Quiz
AWS_301~
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (131)
1Which of the following platforms are supported by Elastic Beanstalk? (Choose two.)
- AA. Apache Tomcat
- BB. .NET
- CC. IBM Websphere
- DD. Oracle JBoss
- EE. Jetty
2 Question #95 Topic 2
Which code snippet below returns the URL of a load balanced web site created in CloudFormation with an AWS::ElasticLoadBalancing::LoadBalancer resource name "ElasticLoad Balancer"?- AA. "Fn::Join" : ["". [ "http://", {"Fn::GetAtr" : [ "ElasticLoadBalancer","DNSName"]}]]
- BB. "Fn::Join" : ["". [ "http://", {"Fn::GetAtr" : [ "ElasticLoadBalancer","Url"]}]]
- CC. "Fn::Join" : ["". [ "http://", {"Ref" : "ElasticLoadBalancerUrl"}]]
- DD. "Fn::Join" : [".", [ "http://", {"Ref" : "ElasticLoadBalancerDNSName"}]]
3Which features can be used to restrict access to data in S3? (Choose two.)
- AA. Use S3 Virtual Hosting
- BB. Set an S3 Bucket policy.
- CC. Enable IAM Identity Federation.
- DD. Set an S3 ACL on the bucket or the object.
- EE. Create a CloudFront distribution for the bucket
4What happens, by default, when one of the resources in a CloudFormation stack cannot be created?
- AA. Previously-created resources are kept but the stack creation terminates.
- BB. Previously-created resources are deleted and the stack creation terminates.
- CC. The stack creation continues, and the final results indicate which steps failed.
- DD. CloudFormation templates are parsed in advance so stack creation is guaranteed to succeed.
5Which of the following are correct statements with policy evaluation logic in AWS Identity and Access Management? (Choose two.)
- AA. By default, all requests are denied
- BB. An explicit allow overrides an explicit deny
- CC. An explicit allow overrides default deny.
- DD. An explicit deny does not override an explicit allow
- EE. By default, all request are allowed
6You have an environment that consists of a public subnet using Amazon VPC and 3 instances that are running in this subnet. These three instances can successfully communicate with other hosts on the Internet. You launch a fourth instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the Internet.
What should you do to enable internet access?- AA. Deploy a NAT instance into the public subnet.
- BB. Modify the routing table for the public subnet
- CC. Configure a publically routable IP Address In the host OS of the fourth instance.
- DD. Assign an Elastic IP address to the fourth instance.
7If a message is retrieved from a queue in Amazon SQS, how long is the message inaccessible to other users by default?
- AA. 0 seconds
- BB. 1 hour
- CC. 1 day
- DD. forever
- EE. 30 seconds
8What is the format of structured notification messages sent by Amazon SNS?
- AA. An XML object containing MessageId, UnsubscribeURL, Subject, Message and other values
- BB. An JSON object containing MessageId, DuplicateFlag, Message and other values
- CC. An XML object containing MessageId, DuplicateFlag, Message and other values
- DD. An JSON object containing MessageId, unsubscribeURL, Subject, Message and other values
9Which of the following services are key/value stores? (Choose three.)
- AA. Amazon ElastiCache
- BB. Simple Notification Service
- CC. DynamoDB
- DD. Simple Workflow Service
- EE. Simple Storage Service
10When uploading an object, what request header can be explicitly specified in a request to Amazon S3 to encrypt object data when saved on the server side?
- AA. x-amz-storage-class
- BB. Content-MD5
- CC. x-amz-security-token
- DD. x-amz-server-side-encryption
11What item operation allows the retrieval of multiple items from a DynamoDB table in a single API call?
- AA. GetItem
- BB. BatchGetItem
- CC. GetMultipleItems
- DD. GetItemRange
12After launching an instance that you intend to serve as a NAT (Network Address Translation) device in a public subnet you modify your route tables to have the
NAT device be the target of internet bound traffic of your private subnet. When you try and make an outbound connection to the Internet from an instance in the private subnet, you are not successful.
Which of the following steps could resolve the issue?- AA. Attaching a second Elastic Network interface (ENI) to the NAT instance, and placing it in the private subnet
- BB. Attaching a second Elastic Network Interface (ENI) to the instance in the private subnet, and placing it in the public subnet
- CC. Disabling the Source/Destination Check attribute on the NAT instance
- DD. Attaching an Elastic IP address to the instance in the private subnet
13You attempt to store an object in the US-STANDARD region in Amazon S3, and receive a confirmation that it has been successfully stored. You then immediately make another API call and attempt to read this object. S3 tells you that the object does not exist.
What could explain this behavior?- AA. US-STANDARD uses eventual consistency and it can take time for an object to be readable in a bucket
- BB. Objects in Amazon S3 do not become visible until they are replicated to a second region.
- CC. US-STANDARD imposes a 1 second delay before new objects are readable.
- DD. You exceeded the bucket object limit, and once this limit is raised the object will be visible.
14What is the maximum number of S3 Buckets available per AWS account?
- AA. 100 per region
- BB. there is no limit
- CC. 100 per account
- DD. 500 per account
- EE. 100 per IAM user
15Which of the following items are required to allow an application deployed on an EC2 instance to write data to a DynamoDB table?
Assume that no security Keys are allowed to be stored on the EC2 instance. (Choose two.)- AA. Create an IAM User that allows write access to the DynamoDB table.
- BB. Add an IAM Role to a running EC2 instance.
- CC. Add an IAM User to a running EC2 Instance.
- DD. Launch an EC2 Instance with the IAM Role included in the launch configuration.
- EE. Create an IAM Role that allows write access to the DynamoDB table.
- FF. Launch an EC2 Instance with the IAM User included in the launch configuration.
16A Developer is trying to make API calls using SDK. The IAM user credentials used by the application require multi-factor authentication for all API calls.
Which method the Developer use to access the multi-factor authentication protected API?- AA. GetFederationToken
- BB. GetCallerIdentity
- CC. GetSessionToken
- DD. DecodeAuthorizationMessage
17A Developer has an e-commerce API hosted on Amazon ECS. Variable and spiking demand on the application is causing order processing to take too long. The application processes Amazon SQS queues. The ApproximateNumberOfMessagesVisible metric spikes at very high values throughout the day, which cause
Amazon CloudWatch alarm breaches. Other ECS metrics for the API containers are well within limits.
What can the Developer implement to improve performance while keeping costs low?- AA. Target tracking scaling policy
- BB. Docker Swarm
- CC. Service scheduler
- DD. Step scaling policy
18A Developer wants to build an application that will allow new users to register and create new user accounts. The application must also allow users with social media accounts to log in using their social media credentials.
Which AWS service or feature can be used to meet these requirements?- AA. AWS IAM
- BB. Amazon Cognito identity pools
- CC. Amazon Cognito user pools
- DD. AWS Directory Service
19A company is developing a web application that allows its employees to upload a profile picture to a private Amazon S3 bucket. There is no size limit for the profile pictures, which should be displayed every time an employee logs in. For security reasons, the pictures cannot be publicly accessible.
What is a viable long-term solution for this scenario?- AA. Generate a presigned URL when a picture is uploaded. Save the URL in an Amazon DynamoDB table. Return the URL to the browser when the employee logs in.
- BB. Save the picture's S3 key in an Amazon DynamoDB table. Create an Amazon S3 VPC endpoint to allow the employees to download pictures once they log in.
- CC. Encode a picture using base64. Save the base64 string in an Amazon DB table. Allow the browser to retrieve the string and convert it to a picture.
- DD. Save the picture's S3 key in an Amazon DynamoDB table. Use a function to generate a presigned URL every time an employee logs in. Return the URL to the browser.
20A Developer is going to deploy an AWS Lambda function that requires significant CPU utilization.
Which approach will MINIMIZE the average runtime of the function?- AA. Deploy the function into multiple AWS Regions.
- BB. Deploy the function into multiple Availability Zones.
- CC. Deploy the function using Lambda layers.
- DD. Deploy the function with its memory allocation set to the maximum amount.
21A company has a legacy application that was migrated to a fleet of Amazon EC2 instances. The application stores data in a MySQL database that is currently installed on a single EC2 instance. The company has decided to migrate the database from the EC2 instance to MySQL on Amazon EDS.
What should the Developer do to update the application to support data storage in Amazon RDS?- AA. Update the database connection parameters in the application to point to the new RDS instance.
- BB. Add a script to the EC2 instance that implements an AWS SDK for requesting database credentials.
- CC. Create a new EC2 instance with an IAM role that allows access to the new RDS database.
- DD. Create an AWS Lambda function that will route traffic, from the EC2 instance to the RDS database.
22A Developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item and update some of its attributes, or create the item if it does not exist. The Lambda function has access to the primary key.
Which IAM permissions should the Developer request for the Lambda function to achieve this functionality?- AA. dynamodb:DeleteItem dynamodb:GetItem dynamodb:PutItem
- BB. dynamodb:UpdateItem dynamodb:GetItem dynamodb:DescribeTable
- CC. dynamodb:GetRecords dynamodb:PutItem dynamodb:UpdateTable
- DD. dynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem
23A Developer is storing sensitive data generated by an application in Amazon S3. The Developer wants to encrypt the data at rest. A company policy requires an audit trail of when the master key was used and by whom.
Which encryption option will meet these requirements?- AA. Server-side encryption with Amazon S3 managed keys (SSE-S3)
- BB. Server-side encryption with AWS KMS managed keys (SSE-KMS)
- CC. Server-side encryption with customer-provided keys (SSE-C)
- DD. Server-side encryption with self-managed keys
24A company's website runs on an Amazon EC2 instance and uses Auto Scaling to scale the environment during peak times. Website users across the world are experiencing high latency due to static content on the EC2 instance, even during non-peak hours.
Which combination of steps will resolve the latency issue? (Choose two.)- AA. Double the Auto Scaling group's maximum number of servers.
- BB. Host the application code on AWS Lambda.
- CC. Scale vertically by resizing the EC2 instances.
- DD. Create an Amazon CloudFront distribution to cache the static content.
- EE. Store the application's static content in Amazon S3.
25A Developer is leveraging a Border Gateway Protocol (BGP)-based AWS VPN connection to connect from on-premises to Amazon EC2 instances in the
Developer's account. The Developer is able to access an EC2 instance in subnet A, but is unable to access an EC2 instance in subnet B in the same VPC.
Which logs can the Developer use to verify whether the traffic is reaching subnet B?- AA. VPN logs
- BB. BGP logs
- CC. VPC Flow Logs
- DD. AWS CloudTrail logs
26A Developer has created a new AWS IAM user that has s3 putObject permission to write to a specific Amazon S3 bucket. This S3 bucket uses server-side encryption with AWS KMS managed (SSE-KMS) as the default encryption. Using the access key and secret key of the IAM user, the application received an access denied error when calling the PutObject API.
How can this issue be resolved?- AA. Update the policy of the IAM user to allow the s3 Encrypt action.
- BB. Update the bucket policy of the S3 bucket to allow the IAM user to upload objects.
- CC. Update the policy of the IAM user to allow the kms:GenerateDataKey action.
- DD. Update the ACL of the S3 bucket to allow the IAM user to upload objects.
27A company has a web application that uses an Amazon Cognito user pool for authentication. The company wants to create a login page with the company logo.
What should a Developer do to meet these requirements?- AA. Create a hosted user interface in Amazon Cognito and customize it with the company logo.
- BB. Create a login page with the company logo and upload it to Amazon Cognito.
- CC. Create a login page in Amazon API Gateway with the logo and save the link in Amazon Cognito.
- DD. Upload the logo to the Amazon Cognito app settings and point to the logo on a custom login page.
28A Developer wants the ability to roll back to a previous version of an AWS Lambda function in the event of errors caused by a new deployment.
How can the Developer achieve this with MINIMAL impact on users?- AA. Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to use the newly deployed version. If too many errors are encountered, point the alias back to the previous version.
- BB. Change the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version.
- CC. Do not make any changes to the application. Deploy the new version of the code. If too many errors are encountered, point the application back to the previous version using the version number in the Amazon Resource Name (ARN).
- DD. Create three aliases: new, existing, and router. Point the existing alias to the current version. Have the router alias direct 100% of users to the existing alias. Update the application to use the router alias. Deploy the new version of the code. Point the new alias to this version. Update the router alias to direct 10% of users to the new alias. If too many errors are encountered, send 100% of traffic to the existing alias.
29A company is developing an application that will be accessed through the Amazon API Gateway REST API. Registered users should be the only ones who can access certain resources of this API. The token being used should expire automatically and needs to be refreshed periodically.
How can a Developer meet these requirements?- AA. Create an Amazon Cognito identity pool, configure the Amazon Cognito Authorizer in API Gateway, and use the temporary credentials generated by the identity pool.
- BB. Create and maintain a database record for each user with a corresponding token and use an AWS Lambda authorizer in API Gateway.
- CC. Create an Amazon Cognito user pool, configure the Cognito Authorizer in API Gateway, and use the identity or access token.
- DD. Create an IAM user for each API user, attach an invoke permissions policy to the API, and use an IAM authorizer in API Gateway.
30A Developer is working on a serverless project based in Java. Initial testing shows a cold start takes about 8 seconds on average for AWS Lambda functions.
What should the Developer do to reduce the cold start time? (Choose two.)- AA. Add the Spring Framework to the project and enable dependency injection.
- BB. Reduce the deployment package by including only needed modules from the AWS SDK for Java.
- CC. Increase the memory allocation setting for the Lambda function.
- DD. Increase the timeout setting for the Lambda function.
- EE. Change the Lambda invocation mode from synchronous to asynchronous.
31A company's ecommerce website is experiencing massive traffic spikes, which are causing performance problems in the company database. Users are reporting that accessing the website takes a long time.
A Developer wants to implement a caching layer using Amazon ElastiCache. The website is required to be responsive no matter which product a user views, and the updates to product information and prices must be strongly consistent.
Which cache writing policy will satisfy these requirements?- AA. Write to the cache directly and sync the backend at a later time
- BB. Write to the backend first and wait for the cache to expire
- CC. Write to the cache and the backend at the same time
- DD. Write to the backend first and invalidate the cache
32An online retail company has deployed a serverless application with AWS Lambda, Amazon API Gateway, Amazon S3, and Amazon DynamoDB using AWS
CloudFormation. The company rolled out a new release with major upgrades to the Lambda function and deployed the release to production. Subsequently, the application stopped working.
Which solution should bring the application back up as quickly as possible?- AA. Redeploy the application on Amazon EC2 so the Lambda function can resolve dependencies
- BB. Migrate DynamoDB to Amazon RDS and redeploy the Lambda function
- CC. Roll back the Lambda function to the previous version
- DD. Deploy the latest Lambda function in a different Region
33A Developer is writing an application that will run on Amazon EC2 instances in an Auto Scaling group. The Developer wants to externalize session state to support the application.
Which services will meet these needs? (Choose two.)- AA. Amazon DynamoDB
- BB. Amazon Cognito
- CC. Amazon ElastiCache
- DD. Amazon EBS
- EE. Amazon SQS
34A Developer has a legacy application that is hosted on-premises. Other applications hosted on AWS depend on the on-premises application for proper functioning.
In case of any application errors, the Developer wants to be able to use Amazon CloudWatch to monitor and troubleshoot all applications from one place.
How can the Developer accomplish this?- AA. Install an AWS SDK on the on-premises server to automatically send logs to CloudWatch.
- BB. Download the CloudWatch agent to the on-premises server. Configure the agent to use IAM user credentials with permissions for CloudWatch.
- CC. Upload log files from the on-premises server to Amazon S3 and have CloudWatch read the files.
- DD. Upload log files from the on-premises server to an Amazon EC2 instance and have the instance forward the logs to CloudWatch.
35An application ingests a large number of small messages and stores them in a database. The application uses AWS Lambda. A Development team is making change to the application's processing logic. In testing, it is taking more than 15 minutes to process each message. The team is concerned the current backend may time out.
Which changes should be made to the backend system to ensure each message is processed in the MOST scalable way?- AA. Add the messages to an Amazon SQS queue. Set up and Amazon EC2 instance to poll the queue and process messages as they arrive.
- BB. Add the messages to an Amazon SQS queue. Set up Amazon EC2 instances in an Auto Scaling group to poll the queue and process the messages as they arrive.
- CC. Create a support ticket to increase the Lambda timeout to 60 minutes to allow for increased processing time.
- DD. Change the application to directly insert the body of the message into an Amazon RDS database.
36An advertising company has a dynamic website with heavy traffic. The company wants to migrate the website infrastructure to AWS to handle everything except website development.
Which solution BEST meets these requirements?- AA. Use AWS VM Import to migrate a web server image to AWS. Launch the image on a compute-optimized Amazon EC2 instance.
- BB. Launch multiple Amazon Lightsail instances behind a load balancer. Set up the website on those instances.
- CC. Deploy the website code in an AWS Elastic Beanstalk environment. Use Auto Scaling to scale the numbers of instances.
- DD. Use Amazon S3 to host the website. Use Amazon CloudFront to deliver the content at scale.
37A Software Engineer developed an AWS Lambda function in Node.js to do some CPU-intensive data processing. With the default settings, the Lambda function takes about 5 minutes to complete.
Which approach should a Developer take to increase the speed of completion?- AA. Instead of using Node.js, rewrite the Lambda function using Python.
- BB. Instead of packaging the libraries in the ZIP file with the function, move them to a Lambda layer and use the layer with the function.
- CC. Allocate the maximum available CPU units to the function.
- DD. Increase the available memory to the function.
38A company has implemented AWS CodePipeline to automate its release pipelines. The Development team is writing an AWS Lambda function what will send notifications for state changes of each of the actions in the stages.
Which steps must be taken to associate the Lambda function with the event source?- AA. Create a trigger that invokes the Lambda function from the Lambda console by selecting CodePipeline as the event source.
- BB. Create an event trigger and specify the Lambda function from the CodePipeline console.
- CC. Create an Amazon CloudWatch alarm that monitors status changes in Code Pipeline and triggers the Lambda function.
- DD. Create an Amazon CloudWatch Events rule that uses CodePipeline as an event source.
39A Developer has built an application running on AWS Lambda using AWS Serverless Application Model (AWS SAM).
What is the correct order of execution to successfully deploy the application?- AA. 1. Build the SAM template in Amazon EC2. 2. Package the SAM template to Amazon EBS storage. 3. Deploy the SAM template from Amazon EBS.
- BB. 1. Build the SAM template locally. 2. Package the SAM template onto Amazon S3. 3. Deploy the SAM template from Amazon S3.
- CC. 1. Build the SAM template locally. 2. Deploy the SAM template from Amazon S3. 3. Package the SAM template for use.
- DD. 1. Build the SAM template locally. 2. Package the SAM template from AWS CodeCommit. 3. Deploy the SAM template to CodeCommit.
40A company wants to migrate an imaging service to Amazon EC2 while following security best practices. The images are sourced and read from a non-public
Amazon S3 bucket.
What should a Developer do to meet these requirements?- AA. Create an IAM user with read-only permissions for the S3 bucket. Temporarily store the user credentials in the Amazon EBS volume of the EC2 instance.
- BB. Create an IAM user with read-only permissions for the S3 bucket. Temporarily store the user credentials in the user data of the EC2 instance.
- CC. Create an EC2 service role with read-only permissions for the S3 bucket. Attach the role to the EC2 instance.
- DD. Create an S3 service role with read-only permissions for the S3 bucket. Attach the role to the EC2 instance.
41A Development team wants to immediately build and deploy an application whenever there is a change to the source code.
Which approaches could be used to trigger the deployment? (Choose two.)- AA. Store the source code in an Amazon S3 bucket. Configure AWS CodePipeline to start whenever a file in the bucket changes.
- BB. Store the source code in an encrypted Amazon EBS volume. Configure AWS CodePipeline to start whenever a file in the volume changes.
- CC. Store the source code in an AWS CodeCommit repository. Configure AWS CodePipeline to start whenever a change is committed to the repository.
- DD. Store the source code in an Amazon S3 bucket. Configure AWS CodePipeline to start every 15 minutes.
- EE. Store the source code in an Amazon EC2 instance's ephemeral storage. Configure the instance to start AWS CodePipeline whenever there are changes to the source code.
42A company has implemented AWS CodeDeploy as part of its cloud native CI/CD stack. The company enables automatic rollbacks while deploying a new version of a popular web application from in-place to Amazon EC2.
What occurs if the deployment of the new version fails due to code regression?- AA. The last known good deployment is automatically restored using the snapshot stored in Amazon S3.
- BB. CodeDeploy switches the Amazon Route 53 alias records back to the known good green deployment and terminates the failed blue deployment.
- CC. A new deployment of the last known version of the application is deployed with a new deployment ID.
- DD. AWS CodePipeline promotes the most recent deployment with a SUCCEEDED status to production.
43A software company needs to make sure user-uploaded documents are securely stored in Amazon S3. The documents must be encrypted at rest in Amazon S3.
The company does not want to manage the security infrastructure in-house, but the company still needs extra protection to ensure it has control over its encryption keys due to industry regulations.
Which encryption strategy should a Developer use to meet these requirements?- AA. Server-side encryption with Amazon S3 managed keys (SSE-S3)
- BB. Server-side encryption with customer-provided encryption keys (SSE-C)
- CC. Server-side encryption with AWS KMS managed keys (SSE-KMS)
- DD. Client-side encryption
44A Developer uses Amazon S3 buckets for static website hosting. The Developer creates one S3 bucket for the code and another S3 bucket for the assets, such as image and video files. Access is denied when a user attempts to access the assets bucket from the code bucket, with the website application showing a 403 error.
How should the Developer solve this issue?- AA. Create an IAM role and apply it to the assets bucket for the code bucket to be granted access.
- BB. Edit the bucket policy of the assets bucket to open access to all principals.
- CC. Edit the cross-origin resource sharing (CORS) configuration of the assets bucket to allow any origin to access the assets.
- DD. Change the code bucket to use AWS Lambda functions instead of static website hosting.
45A Developer migrated a web application to AWS. As part of the migration, the Developer implemented an automated continuous integration/continuous improvement (CI/CD) process using a blue/green deployment. The deployment provisions new Amazon EC2 instances in an Auto Scaling group behind a new
Application Load Balancer. After the migration was completed, the Developer began receiving complaints from users getting booted out of the system. The system also requires users to log in after every new deployment.
How can these issues be resolved?- AA. Use rolling updates instead of a blue/green deployment
- BB. Externalize the user sessions to Amazon ElastiCache
- CC. Turn on sticky sessions in the Application Load Balancer
- DD. Use multicast to replicate session information
46A Developer wants to insert a record into an Amazon DynamoDB table as soon as a new file is added to an Amazon S3 bucket.
Which set of steps would be necessary to achieve this?- AA. Create an event with Amazon CloudWatch Events that will monitor the S3 bucket and then insert the records into DynamoDB.
- BB. Configure an S3 event to invoke a Lambda function that inserts records into DynamoDB.
- CC. Create a Lambda function that will poll the S3 bucket and then insert the records into DynamoDB.
- DD. Create a cron job that will run at a scheduled time and insert the records into DynamoDB.
47A Developer is building an application that needs to store data in Amazon S3. Management requires that the data be encrypted before it is sent to Amazon S3 for storage. The encryption keys need to be managed by the Security team.
Which approach should the Developer take to meet these requirements?- AA. Implement server-side encryption using customer-provided encryption keys (SSE-C).
- BB. Implement server-side encryption by using a client-side master key.
- CC. Implement client-side encryption using an AWS KMS managed customer master key (CMK).
- DD. Implement client-side encryption using Amazon S3 managed keys.
48A Developer has written an Amazon Kinesis Data Streams application. As usage grows and traffic increases over time, the application is regularly receiving
ProvisionedThroughputExceededException error messages.
Which steps should the Developer take to resolve the error? (Choose two.)- AA. Use Auto Scaling to scale the stream for better performance
- BB. Increase the delay between the GetRecords call and the PutRecords call
- CC. Increase the number of shards in the data stream
- DD. Specify a shard iterator using the ShardIterator parameter
- EE. Implement exponential backoff on the GetRecords call and the PutRecords call
49A Developer is publishing critical log data to a log group in Amazon CloudWatch Logs, which was created 2 months ago. The Developer must encrypt the log data using an AWS KMS customer master key (CMK) so future data can be encrypted to comply with the company's security policy.
How can the Developer meet this requirement?- AA. Use the CloudWatch Logs console and enable the encrypt feature on the log group
- BB. Use the AWS CLI create-log-group command and specify the key Amazon Resource Name (ARN)
- CC. Use the KMS console and associate the CMK with the log group
- DD. Use the AWS CLI associate-kms-key command and specify the key Amazon Resource Name (ARN)
50A Developer has code running on Amazon EC2 instances that needs read-only access to an Amazon DynamoDB table.
What is the MOST secure approach the Developer should take to accomplish this task?- AA. Create a user access key for each EC2 instance with read-only access to DynamoDB. Place the keys in the code. Redeploy the code as keys rotate.
- BB. Use an IAM role with an AmazonDynamoDBReadOnlyAccess policy applied to the EC2 instances.
- CC. Run all code with only AWS account root user access keys to ensure maximum access to services.
- DD. Use an IAM role with Administrator access applied to the EC2 instance.
51A Developer decides to store highly secure data in Amazon S3 and wants to implement server-side encryption (SSE) with granular control of who can access the master key. Company policy requires that the master key be created, rotated, and disabled easily when needed, all for security reasons.
Which solution should be used to meet these requirements?- AA. SSE with Amazon S3 managed keys (SSE-S3)
- BB. SSE with AWS KMS managed keys (SSE-KMS)
- CC. SSE with AWS Secrets Manager
- DD. SSE with customer-provided encryption keys
52A Developer is migrating an on-premises application to AWS. The application currently takes user uploads and saves them to a local directory on the server. All uploads must be saved and made immediately available to all instances in an Auto Scaling group.
Which approach will meet these requirements?- AA. Use Amazon EBS and configure the application AMI to use a snapshot of the same EBS instance on boot.
- BB. Use Amazon S3 and rearchitect the application so all uploads are placed in S3.
- CC. Use instance storage and share it between instances launched from the same Amazon Machine Image (AMI).
- DD. Use Amazon EBS and file synchronization software to achieve eventual consistency among the Auto Scaling group.
53A Developer implemented a static website hosted in Amazon S3 that makes web service requests hosted in Amazon API Gateway and AWS Lambda. The site is showing an error that reads: "No "˜Access-Control-Allow-Origin' header is present on the requested resource. Origin "˜null' is therefore not allowed access."
What should the Developer do to resolve this issue?- AA. Enable cross-origin resource sharing (CORS) on the S3 bucket.
- BB. Enable cross-origin resource sharing (CORS) for the method in API Gateway
- CC. Add the Access-Control-Request-Method header to the request
- DD. Add the Access-Control-Request-Headers header to the request
54A Developer is writing an application in AWS Lambda. To simplify testing and deployments, the Developer needs the database connections string to be easily changed without modifying the Lambda code.
How can this requirement be met?- AA. Store the connection string as a secret in AWS Secrets Manager.
- BB. Store the connection string in an IAM user account.
- CC. Store the connection string in AWS KMS.
- DD. Store the connection string as a Lambda layer.
55A company is launching an ecommerce website and will host the static data in Amazon S3. The company expects approximately 1,000 transactions per second
(TPS) for GET and PUT requests in total. Logging must be enabled to track all requests and must be retained for auditing purposes.
What is the MOST cost-effective solution?- AA. Enable AWS CloudTrail logging for the S3 bucket-level action and create a lifecycle policy to move the data from the log bucket to Amazon S3 Glacier in 90 days.
- BB. Enable S3 server access logging and create a lifecycle policy to expire the data in 90 days.
- CC. Enable AWS CloudTrail logging for the S3 bucket-level action and create a lifecycle policy to expire the data in 90 days.
- DD. Enable S3 server access logging and create a lifecycle policy to move the data to Amazon S3 Glacier in 90 days.
56A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon EBS disks for storing data. The application will process sensitive information and all the data must be encrypted.
What should a Developer do to ensure the data is encrypted on disk without impacting performance?- AA. Configure the Amazon EC2 instance fleet to use encrypted EBS volumes for storing data.
- BB. Add logic to write all data to an encrypted Amazon S3 bucket.
- CC. Add a custom encryption algorithm to the application that will encrypt and decrypt all data.
- DD. Create a new Amazon Machine Image (AMI) with an encrypted root volume and store the data to ephemeral disks.
57A Developer has written an application that runs on Amazon EC2 instances and generates a value every minute. The Developer wants to monitor and graph the values generated over time without logging in to the instance each time.
Which approach should the Developer use to achieve this goal?- AA. Use the Amazon CloudWatch metrics reported by default for all EC2 instances. View each value from the CloudWatch console.
- BB. Develop the application to store each value in a file on Amazon S3 every minute with the timestamp as the name.
- CC. Publish each generated value as a custom metric to Amazon CloudWatch using available AWS SDKs.
- DD. Store each value as a variable and add the variable to the list of EC2 metrics that should be reported to the Amazon CloudWatch console.
58A Development team decides to adopt a continuous integration/continuous delivery (CI/CD) process using AWS CodePipeline and AWS CodeCommit for a new application. However, management wants a person to review and approve the code before it is deployed to production.
How can the Development team add a manual approver to the CI/CD pipeline?- AA. Use AWS SES to send an email to approvers when their action is required. Develop a simple application that allows approvers to accept or reject a build. Invoke an AWS Lambda function to advance the pipeline when a build is accepted.
- BB. If approved, add an approved tag when pushing changes to the CodeCommit repository. CodePipeline will proceed to build and deploy approved commits without interruption.
- CC. Add an approval step to CodeCommit. Commits will not be saved until approved.
- DD. Add an approval action to the pipeline. Configure the approval action to publish to an Amazon SNS topic when approval is required. The pipeline execution will stop and wait for an approval.
59A Developer is building a serverless application using AWS Lambda and must create a REST API using an HTTP GET method.
What needs to be defined to meet this requirement? (Choose two.)- AA. A Lambda@Edge function
- BB. An Amazon API Gateway with a Lambda function
- CC. An exposed GET method in an Amazon API Gateway
- DD. An exposed GET method in the Lambda function
- EE. An exposed GET method in Amazon Route 53
60A Developer needs to create an application that supports Security Assertion Markup Language (SAML) and Facebook authentication. It must also allow access to
AWS services, such as Amazon DynamoDB.
Which AWS service or feature will meet these requirements with the LEAST amount of additional coding?- AA. AWS AppSync
- BB. Amazon Cognito identity pools
- CC. Amazon Cognito user pools
- DD. Amazon Lambda@Edge
61A Developer is trying to monitor an application's status by running a cron job that returns 1 if the service is up and 0 if the service is down. The Developer created code that uses an AWS CLI put-metric-alarm command to publish the custom metrics to Amazon CloudWatch and create an alarm. However, the Developer is unable to create an alarm as the custom metrics do not appear in the CloudWatch console.
What is causing this issue?- AA. Sending custom metrics using the CLI is not supported.
- BB. The Developer needs to use the put-metric-data command.
- CC. The Developer must use a unified CloudWatch agent to publish custom metrics.
- DD. The code is not running on an Amazon EC2 instance.
62A Developer registered an AWS Lambda function as a target for an Application Load Balancer (ALB) using a CLI command. However, the Lambda function is not being invoked when the client sends requests through the ALB.
Why is the Lambda function not being invoked?- AA. A Lambda function cannot be registered as a target for an ALB.
- BB. A Lambda function can be registered with an ALB using AWS Management Console only.
- CC. The permissions to invoke the Lambda function are missing.
- DD. Cross-zone is not enabled on the ALB.
63A company provides APIs as a service and commits to a service level agreement (SLA) with all its users.
To comply with each SLA, what should the company do?- AA. Enable throttling limits for each method in Amazon API Gateway
- BB. Create a usage plan for each user and request API keys to access the APIs
- CC. Enable API rate limiting in Amazon Cognito for each user
- DD. Enable default throttling limits for each stage after deploying the APIs
64A Developer is preparing a deployment package using AWS CloudFormation. The package consists of two separate templates: one for the infrastructure and one for the application. The application has to be inside the VPC that is created from the infrastructure template.
How can the application stack refer to the VPC created from the infrastructure template?- AA. Use the Ref function to import the VPC into the application stack from the infrastructure template.
- BB. B. Use the export flag in the infrastructure template, and then use the Fn::ImportValue function in the application template.
- CC. Use the DependsOn attribute to specify that the application instance depends on the VPC in the application template.
- DD. Use the Fn::GetAtt function to include the attribute of the VPC in the application template.
65A Developer must allow guest users without logins to access an Amazon Cognito-enabled site to view files stored within an Amazon S3 bucket.
How should the Developer meet these requirements?- AA. Create a blank user ID in a user pool, add to the user group, and grant access to AWS resources.
- BB. Create a new identity pool, enable access to authenticated identities, and grant access to AWS resources.
- CC. Create a new user pool, enable access to authenticated identifies, and grant access to AWS resources.
- DD. Create a new user pool, disable authentication access, and grant access to AWS resources.
66A Developer has written code for an application and wants to share it with other Developers on the team to receive feedback. The shared application code needs to be stored long-term with multiple versions and batch change tracking.
Which AWS service should the Developer use?- AA. AWS CodeBuild
- BB. Amazon S3
- CC. AWS CodeCommit
- DD. AWS Cloud9
67A Developer has discovered that an application responsible for processing messages in an Amazon SQS queue is routinely falling behind. The application is capable of processing multiple messages in one execution, but is only receiving one message at a time.
What should the Developer do to increase the number of messages the application receives?- AA. Call the ChangeMessageVisibility API for the queue and set MaxNumberOfMessages to a value greater than the default of 1.
- BB. Call the AddPermission API to set MaxNumberOfMessages for the ReceiveMessage action to a value greater than the default of 1.
- CC. Call the ReceiveMessage API to set MaxNumberOfMessages to a value greater than the default of 1.
- DD. Call the SetQueueAttributes API for the queue and set MaxNumberOfMessages to a value greater than the default of 1.
68A Developer is investigating an application's performance issues. The application consists of hundreds of microservices, and a single API call can potentially have a deep call stack. The Developer must isolate the component that is causing the issue.
Which AWS service or feature should the Developer use to gather information about what is happening and isolate the fault?- AA. AWS X-Ray
- BB. VPC Flow Logs
- CC. Amazon GuardDuty
- DD. Amazon Macie
69A Company runs continuous integration/continuous delivery (CI/CD) pipelines for its application on AWS CodePipeline. A Developer must write unit tests and run them as part of the pipelines before staging the artifacts for testing.
How should the Developer incorporate unit tests as part of CI/CD pipelines?- AA. Create a separate CodePipeline pipeline to run unit tests
- BB. Update the AWS CodeBuild specification to include a phase for running unit tests
- CC. Install the AWS CodeDeploy agent on an Amazon EC2 instance to run unit tests
- DD. Create a testing branch in AWS CodeCommit to run unit tests
70An application has the following requirements:
✑ Performance efficiency of seconds with up to a minute of latency.
✑ The data storage size may grow up to thousands of terabytes.
✑ Per-message sizes may vary between 100 KB and 100 MB.
✑ Data can be stored as key/value stores supporting eventual consistency.
What is the MOST cost-effective AWS service to meet these requirements?- AA. Amazon DynamoDB
- BB. Amazon S3
- CC. Amazon RDS (with a MySQL engine)
- DD. Amazon ElastiCache
71An application is experiencing performance issues based on increased demand. This increased demand is on read-only historical records pulled from an Amazon
RDS-hosted database with custom views and queries. A Developer must improve performance without changing the database structure.
Which approach will improve performance and MINIMIZE management overhead?- AA. Deploy Amazon DynamoDB, move all the data, and point to DynamoDB.
- BB. Deploy Amazon ElastiCache for Redis and cache the data for the application.
- CC. Deploy Memcached on Amazon EC2 and cache the data for the application.
- DD. Deploy Amazon DynamoDB Accelerator (DAX) on Amazon RDS to improve cache performance.
72A Developer has an Amazon DynamoDB table that must be in provisioned mode to comply with user requirements. The application needs to support the following:
✑ Average item size: 10 KB
✑ Item reads each second: 10 strongly consistent
✑ Item writes each second: 2 transactional
Which read and write capacity cost-effectively meets these requirements?- AA. Read 10; write 2
- BB. Read 30; write 40
- CC. Use on-demand scaling
- DD. Read 300; write 400
73A company wants to containerize an existing three-tier web application and deploy it to Amazon ECS Fargate. The application is using session data to keep track of user activities.
Which approach would provide the BEST user experience?- AA. Provision a Redis cluster in Amazon ElastiCache and save the session data in the cluster.
- BB. Create a session table in Amazon Redshift and save the session data in the database table.
- CC. Enable session stickiness in the existing Network Load Balancer and manage the session data in the container.
- DD. Use an Amazon S3 bucket as data store and save the session data in the bucket.
74An application is using a single-node Amazon ElastiCache for Redis instance to improve read performance. Over time, demand for the application has increased exponentially, which has increased the load on the ElastiCache instance. It is critical that this cache layer handles the load and is resilient in case of node failures.
What can the Developer do to address the load and resiliency requirements?- AA. Add a read replica instance.
- BB. Migrate to a Memcached cluster.
- CC. Migrate to an Amazon Elasticsearch Service cluster.
- DD. Vertically scale the ElastiCache instance.
75A Developer is designing an AWS Lambda function that create temporary files that are less than 10 MB during execution. The temporary files will be accessed and modified multiple times during execution. The Developer has no need to save or retrieve these files in the future.
Where should the temporary file be stored?- AA. the /tmp directory
- BB. Amazon EFS
- CC. Amazon EBS
- DD. Amazon S3
76A Developer is writing an application that runs on Amazon EC2 instances in an Auto Scaling group. The application data is stored in an Amazon DynamoDB table and records are constantly updated by all instances. An instance sometimes retrieves old data. The Developer wants to correct this by making sure the reads are strongly consistent.
How can the Developer accomplish this?- AA. Set ConsistentRead to true when calling Getltem.
- BB. Create a new DynamoDB Accelerator (DAX) table.
- CC. Set Consistency to strong when calling UpdateTable.
- DD. Use the GetShardIterator command.
77A Developer has an application that must accept a large amount of incoming data streams and process the data before sending it to many downstream users.
Which serverless solution should the Developer use to meet these requirements?- AA. Amazon RDS MySQL stored procedure with AWS Lambda
- BB. AWS Direct Connect with AWS Lambda
- CC. Amazon Kinesis Data Streams with AWS Lambda
- DD. Amazon EC2 bash script with AWS Lambda
78A company is using Amazon API Gateway to manage its public-facing API. The CISO requires that the APIs be used by test account users only.
What is the MOST secure way to restrict API access to users of this particular AWS account?- AA. Client-side SSL certificates for authentication
- BB. API Gateway resource policies
- CC. Cross-origin resource sharing (CORS)
- DD. Usage plans
79A Developer is migrating existing applications to AWS. These applications use MongoDB as their primary data store, and they will be deployed to Amazon EC2 instances. Management requires that the Developer minimize changes to applications while using AWS services.
Which solution should the Developer use to host MongoDB in AWS?- AA. Install MongoDB on the same instance where the application is running.
- BB. Deploy Amazon DocumentDB in MongoDB compatibility mode.
- CC. Use Amazon API Gateway to translate API calls from MongoDB to Amazon DynamoDB.
- DD. Replicate the existing MongoDB workload to Amazon DynamoDB.
80A company requires that AWS Lambda functions written by Developers log errors so System Administrators can more effectively troubleshoot issues.
What should the Developers implement to meet this need?- AA. Publish errors to a dedicated Amazon SQS queue.
- BB. Create an Amazon CloudWatch Events event trigger based on certain Lambda events.
- CC. Report errors through logging statements in Lambda function code.
- DD. Set up an Amazon SNS topic that sends logging statements upon failure.
81A Developer needs to deploy an application running on AWS Fargate using Amazon ECS. The application has environment variables that must be passed to a container for the application to initialize.
How should the environment variables be passed to the container?- AA. Define an array that includes the environment variables under the environment parameter within the service definition.
- BB. Define an array that includes the environment variables under the environment parameter within the task definition.
- CC. Define an array that includes the environment variables under the entryPoint parameter within the task definition.
- DD. Define an array that includes the environment variables under the entryPoint parameter within the service definition.
82A company's fleet of Amazon EC2 instances receives data from millions of users through an API. The servers batch the data, add an object for each user, and upload the objects to an S3 bucket to ensure high access rates. The object attributes are Customer ID, Server ID, TS-Server (TimeStamp and Server ID), the size of the object, and a timestamp. A Developer wants to find all the objects for a given user collected during a specified time range.
After creating an S3 object created event, how can the Developer achieve this requirement?- AA. Execute an AWS Lambda function in response to the S3 object creation events that creates an Amazon DynamoDB record for every object with the Customer ID as the partition key and the Server ID as the sort key. Retrieve all the records using the Customer ID and Server ID attributes.
- BB. Execute an AWS Lambda function in response to the S3 object creation events that creates an Amazon Redshift record for every object with the Customer ID as the partition key and TS-Server as the sort key. Retrieve all the records using the Customer ID and TS-Server attributes.
- CC. Execute an AWS Lambda function in response to the S3 object creation events that creates an Amazon DynamoDB record for every object with the Customer ID as the partition key and TS-Server as the sort key. Retrieve all the records using the Customer ID and TS-Server attributes.
- DD. Execute an AWS Lambda function in response to the S3 object creation events that creates an Amazon Redshift record for every object with the Customer ID as the partition key and the Server ID as the sort key. Retrieve all the records using the Customer ID and Server ID attributes.
83A company is managing a NoSQL database on-premises to host a critical component of an application, which is starting to have scaling issues. The company wants to migrate the application to Amazon DynamoDB with the following considerations:
✑ Optimize frequent queries
✑ Reduce read latencies
✑ Plan for frequent queries on certain key attributes of the table
Which solution would help achieve these objectives?- AA. Create global secondary indexes on keys that are frequently queried. Add the necessary attributes into the indexes.
- BB. Create local secondary indexes on keys that are frequently queried. DynamoDB will fetch needed attributes from the table.
- CC. Create DynamoDB global tables to speed up query responses. Use a scan to fetch data from the table.
- DD. Create an AWS Auto Scaling policy for the DynamoDB table.
84A developer is writing an application that will process data delivered into an Amazon S3 bucket. The data is delivered approximately 10 times a day, and the developer expects the data will be processed in less than 1 minute, on average.
How can the developer deploy and invoke the application with the lowest cost and lowest latency?- AA. Deploy the application as an AWS Lambda function and invoke it with an Amazon CloudWatch alarm triggered by an S3 object upload.
- BB. Deploy the application as an AWS Lambda function and invoke it with an S3 event notification.
- CC. Deploy the application as an AWS Lambda function and invoke it with an Amazon CloudWatch scheduled event.
- DD. Deploy the application onto an Amazon EC2 instance and have it poll the S3 bucket for new objects.
85A developer converted an existing program to an AWS Lambda function in the console. The program runs properly on a local laptop, but shows an "Unable to import module" error when tested in the Lambda console.
Which of the following can fix the error?- AA. Install the missing module and specify the current directory as the target. Create a ZIP file to include all files under the current directory, and upload the ZIP file.
- BB. Install the missing module in a lib directory. Create a ZIP file to include all files under the lib directory, and upload the ZIP file as dependency file.
- CC. In the Lambda code, invoke a Linux command to install the missing modules under the /usr/lib directory.
- DD. In the Lambda console, create a LB_LIBRARY_PATH environment and specify the value for the system library plan.
86A front-end web application is using Amazon Cognito user pools to handle the user authentication flow. A developer is integrating Amazon DynamoDB into the application using the AWS SDK for JavaScript.
How would the developer securely call the API without exposing the access or secret keys?- AA. Configure Amazon Cognito identity pools and exchange the JSON Web Token (JWT) for temporary credentials.
- BB. Run the web application in an Amazon EC2 instance with the instance profile configured.
- CC. Hardcore the credentials, use Amazon S3 to host the web application, and enable server-side encryption.
- DD. Use Amazon Cognito user pool JSON Web Tokens (JWITs) to access the DynamoDB APIs.
87A developer needs to manage AWS infrastructure as code and must be able to deploy multiple identical copies of the infrastructure, stage changes, and revert to previous versions.
Which approach addresses these requirements?- AA. Use cost allocation reports and AWS OpsWorks to deploy and manage the infrastructure.
- BB. Use Amazon CloudWatch metrics and alerts along with resource tagging to deploy and manage the infrastructure.
- CC. Use AWS Elastic Beanstalk and AWS CodeCommit to deploy and manage the infrastructure.
- DD. Use AWS CloudFormation and AWS CodeCommit to deploy and manage the infrastructure.
88What is required to trace Lambda-based applications with AWS X-Ray?
- AA. Send logs from the Lambda application to an S3 bucket; trigger a Lambda function from the bucket to send data to AWS X-Ray.
- BB. Trigger a Lambda function from the application logs in Amazon CloudWatch to submit tracing data to AWS X-Ray.
- CC. Use an IAM execution role to give the Lambda function permissions and enable tracing.
- DD. Update and add AWS X-Ray daemon code to relevant parts of the Lambda function to set up the trace.
89A development team is building a new application that will run on Amazon EC2 and use Amazon DynamoDB as a storage layer. The developers all have assigned
IAM user accounts in the same IAM group. The developers currently can launch EC2 instances, and they need to be able to launch EC2 instances with an instance role allowing access to Amazon DynamoDB.
Which AWS IAM changes are needed when creating an instance role to provide this functionality?- AA. Create an IAM permission policy attached to the role that allows access to DynamoDB. Add a trust policy to the role that allows DynamoDB to assume the role. Attach a permissions policy to the development group in AWS IAM that allows developers to use the iam:GetRole and iam:PassRole permissions for the role.
- BB. Create an IAM permissions policy attached to the role that allows access to DynamoDB. Add a trust policy to the role that allows Amazon EC2 to assume the role. Attach a permissions policy to the development group in AWS IAM that allows developers to use the iam:PassRole permission for the role.
- CC. Create an IAM permission policy attached to the role that allows access to Amazon EC2. Add a trust policy to the role that allows DynamoDB to assume the role. Attach a permissions policy to the development group in AWS IAM that allows developers to use the iam:PassRole permission for the role.
- DD. Create an IAM permissions policy attached to the role that allows access to DynamoDB. Add a trust policy to the role that allows Amazon EC2 to assume the role. Attach a permissions policy to the development group in AWS IAM that allows developers to use the iam:GetRole permission for the role.
90A developer is migrating code to an AWS Lambda function that will an Amazon Aurora MySQL database.
What is the MOST secure way to authenticate the function to the database?- AA. Store the database credentials as encrypted parameters in AWS Systems Manager Parameters Store. Obtain the credentials from Systems Manager when the Lambda function needs to connect to the database.
- BB. Store the database credentials in AWS Secrets Manager. Let Secrets Manager handle the rotation of the credentials, as required.
- CC. Store the database credentials in an Amazon S3 bucket that has a restrictive bucket policy for the Lambda role when accessing the credentials. Use AWS KMS to encrypt the data.
- DD. Create a policy with rds-db:connect access to the database and attach it to the role assigned to the Lambda function.
91A development team uses AWS Elastic Beanstalk for application deployment. The team has configured the application version lifecycle policy to limit the number of application versions to 25. However, even with the lifecycle policy, the source bundle is deleted from the Amazon S3 source bucket.
What should a developer do in the Elastic Beanstalk application version lifecycle settings to retain the source code in the S3 bucket?- AA. Change the Set the application versions limit by total count setting to zero.
- BB. Disable the Lifecycle policy setting.
- CC. Change the Set the application version limit by age setting to zero.
- DD. Set Retention to Retain source bundle in S3.
92A developer has built a market application that stores pricing data in Amazon DynamoDB with Amazon ElastiCache in front. The prices of items in the market change frequently. Sellers have begun complaining that, after they update the price of an item, the price does not actually change in the product listing.
What could be causing this issue?- AA. The cache is not being invalidated when the price of the item is changed
- BB. The price of the item is being retrieved using a write-through ElastiCache cluster
- CC. The DynamoDB table was provisioned with insufficient read capacity
- DD. The DynamoDB table was provisioned with insufficient write capacity
93A developer is provided with an HTTPS clone URL for an AWS CodeCommit repository.
What needs to be configured before cloning this repository?- AA. Use AWS KMS to set up public and private keys for use with AWS CodeCommit.
- BB. Set up the Git credential helper to use an AWS credential profile, and enable the helper to send the path to the repositories.
- CC. Use AWS Certificate Manager to provision public and private SSL/TLS certificates.
- DD. Generate encryption keys using AWS CloudHSM, then export the key for use with AWS CodeCommitl.
94A developer is building an application using an Amazon API Gateway REST API backend by an AWS Lambda function that interacts with an Amazon DynamoDB table. During testing, the developer observes high latency when making requests to the API.
How can the developer evaluate the end-to-end latency and identify performance bottlenecks?- AA. Enable AWS CloudTrail logging and use the logs to map each latency and bottleneck.
- BB. Enable and configure AWS X-Ray tracing on API Gateway and the Lambda function. Use X-Ray to trace and analyze user requests.
- CC. Enable Amazon CloudWatch Logs for the Lambda function. Enable execution logs for API Gateway to view and analyze user request logs.
- DD. Enable VPC Flow Logs to capture and analyze network traffic within the VPC.
95A developer is writing an AWS Lambda function. The developer wants to log key events that occur during the Lambda function and include a unique identifier to associate the events with a specific function invocation.
Which of the following will help the developer accomplish this objective?- AA. Obtain the request identifier from the Lambda context object. Architect the application to write logs to the console.
- BB. Obtain the request identifier from the Lambda event object. Architect the application to write logs to a file.
- CC. Obtain the request identifier from the Lambda event object. Architect the application to write logs to the console.
- DD. Obtain the request identifier from the Lambda context object. Architect the application to write logs to a file.
96An IAM role is attached to an Amazon EC2 instance that explicitly denies access to all Amazon S3 API actions. The EC2 instance credentials file specifies the IAM access key and secret access key, which allow full administrative access.
Given that multiple modes of IAM access are present for this EC2 instance, which of the following is correct?- AA. The EC2 instance will only be able to list the S3 buckets.
- BB. The EC2 instance will only be able to list the contents of one S3 bucket at a time.
- CC. The EC2 instance will be able to perform all actions on any S3 bucket.
- DD. The EC2 instance will not be able to perform any S3 action on any S3 bucket.
97Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon DynamoDB table.
How can each microservice be granted the minimum privileges?- AA. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
- BB. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
- CC. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.
- DD. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.
98A developer has written an AWS Lambda function using Java as the runtime environment. The developer wants to isolate a performance bottleneck in the code.
Which steps should be taken to reveal the bottleneck?- AA. Use the Amazon CloudWatch API to write timestamps to a custom CloudWatch metric. Use the CloudWatch console to analyze the resulting data.
- BB. Use the AWS X-Ray API to write trace data into X-Ray from strategic places within the code. Use the Amazon CloudWatch console to analyze the resulting data.
- CC. Use the AWS X-Ray API to write trace data into X-Ray from strategic places within the code. Use the X-Ray console to analyze the resulting data.
- DD. Use the Amazon CloudWatch API to write timestamps to a custom CloudWatch metric. Use the AWS X-Ray console to analyze the resulting data.
99A developer added a new feature to an application running on an Amazon EC2 instance that uses Amazon SQS. After deployment, the developer noticed a significant increase in Amazon SQS costs. When monitoring the Amazon SQS metrics on Amazon CloudWatch, the developer found that on average one message per minute is posted on this queue.
What can be done to reduce Amazon SQS costs for this application?- AA. Increase the Amazon SQS queue polling timeout.
- BB. Scale down the Amazon SQS queue to the appropriate size for low traffic demand.
- CC. Configure push delivery via Amazon SNS instead of polling the Amazon SQS queue.
- DD. Use an Amazon SQS first-in, first-out (FIFO) queue instead of a standard queue.
100A developer is using Amazon DynamoDB to store application data. The developer wants to further improve application performance by reducing response times for read and write operations.
Which DynamoDB feature should be used to meet these requirements?- AA. Amazon DynamoDB Streams
- BB. Amazon DynamoDB Accelerator
- CC. Amazon DynamoDB global tables
- DD. Amazon DynamoDB transactions
101A developer is creating a script to automate the deployment process for a serverless application. The developer wants to use an existing AWS Serverless
Application Model (AWS SAM) template for the application.
What should the developer use for the project? (Choose two.)- AA. Call aws cloudformation package to create the deployment package. Call aws cloudformation deploy to deploy the package afterward.
- BB. Call sam package to create the deployment package. Call sam deploy to deploy the package afterward.
- CC. Call aws s3 cp to upload the AWS SAM template to Amazon S3. Call aws lambda update-function-code to create the application.
- DD. Create a ZIP package locally and call aws serverlessrepo create-application to create the application.
- EE. Create a ZIP package and upload it to Amazon S3. Call aws cloudformation create-stack to create the application.
102A development team is designing a mobile app that requires multi-factor authentication.
Which steps should be taken to achieve this? (Choose two.)- AA. Use Amazon Cognito to create a user pool and create users in the user pool.
- BB. Send multi-factor authentication text codes to users with the Amazon SNS Publish API call in the app code.
- CC. Enable multi-factor authentication for the Amazon Cognito user pool.
- DD. Use AWS IAM to create IAM users.
- EE. Enable multi-factor authentication for the users created in AWS IAM.
103A developer is using AWS CodeDeploy to deploy an application running on Amazon EC2. The developer wants to change the file permissions for a specific deployment file.
Which lifecycle event should a developer use to meet this requirement?- AA. AfterInstall
- BB. DownloadBundle
- CC. BeforeInstall
- DD. ValidateService
104A company is developing a report executed by AWS Step Functions, Amazon CloudWatch shows errors in the Step Functions task state machine. To troubleshoot each task, the state input needs to be included along with the error message in the state output.
Which coding practice can preserve both the original input and the error for the state?- AA. Use ResultPath in a Catch statement to include the error with the original input.
- BB. Use InputPath in a Catch statement and set the value to null.
- CC. Use Error Equals in a Retry statement to include the error with the original input.
- DD. Use OutputPath in a Retry statement and set the value to $.
105A developer is updating an application deployed on AWS Elastic Beanstalk. The new version is incompatible with the old version. To successfully deploy the update, a full cutover to the new, updated version must be performed on all instances at one time, with the ability to roll back changes in case of a deployment failure in the new version.
How can this be performed with the LEAST amount of downtime?- AA. Use the Elastic Beanstalk All at once deployment policy to update all instances simultaneously.
- BB. Perform an Elastic Beanstalk Rolling with additional batch deployment.
- CC. Deploy the new version in a new Elastic Beanstalk environment and swap environment URLs.
- DD. Perform an Elastic Beanstalk Rolling deployment.
106A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when requested, and only for a duration of 15 minutes.
How can the developer meet these requirements?- AA. Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
- BB. Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
- CC. Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download the documents using HTTPS.
- DD. Modify the S3 bucket policy to only allow specific users to download the documents. Revert the change after 15 minutes.
107A developer wants to send multi-value headers to an AWS Lambda function that is registered as a target with an Application Load Balancer (ALB).
What should the developer do to achieve this?- AA. Place the Lambda function and target group in the same account.
- BB. Send the request body to the Lambda function with a size less than 1 MB.
- CC. Include the Base64 encoding status, status code, status description, and headers in the Lambda function.
- DD. Enable the multi-value headers on the ALB.
108An ecommerce startup is preparing for an annual sales event. As the traffic to the company's application increases, the development team wants to be notified when the Amazon EC2 instance's CPU utilization exceeds 80%.
Which solution will meet this requirement?- AA. Create a custom Amazon CloudWatch alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
- BB. Create a custom AWS Cloud Trail alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
- CC. Create a cron job on the EC2 instance that executes the --describe-instance-information command on the host instance every 15 minutes and sends the results to an Amazon SNS topic.
- DD. Create an AWS Lambda function that queries the AWS CloudTrail logs for the CPUUtilization metric every 15 minutes and sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
109An application running on Amazon EC2 opens connections to an Amazon RDS SQL Server database. The developer does not want to store the user name and password for the database in the code. The developer would also like to automatically rotate the credentials.
What is the MOST secure way to store and access the database credentials?- AA. Create an IAM role that has permissions to access the database. Attach the role to the EC2 instance.
- BB. Use AWS Secrets Manager to store the credentials. Retrieve the credentials from Secrets Manager as needed.
- CC. Store the credentials in an encrypted text file in an Amazon S3 bucket. Configure the EC2 instance's user data to download the credentials from Amazon S3 as the instance boots.
- DD. Store the user name and password credentials directly in the source code. No further action is needed because the source code is stored in a private repository.
110A global company has an application running on Amazon EC2 instances that serves image files from Amazon S3. User requests from the browser are causing high traffic, which results in degraded performance.
Which optimization solution should a developer implement to increase application performance?- AA. Create multiple prefixes in the S3 bucket to increase the request rate.
- BB. Create an Amazon ElastiCache cluster to cache and serve frequently accessed items.
- CC. Use Amazon CloudFront to serve the content of images stored in Amazon S3.
- DD. Submit a ticket to AWS Support to request a rate limit increase for the S3 bucket.
111An application needs to encrypt data that is written to Amazon S3 where the keys are managed in an on-premises data center, and the encryption is handled by
S3.
Which type of encryption should be used?- AA. Use server-side encryption with Amazon S3-managed keys
- BB. Use server-side encryption with AWS KMS-managed keys
- CC. Use client-side encryption with customer master key
- DD. Use server-side encryption with customer-provided keys
112A development team is working on a mobile app that allows users to upload pictures to Amazon S3. The team expects the app will be used by hundreds of thousands of users during a single event simultaneously. Once the pictures are uploaded, the backend service will scan and parse the pictures for inappropriate content.
Which approach is the MOST resilient way to achieve this goal, which also smooths out temporary volume spikes for the backend service?- AA. Develop an AWS Lambda function to check the upload folder in the S3 bucket. If new uploaded pictures are detected, the Lambda function will scan and parse them.
- BB. Once a picture is uploaded to Amazon S3, publish the event to an Amazon SQS queue. Use the queue as an event source to trigger an AWS Lambda function. In the Lambda function, scan and parse the picture.
- CC. When the user uploads a picture, invoke an API hosted in Amazon API Gateway. The API will invoke an AWS Lambda function to scan and parse the picture.
- DD. Create a state machine in AWS Step Functions to check the upload folder in the S3 bucket. If a new picture is detected, invoke an AWS Lambda function to scan and parse.
113A development team wants to run their container workloads on Amazon ECS. Each application container needs to share data with another container to collect logs and metrics.
What should the developer team do to meet these requirements?- AA. Create two pod specifications. Make one to include the application container and the other to include the other container. Link the two pods together.
- BB. Create two task definitions. Make one to include the application container and the other to include the other container. Mount a shared volume between the two tasks.
- CC. Create one task definition. Specify both containers in the definition. Mount a shared volume between those two containers.
- DD. Create a single pod specification. Include both containers in the specification. Mount a persistent volume to both containers.
114A company has 25,000 employees and is growing. The company is creating an application that will be accessible to its employees only. A developer is using
Amazon S3 to store images and Amazon RDS to store application data. The company requires that all employee information remain in the legacy Security
Assertion Markup Language (SAML) employee directory only and is not interested in mirroring any employee information on AWS.
How can the developer provide authorized access for the employees who will be using this application so each employee can access their own application data only?- AA. Use Amazon VPC and keep all resources inside the VPC, and use a VPC link for the S3 bucket with the bucket policy.
- BB. Use Amazon Cognito user pools, federate with the SAML provider, and use user pool groups with an IAM policy.
- CC. Use an Amazon Cognito identity pool, federate with the SAML provider, and use an IAM condition key with a value for the cognito-identity.amazonaws.com:sub variable to grant access to the employees.
- DD. Create a unique IAM role for each employee and have each employee assume the role to access the application so they can access their personal data only.
115A company has developed a new serverless application using AWS Lambda functions that will be deployed using the AWS Serverless Application Model (AWS
SAM) CLI.
Which step should the developer complete prior to deploying the application?- AA. Compress the application to a .zip file and upload it into AWS Lambda
- BB. Test the new AWS Lambda function by first tracing it in AWS X-Ray
- CC. Bundle the serverless application using a SAM package
- DD. Create the application environment using the eb create my-env command
116A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. An application running on Amazon EC2 instances in Account B requires access to the PII table. An administrator in Account A created an IAM role named AccessPII with privileges to access the PII table, and made Account B a trusted entity.
Which combination of additional steps should developers take to access the table? (Choose two.)- AA. Ask an administrator in Account B to allow the EC2 IAM role permission to assume the AccessPII role.
- BB. Ask an administrator in Account B to allow the EC2 IAM role permission to assume the AccessPII role with predefined service control policies.
- CC. Ask an administrator in Account A to allow the EC2 IAM role permission to assume the AccessPII role with predefined service control policies.
- DD. Include the AssumeRole API in the application code logic to obtain credentials to access the PII table.
- EE. Include the GetSessionToken API in the application code logic to obtain credentials to access the PII table.
117A developer is creating an AWS Lambda function that generates a new file each time it runs. Each new file must be checked into an AWS CodeCommit repository hosted in the same AWS account.
How should the developer accomplish this?- AA. When the Lambda function starts, use the Git CLI to clone the repository. Check the new file into the cloned repository and push the change.
- BB. After the new file is created in Lambda, use cURL to invoke the CodeCommit API. Send the file to the repository.
- CC. Use an AWS SDK to instantiate a CodeCommit client. Invoke the put_file method to add the file to the repository.
- DD. Upload the new to an Amazon S3 bucket. Create an AWS Step Function to accept S3 events. In the Step Function, add the new file to the repository.
118A developer must ensure that the IAM credentials used by an application in Amazon EC2 are not misused or compromised.
What should the developer use to keep user credentials secure?- AA. Environment variables
- BB. AWS credentials file
- CC. Instance profile credentials
- DD. Command line options
119A company has an application where reading objects from Amazon S3 is based on the type of user. The user types are registered user and guest user. The company has 25,000 users and is growing. Information is pulled from an S3 bucket depending on the user type.
Which approaches are recommended to provide access to both user types? (Choose two.)- AA. Provide a different access key and secret access key in the application code for registered users and guest users to provide read access to the objects.
- BB. Use S3 bucket policies to restrict read access to specific IAM users.
- CC. Use Amazon Cognito to provide access using authenticated and unauthenticated roles.
- DD. Create a new IAM user for each user and grant read access.
- EE. Use the AWS IAM service and let the application assume the different roles using the AWS Security Token Service (AWS STS) AssumeRole action depending on the type of user and provide read access to Amazon S3 using the assumed role.
120A developer is testing an application that invokes an AWS Lambda function asynchronously. During the testing phase, the Lambda function fails to process after two retries.
How can the developer troubleshoot the failure?- AA. Configure AWS CloudTrail logging to investigate the invocation failures
- BB. Configure Dead Letter Queues by sending events to Amazon SQS for investigation
- CC. Configure Amazon Simple Workflow Service to process any direct unprocessed events
- DD. Configure AWS Config to process any direct unprocessed events
121A developer is setting up Amazon API Gateway for their company's products. The API will be used by registered developers to query and update their environments. The company wants to limit the amount of requests end users can send for both cost and security reasons. Management wants to offer registered developers the option of buying larger packages that allow for more requests.
How can the developer accomplish this with the LEAST amount of overhead management?- AA. Enable throttling for the API Gateway stage. Set a value for both the rate and burst capacity. If a registered user chooses a larger package, create a stage for them, adjust the values, and share the new URL with them.
- BB. Set up Amazon CloudWatch API logging in API Gateway. Create a filter based on the user and requestTime fields and create an alarm on this filter. Write an AWS Lambda function to analyze the values and requester information, and respond accordingly. Set up the function as the target for the alarm. If a registered user chooses a larger package, update the Lambda code with the values.
- CC. Enable Amazon CloudWatch metrics for the API Gateway stage. Set up CloudWatch alarms based off the Count metric and the ApiName, Method, Resource, and Stage dimensions to alerts when request rates pass the threshold. Set the alarm action to Deny. If a registered user chooses a larger package, create a user-specific alarm and adjust the values.
- DD. Set up a default usage plan, specify values for the rate and burst capacity, and associate it with a stage. If a registered user chooses a larger package, create a custom plan with the appropriate values and associate the plan with the user.
122A developer is refactoring a monolithic application. The application takes a POST request and performs several operations. Some of the operations are in parallel while others run sequentially. These operations have been refactored into individual AWS Lambda functions. The POST request will be processed by Amazon API
Gateway.
How should the developer invoke the Lambda functions in the same sequence using API Gateway?- AA. Use Amazon SQS to invoke the Lambda functions
- BB. Use an AWS Step Functions activity to run the Lambda functions
- CC. Use Amazon SNS to trigger the Lambda functions
- DD. Use an AWS Step Functions state machine to orchestrate the Lambda functions
123A company is adding stored value (or gift card) capability to its highly popular casual gaming website. Users need to be able to trade this value for other users' items on the platform. This would require both users' records be updated as a single transaction, or both users' records to be completely rolled back.
Which AWS database options can provide the transactional capability required for this new feature? (Choose two.)- AA. Amazon DynamoDB with operations made with the ConsistentRead parameter set to true
- BB. Amazon ElastiCache for Memcached with operations made within a transaction block
- CC. Amazon Aurora MySQL with operations made within a transaction block
- DD. Amazon DynamoDB with reads and writes made using Transact* operations
- EE. Amazon Redshift with operations made within a transaction block.
124A developer has created a REST API using Amazon API Gateway. The developer wants to log who and how each caller accesses the API. The developer also wants to control how long the logs are kept.
What should the developer do to meet these requirements?- AA. Enable API Gateway execution logging. Delete old logs using API Gateway retention settings.
- BB. Enable API Gateway access logs. Use Amazon CloudWatch retention settings to delete old logs.
- CC. Enable detailed Amazon CloudWatch metrics. Delete old logs with a recurring AWS Lambda function.
- DD. Create and use API Gateway usage plans. Delete old logs with a recurring AWS Lambda function.
125A company is developing a new web application in Python. A developer must deploy the application using AWS Elastic Beanstalk from the AWS Management
Console. The developer creates an Elastic Beanstalk source bundle to upload using the console.
Which of the following are requirements when creating the source bundle? (Choose two.)- AA. The source bundle must include the ebextensions.yaml file
- BB. The source bundle must not include a top-level directory
- CC. The source bundle must be compressed with any required dependencies in a top-level parent folder
- DD. The source bundle must be created as a single .zip or .war file
- EE. The source bundle must be uploaded into Amazon EFS
126A developer is creating a role to access Amazon S3 buckets. To create the role, the developer uses the AWS CLI create-role command.
Which policy should be added to allow the Amazon EC2 service to assume the role?- AA. Managed policy
- BB. Trust policy
- CC. Inline policy
- DD. Service control policy (SCP)
127A company is running a custom application on a set of on-premises Linux servers that are accessed using Amazon API Gateway AWS X-Ray tracing has been enabled on the API test stage.
How can a developer enable X-Ray tracing on the on-premises servers with the LEAST amount of configuration?- AA. Install and run the X-Ray SDK on the on-premises servers to capture and relay the data to the X-Ray service.
- BB. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.
- CC. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTraceSegments API call.
- DD. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTelemetryRecords API call.
128A developer works in an environment with multiple AWS accounts that have AWS Lambda functions processing the same 100 KB payloads. The developer wants to centralize the point of origin of the payloads to one account and have all the Lambda functions be invoked whenever the initiating event occurs in the parent account.
How can the developer design the workflow in the MOST efficient way, so all the multi-account Lambda functions get invoked when the event occurs?- AA. Create a Lambda function in the parent account and use cross-account IAM roles with the AWS Security Token Service (AWS STS) AssumeRole API call to make AWS Lambda invoke the API call to invoke all the cross-account Lambda functions.
- BB. Subscribe all the multi-account Lambda functions to an Amazon SNS topic and make a SNS Publish API call with the payload to the SNS topic.
- CC. Set up an Amazon SQS queue with the queue policy permitting the ReceiveMessage action for multi-account Lambda functions. Then send the payload to the SQS queue using the sqs:SendMessage permission and poll the queue using multi-account Lambda functions.
- DD. Use a worker on an Amazon EC2 instance to poll for the payload event. Invoke all Lambda functions using the Lambda Invoke API after using cross-account IAM roles with the AWS Security Token Service (AWS STS) AssumeRole API call.
129A large company has its application components distributed across multiple AWS accounts. The company needs to collect and visualize trace data across these accounts.
What should be used to meet these requirements?- AA. AWS X-Ray
- BB. Amazon CloudWatch
- CC. Amazon VPC flow logs
- DD. Amazon Elasticsearch Service
130A startup s photo-sharing site is deployed in a VPC. An ELB distributes web traffic across two subnets. ELB session stickiness is configured to use the AWS-generated session cookie, with a session TTL of 5 minutes.
The webserver Auto Scaling Group is configured as: min-size=4, max-size=4.
The startups preparing for a public launch, by running load-testing software installed on a single EC2 instance running in us-west-2
After 60 minutes of load-testing, the webserver logs show:
Which recommendations can help ensure load-testing HTTP requests are evenly distributed across the four webservers? (Choose two.)- AA. Launch and run the load-tester EC2 instance from us-east-1 instead.
- BB. Re-configure the load-testing software to re-resolve DNS for each web request.
- CC. Use a 3rd-party load-testing service which offers globally-distributed test clients.
- DD. Configure ELB and Auto Scaling to distribute across us-west-2a and us-west-2c.
- EE. Configure ELB session stickiness to use the app-specific session cookie.
131A startup s photo-sharing site is deployed in a VPC. An ELB distributes web traffic across two subnets. ELB session stickiness is configured to use the AWS- generated session cookie, with a session TTL of 5 minutes. The webserver Auto Scaling Group is configured as: min-size=4, max-size=4.
The startups preparing for a public launch, by running load-testing software installed on a single EC2 instance running in us-west-2
After 60 minutes of load-testing, the webserver logs show:
Which recommendations can help ensure load-testing HTTP requests are evenly distributed across the four webservers? (Choose two.)- AA. Launch and run the load-tester EC2 instance from us-east-1 instead.
- BB. Re-configure the load-testing software to re-resolve DNS for each web request.
- CC. Use a 3rd-party load-testing service which offers globally-distributed test clients.
- DD. Configure ELB and Auto Scaling to distribute across us-west-2a and us-west-2c.
- EE. Configure ELB session stickiness to use the app-specific session cookie.
Information
- Description
- Quiz on AWS_301~, created by Nguyen Nhan on 07/09/2020.
- Author
- Nguyen Nhan
- Language
- English
- Views
- 4
- Rating
- No ratings yet Rate this quiz