `CreateBucket` request. This ensures that the tag is applied at creation time, enforcing the company's tagging requirement.

Exam trap

The trap here is that candidates confuse `aws:RequestTag` (tags in the request) with `aws:ResourceTag` (tags on an existing resource), leading them to choose the wrong condition key for enforcing tagging at resource creation.

How to eliminate wrong answers

Option B is wrong because `aws:ResourceTag` evaluates the tags already attached to an existing resource, not the tags in the creation request, so it cannot enforce tagging at bucket creation. Option C is wrong because `s3:ExistingObjectTag` is used to conditionally allow actions based on tags on existing objects within a bucket, not on the bucket creation request itself. Option D is wrong because `aws:TagKeys` is used to restrict which tag keys can be used in a request, but it does not require that a specific tag key be present; it only controls the allowed set of keys.

371
MCQhard

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

A.IAM authorizer
B.API key authorizer
C.JWT authorizer configured for the issuer and audience
D.S3 bucket policy
AnswerC

A JWT authorizer for an HTTP API validates JSON Web Tokens (JWTs) presented by clients, ensuring they are signed by a trusted issuer and intended for the specific API. By configuring the issuer (iss) and audience (aud) claims, the authorizer cryptographically verifies the token's authenticity and its intended recipient. This mechanism precisely controls access by allowing only requests with valid, unexpired tokens from a recognized identity provider, making it ideal for OAuth 2.0 and OpenID Connect flows.

Why this answer

An HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Exam trap

The trap here is that candidates confuse the JWT authorizer with the Lambda authorizer, thinking a custom Lambda is always required for OIDC, but the JWT authorizer natively supports OIDC without custom code when the provider issues standard JWTs.

How to eliminate wrong answers

Option A is wrong because an IAM authorizer uses AWS Signature Version 4 for signing requests with IAM credentials, not OIDC tokens, and is designed for AWS-authenticated principals, not external identity providers. Option B is wrong because an API key authorizer only validates a static key passed in the header, which provides no authentication of the user's identity and cannot verify OIDC tokens. Option D is wrong because an S3 bucket policy controls access to S3 resources, not API Gateway endpoints, and has no mechanism to validate OIDC tokens.

372
MCQmedium

A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?

A.Lambda authorizer
B.IAM authorizer
C.Amazon Cognito user pools authorizer
D.API Gateway resource policy
AnswerA

A Lambda authorizer, formerly known as a custom authorizer, is an AWS Lambda function that API Gateway invokes before forwarding the request to the backend integration. It receives the incoming custom JWT token, validates it against custom logic (e.g., verifying signature, issuer, audience, and expiration), and then returns an IAM policy document. This policy dictates whether the principal is authorized to access the requested API Gateway method, providing ultimate flexibility for any token type.

Why this answer

A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.

Exam trap

The trap here is that candidates often confuse a Lambda authorizer with a Cognito user pools authorizer, assuming any JWT can be validated by Cognito, but Cognito only accepts tokens it issued, not custom JWTs from other providers.

How to eliminate wrong answers

Option B is wrong because an IAM authorizer uses AWS Signature Version 4 to sign requests with IAM credentials, not a custom JWT; it cannot inspect or validate JWT claims like user roles. Option C is wrong because Amazon Cognito user pools authorizer only works with JWTs issued by a Cognito user pool, not with a custom JWT from an external identity provider or self-issued token. Option D is wrong because an API Gateway resource policy controls access at the account or VPC level based on source IP, VPC endpoint, or AWS account, not on individual request-level JWT claims or user roles.

373
MCQeasy

A developer needs to allow an IAM user to perform only specific actions on an S3 bucket. Which type of policy should be attached to the IAM user?

A.A service control policy
B.A bucket policy
C.A trust policy
D.An IAM policy
AnswerD

An IAM policy is a JSON document that explicitly defines permissions, specifying what actions are allowed or denied on which AWS resources, and under what conditions. These policies are directly attached to IAM identities such as users, groups, or roles, making them the fundamental mechanism for granting specific permissions to an IAM user. By attaching a tailored IAM policy to a user, a developer can precisely control and limit the actions that user is authorized to perform across AWS services.

Why this answer

An IAM policy (Option D) is the correct choice because it is an identity-based policy that can be directly attached to an IAM user, group, or role to grant or deny permissions for specific actions on AWS resources, including S3 buckets. This allows the developer to precisely control which S3 actions (e.g., s3:GetObject, s3:PutObject) the user can perform on a particular bucket, meeting the requirement of limiting the user to specific actions.

Exam trap

AWS often tests the distinction between identity-based policies (IAM policies) and resource-based policies (bucket policies), where candidates mistakenly choose a bucket policy thinking it can control user permissions directly, but bucket policies are tied to the resource, not the user identity.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) is used in AWS Organizations to set permission boundaries for all accounts in an organization, not to grant permissions to individual IAM users. Option B is wrong because a bucket policy is a resource-based policy attached directly to an S3 bucket, not to an IAM user; while it can grant cross-account access, it does not control permissions for a specific IAM user within the same account. Option C is wrong because a trust policy is attached to an IAM role to define which principals (e.g., users, services) can assume that role, not to grant direct permissions for S3 actions to an IAM user.

374
MCQmedium

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

A.DynamoDB Auto Scaling
B.DynamoDB Global Tables
C.DynamoDB Accelerator (DAX)
D.DynamoDB Time to Live (TTL)
AnswerC

DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache specifically designed for DynamoDB. It provides microsecond response times for read-heavy workloads by caching items and query results, significantly reducing the load on the underlying DynamoDB table. DAX acts as a transparent proxy, allowing applications to continue using the DynamoDB API while benefiting from accelerated read performance.

Why this answer

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Exam trap

The trap here is that candidates may confuse DAX with Global Tables, thinking that replicating data across regions reduces latency, but the question specifies reducing latency within a single region, where DAX's in-memory caching is the correct solution.

How to eliminate wrong answers

Option A is wrong because DynamoDB Auto Scaling adjusts provisioned throughput capacity based on traffic patterns, which helps manage cost and performance but does not reduce read latency. Option B is wrong because DynamoDB Global Tables provide multi-region replication for disaster recovery and low-latency reads across regions, but they do not improve read latency within a single region. Option D is wrong because DynamoDB Time to Live (TTL) automatically deletes expired items to manage storage costs, and has no impact on read performance or latency.

375
MCQeasy

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

A.An existing KMS key was rotated.
B.A new database encryption key was created.
C.A new KMS customer master key was created.
D.A new service-linked key was created.
AnswerC

This option is correct because the `CreateKey` API is the fundamental operation in AWS Key Management Service (KMS) used to provision a new Customer Master Key (CMK). A CMK is the primary resource you manage in KMS for cryptographic operations. Therefore, a CloudTrail lookup showing a `CreateKey` event precisely indicates that a new, unique KMS customer master key has been successfully generated and made available within the AWS account.

Why this answer

The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Exam trap

The trap here is that candidates assume `CreateKey` only applies to CMKs, but AWS services also use this API for service-linked keys; however, the exam expects you to recognize that the event name is generic and the context (e.g., `userIdentity` or `requestParameters`) determines the key type.

How to eliminate wrong answers

Option A is wrong because key rotation is performed via the `RotateKey` API or automatic rotation settings, not `CreateKey`. Option B is wrong because database encryption keys are typically managed by the database service (e.g., RDS, DynamoDB) using KMS grants or direct CMK usage, not a standalone `CreateKey` event. Option D is wrong because service-linked keys are created by AWS services on your behalf using a different API call (e.g., `CreateKey` with a service principal), but the event name is still `CreateKey`; however, the question's context implies a standard CMK creation, and service-linked keys are a specific subset that would be logged with a different `requestParameters` (e.g., `KeyUsage` and `Origin`).

Page 4

Page 5 of 10

Page 6

All pages