cad5

Question 1

An application uses Amazon EC2, and Application Load Balancer and Amazon CloudFront to serve content. The security team
have reported malicious activity from a specific range of IP addresses.
How can a Developer prevent the application from being targeted by these addresses again?

Accepted Answer

Add a rule to a Web ACL using AWS WAF that denies the IP address ranges

Answer

Create a security group rule denying the address range and apply it to the EC2 instances

Answer

Add a certificate using AWS Certificate Manager (ACM) and encrypt all communications

Answer

Disable the Amazon CloudFront distribution and then reenable it

Question 2

A developer is making some updates to an AWS Lambda function that is part of a serverless application and will be saving a new
version. The application is used by hundreds of users and the developer needs to be able to test the updates and be able to
rollback if there any issues with user experience.
What is the SAFEST way to do this with minimal changes to the application code?

Accepted Answer

Create an alias and point it to the new and previous versions. Assign a weight of 20% to the new version to direct less
traffic. Update the application code to point to the new alias

Answer

Create an alias and point it to the new version. Update the application code to point to the new alias

Answer

Update the application code to point to the new version

Answer

Create A records in Route 53 for each function version’s ARN. Use a weighted routing policy to direct 20% of traffic to
the new version. Add the DNS records to the application code

Question 3

A developer is creating a new application that will store data in a DynamoDB table. Which APIs can be used to read, write and
modify individual items in the table?

Accepted Answer

GetItem, PutItem, UpdateItem

Answer

GetItem, TransactWriteItems, UpdateTable

Answer

GetItem, PutItem, DeleteItem

Answer

BatchGetItem, BatchWriteItem, UpdateItem

Question 4

An application running on Amazon EC2 is experiencing intermittent technical difficulties. The developer needs to find a solution
for tracking the errors that occur in the application logs and setting up a notification when the error rate exceeds a certain
threshold.
How can this be achieved with the LEAST complexity?

Accepted Answer

Use CloudWatch Logs to track the number of errors that occur in the application logs and send an SNS notification

Answer

Use CloudTrail to monitor the application log files and send an SNS notification

Answer

Configure the application to send logs to Amazon S3. Use Amazon Kinesis Analytics to analyze the log files and send
an SES notification

Answer

Configure Amazon CloudWatch Events to monitor the EC2 instances and configure an SNS topic as a target

Question 5

A website consisting of HTML, images, and client-side JavaScript is being hosted on Amazon S3. The website will be used
globally, what’s the best way to MINIMIZE latency for global users?

Accepted Answer

Create a CloudFront distribution and configure the S3 website as an origin

Answer

Host the website from multiple buckets around the world and use Route 53 geolocation-based routing

Answer

Enable S3 transfer acceleration

Answer

Create an ElastiCache cluster and configure the S3 website as an origin

Question 6

A team of developers need to be able to collaborate and synchronize multiple distributed code repositories and leverage a preconfigured
continuous delivery toolchain for deploying their projects on AWS. The team also require a centralized project
dashboard to monitor application activity.Which AWS service should they use?

Accepted Answer

AWS CodeStar

Answer

AWS CodePipeline

Answer

AWS Cloud9

Answer

AWS CodeCommit

Question 7

A developer has created a YAML template file that includes the following header: 'AWS::Serverless-2016-10-31'. Which
commands should the developer use to deploy the application?

Accepted Answer

sam package and sam deploy

Answer

sam package and sam build

Answer

aws cloudformation create-stack-set

Answer

aws cloudformation package and aws cloudformation create-stack

Question 8

An application uses multiple Lambda functions to write data to an Amazon RDS database. The Lambda functions must share the
same connection string. What is the BEST solution to ensure security and operational efficiency?

Accepted Answer

Create a secure string parameter using AWS systems manager parameter store

Answer

Use KMS encrypted environment variables within each Lambda function

Answer

Use a CloudHSM encrypted environment variable that is shared between the functions

Answer

Embed the connection string within the Lambda function code

Question 9

A company has several AWS accounts used by different departments. Developers use the same CloudFormation template to
deploy an application across accounts. What can the developers use to deploy and manage the application with the LEAST
operational effort?

Accepted Answer

Create a CloudFormation Stack in an administrator account and use StackSets to update the stacks across multiple
accounts

Answer

Create a CloudFormation Stack in an administrator account and use CloudFormation Change Sets to modify stacks
across multiple accounts

Answer

Migrate the application into an Elastic Beanstalk environment that is shared between multiple accounts

Answer

Synchronize the applications in multiple accounts using AWS AppSync

Question 10

A company uses an Amazon EC2 web application with Amazon CloudFront to distribute content to its customers globally. The
company requires that all traffic is encrypted between the customers and CloudFront, and CloudFront and the web application.
What steps need to be taken to enforce this encryption? (Select TWO.)

Accepted Answer

Set the Origin Protocol Policy to “HTTPS Only”

Accepted Answer

Set the Viewer Protocol Policy to “HTTPS Only” or “Redirect HTTP to HTTPS”

Answer

Enable Field Level Encryption

Answer

Change the HTTP port to 443 in the Origin Settings

Answer

Use AWS KMS to enforce encryption

Question 11

A developer has a user account in the Development AWS account. He has been asked to modify resources in a Production AWS
account. What is the MOST secure way to provide temporary access to the developer?

Accepted Answer

Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials

Answer

Generate an access key on the second account using the root account and share the access keys with the developer
for API access

Answer

Add the user to a group in the second account that has a role attached granting the necessary permissions

Answer

Use AWS KMS to generate cross-account customer master keys and use those get short-lived credentials

Question 12

An application scans an Amazon DynamoDB table once per day to produce a report. The scan is performed in non-peak hours
when production usage uses around 50% of the provisioned throughput.
How can you MINIMIZE the time it takes to produce the report without affecting production workloads? (Select TWO.)

Accepted Answer

Use a Parallel Scan API operation

Accepted Answer

Use the Limit parameter

Answer

Use a Sequential Scan API operation

Answer

Increase read capacity units during the scan operation

Answer

Use pagination to divide results into 1 MB pages

Question 13

A Developer is creating a banking application that will be used to view financial transactions and statistics. The application
requires multi-factor authentication to be added to the login protocol.
Which service should be used to meet this requirement?

Accepted Answer

Amazon Cognito User Pool with MFA

Answer

AWS IAM with MFA

Answer

AWS Directory Service

Answer

Amazon Cognito Identity Pool with MFA

Question 14

An application is running on a fleet of EC2 instances running behind an Elastic Load Balancer (ELB). The EC2 instances session
data in a shared Amazon S3 bucket. Security policy mandates that data must be encrypted in transit.
How can the Developer ensure that all data that is sent to the S3 bucket is encrypted in transit?

Accepted Answer

Create an S3 bucket policy that denies traffic where SecureTransport is false

Answer

Create an S3 bucket policy that denies any S3 Put request that does not include the x-amz-server-side-encryption

Answer

Configure HTTP to HTTPS redirection on the Elastic Load Balancer

Answer

Create an S3 bucket policy that denies traffic where SecureTransport is true

Question 15

A gaming application displays the results of games in a leaderboard. The leaderboard is updated by 4 KB messages that are
retrieved from an Amazon SQS queue. The updates are received infrequently but the Developer needs to minimize the time
between the messages arriving in the queue and the leaderboard being updated.
Which technique provides the shortest delay in updating the leaderboard?

Accepted Answer

Retrieve the messages from the queue using long polling every 15 seconds

Answer

Reduce the size of the messages with compression before sending them

Answer

Store the message payload in Amazon S3 and use the SQS Extended Client Library for Java

Answer

Retrieve the messages from the queue using short polling every 10 seconds

Question 16

A developer is creating a serverless application that will use a DynamoDB table. The average item size is 9KB. The application will make 4 strongly consistent reads/sec, and 2 standard write/sec. How many RCUs/WCUs are required?

Accepted Answer

12 RCU and 18 WCU

Answer

24 RCU and 18 WCU

Answer

12 RCU and 36 WCU

Answer

6 RCU and 18 WCU

Question 17

A monitoring application that keeps track of a large eCommerce website uses Amazon Kinesis for data ingestion. During periods
of peak data rates, the Kinesis stream cannot keep up with the incoming data.
What step will allow Kinesis data streams to accommodate the traffic during peak hours?

Accepted Answer

Increase the shard count of the stream using UpdateShardCount

Answer

Install the Kinesis Producer Library (KPL) for ingesting data into the stream

Answer

Create an SQS queue and decouple the producers from the Kinesis data stream

Answer

Ingest multiple records into the stream in a single call using PutRecords

Question 18

A Developer has created a serverless function that processes log files. The function should be invoked once every 15 minutes.
How can the Developer automatically invoke the function using serverless services?

Accepted Answer

Create an Amazon CloudWatch Events rule that is scheduled to run and invoke the function

Answer

Launch an EC2 Linux instance and add a command to periodically invoke the function to its /etc/crontab file

Answer

Configure the Lambda scheduler to run based on recurring time value

Answer

Create an Amazon SNS rule to send a notification to Lambda to instruct it to run

Question 19

A Developer wants to find a list of items in a global secondary index from an Amazon DynamoDB table.Which DynamoDB API call can the Developer use in order to consume the LEAST number of read capacity units?

Accepted Answer

Query operation using eventually-consistent reads

Answer

Scan operation using eventually-consistent reads

Answer

Query operation using strongly-consistent reads

Answer

Scan operation using strongly-consistent reads

Question 20

A company provides a large number of services on AWS to customers. The customers connect to one or more services directly
and the architecture is becoming complex. How can the architecture be refactored to provide a single interface for the
services?

Accepted Answer

Amazon API Gateway

Answer

AWS X-Ray

Answer

AWS Cognito

Answer

AWS Single Sign On (SSO)

Question 21

An application writes items to an Amazon DynamoDB table. As the application scales to thousands of instances, calls to the
DynamoDB API generate occasional ThrottlingException errors. The application is coded in a language that is incompatible with
the AWS SDK.
What can be done to prevent the errors from occurring?

Accepted Answer

Add exponential backoff to the application logic

Answer

Use Amazon SQS as an API message bus

Answer

Pass API calls through Amazon API Gateway

Answer

Send the items to DynamoDB through Amazon Kinesis Data Firehose

Question 22

A Developer has created an AWS Lambda function in a new AWS account. The function is expected to be invoked 40 times per
second and the execution duration will be around 100 seconds. What MUST the Developer do to ensure there are no errors?

Accepted Answer

Contact AWS Support to increase the concurrent execution limits

Answer

Implement error handling within the function code

Answer

Implement a Dead Letter Queue to capture invocation errors

Answer

Implement tracing with X-Ray

Question 23

You run an ad-supported photo sharing website using Amazon S3 to serve photos to visitors of your site. At some point you find
out that other sites have been linking to the photos on your site, causing loss to your business.
What is an effective method to mitigate this?

Accepted Answer

Remove public read access and use signed URLs with expiry dates

Answer

Store photos on an EBS volume of the web server

Answer

Use CloudFront distributions for static content

Answer

Block the IPs of the offending websites in Security Groups

Question 24

A company manages an application that stores data in an Amazon DynamoDB table. The company need to keep a record of all
new changes made to the DynamoDB table in another table within the same AWS region. What is the MOST suitable way to
deliver this requirement?

Accepted Answer

Use Amazon DynamoDB streams

Answer

Use CloudWatch events

Answer

Use Amazon CloudTrail

Answer

Use Amazon DynamoDB snapshots

Question 25

An IT automation architecture uses many AWS Lambda functions invoking one another as a large state machine. The
coordination of this state machine is legacy custom code that breaks easily.
Which AWS Service can help refactor and manage the state machine?

Accepted Answer

AWS Step Functions

Answer

AWS CodePipeline

Answer

AWS CodeBuild

Answer

AWS CloudFormation

Question 26

A Developer is deploying an Amazon ECS update using AWS CodeDeploy. In the appspec.yaml file, which of the following is a
valid structure for the order of hooks that should be specified?

Accepted Answer

BeforeInstall > AfterInstall > AfterAllowTestTraffic > BeforeAllowTraffic > AfterAllowTraffic

Answer

BeforeInstall > AfterInstall > ApplicationStart > ValidateService

Answer

BeforeAllowTraffic > AfterAllowTraffic

Answer

BeforeBlockTraffic > AfterBlockTraffic > BeforeAllowTraffic > AfterAllowTraffic

Question 27

A Developer has setup an Amazon Kinesis Data Stream with 6 shards to ingest a maximum of 2000 records per second. An AWS
Lambda function has been configured to process these records. In which order will these records be processed?

Accepted Answer

Lambda will receive each record in the exact order it was placed into the shard. There is no guarantee of order across
shards

Answer

Lambda will receive each record in the reverse order it was placed into the stream

Answer

Lambda will receive each record in the exact order it was placed into the stream

Answer

The Developer can select exact order or reverse order using the GetRecords API

Question 28

A Developer created an AWS Lambda function for a serverless application. The Lambda function has been executing for several
minutes and the Developer cannot find any log data in CloudWatch Logs.
What is the MOST likely explanation for this issue?

Accepted Answer

The execution role for the Lambda function is missing permissions to write log data to the CloudWatch Logs

Answer

The Lambda function does not have any explicit log statements for the log data to send it to CloudWatch Logs

Answer

The Lambda function is missing CloudWatch Logs as a source trigger to send log data

Answer

The Lambda function is missing a target CloudWatch Logs group

Question 29

A Developer is looking for a way to use shorthand syntax to express functions, APIs, databases, and event source mappings. The
Developer will test using AWS SAM to create a simple Lambda function using Nodejs.12x.
What is the SIMPLEST way for the Developer to get started with a Hello World Lambda function?

Accepted Answer

Install the AWS SAM CLI, run sam init and use one of the AWS Quick Start Templates

Answer

Install the AWS CLI, run aws sam init and use one of the AWS Quick Start Templates

Answer

Use the AWS Management Console to access AWS SAM and deploy a Hello World function

Answer

Use AWS CloudFormation to deploy a Hello World stack using AWS SAM

Question 30

An Amazon Kinesis Data Stream has recently been configured to receive data from sensors in a manufacturing facility. A
consumer EC2 instance is configured to process the data every 48 hours and save processing results to an Amazon RedShift data warehouse. Testing has identified a large amount of data is missing. A review of monitoring logs has identified that the
sensors are sending data correctly and the EC2 instance is healthy.
What is the MOST likely explanation for this issue?

Accepted Answer

Records are retained for 24 hours in the Kinesis Data Stream by default

Answer

Amazon RedShift is not suitable for storing streaming data

Answer

The EC2 instance is failing intermittently

Answer

Amazon Kinesis has too many shards provisioned

Question 31

A Developer is managing an application that includes an Amazon SQS queue. The consumers that process the data from the
queue are connecting in short cycles and the queue often does not return messages. The cost for API calls is increasing. How
can the Developer optimize the retrieval of messages and reduce cost?

Accepted Answer

Call the ReceiveMessage API with the WaitTimeSeconds parameter set to 20

Answer

Call the ReceiveMessage API with the VisibilityTimeout parameter set to 30

Answer

Call the SetQueueAttributes API with the DelaySeconds parameter set to 900

Answer

Call the SetQueueAttributes API with the maxReceiveCount set to 20

Question 32

A company currently runs a number of legacy automated batch processes for system update management and operational
activities. The company are looking to refactor these processes and require a service that can coordinate multiple AWS services
into serverless workflows.
What is the MOST suitable service for this requirement?

Accepted Answer

AWS Step Functions

Answer

Amazon SWF

Answer

AWS Batch

Answer

AWS Lambda

Question 33

A Development team have moved their continuous integration and delivery (CI/CD) pipeline into the AWS Cloud. The team is
leveraging AWS CodeCommit for management of source code. The team need to compile their source code, run tests, and
produce software packages that are ready for deployment.
Which AWS service can deliver these outcomes?

Accepted Answer

AWS CodeBuild

Answer

AWS CodePipeline

Answer

AWS CodeCommit

Answer

AWS Cloud9

Question 34

Every time an Amazon EC2 instance is launched, certain metadata about the instance should be recorded in an Amazon
DynamoDB table. The data is gathered and written to the table by an AWS Lambda function.
What is the MOST efficient method of invoking the Lambda function?

Accepted Answer

Create a CloudWatch Event with an event pattern looking for EC2 state changes and a target set to use the Lambda
function

Answer

Create a CloudWatch alarm that triggers the Lambda function based on log streams indicating an EC2 state change in
CloudWatch logs

Answer

Create a CloudTrail trail alarm that triggers the Lambda function based on the RunInstances API action

Answer

Configure detailed monitoring on Amazon EC2 and create an alarm that triggers the Lambda function in initialization

Question 35

A Developer is migrating Docker containers to Amazon ECS. A large number of containers will be deployed across some newly
deployed ECS containers instances using the same instance type. High availability is provided within the microservices
architecture. Which task placement strategy requires the LEAST configuration for this scenario?

Accepted Answer

random

Answer

binpack

Answer

spread

Answer

Fargate

Question 36

A Developer has noticed some suspicious activity in her AWS account and is concerned that the access keys associated with her
IAM user account may have been compromised. What is the first thing the Developer do in should do in this situation?

Accepted Answer

Delete the compromised access keys

Answer

Delete her IAM user account

Answer

Report the incident to AWS Support

Answer

Change her IAM User account password

Question 37

A Developer needs to setup a new serverless application that includes AWS Lambda and Amazon API Gateway as part of a
single stack. The Developer needs to be able to locally build and test the serverless applications before deployment on AWS.
Which service should the Developer use?

Accepted Answer

AWS Serverless Application Model (SAM)

Answer

AWS CloudFormation

Answer

AWS Elastic Beanstalk

Answer

AWS CodeBuild

Question 38

An application needs to read up to 100 items at a time from an Amazon DynamoDB. Each item is up to 100 KB in size and all
attributes must be retrieved.
What is the BEST way to minimize latency?

Accepted Answer

Use BatchGetItem

Answer

Use GetItem and use a projection expression

Answer

Use a Scan operation with pagination

Answer

Use a Query operation with a FilterExpression

Question 39

A Developer manages a website running behind an Elastic Load Balancer in the us-east-1 region. The Developer has recently
deployed an identical copy of the website in us-west-1 and needs to send 20% of the traffic to the new site.
How can the Developer achieve this requirement?

Accepted Answer

Use an Amazon Route 53 Weighted Routing Policy

Answer

Use an Amazon Route 53 Geolocation Routing Policy

Answer

Use a blue/green deployment with Amazon Elastic Beanstalk

Answer

Use a blue/green deployment with Amazon CodeDeploy

Question 40

A Development team are deploying an AWS Lambda function that will be used by a production application. The function code
will be updated regularly, and new versions will be published. The development team do not want to modify application code
to point to each new version.
How can the Development team setup a static ARN that will point to the latest published version?

Accepted Answer

Setup an Alias that will point to the latest version

Answer

Publish a mutable version and point it to the $LATEST version

Answer

Use an unqualified ARN

Answer

Setup a Route 53 Alias record that points to the published version

Question 41

An application is being instrumented to send trace data using AWS X-Ray. A Developer needs to upload segment documents
using JSON-formatted strings to X-Ray using the API. Which API action should the developer use?

Accepted Answer

The PutTraceSegments API action

Answer

The PutTelemetryRecords API action

Answer

The UpdateGroup API action

Answer

The GetTraceSummaries API action

Question 42

A three-tier application is being migrated from an on-premises data center. The application includes an Apache Tomcat web
tier, an application tier running on Linux, and a MySQL back end. A Developer must refactor the application to run on the AWS
cloud. The cloud-based application must be fault tolerant and elastic.
How can the Developer refactor the web tier and application tier? (Select TWO.)

Accepted Answer

Create an Auto Scaling group of EC2 instances for both the web tier and application tier

Accepted Answer

Implement an Elastic Load Balancer for both the web tier and the application tier

Answer

Create an Amazon CloudFront distribution for the web tier

Answer

Use a multi-AZ Amazon RDS database for the back end using the MySQL engine

Answer

Implement an Elastic Load Balancer for the application tier

Question 43

A Developer has joined a team and needs to connect to the AWS CodeCommit repository using SSH. What should the Developer
do to configure access using Git?

Accepted Answer

Generate an SSH public and private key. Upload the public key to the Developer’s IAM account

Answer

On the Developer’s IAM account, under security credentials, choose to create HTTPS Git credentials for AWS
CodeCommit

Answer

On the Developer’s IAM account, under security credentials, choose to create an access key and secret ID

Answer

Create an account on Github and user those login credentials to login to AWS CodeCommit

Question 44

A large quantity of sensitive data must be encrypted. A Developer will use a custom CMK to generate the encryption key. The
key policy currently looks like this:
What API action must be added to the key policy?

Accepted Answer

kms:GenerateDataKey

Answer

kms:EnableKey

Answer

kms:CreateKey

Answer

kms:GetKeyPolicy

Question 45

A Developer needs to access AWS CodeCommit over SSH. The SSH keys configured to access AWS CodeCommit are tied to a
user with the following permissions:
{
"version": "2012-10-17"
"Statement": [
{
"Effect": "Allow",
"Action": [
"codecommit:BatchGetRepositories",
"codecommit:Get*"
"codecommit:List*",
"codecommit:GitPull"
],
"Resource": "*"
}
]
}
The Developer needs to create/delete branches.
Which specific IAM permissions need to be added based on the principle of least privilege?

Accepted Answer

“codecommit:CreateBranch” and “codecommit:DeleteBranch”

Answer

“codecommit:Put*:”

Answer

“codecommit:Update*”

Answer

“codecommit:*”

Question 46

An application uses Amazon Kinesis Data Streams to ingest and process large streams of data records in real time. Amazon EC2
instances consume and process the data using the Amazon Kinesis Client Library (KCL). The application handles the failure
scenarios and does not require standby workers. The application reports that a specific shard is receiving more data than
expected. To adapt to the changes in the rate of data flow, the “hot” shard is resharded.
Assuming that the initial number of shards in the Kinesis data stream is 6, and after resharding the number of shards increased
to 8, what is the maximum number of EC2 instances that can be deployed to process data from all the shards?

Accepted Answer

8

Answer

12

Answer

6

Answer

1

Question 47

What does an Amazon SQS delay queue accomplish?

Accepted Answer

Messages are hidden for a configurable amount of time when they are first added to the queue

Answer

Messages are hidden for a configurable amount of time after they are consumed from the queue

Answer

The consumer can poll the queue for a configurable amount of time before retrieving a message

Answer

Message cannot be deleted for a configurable amount of time after they are consumed from the queue

Question 48

An organization needs to add encryption in-transit to an existing website running behind an Elastic Load Balancer. The website’s
Amazon EC2 instances are CPU-constrained and therefore load on their CPUs should not be increased. What should be done to
secure the website? (Select TWO.)

Accepted Answer

Configure SSL certificates on an Elastic Load Balancer

Accepted Answer

Configure an Elastic Load Balancer with SSL termination

Answer

Configure an Elastic Load Balancer with SSL pass-through

Answer

Configure an Elastic Load Balancer with a KMS CMK

Answer

Install SSL certificates on the EC2 instances

Question 49

A company is running a Docker application on Amazon ECS. The application must scale based on user load in the last 15
seconds.
How should the Developer instrument the code so that the requirement can be met?

Accepted Answer

Create a high-resolution custom Amazon CloudWatch metric for user activity data, then publish data every 5 seconds

Answer

Create a high-resolution custom Amazon CloudWatch metric for user activity data, then publish data every 30
seconds

Answer

Create a standard-resolution custom Amazon CloudWatch metric for user activity data, then publish data every 30
seconds

Answer

Create a standard-resolution custom Amazon CloudWatch metric for user activity data, then publish data every 5
seconds

Question 50

A company needs a fully-managed source control service that will work in AWS. The service must ensure that revision control
synchronizes multiple distributed repositories by exchanging sets of changes peer-to-peer. All users need to work productively
even when not connected to a network.
Which source control service should be used?

Accepted Answer

AWS CodeCommit

Answer

Subversion

Answer

AWS CodeBuild

Answer

AWS CodeStar

Question 51

A Developer needs to return a list of items in a global secondary index from an Amazon DynamoDB table.
Which DynamoDB API call can the Developer use in order to consume the LEAST number of read capacity units?

Accepted Answer

Query operation using eventually-consistent reads

Answer

Scan operation using eventually-consistent reads

Answer

Query operation using strongly-consistent reads

Answer

Scan operation using strongly-consistent reads

Question 52

A Developer is writing an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The Developer
must write the function so that it sends a notice to Administrators if it fails to process a batch of records.
How should the Developer write the function?

Accepted Answer

Configure an Amazon SNS topic as an on-failure destination

Answer

Separate the Lambda handler from the core logic

Answer

Use Amazon CloudWatch Events to send the processed data

Answer

Push the failed records to an Amazon SQS queue

Question 53

An application is running on a cluster of Amazon EC2 instances. The application has received an error when trying to read
objects stored within an Amazon S3 bucket. The bucket is encrypted with server-side encryption and AWS KMS managed keys
(SSE-KMS). The error is as follows:
Service: AWSKMS; Status Code: 400, Error Code: ThrottlingException
Which combination of steps should be taken to prevent this failure? (Select TWO.)

Accepted Answer

Contact AWS support to request an AWS KMS rate limit increase

Accepted Answer

Perform error retries with exponential backoff in the application code

Answer

Contact AWS support to request an S3 rate limit increase

Answer

Import a customer master key (CMK) with a larger key size

Answer

Use more than once customer master key (CMK) to encrypt S3 data

Question 54

A Developer is creating an AWS Lambda function that generates a new file each time it runs. Each new file must be checked into
an AWS CodeCommit repository hosted in the same AWS account.How should the Developer accomplish this?

Accepted Answer

Use an AWS SDK to instantiate a CodeCommit client. Invoke the put_file method to add the file to the repository

Answer

When the Lambda function starts, use the Git CLI to clone the repository. Check the new file into the cloned
repository and push the change

Answer

After the new file is created in Lambda, use cURL to invoke the CodeCommit API. Send the file to the repository

Answer

Upload the new file to an Amazon S3 bucket. Create an AWS Step Function to accept S3 events. In the Step Function,
add the new file to the repository

Question 55

A Developer needs to run some code using Lambda in response to an event and forward the execution result to another
application using a pub/sub notification.
How can the Developer accomplish this?

Accepted Answer

Configure a Lambda “on success” destination and route the execution results to Amazon SNS

Answer

Configure a CloudWatch Events alarm the triggers based on Lambda execution success and route the execution
results to Amazon SNS

Answer

Configure a Lambda “on success” destination and route the execution results to Amazon SQS

Answer

Configure a CloudWatch Events alarm the triggers based on Lambda execution success and route the execution
results to Amazon SQS

Question 56

An application runs on Amazon EC2 and generates log files. A Developer needs to centralize the log files so they can be queried
and retained. What is the EASIEST way for the Developer to centralize the log files?

Accepted Answer

Install the Amazon CloudWatch Logs agent and collect the logs from the instances

Answer

Create a script that copies the log files to Amazon S3 and use a cron job to run the script on a recurring schedule

Answer

Create a script that uses the AWS SDK to collect and send the log files to Amazon CloudWatch Logs

Answer

Setup a CloudWatch Events rule to trigger an SNS topic when an application log file is generated

Question 57

A company needs to encrypt a large quantity of data. The data encryption keys must be generated from a dedicated, tamperresistant
hardware device.
To deliver these requirements, which AWS service should the company use?

Accepted Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Certificate Manager

Answer

AWS IAM

Question 58

A Developer needs to restrict all users and roles from using a list of API actions within a member account in AWS Organizations.
The Developer needs to deny access to a few specific API actions.
What is the MOST efficient way to do this?

Accepted Answer

Create a deny list and specify the API actions to deny

Answer

Create an allow list and specify the API actions to deny

Answer

Create an IAM policy that denies the API actions for all users and roles

Answer

Create an IAM policy that allows only the unrestricted API actions

Question 59

A development team require a fully-managed source control service that is compatible with Git.
Which service should they use?

Accepted Answer

AWS CodeCommit

Answer

AWS CodeDeploy

Answer

AWS Cloud9

Answer

AWS CodePipeline

Question 60

How can a Developer view a summary of proposed changes to an AWS CloudFormation stack without implementing the
changes in production?

Accepted Answer

Create a Change Set

Answer

Create a StackSet

Answer

Use drift detection

Answer

Use a direct update

Question 61

Based on the following AWS CLI command the resulting output, what has happened here?
$ aws lambda invoke --function-name MyFunction --payload
ewogICJrZXkxIjogInZhbHVlMSIsCiAgImtleTIiOiAidmFsdWUyIiwKICAia2V5MyI6ICJ2YWx1ZTMiCn0= response.json
{
"StatusCode": 200
}

Accepted Answer

An AWS Lambda function has been invoked synchronously and has completed successfully

Answer

An AWS Lambda function has been invoked synchronously and has not completed successfully

Answer

An AWS Lambda function has been invoked asynchronously and has completed successfully

Answer

An AWS Lambda function has been invoked asynchronously and has not completed successfully

Question 62

A Developer must run a shell script on Amazon EC2 Linux instances each time they are launched by an Amazon EC2 Auto Scaling
group. What is the SIMPLEST way to run the script?

Accepted Answer

Add the script to the user data when creating the launch configuration

Answer

Configure Amazon CloudWatch Events to trigger the AWS CLI when an instance is launched and run the script

Answer

Package the script in a zip file with some AWS Lambda source code. Upload to Lambda and run the function when
instances are launched

Answer

Run the script using the AWS Systems Manager Run Command

Question 63

A Developer has created a task definition that includes the following JSON code:
"placementConstraints": [
{
"expression": "task:group == databases",
"type": "memberOf"
}
]
What will be the effect for tasks using this task definition?

Accepted Answer

They will be placed on container instances in the “databases” task group

Answer

They will become members of a task group called “databases”

Answer

They will not be placed on container instances in the “databases” task group

Answer

They will not be allowed to run unless they have the “databases” tag assigned

Question 64

Data must be loaded into an application each week for analysis. The data is uploaded to an Amazon S3 bucket from several
offices around the world. Latency is slowing the uploads and delaying the analytics job. What is the SIMPLEST way to improve
upload times?

Accepted Answer

Upload using Amazon S3 Transfer Acceleration

Answer

Upload to a local Amazon S3 bucket within each region and enable Cross-Region Replication (CRR)

Answer

Upload via a managed AWS VPN connection

Answer

Upload to Amazon CloudFront and then download from the local cache to the S3 bucket

cad5

Crie uma conta grátis para terminar este quiz

Perguntas do quiz (65)

Informações

Fale Conosco

O que você acha do novo visual?