Official Exam Details: (DVA-C02)

General Practice Questions

• A. Enable API caching in API Gateway.
• B. Configure API Gateway to use an interface VPC endpoint.
• C. Enable cross-origin resource sharing (CORS) for the APIs.
• D. Configure usage plans and API keys in API Gateway.

• A. options/DVAC02_1be0b2ac4f.webp
• B. options/DVAC02_a5c92a9fd5.webp
• C. options/DVAC02_4ca046fccb.webp
• D. options/DVAC02_12bb700b15.webp

• A. Inspect the frontend for API failures. Call the POST API manually by using the requests from the file.
• B. Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events.
• C. Inspect the Lambda logs in Amazon CloudWatch for possible errors. Fix the errors.
• D. Make sure that caching is disabled for the POST API in API Gateway.

• A. Define a development stage on the API Gateway API. Instruct the other developers to point to the development stage.
• B. Define a new API Gateway API that points to the new API application code. Instruct the other developers to point the endpoints to the new API.
• C. Implement a query parameter in the API application code that determines which version to call.
• D. Specify new API Gateway endpoints for the API endpoints that the developer wants to add.

• A. Create an Amazon ElastiCache for Redis instance. Enable encryption of data in transit and at rest. Store frequently accessed data the cache.
• B. Create an Amazon ElastiCache Memcached instance. Enable encryption data in transit and at rest Store frequently accessed data in the cache.
• C. Create an Ammon RDS for MySQL read replica. Connect to the read replica by using SSL. Configure the read replica to store frequently accessed data.
• D. Create an DynamoDB table and a DynamoDB Accelerator (DAX) cluster for the table. Store frequently accessed data in the DynamoDB table.

• A. Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”-.
• B. Define a resource-based policy on the S3 bucket to allow when a request meets the condition “aws:SecureTransport”-: “false".
• C. Define a role-based on the other accounts' roles to deny access when a request meets the condition of “aws:SecureTransort”: “false”.
• D. Define a resource-based policy on the KMS key to deny access when a request meets the condition of “aws:SecureTransport”: “false".

• A. Run the amplify add test command in the Amplify CLI.
• B. Create unit tests in the application. Deploy the unit tests by using the amplify push command in the Amplify CLI.
• C. Add a test phase to the amplify.yml build settings for the application.
• D. Add a test phase to the aws-exports.js file for the application.

• A. Create new AMIs, and specify encryption parameters. Copy the encrypted AMIS to the destination Region. Delete the unencrypted AMIs.
• B. Use AWS Key Management Service (AWS KMS) to enable encryption on the unencrypted AMIS. Copy the encrypted AMIS to the destination Region.
• C. Use AWS Certificate Manager (ACM) to enable encryption on the unencrypted AMIs. Copy the encrypted AMIS to the destination Region.
• D. Copy the unencrypted AMIS to the destination Region. Enable encryption by default in the destination Region.

• A. AWS Batch
• B. AWS Step Functions
• C. AWS Glue
• D. AWS Lambda

• A. Store the session state in Amazon ElastiCache.
• B. Store the session state in Amazon CloudFront.
• C. Store the session state in Amazon S3.
• D. Enable session stickiness using elastic load balancers.

• A. CloudFront distributions can be created only in the us-east-1 Region.
• B. Lambda@Edge functions can be created only in the us-east-1 Region.
• C. A single AWS SAM template cannot contain multiple Lambda functions.
• D. The CloudFront distribution and the S3 bucket cannot be created in the same Region.

• A. CodeDeployDefault. ECSCanary10Percent 15Minutes
• B. Code DeployDefault.LambdaCanary10Percent5Minutes
• C. CodeDeployDefault.LambdaCanary10Percent15Minutes
• D. CodeDeployDefault. ECSLinear10PercentEvery1 Minutes

• A. Switch to HTTP APIs in the backend service.
• B. Switch to REST APIs in the backend service.
• C. Use the callback URL to disconnect the client from the backend service.
• D. Add code to track the client status in Amazon ElastiCache in the backend service.
• E. Implement $connect and $disconnect routes in the backend service.

• A. VPN logs
• B. BGP logs
• C. VPC Flow Logs
• D. AWS CloudTrail logs

• A. Run the sam package and sam deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
• B. Run the cdk synth and cdk deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
• C. Run the cdk synth and sam local invoke commands with the function construct identifier and the path to the synthesized CloudFormation template.
• D. Run the cdk synth and sam local start-lambda commands with the function construct identifier and the path to the synthesized CloudFormation template.

• A. Create an AWS Lambda function. Use API Gateway proxy integration to return constant HTTP responses.
• B. Create an Amazon EC2 instance that serves the backend REST API by using an AWS CloudFormation template.
• C. Customize the API Gateway stage to select a response type based on the request.
• D. Use a request mapping template to select the mock integration response.

• A. Install and run the X-Ray SDK on the on-premises servers to capture and relay the data to the X-Ray service.
• B. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.
• C. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTraceSegments API call.
• D. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTelemetryRecords API call.

• A. The Lambda function's concurrency limit has been exceeded.
• B. The DynamoDB table requires a global secondary index (GSI) to support writes.
• C. The Lambda function does not have IAM permissions to write to DynamoDB.
• D. The DynamoDB table is not running in the same Availability Zone as the Lambda function.

• A. Create a CLI script that loops on the Lambda functions to add a Lambda function URL with the AWS_IAM auth type. Run another script to create an IAM identity-based policy that allows the lambda:lnvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). Attach the plicy to the QA IAM group.
• B. Create a CLI script that loops on the Lambda functions to add a Lambda function URL with the NONE auth type. Run another script to create an IAM resource- based policy that allows the lambda:lnvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). Attach the policy to the QA IAM group.
• C. Create a CLI script that loops on the Lambda functions to add a Lambda function URL with the AWS_IAM auth type. Run another script to loop on the Lambda functions to create an IAM identity-based policy that allows the lambda:lnvokeFunctionUrl action from the QA IAM group's Amazon Resource Name (ANN).
• D. Create a CLI script that loops on the Lambda functions to add a Lambda function URL with the NONE auth type. Run another script to loop on the Lambda functions to create an IAM resource-based policy that allows the lambda:lnvokeFunctionUrl action from the QA IAM group's Amazon Resource Name (ANN).

• A. IAM role
• B. Amazon Cognito identity pools
• C. Amazon Cognito user pools
• D. AWS Directory Service

• A. Create an Amazon Elastic File System (Amazon EFS) file system. Mount the EFS file system in Lambda. Store the result files and log file in the mount point. Append the log entries to the log file.
• B. Create an Amazon Elastic Block Store (Amazon EBS) Multi-Attach enabled volume. Attach the EBS volume to all Lambda functions. Update the Lambda function to download the log file. append the log entries. and upload the modified log file to Amazon EBS.
• C. Create a reference to the /tmp local directory. Store the result files and log file by using the directory reference. Append the log entry to the log file.
• D. Create a reference to the /opt storage directory. Store the result files and log file by using the directory reference. Append the log entry to the log file.

• A. Create a container image. Deploy the container image by using Amazon Elastic Kubernetes Service (Amazon EKS). Expose the functionality by using Amazon API Gateway.
• B. Create an AWS Lambda function by using the AWS Serverless Application Model (AWS SAM). Expose the Lambda functionality by using Amazon API Gateway.
• C. Create a container image. Deploy the container image by using Amazon Elastic Container Service (Amazon ECS). Expose the functionality by using Amazon API Gateway.
• D. Create a microservices application. Deploy the application to AWS Elastic Beanstalk. Expose the AWS Lambda functionality by using an Application Load Balancer.

• A. Use the AWS::Region pseudo parameter.
• B. Require the Region as a CloudFormation parameter.
• C. Find the Region from the AWS::Stackld pseudo parameter by using the Fn::Split intrinsic function.
• D. Dynamically import the Region by referencing the relevant parameter in AWS Systems Manager Parameter Store.

• A. Add a Lambda@Edge function to the distribution. Invoke the function on viewer request. Add permissions to the function's execution role to allow the function to access AWS STS. Move all SDK calls from the frontend into the function.
• B. Add a CloudFront function to the distribution. Invoke the function on viewer request. Add permissions to the function's execution role to allow the function to access AWS STS. Move all SDK calls from the frontend into the function.
• C. Add a Lambda@Edge function to the distribution. Invoke the function on viewer request. Move the credentials from the JSON file into the function. Move all SDK calls from the frontend into the function.
• D. Add a CloudFront function to the distribution. Invoke the function on viewer request. Move the credentials from the JSON file into the function. Move all SDK calls from the frontend into the function.

• A. A read-through cache
• B. A write-behind cache
• C. A lazy-loading cache
• D. A write-through cache

• A. Create a new resource in the current stage. Create a new method with Lambda proxy integration. Select the Lambda function. Add the hotfix alias. Redeploy the current stage. Test the backend.
• B. Update the Lambda function in the API Gateway API integration request to use the hotfix alias. Deploy the API Gateway API to a new stage named hotfix. Test the backend.
• C. Modify the Lambda function by fixing the Test the Lambda function. Create the alias hotfix. Point the alias to the SLATEST version.
• D. Modify the Lambda function by fixing the Test the Lambda function. When the Lambda function is working as publish the Lambda function as a new version. Create the alias hotfix. Point the alias to the new version.
• E. Create a new API Gateway API for the development environment. Add a resource and method with integration. Choose the Lambda function and the hotfix alias. Deploy to a new stage. Test the backend.

• A. Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos and details in the DynamoDB table. Retrieve previously uploaded photos directly from the DynamoDB table.
• B. Use Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
• C. Create an IAM user for each user of the application during the sign-up process. Use IAM authentication to access the API Gateway API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photosby querying DynamoDB for the S3 key.
• D. Create a user’s table in DynamoDB. Use the table to manage user accounts. Create a Lambda authorizer that validates user credentials against the user’s table. Integrate the Lambda authorizer with API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object’s S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.

• A. Package each Python library in its own .zip file archive. Deploy each Lambda function with its own copy of the library.
• B. Create a Lambda layer with the required Python library. Use the Lambda layer in both Lambda functions.
• C. Combine the two Lambda functions into one Lambda function. Deploy the Lambda function as a single .zip file archive.
• D. Download the Python library to an S3 bucket. Program the Lambda functions to reference the object URLs.

• A. Create an Amazon Kinesis data stream, and attach it to the DynamoDB table. Create a trigger to connect the data stream to the Lambda function.
• B. Create an Amazon EventBridge rule to invoke the Lambda function on a regular schedule. Connect to the DynamoDB table from the Lambda function to detect changes.
• C. Enable DynamoDB Streams on the table. Create a trigger to connect the DynamoDB stream to the Lambda function.
• D. Create an Amazon Kinesis Data Firehose delivery stream, and attach it to the DynamoDB table. Configure the delivery stream destination as the Lambda function.

• A. Install an AWS SDK on the on-premises server to automatically send logs to CloudWatch.
• B. Download the CloudWatch agent to the on-premises server. Configure the agent to use IAM user credentials with permissions for CloudWatch.
• C. Upload log files from the on-premises server to Amazon S3 and have CloudWatch read the files.
• D. Upload log files from the on-premises server to an Amazon EC2 instance and have the instance forward the logs to CloudWatch.

• A. Host each website by using AWS Amplify with a serverless backend. Connect the repository branches that correspond to each of the desired environments. Start deployments by merging code changes to a desired branch.
• B. Host each website in AWS Elastic Beanstalk with multiple environments. Use the EB CLI to link each repository branch. Integrate AWS CodePipeIine to automate deployments from version control code merges.
• C. Host each website in different Amazon S3 buckets for each environment. Configure AWS CodePipeline to pull source code from version control. Add an AWS CodeBuild stage to copy source code to Amazon S3.
• D. Host each website on its own Amazon EC2 instance. Write a custom deployment script to bundle each website's static assets. Copy the assets to Amazon EC2. Set up a workflow to run the script when code is merged.

• A. Use EC2 Image Builder to create an Amazon Machine Image (AMI). Install all the patches and agents that are needed to manage and run the application. Update the Auto Scaling group launch configuration to use the AMI.
• B. Use EC2 Image Builder to create an Amazon Machine Image (AMI). Install the latest version of the application and all the patches and agents that are needed to manage and run the application. Update the Auto Scaling group launch configuration to use the AMI.
• C. Set up AWS CodeDeploy to deploy the most recent version of the application at runtime.
• D. Set up AWS CodePipeline to deploy the most recent version of the application at runtime.
• E. Remove any commands that perform operating system patching from the UserData script.

• A. Increase the function's CPU core count.
• B. Increase the function's memory.
• C. Increase the function's reserved concurrency.
• D. Increase the function's timeout.

• A. Increase the number of write capacity units (WCUs) for the table.
• B. Append a hash suffix to the partition key value that is based on the order ID.
• C. Add a global secondary index (GSI) that has its own write capacity units (WCUs).
• D. Use DynamoDB Accelerator (DAX).

• A. Use AWS OpsWorks to perform blue/green deployments.
• B. Use a function alias with different versions.
• C. Maintain deployment packages for older versions in Amazon S3.
• D. Use AWS CodePipeline for deployments and rollbacks.

• A. Retry the batch operation immediately.
• B. Retry the batch operation with exponential backoff and randomized delay.
• C. Update the application to use an AWS software development kit (AWS SDK) to make the requests.
• D. Increase the provisioned read capacity of the DynamoDB tables that the operation accesses.
• E. Increase the provisioned write capacity of the DynamoDB tables that the operation accesses.

• A. Set up an S3 event notification that invokes the removePii function when an S3 GET request is made. Call Amazon S3 by using a GET request to access the object without PII.
• B. Set up an S3 event notification that invokes the removePii function when an S3 PUT request is made. Call Amazon S3 by using a PUT request to access the object without PII.
• C. Create an S3 Object Lambda access point from the S3 console. Select the removePii function. Use S3 Access Points to access the object without PII.
• D. Create an S3 access point from the S3 console. Use the access point name to call the GetObjectLegalHold S3 API function. Pass in the removePii function name to access the object without PII.

• A. CacheHitCount
• B. IntegrationLatency
• C. CacheMissCount
• D. Latency
• E. Count

• A. Create a separate CloudFormation template for each EC2 instance type in the list.
• B. In the Resources section of the CloudFormation template, create resources for each EC2 instance type in the list.
• C. In the CloudFormation template, create a separate parameter for each EC2 instance type in the list.
• D. In the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.

• A. Inspect the frontend logs for API failures. Call the POST API manually by using the requests from the log file.
• B. Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events.
• C. Inspect the Lambda logs in Amazon CloudWatch for possible errors. Fix the errors.
• D. Make sure that caching is disabled for the POST API in API Gateway.

• A. CloudFormation serverless intrinsic functions
• B. AWS Elastic Beanstalk
• C. AWS Serverless Application Model (AWS SAM)
• D. AWS Cloud Development Kit (AWS CDK)

• A. Create an AWS CloudFormation template that creates an SQS queue and deploys the Lambda function. Create a stack from the template during the CI/CD process. Invoke the deployed function. Verify the output.
• B. Create an SQS event for tests. Use a test that consumes messages from the SQS queue during the function's CI/CD process.
• C. Create an SQS queue for tests. Use this SQS queue in the application's unit test. Run the unit tests during the CI/CD process.
• D. Use the aws lambda invoke command with a test event during the CI/CD process.

• A. Update the IAM instance profile that is attached to the EC2 instance to include the permission for the S3 bucket.
• B. Update the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket.
• C. Update the developer's user permissions to include the S3:ListBucket permission for the S3 bucket.
• D. Update the S3 bucket policy by including the S3:ListBucket permission and by setting the Principal element to specify the account number of the EC2 instance.

• A. Decrease the number of vCPUs for the DB instance. Increase the max_connections setting.
• B. Use Amazon RDS Proxy to create a proxy that connects to the DB instance. Update the Lambda function to connect to the proxy.
• C. Add a CloudWatch alarm that changes the DB instance class when the number of connections increases to more than 1,000.
• D. Add an Amazon EventBridge rule that increases the max_connections setting of the DB instance when CPU utilization is above 75%.

• A. Create four access points that allow access to the central S3 bucket. Assign an access point to each web application bucket.
• B. Create a bucket policy that allows access to the central S3 bucket. Attach the bucket policy to the central S3 bucket.
• C. Create a cross-origin resource sharing (CORS) configuration that allows access to the central S3 bucket. Add the CORS configuration to the central S3 bucket.
• D. Create a Content-MD5 header that provides a message integrity check for the central S3 bucket. Insert the Content-MD5 header for each web application request.

• A. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received.
• B. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.
• C. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status.
• D. Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user.

• A. Store the smart meter readings in an Amazon RDS database. Create an index on the location ID and timestamp columns. Use the columns to filter on the customers' data.
• B. Store the smart meter readings in an Amazon DynamoDB table. Create a composite key by using the location ID and timestamp columns. Use the columns to filter on the customers' data.
• C. Store the smart meter readings in Amazon ElastiCache for Redis. Create a SortedSet key by using the location ID and timestamp columns. Use the columns to filter on the customers' data.
• D. Store the smart meter readings in Amazon S3. Partition the data by using the location ID and timestamp columns. Use Amazon Athena to filter on the customers' data.

• A. Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior's settings unchanged.
• B. Add a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to * and make viewer access restricted. Change the default cache behavior's path pattern to the path of the login page, and make viewer access unrestricted.
• C. Add a second origin as a failover origin to the default cache behavior. Point the failover origin to the S3 bucket. Set the path pattern for the primary origin to * and make viewer access restricted. Set the path pattern for the failover origin to the path of the login page, and make viewer access unrestricted.
• D. Add a bucket policy to the S3 bucket to allow read access. Set the resource on the policy to the Amazon Resource Name (ARN) of the login page object in the S3 bucket. Add a CloudFront function to the default cache behavior to redirect unauthorized requests to the login page's S3 URI.

• A. Amazon S3
• B. AWS CloudTrail
• C. Amazon CloudWatch
• D. Amazon DynamoDB

• A. Increase the number of shards of the Kinesis data stream.
• B. Decrease the timeout of the Lambda function.
• C. Increase the memory that is allocated to the Lambda function.
• D. Decrease the number of shards of the Kinesis data stream.
• E. Increase the timeout of the Lambda function.

• A. the /tmp directory
• B. Amazon Elastic File System (Amazon EFS)
• C. Amazon Elastic Block Store (Amazon EBS)
• D. Amazon S3

An application is processing clickstream data using Amazon Kinesis. The clickstream data feed into Kinesis experiences periodic spikes. The PutRecords API call occasionally fails and the logs show that the failed call returns the response shown below:

Which techniques will help mitigate this exception? (Choose two.)

• A. Implement retries with exponential backoff.
• B. Use a PutRecord API instead of PutRecords.
• C. Reduce the frequency and/or size of the requests.
• D. Use Amazon SNS instead of Kinesis.
• E. Reduce the number of KCL consumers.

• A. Beforelnstall -> ApplicationStop -> ApplicationStart -> Afterlnstall
• B. ApplicationStop -> Beforelnstall -> Afterlnstall -> ApplicationStart
• C. Beforelnstall -> ApplicationStop -> ValidateService -> ApplicationStart
• D. ApplicationStop -> Beforelnstall -> ValidateService -> ApplicationStart

• A. A simple primary key that has the partition key set to customerld
• B. A composite primary key that has the partition key set to customerld and the sort key set to date
• C. A composite primary key that has the partition key set to customerld and the sort key set to product
• D. A composite primary key that has the partition key set to customerld and the sort key set to unitPrice.

• A. Encode each employee's contact information and photos using Base64. Store the information in an Amazon DynamoDB table using a sort key.
• B. Store each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3.
• C. Use Amazon Cognito user pools to implement the employee directory in a fully managed software-as-a-service (SaaS) method.
• D. Store employee contact information in an Amazon RDS DB instance with the photos stored in Amazon Elastic File System (Amazon EFS).

• A. Change the Auto Scaling group to six desired instances.
• B. Change the deployment policy to traffic splitting. Specify an evaluation time of I hour.
• C. Change the deployment policy to rolling with additional batch. Specify a batch size of 1.
• D. Change the deployment policy to rolling. Specify a batch size of 2.

• A. AWS CodeDeploy
• B. AWS CodeArtifact
• C. AWS CodeCommit
• D. Amazon CodeGuru

A developer has written the following IAM policy to provide access to an Amazon S3 bucket:

Which access does the policy allow regarding the s3:GetObject and s3:PutObject actions?

• A. Access on all buckets except the "DOC-EXAMPLE-BUCKET" bucket
• B. Access on all buckets that start with "DOC-EXAMPLE-BUCKET" except the "DOC-EXAMPLE-BUCKET/secrets" bucket.
• C. Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket along with access to all S3 actions for objects in the "DOC-EXAMPLE-BUCKET" bucket that start with "secrets"
• D. Access on all objects in the "DOC-EXAMPLE-BUCKET" bucket except on objects that start with "secrets"

• A. Set the function's reserved concurrency to 1. Calculate the rolling average in the function. Store the calculated rolling average in Amazon ElastiCache.
• B. Modify the function to store the values in Amazon ElastiCache. When the function initializes. use the previous values from the cache to calculate the rolling average.
• C. Set the function's provisioned concurrency to 1. Calculate the rolling average in the function. Store the calculated rolling average in Amazon ElastiCache.
• D. Modify the function to store the values in the function's layers. When the function initializes. use the previously stored values to calculate the rolling average.

• A. Manually instrument the X-Ray SDK in the application code.
• B. Use the X-Ray auto-instrumentation agent.
• C. Use Amazon Macie to detect and hide PII. Call the X-Ray API from AWS Lambda.
• D. Use AWS Distro for OpenTelemetry.

• A. Modify the RDS security group. Add a rule to allow traffic from all the ports from the VPC CIDR block.
• B. Redeploy the Lambda function in the same subnet as the RDS instance. Ensure that the RDS security group allows traffic from the Lambda function.
• C. Create a security group for the Lambda function. Add a new rule in the RDS security group to allow traffic from the new Lambda security group.
• D. Create an IAM role. Attach a policy that allows access to the RDS database. Attach the role to the Lambda function.

• A. Clone the repository. Create a new branch. Update the branch with the changes.
• B. Create a new branch. Apply the changes from the previous branch.
• C. Use the Commit Visualizer view to compare the commits when a feature was added. Fix the merge conflicts.
• D. Stop the pull from the main branch to the feature branch. Rebase the feature branch from the main branch.

• A. Implement Kinesis Data Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream.
• B. Launch an Amazon EC2 instance. Set the EC2 instance as the destination of the delivery stream. Run an application on the EC2 instance to remove the customer identifiers. Store the transformed data in an Amazon S3 bucket.
• C. Create an Amazon OpenSearch Service instance. Set the OpenSearch Service instance as the destination of the delivery stream. Use search and replace to remove the customer identifiers. Export the data to an Amazon S3 bucket.
• D. Create an AWS Step Functions workflow to remove the customer identifiers. As the last step in the workflow, store the transformed data in an Amazon S3 bucket. Set the workflow as the destination of the delivery stream.

• A. Build the container image and run the docker scan command locally. Mitigate any findings before pushing changes to the source code repository. Write a pre-commit hook that enforces the use of this workflow before commit.
• B. Create a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.
• C. Create a new CodePipeline stage that occurs after source code has been retrieved from its repository. Run a security scanner on the latest revision of the source code. Fail the pipeline if there are findings.
• D. Add an action to the deployment stage of the pipeline so that the action occurs before the deployment to the EKS cluster. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.

• A. Configure the DB cluster's public access setting to Yes.
• B. Configure an Amazon RDS database proxy for the Lambda functions.
• C. Configure a NAT gateway and a security group for the Lambda functions.
• D. Configure the VPC, subnets, and a security group for the Lambda functions.

• A. Create an event with Amazon EventBridge that will monitor the S3 bucket and then insert the records into DynamoDB.
• B. Configure an S3 event to invoke an AWS Lambda function that inserts records into DynamoDB.
• C. Create an AWS Lambda function that will poll the S3 bucket and then insert the records into DynamoDB.
• D. Create a cron job that will run at a scheduled time and insert the records into DynamoDB.

• A. Create an Amazon DynamoDB table. Configure the table with a primary key that consists of the title as the partition key and the release year as the sort key. Create a global secondary index that uses the genre as the partition key and the title as the sort key.
• B. Create an Amazon DynamoDB table. Configure the table with a primary key that consists of the genre as the partition key and the release year as the sort key. Create a global secondary index that uses the title as the partition key.
• C. On an Amazon RDS DB instance, create a table that contains columns for title, release year, and genre. Configure the title as the primary key.
• D. On an Amazon RDS DB instance, create a table where the primary key is the title and all other data is encoded into JSON format as one additional column.

• A. Create an Amazon RDS for MySQL DB instance. Store the unique identifier for each request in a database table. Modify the function to check the table for the identifier before processing the request.
• B. Create an Amazon DynamoDB table. Store the unique identifier for each request in the table. Modify the Lambda function to check the table for the identifier before processing the request.
• C. Create an Amazon DynamoDB table. Store the unique identifier for each request in the table. Modify the Lambda function to return a client error response when the function receives a duplicate request.
• D. Create an Amazon ElastiCache for Memcached instance. Store the unique identifier for each request in the cache. Modify the Lambda function to check the cache for the identifier before processing the request.

• A. Create and deploy an AWS Lambda function in each desired Region. Configure the Lambda function to create a stack from an AWS CloudFormation template in that Region when the function is invoked.
• B. Create an AWS CloudFormation template that defines the load test resources. Use the AWS CLI create-stack-set command to create a stack set in the desired Regions.
• C. Create an AWS Systems Manager document that defines the resources. Use the document to create the resources in the desired Regions.
• D. Create an AWS CloudFormation template that defines the load test resources. Use the AWS CLI deploy command to create a stack from the template in each Region.

• A. Create the Lambda function. Configure VPC1 access for the function. Attach a security group named SG1 to both the Lambda function and the database. Configure the security group inbound and outbound rules to allow TCP traffic on Port 3306.
• B. Create and launch a Lambda function in a new public subnet that is in a new VPC named VPC2. Create a peering connection between VPC1 and VPC2.
• C. Create the Lambda function. Configure VPC1 access for the function. Assign a security group named SG1 to the Lambda function. Assign a second security group named SG2 to the database. Add an inbound rule to SGI to allow TCP traffic from Port 3306.
• D. Export the data from the Aurora database to Amazon S3. Create and launch a Lambda function in VPC1. Configure the Lambda function query the data from Amazon S3.

• A. Use S3 Event Notifications to validate the file upload and download requests and update the user interface. (UI).
• B. Save the details of the uploaded files in a separate Amazon DynamoDB table. Filter the list of files in the user interface (UI) by comparing the current user ID with the user It) associated with the file in the table.
• C. Use Amazon API Gateway and an AWS Lambda function to upload and download files. Validate each request in the Lambda function before performing the requested operation.
• D. Use an IAM policy within the Amazon identity prefix to restrict users to use their own folders in Amazon S3.

• A. Use a mufti-AZ Amazon RDS deployment. Increase the number of connections that the code makes to the database or increase the connection pool size if a connection pool is in use.
• B. Use a multi-AZ Amazon RDS deployment. Modify the code so that queries access the secondary RDS instance.
• C. Deploy Amazon RDS with one or more read replicas. Modify the application code so that queries use the URL for the read replicas.
• D. Use open source replication software to create a of the MySQL database on an Amazon EC2 instance. Modify the application so that queries use the IP address of the EC2 instance.

• A. Use an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a based policy to the parameter to allow access from. other accounts. Update the IAM role of EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with decrypt flag enabled. Use the decrypted access token to send the message to the chat.
• B. Encrypt the token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS. Retrieve the token from DynamoDB. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
• C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
• D. Encrypt access token by using an AWS Key Management Service (AWS KMS) AWS managed key. Store access token in an Amazon S3 bucket Add a bucket to the S3 bucket to allow access from other accounts. the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.

• A. Store the credentials in AWS Systems Manager Parameter Store. Select the database that the parameter will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the parameter. Enable automatic rotation for the parameter. Use the parameter from Parameter Store on the Lambda function to connect to the database.
• B. Encrypt the credentials with default AWS Key Management Service (AWS KMS) key. Store the credentials as environment variables for the Lambda function. Create a second Lambda function to generate new credentials and to rotate the credentials by updating the environment variables of the first Lambda function. Invoke second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the database to use the new credentials. On the first Lambda function, retrieve the credentials from the environment variables. Decrypt the credentials by using AWS KMS. Connect to the database.
• C. Store the credentials in AWS Secrets Manager. Set the secret to Credentials for Amazon RDS database. Select the database that the secret will access. Use default AWS Key Management Service (AWS KMS) key to encrypt the secret. Enable automatic rotation for the secret. Use the secret from Secrets Manager on the Lambda function to connect to the database.
• D. Encrypt the credentials by using AWS Key Management Service (AWS KMS). Store the credentials in an Amazon DynamoDB table. Create a second Lambda function to rotate the credentials. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the DynamoDB table. the database to use the generated credentials. Retrieve the credentials from DynamoDB with the first function. Connect to the database.

• A. Amazon S3 with encrypted files with “config”.
• B. AWS Secrets Manager secrets with a tag that is named SecretString.
• C. AWS Systems Manager Parameter Store SecureString parameters
• D. CloudFormation NoEcho parameters.

• A. Create an AWS Key Management Service (AWS KMS) key. Assign the KMS key to the S3 bucket.
• B. Set the x-amz-server-side-encryption header when invoking the PutObject API operation.
• C. Provide the encryption key in the HTTP header of every request.
• D. Apply TLS to encrypt the traffic to the S3 bucket.

• A. Create a global secondary index (GSI) with productFamily as the partition key and productType as the sort key.
• B. Create a loc.al secondary index (LSI) with productFamily as the partition key and as the sort key.
• C. Recreate the table. Add partNumber as the partition key and vendor as the sort key. During table creation, add a local secondary index (LSI) with productFamily as the partition key and productType as the sort key.
• D. Update the queries to use Scan operations with productFamily as the partition key and productType as the sort key.

• A. Create a standard parameter in AWS Systems Manager Parameter Store. Set Expiration and ExpirationNotification policy types.
• B. Create a standard parameter in AWS Systems Manager Parameter Store. Create an AWS Lambda function to expire the configuration and to send Amazon Simple Notification Service (Amazon SNS) notifications.
• C. Create an advanced parameter in AWS Systems Manager Parameter Store. Set Expiration and ExpirationNotification plicy types.
• D. Create an advanced parameter in AWS Systems Manager Parameter Store. Create an Amazon EC2 instance with a cron job to expire the configuration and to send notifications.

• A. Generate the reports and then store the reports as Amazon DynamoDB items that have a specified TTL. Generate a URL that retrieves the reports from DynamoDB. Provide the URL to customers through the web application.
• B. Generate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Attach the reports to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe the customer to email notifications from Amazon SNS.
• C. Generate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Generate a presigned URL that contains an expiration date. Provide the URL to customers through the web application. Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports.
• D. Generate the reports and then store the reports in an Amazon RDS database with a date stamp. Generate an URL that retrieves the reports from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records that have expired date stamps.

• A. Retrieve the credentials from variables that are hardcoded in the buildspec.yml file. Configure an AWS Lambda function to rotate the credentials.
• B. Retrieve the credentials from an environment variable that is linked to a SecureString parameter in AWS Systems Manager Parameter Store. Configure Parameter Store for automatic rotation.
• C. Retrieve the credentials from an environment variable that is linked to an AWS Secrets Manager secret. Configure Secrets Manager for automatic rotation.
• D. Retrieve the credentials from an environment variable that contains the connection string in plaintext. Configure an Amazon EventBridge event to rotate the credentials.

• A. Mount an Amazon Elastic Block Store (Amazon EBS) onto one of the EC2 instances. a file system on the EBS volume. Use the host system to share a folder. the application code to read and write configuration files from the shared folder.
• B. Deploy a micro EC2 instance with an instance store volume. Use the host operating system to share a folder the application code to read and write configuration files from the shared folder.
• C. Create an Amazon S3 bucket to host the repository. Migrate the existing .xml files to the S3 bucket. Update application code to use the AWS SDK to read and write configuration files from Amazon S3.
• D. Create an Amazon S3 bucket to host the repository. Migrate the existing .xml files to the S3 bucket. Mount the S3 bucket to the EC2 instances as a local volume. the application code to read and write configuration files from the disk.

• A. Use an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with the decrypt flag enabled. Use the decrypted access token to send the message to the chat.
• B. Encrypt the access token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS. Retrieve the token from DynamoDecrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
• C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
• D. Encrypt the access token by using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to the S3 bucket to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.

• A. AWS CodeBuild
• B. Amazon S3
• C. AWS CodeCommit
• D. AWS Cloud9

• A. Set up a cron job on an Amazon EC2 instance. Run a script every hour to query the table for changes and process the documents.
• B. Enable a DynamoDB stream on the table. Invoke an AWS Lambda function to process the documents.
• C. Update the application to send a PutEvents request to Amazon EventBridge (Amazon CloudWatch Events). Create an EventBridge (CloudWatch Events) rule to invoke an AWS Lambda function to process the documents.
• D. Update the application to synchronously process the documents directly after the DynamoDB write.

• A. Change the AWS CloudFormation templates for us-east-1 and us-west-1 to use an AWS AMI. Relaunch the stack for both Regions.
• B. Copy the custom AMI from us-east-1 to us-west-1. Update the AWS CloudFormation template for us-west-1 to refer to AMI ID for the copied AMI. Relaunch the stack.
• C. Build the custom AMI in us-west-1. Create a new AWS CloudFormation template to launch the stack in us-west-1 with the new AMI ID.
• D. Manually deploy the application outside AWS CloudFormation in us-west-1.

• A. Create a new API in API Gateway. Direct a portion of the traffic to the new API using an Amazon Route 53 weighted routing policy.
• B. Validate the new API version and promote it to production during the window of lowest expected utilization.
• C. Implement an Amazon CloudWatch alarm to trigger a rollback if the observed HTTP 500 status code rate exceeds a predetermined threshold.
• D. Use the canary release deployment option in API Gateway. Direct a percentage of the API traffic using the canarySettings setting.

• A. Rewrite the application to be cloud native and to run on AWS Lambda, where the logs can be reviewed in Amazon CloudWatch.
• B. Set up centralized logging by using Amazon Elasticsearch Service (Amazon ES), Logstash, and Kibana.
• C. Scale down the application to one larger EC2 instance where only one instance is recording logs.
• D. Install the unified Amazon CloudWatch agent on the EC2 instances. Configure the agent to push the application logs to CloudWatch.

• A. AWS CodeDeploy
• B. AWS CloudFormation
• C. AWS OpsWorks
• D. AWS Elastic Beanstalk

• A. Enable Amazon EBS volume encryption with an AWS KMS CMK in the Lambda function configuration so that all storage attached to the Lambda function is encrypted.
• B. Set up the Lambda function with a role and key policy to access an AWS KMS CMK. Use the CMK to generate a data key used to encrypt all data prior to writing to /tmp storage.
• C. Use OpenSSL to generate a symmetric encryption key on Lambda startup. Use this key to encrypt the data prior to writing to /tmp storage.
• D. Use an on-premises hardware security module (HSM) to generate keys, where the Lambda function requests a data key from the HSM and uses that to encrypt data on all requests to the function.

• A. Use an Application Load Balancer and the X-Forwarded-For headers.
• B. Use a Network Load Balancer (NLB). Enable proxy protocol support on the NLB and the target application.
• C. Use an Application Load Balancer. Register the targets by the instance ID.
• D. Use a Network Load Balancer and the X-Forwarded-For headers.

• A. Query the instance metadata from http://169.254.169.254/latest/meta-data/.
• B. Query the instance user data from http://169.254.169.254/latest/user-data/.
• C. Query the Amazon Machine Image (AMI) information from http://169.254 169.254/latest/meta-data/ami/.
• D. Check the hosts file of the operating system.

• A. The IAM policy that is attached to the EC2 instance profile role.
• B. The session policy that is applied to the EC2 instance role session.
• C. The AWS Key Management Service (AWS KMS) key policy that is attached to the EC2 instance profile role.
• D. The Amazon VPC endpoint policy.

• A. Deploy the API Gateway REST API to all the required AWS accounts. Use the same custom domain name for all the gateway endpoints so that a single SCM webhook can be used for all events from all accounts.
• B. Deploy the API Gateway REST API to all the receiver AWS accounts. Create as many SCM webhooks as the number of AWS accounts.
• C. Grant permission to the central AWS account for EventBridge (CloudWatch Events)to access the receiver AWS accounts. Add an EventBridge (CloudWatch Events) event bus on the receiver AWS accounts as the targets to the existing EventBridge (CloudWatch Events) rule.
• D. Convert the API Gateway type from REST API to HTTP API.

• A. Write a script that deletes old records; schedule the scripts as a cron job on an Amazon EC2 instance.
• B. Add an attribute with the expiration time; enable the Time To Live feature based on that attribute.
• C. Each day, create a new table to hold session data; delete the previous day's table.
• D. Add an attribute with the expiration time; name the attribute ItemExpiration.

• A. A setup of the Amazon CloudWatch interface VPC endpoint is required for filtering the CloudWatch Logs in the VPC.
• B. CloudWatch Logs only publishes metric data for events that happen after the filter is created.
• C. The log group for CloudWatch Logs should be first streamed to Amazon OpenSearch Service before metric filtering returns the results.
• D. Metric data points for logs groups can be filtered only after they are exported to an Amazon S3 bucket.

• A. Amazon S3 with encrypted files prefixed with "config"
• B. AWS Secrets Manager secrets with a tag that is named SecretString
• C. AWS Systems Manager Parameter Store SecureString parameters
• D. CloudFormation NoEcho parameters

• A. Import the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API. Create a DNS A record for the custom domain.
• B. Import the SSUTLS certificate into CloudFront. Create a DNS CNAME record for the custom domain.
• C. Import the SSUTLS certificate into AWS Certificate Manager (ACM) in the same Region as the API. Create a DNS CNAME record for the custom domain.
• D. Import the SSUTLS certificate into AWS Certificate Manager (ACM) in the us-east-I Region. Create a DNS CNAME record for the custom domain.

• A. Write the results of payment processing API calls to Amazon CloudWatch. Use Amazon CloudWatch Logs Insights to query the CloudWatch logs. Schedule the Lambda function to check the CloudWatch logs and notify the existing SNS topic.
• B. Publish custom metrics to CloudWatch that record the failures of the external payment processing API calls. Configure a CloudWatch alarm to notify the existing SNS topic when error rate exceeds the specified rate.
• C. Publish the results of the external payment processing API calls to a new Amazon SNS topic. Subscribe the support team members to the new SNS topic.
• D. Write the results of the external payment processing API calls to Amazon S3. Schedule an Amazon Athena query to run at regular intervals. Configure Athena to send notifications to the existing SNS topic when the error rate exceeds the specified rate.

• A. Add a test listener to the deployment group. Set the test listener port for the ALB to the protocol and port values that were named during creation of the test listener. Update the AppSpec file to associate the Lambda function with the Afterlnstall lifecycle hook.
• B. Add a test listener to the ALB. Set the test listener port for the deployment group to the protocol and port values that were named during creation of the test listener. Update the AppSpec file to associate the Lambda function with the BeforeAllowTraffic lifecycle hook.
• C. Add a test listener to the deployment group. Set the test listener port for the ALB to the protocol and port values that were named during creation of the test listener. Update the AppSpec file to associate the Lambda function with the BeforeAllowTraffic lifecycle hook.
• D. Add a test listener to the ALB. Set the test listener port for the deployment group to the protocol and port values that were named during creation of the test listener. Update the AppSpec file to associate the Lambda function with the Afterlnstall lifecycle hook.

• A. Add a CloudFormation DeletionPolicy attribute with the Retain value to the database resource.
• B. Update the CloudFormation stack policy to prevent updates to the database.
• C. Modify the database to use a Multi-AZ deployment.
• D. Create a CloudFormation stack set for the web application and database deployments.
• E. Add a CloudFormation DeletionPolicy attribute with the Retain value to the stack.

• A. Configure the application to create a custom metric and to push the metric to CloudWatch. Create an AWS CloudTrail alarm. Configure the CloudTrail alarm to use an Amazon Simple Notification Service (Amazon SNS) topic to send notifications.
• B. Create an AWS function to run every 5 minutes to scan the CloudWatch logs for the keyword DECRYP ERROR. Configure the Lambda function to use Amazon Simple Notification Service (Amazon SNS) to send a notification.
• C. Use Amazon CloudWatch Logs to create a metric filter that has a filter pattern for DECRYP_ERROR. Create a CloudWatch alarm on this metric for a threshold >=1. Configure the alarm to send Amazon Simple Notification Service (Amazon SNS) notifications.
• D. Install the CloudWatch unified agent on the EC2 instance. Configure the application to generate a metric for the keyword DECRYP ERROR errors. Configure the agent to send Amazon Simple Notification Service (Amazon SNS) notifications.

• A. Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.
• B. Update the application to retrieve the variables from AWS Key Management Service (AWS KMS). Store the API URL and credentials as unique keys for each environment.
• C. Update the application to retrieve the variables from an encrypted file that is stored with the application. Store the API URL and credentials in unique files for each environment.
• D. Update the application to retrieve the variables from each of the deployed environments. Define the authentication information and API URL in the ECS task definition as unique names during the deployment process.

• A. Add a Host header to the HTTP server log configuration file.
• B. Install the Amazon CloudWatch Logs agent on each EC2 instance. Configure the agent to write to the log file.
• C. Install the AWS X-Ray daemon on each EC2 instance. Configure the daemon to write to the log file.
• D. Add an X-Forwarded-For header to the HTTP server log configuration file.

• A. Create a different Amazon Simple Notification Service (Amazon SNS) topic for each partner. Configure the Lambda function to publish messages for each partner to the partner's SNS topic.
• B. Create a different Lambda function for each partner. Configure the Lambda function to notify each partner's service endpoint directly.
• C. Create an Amazon Simple Notification Service (Amazon SNS) topic. Configure the Lambda function to publish messages with specific attributes to the SNS topic. Subscribe each partner to the SNS topic. Apply the appropriate filter policy to the topic subscriptions.
• D. Create one Amazon Simple Notification Service (Amazon SNS) topic. Subscribe all partners to the SNS topic.

• A. Create an AWS CodeCommit project. Add the repository package's build and test commands to the project's buildspec.
• B. Create an AWS CodeBuiId project. Add the repository package's build and test commands to the project's buildspec.
• C. Create an AWS CodeDeploy project. Add the repository package's build and test commands to the project's buildspec.
• D. Add an action to the source stage. Specify the newly created project as the action provider. Specify the build artifact as the action's input artifact.
• E. Add a new stage to the pipeline after the source stage. Add an action to the new stage. Specify the newly created project as the action provider. Specify the source artifact as the action's input artifact.

• A. Amazon DynamoDB
• B. Amazon EC2
• C. AWS Lambda
• D. Amazon RDS

• A. Add the signature to an HTTP header that is named Authorization
• B. Add the signature to a session cookie
• C. Add the signature to an HTTP header that is named Authentication
• D. Add the signature to a query string parameter that is named X-Amz-Signature
• E. Add the signature to an HTTP header that is named WWW-Authenticate

• A. The S3 event notification does not activate for files that are larger than 1,000 MB.
• B. The resource-based policy for the Lambda function does not have the required permissions to be invoked by Amazon S3.
• C. Lambda functions cannot be invoked directly from an S3 event.
• D. The S3 bucket needs to be made public.

• A. Immutable
• B. Rolling
• C. Rolling with additional batch
• D. All at once

• A. Use the KMS Encrypt API to encrypt the data. Store the encrypted data key and data.
• B. Use a cryptography library to generate an encryption key for the application. Use the encryption key to encrypt the data. Store the encrypted data.
• C. Use the KMS GenerateDataKey API to get a data key. Encrypt the data with the data key. Store the encrypted data key and data.
• D. Upload the data to an S3 bucket using server side-encryption with an AWS KMS key.

• A. Store the database credentials in AWS Secrets Manager. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Secrets Manager.
• B. Include the database credentials as part of the Lambda function code. Update the credentials periodically and deploy the new Lambda function.
• C. Use Lambda environment variables. Update the environment variables when new credentials are available.
• D. Store the database credentials in AWS Systems Manager Parameter Store Turn on rotation. Write code in the Lambda function to retrieve the credentials from Systems Manager Parameter Store.

• A. Add an override to the feature. Set the identifier of the override to the engineer's user ID. Set the variation to Variation A.
• B. Add an override to the feature. Set the identifier of the override to Variation A. Set the variation to 100%.
• C. Add an experiment to the project. Set the identifier of the experiment to Variation B. Set the variation to 0%.
• D. Add an experiment to the project. Set the identifier of the experiment to the AWS account's account ISet the variation to Variation A.

• A. Initialize the database connection outside the handler function. Increase the max_user_connections value on the parameter group of the DB cluster. Restart the DB cluster.
• B. Initialize the database connection outside the handler function. Use RDS Proxy instead of connecting directly to the DB cluster.
• C. Use Amazon Simple Queue Service (Amazon SQS) FIFO queues to queue the orders. Ingest the orders into the database. Set the Lambda function's concurrency to a value that equals the number of available database connections.
• D. Use Amazon Simple Queue Service (Amazon SQS) FIFO queues to queue the orders. Ingest the orders into the database. Set the Lambda function's concurrency to a value that is less than the number of available database connections.

• A. Amazon Cognito user pool
• B. S3 presigned URLs
• C. S3 bucket policy
• D. Amazon Cognito identity pool

• A. Create Lambda functions inside the VPC with the AWSLambdaBasicExecutionRole policy attached to the Lambda execution role. Modify the RDS security group to allow inbound access from the Lambda security group.
• B. Create Lambda functions inside the VPC with the AWSLambdaVPCAccessExecutionRole policy attached to the execution role. Modify the RDS security group to allow inbound access from the Lambda security group.
• C. Create Lambda functions with the AWSLambdaBasicExecutionRole policy attached to the Lambda execution role. Create an interface VPC endpoint for the Lambda functions. Configure the interface endpoint policy to allow the lambda:lnvokeFunction action for each Lambda function's Amazon Resource Name (ARN).
• D. Create Lambda functions with the AWSLambdaVPCAccessExecutionRole policy attached to the Lambda execution role. Create an interface VPC endpoint for the functions. Configure the interface endpoint policy to allow the lambda:lnvokeFunction action for each Lambda function's Amazon Resource Name (ARN).

• A. BatchGetltem
• B. Getltem
• C. Scan
• D. Query

• A. Use the AWS CodeDeploy in-place deployment configuration for the Lambda functions. Shift all traffic immediately after deployment.
• B. Use the AWS CodeDeploy linear deployment configuration to shift 10% of the traffic every minute.
• C. Use the AWS CodeDeploy all-at-once deployment configuration to shift all traffic to the updated versions immediately.
• D. Use the AWS CodeDeploy predefined canary deployment configuration to shift 10% of the traffic immediately and shift the remaining traffic after 5 minutes.

• A. Create a new version of the Lambda function. Create a new stage on API Gateway with integration to the new Lambda version. Use the new API Gateway stage to test the Lambda function.
• B. Update the existing Lambda alias used by API Gateway to a weighted alias. Add the new Lambda version as an additional Lambda function with a weight of 10%. Use the existing API Gateway stage for testing.
• C. Create a new version of the Lambda function. Create and deploy a second Lambda function to filter incoming requests from API Gateway. If the filtering Lambda function detects a test request. the filtering Lambda function will invoke the new Lambda version of the code. For other requests, the filtering Lambda function will invoke the old Lambda version. Update the API Gateway API to use the filtering Lambda function.
• D. Create a new version of the Lambda function. Create a new API Gateway API for testing purposes. Update the integration of the new API with the new version. Use the new API for testing.

• A. Update the Lambda execution role for the production Lambda function to add a policy that allows the execution role to read from only the production environment S3 bucket.
• B. Move the development and production environments into separate AWS accounts. Add a resource policy to each Lambda function to allow only S3 buckets that are within the same account to invoke the function.
• C. Add a resource policy to the production Lambda function to allow only the production environment S3 bucket to invoke the function.
• D. Move the development and production environments into separate AWS accounts. Update the execution role for each function to add a policy that allows the execution role to read from the S3 bucket that is within the same account.

• A. Create a database user. Store the user name and password in an AWS Systems Manager Parameter Store secure string parameter. Enable rotation of the AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter.
• B. Enable IAM authentication for the database. Create a database user for use with IAM authentication. Enable password rotation.
• C. Create a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled.
• D. Use the EC2 user data to create a database user. Provide the user name and password in environment variables to the application.

• A. Check whether the policy that is assigned to the IAM role that is attached to the EC2 instances grants access to Amazon S3.
• B. Check the S3 bucket policy to validate the access permissions for the S3 bucket.
• C. Check whether the policy that is assigned to the IAM user that is attached to the EC2 instances grants access to Amazon S3.
• D. Check the S3 Lifecycle policy to validate the permissions that are assigned to the S3 bucket.
• E. Check the security groups that are assigned to the EC2 instances. Make sure that a rule is not blocking the access to Amazon S3.

• A. Create a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Update the test system code to use this cookie to test the beta version of the application.
• B. Create a new ALB. Auto Scaling group. and target group for the beta version of the application. Configure an alternate Amazon Route 53 record for the new ALB endpoint. Use the alternate Route 53 endpoint in the test system requests to test the beta version of the application.
• C. Create a new ALB. Auto Scaling group. and target group for the beta version of the application. Use Amazon CloudFront with Lambda@Edge to determine which specific request will go to the new ALB. Use the CloudFront endpoint to send the test system requests to test the beta version of the application.
• D. Create a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Use Amazon CloudFront with Lambda@Edge to update the test system requests to add the required cookie when the requests go to the ALB.

• A. Create an AWS Lambda-backed CloudFormation custom resource. Write Lambda code that generates a secure string. Return the value of the secure string as a data field of the custom resource response object. Use the CloudFormation Fn::GetAtt intrinsic function to get the value of the secure string. Use the value to create the DB instance.
• B. Use the AWS CodeBuild action of CodePipeline to generate a secure string by using the following AWS CLI command: aws secretsmanager get-random- password. Pass the generated secure string as a CloudFormation parameter with the NoEcho attribute set to true. Use the parameter reference to create the DB instance.
• C. Create an AWS Lambda-backed CloudFormation custom resource. Write Lambda code that generates a secure string. Return the value of the secure string as a data field of the custom resource response object. Use the CloudFormation Fn::GetAtt intrinsic function to get a value of the secure string. Create secrets in AWS Secrets Manager. Use the secretsmanager dynamic reference to use the value stored in the secret to create the DB instance.
• D. Use the AWS::SecretsManager::Secret resource to generate a secure string. Store the secure string as a secret in AWS Secrets Manager. Use the secretsmanager dynamic reference to use the value stored in the secret to create the DB instance.

• A. Clone the production environment to a different platform version. Deploy the new application code. and test it. Swap the environment URLs upon verification.
• B. Deploy the new application code in an all-at-once deployment to the existing EC2 instances. Test the code. Redeploy the previous code if verification fails.
• C. Perform an immutable update to deploy the new application to new EC2 instances. Serve traffic to the new instances after they pass health checks.
• D. Use a rolling deployment for the new application code. Apply the code to a subset of EC2 instances until the tests pass. Redeploy the previous code if the tests fail.

• A. Add a bucket policy to the S3 bucket to deny S3 actions when the aws:SecureTransport condition is equal to false.
• B. Add a bucket policy to the S3 bucket to deny S3 actions when the s3:x-amz-acl condition is equal to public-read.
• C. Add an IAM policy to the IAM users to enforce the usage of the AWS SDK.
• D. Add an IAM policy to the IAM users that allows S3 actions when the s3:x-amz-acl condition is equal to bucket-owner-read.

• A. Create an Amazon Cognito user pool. Configure the user pool to allow unauthenticated users. Exchange user tokens for temporary credentials that allow authenticated users to assume a role.
• B. Create an Amazon Cognito identity pool. Configure the identity pool to allow unauthenticated users. Exchange unique identity for temporary credentials that allow all users to assume a role.
• C. Create an Amazon CloudFront distribution. Configure the distribution to allow unauthenticated users. Exchange user tokens for temporary credentials that allow all users to assume a role.
• D. Create a role for authenticated users that allows access to all content. Create a role for unauthenticated users that allows access to only the sample content.
• E. Allow all users to access the sample content by default. Create a role for authenticated users that allows access to the other content.

• A. Refactor the Lambda function into two functions. Configure one function to transform the data and one function to load the data into the DynamoDB table. Create an Amazon Simple Queue Service (Amazon SQS) queue in between the functions to hold the items as messages and to invoke the second function.
• B. Turn on auto scaling for the DynamoDB table. Use Amazon CloudWatch to monitor the table's read and write capacity metrics and to track consumed capacity.
• C. Create an alias for the Lambda function. Configure provisioned concurrency for the application to use.
• D. Refactor the Lambda function into two functions. Configure one function to store the data in the DynamoDB table. Configure the second function to process the data and update the items after the data is stored in DynamoDB. Create a DynamoDB stream to invoke the second function after the data is stored.

• A. Create an Amazon EventBridge rule. Configure the rule with a pattern to match the S3 object created event.
• B. Schedule an Amazon EventBridge rule to run a new Lambda function to scan the S3 bucket.
• C. Add a trigger to the existing Lambda function. Set the trigger to EventBridge. Select the Amazon EventBridge rule.
• D. Create a new Lambda function to scan the S3 bucket for recently added S3 objects.
• E. Add S3 Lifecycle rules to invoke the existing Lambda function.

• A. Deploy AWS X-Ray as a sidecar container to the microservices. Update the task role policy to allow access to the X-Ray API.
• B. Deploy AWS X-Ray as a daemonset to the Fargate cluster Update the service role policy to allow to the X-Ray API.
• C. Instrument the application by using the AWS X-Ray SDK. Update the application to use the PutXrayTrace API call to communicate with the X-Ray API.
• D. Instrument the application by using the AWS X-Ray SDK. Update the application to with the X-Ray daemon.
• E. Instrument the ECS task to send the stdout and stderr output to Amazon CloudWatch Logs. Update the task role policy to allow the cloudwatch:PutLogs action.

• A. Use an EC2 instance to host the MySQL database. Store the session data and the application data in the MySQL database.
• B. Use Amazon ElastiCache for Memcached to store and manage the session data. Use an Amazon RDS for MySQL DB instance to store the application data.
• C. Use Amazon ElastiCache for Memcached to store and manage the session data and the application data.
• D. Use the EC2 instance store to manage the session data. Use an Amazon RDS for MySQL DB instance to store the application data.

• A. Set up a mock integration for API methods in API Gateway. In the integration request from Method Execution, add simple logic to return either a success or error based on HTTP status code. In the integration add messages that correspond to the HTTP status codes.
• B. Create two mock integration resources for API methods in API Gateway. In the integration request, return a success HTTP status code for one resource and an error HTTP status code for the other resource. In the integration response. add messages that correspond to the HTTP status codes.
• C. Create Lambda functions to perform tests. Add simple logic to return either success or error, based on the HTTP status codes. Build an API Gateway Lambda integration. Select appropriate Lambda functions that correspond to the HTTP status codes.
• D. Create a Lambda function to perform tests. Add simple logic to return either success or error-based HTTP status codes. Create a mock integration in API Gateway. Select the Lambda function that corresponds to the HTTP status codes.

• A. Create a Lambda layer to store the external library. Configure the Lambda function to use the layer.
• B. Create an Amazon S3 bucket. Upload the external library into the S3 bucket. Mount the S3 bucket folder in the Lambda function. Import the library by using the proper folder in the mount point.
• C. Load the external library to the Lambda function's /tmp directory during deployment of the Lambda package. Import the library from the /tmp directory.
• D. Create an Amazon Elastic File System (Amazon EFS) volume. Upload the external library to the EFS volume. Mount the EFS volume in the Lambda function. Import the library by using the proper folder in the mount point.

Need the Full Exam Simulator?

Practice the complete question bank in a realistic, timed environment with advanced tracking.

Access Full CertoMetrics Engine →