AWS SM 4

Question 1

An IT company is using AWS CloudFormation to manage its IT infrastructure. It has created a template to provision a stack with a VPC and a subnet. The output value of this subnet has to be used in another stack.
As a Developer Associate, which of the following options would you suggest to provide this information to another stack?

Accepted Answer

Use 'Export' field in the Output section of the stack's template

Answer

Use 'Expose' field in the Output section of the stack's template

Answer

Use Fn::Transform

Answer

Use Fn::ImportValue

Question 2

A cybersecurity company is publishing critical log data to a log group in Amazon CloudWatch Logs, which was created 3 months ago. The company must encrypt the log data using an AWS KMS customer master key (CMK), so any future data can be encrypted to meet the company’s security guidelines.
How can the company address this use-case?

Accepted Answer

Use the AWS CLI associate-kms-key command and specify the KMS key ARN

Answer

Use the AWS CLI describe-log-groups command and specify the KMS key ARN

Answer

Use the AWS CLI create-log-group command and specify the KMS key ARN

Answer

Enable the encrypt feature on the log group via the CloudWatch Logs console

Question 3

A firm maintains a highly available application that receives HTTPS traffic from mobile devices and web browsers. The main Developer would like to set up the Load Balancer routing to route traffic from web servers to smart.com/api and from mobile devices to smart.com/mobile. A developer advises that the previous recommendation is not needed and that requests should be sent to api.smart.com and mobile.smart.com instead.
Which of the following routing options were discussed in the given use-case? (select two)

Accepted Answer

Path based

Accepted Answer

Host based

Answer

Cookie value

Answer

Client IP

Answer

Web browser version

Question 4

A senior cloud engineer designs and deploys online fraud detection solutions for credit card companies processing millions of transactions daily. The Elastic Beanstalk application sends files to Amazon S3 and then sends a message to an Amazon SQS queue containing the path of the uploaded file in S3. The engineer wants to postpone the delivery of any new messages to the queue for at least 10 seconds.
Which SQS feature should the engineer leverage?

Accepted Answer

Use DelaySeconds parameter

Answer

Use visibility timeout parameter

Answer

Enable LongPolling

Answer

Implement application-side delay

Question 5

A .NET developer team works with many ASP.NET web applications that use EC2 instances to host them on IIS. The deployment process needs to be configured so that multiple versions of the application can run in AWS Elastic Beanstalk. One version would be used for development, testing, and another version for load testing.
Which of the following methods do you recommend?

Accepted Answer

Define a dev environment with a single instance and a 'load test' environment that has settings close to production environment

Answer

Use only one Beanstalk environment and perform configuration changes using an Ansible script

Answer

You cannot have multiple development environments in Elastic Beanstalk, just one development and one production environment

Answer

Create an Application Load Balancer to route based on hostname so you can pass on parameters to the development Elastic Beanstalk environment. Create a file in .ebextensions/ to know how to handle the traffic coming from the ALB

Question 6

A company wants to add geospatial capabilities to the cache layer, along with query capabilities and an ability to horizontally scale. The company uses Amazon RDS as the database tier.
Which solution is optimal for this use-case?

Accepted Answer

Leverage the capabilities offered by ElastiCache for Redis with cluster mode enabled

Answer

Use CloudFront caching to cater to demands of increasing workloads

Answer

Migrate to Amazon DynamoDB to utilize the automatically integrated DynamoDB Accelerator (DAX) along with query capability features

Answer

Leverage the capabilities offered by ElastiCache for Redis with cluster mode disabled

Question 7

DevOps engineers are developing an order processing system where notifications are sent to a department whenever an order is placed for a product. The system also pushes identical notifications of the new order to a processing module that would allow EC2 instances to handle the fulfillment of the order. In the case of processing errors, the messages should be allowed to be re-processed at a later stage. The order processing system should be able to scale transparently without the need for any manual or programmatic provisioning of resources.
Which of the following solutions can be used to address this use-case?

Accepted Answer

SNS + SQS

Answer

SNS + Kinesis

Answer

SQS + SES

Answer

SNS + Lambda

Question 8

Your company manages MySQL databases on EC2 instances to have full control. Applications on other EC2 instances managed by an ASG make requests to these databases to get information that displays data on dashboards viewed on mobile phones, tablets, and web browsers.
Your manager would like to scale your Auto Scaling group based on the number of requests per minute. How can you achieve this?

Accepted Answer

You create a CloudWatch custom metric and build an alarm to scale your ASG

Answer

Attach additional Elastic File Storage

Answer

Attach an Elastic Load Balancer

Answer

You enable detailed monitoring and use that to scale your ASG

Question 9

You have been hired at a company that needs an experienced developer to help with a continuous integration/continuous delivery (CI/CD) workflow on AWS. You configure the company’s workflow to run an AWS CodePipeline pipeline whenever the application’s source code changes in a repository hosted in AWS Code Commit and compiles source code with AWS Code Build. You are configuring ProjectArtifacts in your build stage.
Which of the following should you do?

Accepted Answer

Give AWS CodeBuild permissions to upload the build output to your Amazon S3 bucket

Answer

Configure AWS CodeBuild to store output artifacts on EC2 servers

Answer

Give AWS CodeCommit permissions to upload the build output to your Amazon S3 bucket

Answer

Contact AWS Support to allow AWS CodePipeline to manage build outputs

Question 10

You are a manager for a tech company that has just hired a team of developers to work on the company's AWS infrastructure. All the developers are reporting to you that when using the AWS CLI to execute commands it fails with the following exception: You are not authorized to perform this operation. Encoded authorization failure message: 6h34GtpmGjJJUm946eDVBfzWQJk6z5GePbbGDs9Z2T8xZj9EZtEduSnTbmrR7pMqpJrVYJCew2m8YBZQf4HRWEtrpncANrZMsnzk.
Which of the following actions will help developers decode the message?

Accepted Answer

AWS STS decode-authorization-message

Answer

Use KMS decode-authorization-message

Answer

AWS IAM decode-authorization-message

Answer

AWS Cognito Decoder

Question 11

You have uploaded a zip file to AWS Lambda that contains code files written in Node.Js. When your function is executed you receive the following output, 'Error: Memory Size: 10,240 MB Max Memory Used'.
Which of the following explains the problem?

Accepted Answer

Your Lambda function ran out of RAM

Answer

You have uploaded a zip file larger than 50 MB to AWS Lambda

Answer

Your zip file is corrupt

Answer

The uncompressed zip file exceeds AWS Lambda limits

Question 12

You have a popular web application that accesses data stored in an Amazon Simple Storage Service (S3) bucket. Developers use the SDK to maintain the application and add new features. Security compliance requests that all new objects uploaded to S3 be encrypted using SSE-S3 at the time of upload. Which of the following headers must the developers add to their request?

Accepted Answer

'x-amz-server-side-encryption': 'AES256'

Answer

'x-amz-server-side-encryption': 'aws:kms'

Answer

'x-amz-server-side-encryption': 'SSE-S3'

Answer

'x-amz-server-side-encryption': 'SSE-KMS'

Question 13

A firm uses AWS DynamoDB to store information about people’s favorite sports teams and allow the information to be searchable from their home page. There is a daily requirement that all 10 million records in the table should be deleted then re-loaded at 2:00 AM each night.
Which option is an efficient way to delete with minimal costs?

Accepted Answer

Delete then re-create the table

Answer

Call PurgeTable

Answer

Scan and call DeleteItem

Answer

Scan and call BatchDeleteItem

Question 14

An organization recently began using AWS CodeCommit for its source control service. A compliance security team visiting the organization was auditing the software development process and noticed developers making many git push commands within their development machines. The compliance team requires that encryption be used for this activity.
How can the organization ensure source code is encrypted in transit and at rest?

Accepted Answer

Repositories are automatically encrypted at rest

Answer

Enable KMS encryption

Answer

Use AWS Lambda as a hook to encrypt the pushed code

Answer

Use a git command line hook to encrypt the code client side

Question 15

You are designing a high-performance application that requires millions of connections. You have several EC2 instances running Apache2 web servers and the application will require capturing the user’s source IP address and source port without the use of X-Forwarded-For.
Which of the following options will meet your needs?

Accepted Answer

Network Load Balancer

Answer

Elastic Load Balancer

Answer

Classic Load Balancer

Answer

Application Load Balancer

Question 16

You are getting ready for an event to show off your Alexa skill written in JavaScript. As you are testing your voice activation commands you find that some intents are not invoking as they should and you are struggling to figure out what is happening. You included the following code console.log(JSON.stringify(this.event)) in hopes of getting more details about the request to your Alexa skill.
You would like the logs stored in an Amazon Simple Storage Service (S3) bucket named MyAlexaLog. How do you achieve this?

Accepted Answer

Use CloudWatch integration feature with S3

Answer

Use CloudWatch integration feature with Lambda

Answer

Use CloudWatch integration feature with Glue

Answer

Use CloudWatch integration feature with Kinesis

Question 17

A developer is creating access credentials for an Amazon EC2 instance that hosts the web application using AWS SDK for Java.
If the default credentials provider chain is used on the instance, which parameter will be checked first for the required credentials?

Accepted Answer

Parameters aws.accessKeyId and aws.secretKey will be checked in the Java system properties

Answer

Instance profile credentials, which exist within the instance metadata associated with the IAM role for the EC2 instance

Answer

The system environment variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are checked first

Answer

Credentials delivered through the Amazon EC2 container service

Question 18

A development team uses the AWS SDK for Java to maintain an application that stores data in AWS DynamoDB. The application makes use of Scan operations to return several items from a 25 GB table. There is no possibility of creating indexes to retrieve these items predictably. Developers are trying to get these specific rows from DynamoDB as fast as possible.
Which of the following options can be used to improve the performance of the Scan operation?

Accepted Answer

Use parallel scans

Answer

Use a Query

Answer

Use a ProjectionExpression

Answer

Use a FilterExpression

Question 19

A development team had enabled and configured CloudTrail for all the Amazon S3 buckets used in a project. The project manager owns all the S3 buckets used in the project. However, the manager noticed that he did not receive any object-level API access logs when the data was read by another AWS account.
What could be the reason for this behavior/error?

Accepted Answer

The bucket owner also needs to be object owner to get the object access logs

Answer

CloudTrail needs to be configured on both the AWS accounts for receiving the access logs in cross-account access

Answer

CloudTrail always delivers object-level API access logs to the requester and not to object owner

Answer

The meta-data of the bucket is in an invalid state and needs to be corrected by the bucket owner from AWS console to fix the issue

Question 20

Your organization is looking into making a change to all virtual machines in the cloud. They would like to take advantage of running a bootstrap script for their Windows Server 2012 Base AMI virtual machines when they first boot.
Which of the following options will allow the organization to achieve this?

Accepted Answer

EC2 User Data

Answer

Mount EFS network drives

Answer

Custom AMI

Answer

EC2 Meta Data

Question 21

A data analytics company with its IT infrastructure on the AWS Cloud wants to build and deploy its flagship application as soon as there are any changes to the source code.
As a Developer Associate, which of the following options would you suggest to trigger the deployment? (Select two)

Accepted Answer

Keep the source code in an Amazon S3 bucket and start AWS CodePipeline whenever a file in the S3 bucket is updated

Accepted Answer

Keep the source code in an AWS CodeCommit repository and start AWS CodePipeline whenever a change is pushed to the CodeCommit repository

Answer

Keep the source code in an Amazon S3 bucket and set up AWS CodePipeline to recur at an interval of every 15 minutes

Answer

Keep the source code in Amazon EFS and start AWS CodePipeline whenever a file is updated

Answer

Keep the source code in an Amazon EBS volume and start AWS CodePipeline whenever there are updates to the source code

Question 22

You have a web application hosted on EC2 that makes GET and PUT requests for objects stored in Amazon Simple Storage Service (S3) using the SDK for PHP. As the security team completed the final review of your application for vulnerabilities, they noticed that your application uses hardcoded IAM access key and secret access key to gain access to AWS services. They recommend you leverage a more secure setup, which should use temporary credentials if possible.
Which of the following options can be used to address the given use-case?

Accepted Answer

Use an IAM Instance Role

Answer

Use the SSM parameter store

Answer

Hardcode the credentials in the application code

Answer

Use environment variables

Question 23

A company has several Linux-based EC2 instances that generate various log files which need to be analyzed for security and compliance purposes. The company wants to use Kinesis Data Streams (KDS) to analyze this log data.
Which of the following is the most optimal way of sending log data from the EC2 instances to KDS?

Accepted Answer

Install and configure Kinesis Agent on each of the instances

Answer

Run cron job on each of the instances to collect log data and send it to Kinesis Data Streams

Answer

Use Kinesis Producer Library (KPL) to collect and ingest data from each EC2 instance

Answer

Install AWS SDK on each of the instances and configure it to send the necessary files to Kinesis Data Streams

Question 24

You have an Amazon Kinesis Data Stream with 10 shards, and from the metrics, you are well below the throughput utilization of 10 MB per second to send data. You send 3 MB per second of data and yet you are receiving ProvisionedThroughputExceededException errors frequently.
What is the likely cause of this?

Accepted Answer

The partition key that you have selected isn't distributed enough

Answer

The data retention period is too long

Answer

You have too many shards

Answer

Metrics are slow to update

Question 25

As a Full-stack Web Developer, you are involved with every aspect of a company’s platform from development with PHP and JavaScript to the configuration of NoSQL databases with Amazon DynamoDB. You are not concerned about your response receiving stale data from your database and need to perform 16 eventually consistent reads per second of 12 KB in size each.
How many read capacity units (RCUs) do you need?

Accepted Answer

24

Answer

192

Answer

12

Answer

48

Question 26

A development team is storing sensitive customer data in S3 that will require encryption at rest. The encryption keys must be rotated at least annually.
What is the easiest way to implement a solution for this requirement?

Accepted Answer

Use AWS KMS with automatic key rotation

Answer

Import a custom key into AWS KMS and automate the key rotation on an annual basis by using a Lambda function

Answer

Use SSE-C with automatic key rotation on an annual basis

Answer

Encrypt the data before sending it to Amazon S3

Question 27

Your AWS CodeDeploy deployment to T2 instances succeed. The new application revision makes API calls to Amazon S3 however the application is not working as expected due to authorization exceptions and you were assigned to troubleshoot the issue.
Which of the following should you do?

Accepted Answer

Fix the IAM permissions for the EC2 instance role

Answer

Fix the IAM permissions for the CodeDeploy service role

Answer

Enable CodeDeploy Proxy

Answer

Make the S3 bucket public

Question 28

Your company is in the process of building a DevOps culture and is moving all of its on-premise resources to the cloud using serverless architectures and automated deployments. You have created a CloudFormation template in YAML that uses an AWS Lambda function to pull HTML files from GitHub and place them into an Amazon Simple Storage Service (S3) bucket that you specify.
Which of the following AWS CLI commands can you use to upload AWS Lambda functions and AWS CloudFormation templates to AWS?

Accepted Answer

cloudformation package and cloudformation deploy

Answer

cloudformation zip and cloudformation upload

Answer

cloudformation package and cloudformation upload

Answer

cloudformation zip and cloudformation deploy

Question 29

A media company is building an application that needs to store video files in Amazon S3. Management requires that the files be encrypted before they are sent to Amazon S3 for storage. The encryption keys need to be managed by an in-house security team but the key itself is stored on AWS.
Which solution should the company use to meet these requirements?

Accepted Answer

Use client-side encryption with an AWS KMS managed customer master key (CMK)

Answer

Use server-side encryption with customer-provided encryption key (SSE-C)

Answer

Use client-side encryption with Amazon S3 managed key

Answer

Use server-side encryption with a client-side master key

Question 30

A website serves static content from an Amazon Simple Storage Service (Amazon S3) bucket and dynamic content from an application load balancer. The user base is spread across the world and latency should be minimized for a better user experience.
Which technology/service can help access the static and dynamic content while keeping the data latency low?

Accepted Answer

Configure CloudFront with multiple origins to serve both static and dynamic content at low latency to global users

Answer

Use CloudFront's Origin Groups to group both static and dynamic requests into one request for further processing

Answer

Use Global Accelerator to transparently switch between S3 bucket and load balancer for different data needs

Answer

Use CloudFront's Lambda@Edge feature to server data from S3 buckets and load balancer programmatically on-the-fly

Question 31

As part of internal regulations, you must ensure that all communications to Amazon S3 are encrypted.
For which of the following encryption mechanisms will a request get rejected if the connection is not using HTTPS?

Accepted Answer

SSE-C

Answer

SSE-KMS

Answer

Client Side Encryption

Answer

SSE-S3

Question 32

The development team at a company wants to insert vendor records into an Amazon DynamoDB table as soon as the vendor uploads a new file into an Amazon S3 bucket.
As a Developer Associate, which set of steps would you recommend to achieve this?

Accepted Answer

Create an S3 event to invoke a Lambda function that inserts records into DynamoDB

Answer

Set up an event with Amazon CloudWatch Events that will monitor the S3 bucket and then insert the records into DynamoDB

Answer

Write a cron job that will execute a Lambda function at a scheduled time and insert the records into DynamoDB

Answer

Develop a Lambda function that will poll the S3 bucket and then insert the records into DynamoDB

Question 33

A developer has pushed a Lambda function that pushes data into an RDS MySQL database with the following Python code:
def handler(event, context):
    mysql = mysqlclient.connect()
    data = event['data']
    mysql.execute(f"INSERT INTO foo (bar) VALUES (${data});")
    mysql.close()
    return
 
On the first execution, the Lambda function takes 2 seconds to execute. On the second execution and all the subsequent ones, the Lambda function takes 1.9 seconds to execute.
What can be done to improve the execution time of the Lambda function?

Accepted Answer

Move the database connection out of the handler

Answer

Increase the Lambda function RAM

Answer

Change the runtime to Node.js

Answer

Upgrade the MySQL instance type

Question 34

An organization uses Alexa as its intelligent assistant to improve productivity throughout the organization. A group of developers manages custom Alexa Skills written in Node.Js to control conference-room equipment settings and start meetings using voice activation. The manager has requested developers that all functions code should be monitored for error rates with the possibility of creating alarms on top of them.
Which of the following options should be chosen? (select two)

Accepted Answer

CloudWatch Alarms

Accepted Answer

CloudWatch Metrics

Answer

X-Ray

Answer

SSM

Answer

CloudTrail

Question 35

An IT company uses a blue/green deployment policy to provision new Amazon EC2 instances in an Auto Scaling group behind a new Application Load Balancer for each new application version. The current set up requires the users to log in after every new deployment.
As a Developer Associate, what advice would you give to the company for resolving this issue?

Accepted Answer

Use ElastiCache to maintain user sessions

Answer

Enable sticky sessions in the Application Load Balancer

Answer

Use rolling updates instead of a blue/green deployment

Answer

Use multicast to replicate session information

Question 36

You are planning to build a fleet of EBS-optimized EC2 instances to handle the load of your new application. Due to security compliance, your organization wants any secret strings used in the application to be encrypted to prevent exposing values as clear text.
The solution requires that decryption events be audited and API calls to be simple. How can this be achieved? (select two)

Accepted Answer

Audit using CloudTrail

Accepted Answer

Store the secret as SecureString in SSM Parameter Store

Answer

Store the secret as PlainText in SSM Parameter Store

Answer

Audit using SSM Audit Trail

Answer

Encrypt first with KMS then store in SSM Parameter store

Question 37

A financial services company with over 10,000 employees has hired you as the new Senior Developer. Initially caching was enabled to reduce the number of calls made to all API endpoints and improve the latency of requests to the company’s API Gateway.
For testing purposes, you would like to invalidate caching for the API clients to get the most recent responses. Which of the following should you do?

Accepted Answer

Using the Header Cache-Control: max-age=0

Answer

Use the Request parameter: ?bypass_cache=1

Answer

Using the Header Bypass-Cache=1

Answer

Using the request parameter ?cache-control-max-age=0

Question 38

You are assigned as the new project lead for a web application that processes orders for customers. You want to integrate event-driven processing anytime data is modified or deleted and use a serverless approach using AWS Lambda for processing stream events.
Which of the following databases should you choose from?

Accepted Answer

DynamoDB

Answer

ElastiCache

Answer

RDS

Answer

Kinesis

Question 39

An order management system uses a cron job to poll for any new orders. Every time a new order is created, the cron job sends this order data as a message to the message queues to facilitate downstream order processing in a reliable way. To reduce costs and improve performance, the company wants to move this functionality to AWS cloud.
Which of the following is the most optimal solution to meet this requirement?

Accepted Answer

Use Amazon Simple Notification Service (SNS) to push notifications when an order is created. Configure different Amazon Simple Queue Service (SQS) queues to receive these messages for downstream processing

Answer

Use Amazon Simple Notification Service (SNS) to push notifications and use AWS Lambda functions to process the information received from SNS

Answer

Use Amazon Simple Notification Service (SNS) to push notifications to Kinesis Data Firehose delivery streams for processing the data for downstream applications

Answer

Configure different Amazon Simple Queue Service (SQS) queues to poll for new orders

Question 40

Pregunta 40: Omitido
Your company has been hired to build a resilient mobile voting app for an upcoming music award show that expects to have 5 to 20 million viewers. The mobile voting app will be marketed heavily months in advance so you are expected to handle millions of messages in the system. You are configuring Amazon Simple Queue Service (SQS) queues for your architecture that should receive messages from 20 KB to 200 KB.
Is it possible to send these messages to SQS?

Accepted Answer

Yes, the max message size is 256KB

Answer

No, the max message size is 128KB

Answer

Yes, the max message size is 512KB

Answer

No, the max message size is 64KB

Question 41

You work as a developer doing contract work for the government on AWS gov cloud. Your applications use Amazon Simple Queue Service (SQS) for its message queue service. Due to recent hacking attempts, security measures have become stricter and require you to store data in encrypted queues.
Which of the following steps can you take to meet your requirements without making changes to the existing code?

Accepted Answer

Enable SQS KMS encryption

Answer

Use the SSL endpoint

Answer

Use Secrets Manager

Answer

Use Client side encryption

Question 42

A developer is configuring an Application Load Balancer (ALB) to direct traffic to the application's EC2 instances and Lambda functions.
Which of the following characteristics of the ALB can be identified as correct? (Select two)

Accepted Answer

You can not specify publicly routable IP addresses to an ALB

Accepted Answer

An ALB has three possible target types: Instance, IP and Lambda

Answer

If you specify targets using IP addresses, traffic is routed to instances using the primary private IP address

Answer

An ALB has three possible target types: Hostname, IP and Lambda

Answer

If you specify targets using an instance ID, traffic is routed to instances using any private IP address from one or more network interfaces

Question 43

You have a popular three-tier web application that is used by users throughout the globe receiving thousands of incoming requests daily. You have AWS Route 53 policies to automatically distribute weighted traffic to the API resources located at URL api.global.com.
What is an alternative way of distributing traffic to a web application?

Accepted Answer

ELB

Answer

CloudFront

Answer

Auto Scaling

Answer

S3

Question 44

Your company leverages Amazon CloudFront to provide content via the internet to customers with low latency. Aside from latency, security is another concern and you are looking for help in enforcing end-to-end connections using HTTPS so that content is protected.
Which of the following options is available for HTTPS in AWS CloudFront?

Accepted Answer

Between clients and CloudFront as well as between CloudFront and backend

Answer

Between clients and CloudFront only

Answer

Between CloudFront and backend only

Answer

Neither between clients and CloudFront nor between CloudFront and backend

Question 45

A development team is considering Amazon ElastiCache for Redis as its in-memory caching solution for its relational database.
Which of the following options are correct while configuring ElastiCache? (Select two)

Accepted Answer

All the nodes in a Redis cluster must reside in the same region

Accepted Answer

While using Redis with cluster mode enabled, you cannot manually promote any of the replica nodes to primary

Answer

While using Redis with cluster mode enabled, asynchronous replication mechanisms are used to keep the read replicas synchronized with the primary. If cluster mode is disabled, the replication mechanism is done synchronously

Answer

If you have no replicas and a node fails, you experience no loss of data when using Redis with cluster mode enabled

Answer

You can scale write capacity for Redis by adding replica nodes

Question 46

An IT company has a web application running on Amazon EC2 instances that needs read-only access to an Amazon DynamoDB table.
As a Developer Associate, what is the best-practice solution you would recommend to accomplish this task?

Accepted Answer

Create an IAM role with an AmazonDynamoDBReadOnlyAccess policy and apply it to the EC2 instance profile

Answer

Create an IAM user with Administrator access and configure AWS credentials for this user on the given EC2 instance

Answer

Create a new IAM user with access keys. Attach an inline policy to the IAM user with read-only access to DynamoDB. Place the keys in the code. For security, redeploy the code whenever the keys rotate

Answer

Run application code with AWS account root user credentials to ensure full access to all AWS services

Question 47

Your company stores confidential data on an Amazon Simple Storage Service (S3) bucket. New security compliance guidelines require that files be stored with server-side encryption. The encryption used must be Advanced Encryption Standard (AES-256) and the company does not want to manage S3 encryption keys.
Which of the following options should you use?

Accepted Answer

SSE-S3

Answer

SSE-C

Answer

SSE-KMS

Answer

Client Side Encryption

Question 48

You have moved your on-premise infrastructure to AWS and are in the process of configuring an AWS Elastic Beanstalk deployment environment for production, development, and testing. You have configured your production environment to use a rolling deployment to prevent your application from becoming unavailable to users. For the development and testing environment, you would like to deploy quickly and are not concerned about downtime.
Which of the following deployment policies meet your needs?

Accepted Answer

All at once

Answer

Immutable

Answer

Rolling with additional batches

Answer

Rolling

Question 49

A voting system hosted on-premise was recently migrated to AWS to lower cost, gain scalability, and to better serve thousands of concurrent users. When one of the AWS resource state changes, it generates an event and will need to trigger AWS Lambda. The AWS resource whose state changes and AWS Lambda does not have direct integration.
Which of the following methods can be used to trigger AWS Lambda?

Accepted Answer

CloudWatch Events Rules with AWS Lambda

Answer

Open a support ticket with AWS

Answer

AWS Lambda Custom Sources

Answer

Cron jobs to trigger AWS Lambda to check the state of your service

Question 50

An Amazon Simple Queue Service (SQS) has to be configured between two AWS accounts for shared access to the queue. AWS account A has the SQS queue in its account and AWS account B has to be given access to this queue.
Which of the following options need to be combined to allow this cross-account access? (Select three)

Accepted Answer

The account A administrator creates an IAM role and attaches a permissions policy

Accepted Answer

The account B administrator delegates the permission to assume the role to any users in account B

Accepted Answer

The account A administrator attaches a trust policy to the role that identifies account B as the principal who can assume the role

Answer

The account A administrator attaches a trust policy to the role that identifies account B as the AWS service principal who can assume the role

Answer

The account A administrator delegates the permission to assume the role to any users in account A

Answer

The account B administrator creates an IAM role and attaches a trust policy to the role with account B as the principal

Question 51

You are revising options that would be best for monitoring a few EC2 instances you currently manage. Amazon CloudWatch has metrics available to monitor your EC2 instances for CPU load, I/O, and network I/O. Your budget does not allow for spending on monitoring so using the default monitoring available is your preferred choice.
With default monitoring, at what interval will these metrics be collected?

Accepted Answer

5 minutes

Answer

2 minutes

Answer

1 minute

Answer

10 minutes

Question 52

Your mobile application needs to perform API calls to DynamoDB. You do not want to store AWS secret and access keys onto the mobile devices and need all the calls to DynamoDB made with a different identity per mobile device.
Which of the following services allows you to achieve this?

Accepted Answer

Cognito Identity Pools

Answer

IAM

Answer

Cognito User Pools

Answer

Cognito Sync

Question 53

Your development team uses the AWS SDK for Java on a web application that uploads files to several Amazon Simple Storage Service (S3) buckets using the SSE-KMS encryption mechanism. Developers are reporting that they are receiving permission errors when trying to push their objects over HTTP. Which of the following headers should they include in their request?

Accepted Answer

'x-amz-server-side-encryption': 'aws:kms'

Answer

'x-amz-server-side-encryption': 'SSE-S3'

Answer

'x-amz-server-side-encryption': 'AES256'

Answer

'x-amz-server-side-encryption': 'SSE-KMS'

Question 54

You have a Java-based application running on EC2 instances loaded with AWS CodeDeploy agents. You are considering different options for deployment, one is the flexibility that allows for incremental deployment of your new application versions and replaces existing versions in the EC2 instances. The other option is a strategy in which an Auto Scaling group is used to perform a deployment.
Which of the following options will allow you to deploy in this manner? (Select two)

Accepted Answer

Blue/green Deployment

Accepted Answer

In-place Deployment

Answer

Cattle Deployment

Answer

Warm Standby Deployment

Answer

Pilot Light Deployment

Question 55

A company developed an app-based service for citizens to book transportation rides in the local community. The platform is running on AWS EC2 instances and uses Amazon Relational Database Service (RDS) for storing transportation data. A new feature has been requested where receipts would be emailed to customers with PDF attachments retrieved from Amazon Simple Storage Service (S3).
Which of the following options will provide EC2 instances with the right permissions to upload files to Amazon S3 and generate S3 Signed URL?

Accepted Answer

Create an IAM Role for EC2

Answer

CloudFormation

Answer

Run aws configure on the EC2 instance

Answer

EC2 User Data

Question 56

A developer is migrating an on-premises application to AWS Cloud. The application currently processes user uploads and uploads them to a local directory on the server. All such file uploads must be saved and then made available to all instances in an Auto Scaling group.
As a Developer Associate, which of the following options would you recommend for this use-case?

Accepted Answer

Use Amazon S3 and make code changes in the application so all uploads are put on S3

Answer

Use Amazon EBS as the storage volume and share the files via file synchronization software

Answer

Use Amazon EBS and configure the application AMI to use a snapshot of the same EBS instance while launching new instances

Answer

Use Instance Store type of EC2 instances and share the files via file synchronization software

Question 57

After reviewing your monthly AWS bill you notice that the cost of using Amazon SQS has gone up substantially after creating new queues; however, you know that your queue clients do not have a lot of traffic and are receiving empty responses.
Which of the following actions should you take?

Accepted Answer

Use LongPolling

Answer

Decrease DelaySeconds

Answer

Increase the VisibilityTimeout

Answer

Use a FIFO queue

Question 58

You are working on a project that has over 100 dependencies. Every time your AWS CodeBuild runs a build step it has to resolve Java dependencies from external Ivy repositories which take a long time. Your manager wants to speed this process up in AWS CodeBuild.
Which of the following will help you do this with minimal effort?

Accepted Answer

Cache dependencies on S3

Answer

Use Instance Store type of EC2 instances to facilitate internal dependency cache

Answer

Reduce the number of dependencies

Answer

Ship all the dependencies as part of the source code

Question 59

A company would like to migrate the existing application code from a GitHub repository to AWS CodeCommit.
As an AWS Certified Developer Associate, which of the following would you recommend for migrating the cloned repository to CodeCommit over HTTPS?

Accepted Answer

Use Git credentials generated from IAM

Answer

Use authentication offered by GitHub secure tokens

Answer

Use IAM Multi-Factor authentication

Answer

Use IAM user secret access key and access key ID

Question 60

You are a system administrator whose company recently moved its production application to AWS and migrated data from MySQL to AWS DynamoDB. You are adding new tables to AWS DynamoDB and need to allow your application to query your data by the primary key and an alternate key. This option must be added when first creating tables otherwise changes cannot be made afterward.
Which of the following actions should you take?

Accepted Answer

Create a LSI

Answer

Create a GSI

Answer

Call Scan

Answer

Migrate away from DynamoDB

Question 61

You are storing your video files in a separate S3 bucket than your main static website in an S3 bucket. When accessing the video URLs directly the users can view the videos on the browser, but they can't play the videos while visiting the main website.
What is the root cause of this problem?

Accepted Answer

Enable CORS

Answer

Amend the IAM policy

Answer

Disable Server-Side Encryption

Answer

Change the bucket policy

Question 62

A user has an IAM policy as well as an Amazon SQS policy that apply to his account. The IAM policy grants his account permission for the ReceiveMessage action on example_queue, whereas the Amazon SQS policy gives his account permission for the SendMessage action on the same queue.
Considering the permissions above, which of the following options are correct? (Select two)

Accepted Answer

The user can send a ReceiveMessage request to example_queue, the IAM policy allows this action

Accepted Answer

If you add a policy that denies the user access to all actions for the queue, the policy will override the other two policies and the user will not have access to example_queue

Answer

Either of IAM policies or Amazon SQS policies should be used to grant permissions. Both cannot be used together

Answer

If the user sends a SendMessage request to example_queue, the IAM policy will deny this action

Answer

Adding only an IAM policy to deny the user of all actions on the queue is not enough. The SQS policy should also explicitly deny all action

Question 63

An e-commerce company has implemented AWS CodeDeploy as part of its AWS cloud CI/CD strategy. The company has configured automatic rollbacks while deploying a new version of its flagship application to Amazon EC2.
What occurs if the deployment of the new version fails?

Accepted Answer

A new deployment of the last known working version of the application is deployed with a new deployment ID

Answer

CodeDeploy switches the Route 53 alias records back to the known good green deployment and terminates the failed blue deployment

Answer

AWS CodePipeline promotes the most recent working deployment with a SUCCEEDED status to production

Answer

The last known working deployment is automatically restored using the snapshot stored in Amazon S3

Question 64

Your company manages hundreds of EC2 instances running on Linux OS. The instances are configured in several Availability Zones in the eu-west-3 region. Your manager has requested to collect system memory metrics on all EC2 instances using a script.
Which of the following solutions will help you collect this data?

Accepted Answer

Use a cron job on the instances that pushes the EC2 RAM statistics as a Custom metric into CloudWatch

Answer

Extract RAM statistics using X-Ray

Answer

Extract RAM statistics from the standard CloudWatch metrics for EC2 instances

Answer

Extract RAM statistics using the instance metadata

AWS SM 4

Create a free account to finish this quiz

Questions in this quiz (65)

Information

Feedback

What do you think of the new look?