aws-exam

Question 1

A developer is building a serverless application that will send out a newsletter to customers using AWS Lambda. The Lambda function will be invoked at a 7-day interval.

Which method will provide an automated and serverless approach to trigger the function?

Answer 1

Configure a scheduled Amazon EventBridge (Amazon CloudWatch Events) that triggers every week to invoke the Lambda function.

Question 2

A Lamba function has multiple sub-functions that are chained together to process large data synchronously. When invoked, the function tends to exceed its maximum timeout limit. This has prompted the developer to break the Lambda function into manageable coordinated states using Step Functions, enabling each sub-function to run in separate processes.

Which of the following type of states should the developer use to run processes?

Answer 2

Task State
|
Task State - Do some work in your state machine

Choice State - Make a choice between branches of execution

Fail or Succeed State - Stop execution with failure or success

Pass State - Simply pass its input to its output or inject some fixed data, without performing work.

Question 3

A developer is building a ReactJS application that will be hosted on Amazon S3. Amazon Cognito handles the registration and signing of users using the AWS Software Development Kit (SDK) for JavaScript. The JSON Web Token (JWT) received upon authentication will be stored on the browser’s local storage. After signing in, the application will use the JWT as an authorizer to access an API Gateway endpoint.

What are the steps needed to implement the scenario above? (Select THREE.)

Answer 3

Create an Amazon Cognito User Pool.

On the API Gateway Console, create an authorizer using the Cognito User Pool ID.

Set the name of the header that will be used from the request to the Cognito User Pool as a token source for authorization.

Question 4

A developer needs to use IAM roles to list all EC2 instances that belong to the development environment in an AWS account.

Which methods could be done to verify IAM access to describe instances? (Select TWO.)

Answer 4

Run the describe-instances command with the –dry-run parameter.

Use the IAM Policy Simulator to validate the permission for the IAM role.
||
The –dry-run parameter checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRun-Operation. Otherwise, it is UnauthorizedOperation.

With the IAM policy simulator, you can test and troubleshoot identity-based policies, IAM permissions boundaries, Organizations service control policies (SCPs), and resource-based policies.

Question 5

A developer needs to view the percentage of used memory and the number of TCP connections of instances inside an Auto Scaling Group. To achieve this, the developer must send the metrics to Amazon CloudWatch.

Which approach provides the MOST secure way of authenticating a CloudWatch PUT request?

Answer 5

Create an IAM role with cloudwatch:PutMetricData permission for the new Auto Scaling launch template from which you launch instances.
|||||
Modifying an existing launch template is not possible.

Question 6

A Software Engineer is developing a Node.js application that will be deployed using Elastic Beanstalk. The application source code is currently inside a folder called MyApp. He wants to add a configuration file named tutorialsdojo.config to the application.

Where should the file be placed?

Answer 6

You can add AWS Elastic Beanstalk configuration files (.ebextensions) to your web application’s source code to configure your environment and customize the AWS resources that it contains. Configuration files are YAML- or JSON-formatted documents with a .config file extension that you place in a folder named .ebextensions and deploy in your application source bundle.

Question 7

A developer is writing a web application that will allow users to save and retrieve images in an Amazon S3 bucket. The users are required to register and log in to access the application.

Which combination of AWS Services should the Developer utilize for implementing the user authentication module of the application?

Answer 7

Amazon Cognito Identity Pools and User Pools.
|||||
A user pool is a user directory in Amazon Cognito. With a user pool, your users can sign in to your web or mobile app through Amazon Cognito. Your users can also sign in through social identity providers like Google, Facebook, Amazon, or Apple, and through SAML identity providers.

Amazon Cognito identity pools (federated identities) enable you to create unique identities for your users and federate them with identity providers. With an identity pool, you can obtain temporary, limited-privilege AWS credentials to access other AWS services.

Question 8

A developer is using the AWS CLI to interact with different AWS services. An UnauthorizedOperation error, as shown below, is received after running the stop-instance command:

Along with the response is an additional failure message displayed in ciphertext format.

How can the developer decode the message?

Answer 8

Decode the message by calling the AWS STS decode-authorization-message command.
|||||
The AWS STS DecodeAuthorizationMessage API decodes additional information about the authorization status of a request from an encoded message returned in response to an AWS request.

AWS Security Token Service (AWS STS)

Question 9

A developer is debugging an issue in an AWS Lambda-based application. To save time searching through logs, the developer wants the function to return the corresponding log location of an invocation request.

Which approach should the developer take with the least amount of effort?

Answer 9

Extract the log stream name from the Context object of the handler function.
|||||
When Lambda runs your function, it passes a context object to the handler. This object provides methods and properties that provide information about the invocation, function, and execution environment. One of the properties that you can get from the context object is the log_stream_name which gives the log location of a function instance.

Question 10

A developer plans to launch an EC2 instance, with Amazon Linux 2 as its AMI, using the AWS Console. A security group with port 80 that is open to public access will be associated with the instance. He wants to quickly build and test an Apache webserver with an index.html displaying a hello world message.

Which of the following should the developer do?

Answer 10

Configure the user data at the creation of the EC2 instance to run a script that will install and create the Apache webserver after the instance starts.
\\\\\\\\\\\\\\
When you launch an instance in Amazon EC2, you have the option of passing user data to the instance that can be used to perform common automated configuration tasks and even run scripts after the instance starts.

Question 11

A developer is hosting a static website from an S3 bucket. The website makes requests to an API Gateway endpoint integrated with a Lambda function (non-proxy). The developer noticed that the requests were failing. Upon debugging, he found a: “No ‘Access-Control-Allow-Origin’ header is present on the requested resource” error message.

What should the developer do to resolve this issue?

Answer 11

In the API Gateway Console, enable cross-origin resource sharing (CORS) for the method in the specified resource.
\\\\\\\\\\\\\
For a Lambda custom (non-proxy) integration, HTTP custom (non-proxy) integration, or AWS service integration, you can set up the required headers by using API Gateway method response and integration response settings. When you enable CORS by using the AWS Management Console, API Gateway creates an OPTIONS method and attempts to add the Access-Control-Allow-Origin header to your existing method integration responses.

Question 12

A company is running an e-commerce application on an Amazon EC2 instance. A newly hired developer has been tasked to monitor and handle the necessary updates on the EC2 instance every Saturday. The developer is working from home and needs remote access to the webserver. As the system administrator, you’re looking to use the AWS STS API to give the developer temporary credentials and enforce Multi-factor Authentication (MFA) to protect specific programmatic calls against the instance that could adversely affect the server.

Which of the following STS API should you use?

Answer 12

GetSessionToken
\\\\\\
GetSessionToken - returns a set of temporary security credentials to an existing IAM user. This is useful for providing enhanced security, such as allowing AWS requests only when MFA is enabled for the IAM user. Because the credentials are temporary, they provide enhanced security when you have an IAM user who accesses your resources through a less secure environment.

Question 13

A startup plans to use Amazon Cognito User Pools to easily manage their users’ sign-up and sign-in workflows to an application. To save time from designing the User Interface (UI) for the login page, the development team has decided to use Cognito’s built-in UI. However, the product manager finds the UI bland and instructed the developer to include the product logo on the web page.

How should the developer meet the above requirements?

Answer 13

Upload the logo to the Amazon Cognito app settings and use that logo on the custom login page.
\\\\\\\\\\\\\
You can use the AWS Management Console, or the AWS CLI or API, to specify customization settings for the built-in app UI experience. You can upload a custom logo image to be displayed in the app. You can also choose many CSS customizations.

You can specify app UI customization settings for a single client (with a specific clientId) or for all clients (by setting the clientId to ALL). If you specify ALL, the default configuration will be used for every client that has no UI customization set previously. If you specify UI customization settings for a particular client, it will no longer fall back to the ALL configuration.

Question 14

A developer uses Amazon ECS to orchestrate two Docker containers. He needs to configure ECS to allow the two containers to share log data.

Which configuration should the developer do?

Answer 14

Specify the containers in a single task definition and configure EFS as its volume type.
\\\\\\\\\\\\
Amazon Elastic File System (EFS)

Question 15

A developer wants to expose a legacy web service that uses an XML-based Simple Object Access Protocol (SOAP) interface through API Gateway. However, there is a compatibility issue since most modern applications communicate data in JSON format.

Which is the most cost-effective method that will overcome this issue?

Answer 15

Use API Gateway to create a RESTful API. Transform the incoming JSON into XML using mapping templates. Forward the request into the SOAP interface by using a Lambda function and parse the response (XML) into JSON before sending back to API Gateway.

Question 16

A team is collaborating on an application managed with AWS CodeCommit for source control and AWS CodePipeline for continuous integration and delivery. A developer who was working on a feature branch encounters merge conflicts during a merge attempt into the master branch. Upon investigation, one of the members forgot to pull the latest commits from the master branch.

Which action can fix the merge conflict in the LEAST amount of effort?

Answer 16

Run git rebase in the feature branch onto the master branch, then manually fix the conflicts.
\\\\\\\\\\\\\\\
The git rebase command can help by moving the feature branch’s changes onto the tip of the master branch, allowing you to resolve these conflicts manually.

Question 17

A development team has migrated an existing Git repository to a CodeCommit repository. One of the developers was given an HTTPS clone URL of their new repository. The developer must be able to clone the repository using his access key credentials.

What must the developer do before he can proceed?

Answer 17

Configure the Git credential helper with the AWS credential profile.
\\\\\\\\\\\\\\\\\\\
1. Set-up a Git credential helper using your access key credentials specified in your AWS credential profile.

2. Generate HTTPS Git credentials for AWS CodeCommit. Specify the credentials in the Git Credential Manager.

Question 18

A developer is building a serverless URL shortener using Amazon API Gateway, Amazon DynamoDB, and AWS Lambda. The application code as well as the stack that defines the cloud resources should be written in Python. The code should also be reusable in case an update must be done to the stack.

Which of the following actions must be done by the developer to meet the requirements above?

Answer 18

Use AWS CDK to build the stack. Then, use Python as the runtime environment in writing the application logic on Lambda.
\\\\\\\\\\\\\\\\\\
The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to model and provision your cloud application resources using familiar programming languages. The AWS CDK has first-class support for TypeScript, JavaScript, Python, Java, and C#. The AWS CDK can also update your deployed resources after you modify your app using the appropriate CDK commands.
\\\\\\\\\\\\\\\\\\\
CloudFormation only allows JSON and YAML in defining cloud resources in a stack. But everything is written in python.

Question 19

A company uses AWS CodeDeploy in their CI/CD pipeline to handle in-place deployments of their web application on EC2 instances. Recently, a new version of the application was pushed, which contained a code regression. The deployment group is configured with automatic rollback.

What happens if the deployment of the new version fails?

Answer 19

CodeDeploy redeploys the last known good version of an application with a new deployment ID.
\\\\\\\\\\\\\\\\\\\\\\\\\

Question 20

A mobile game developer is using DynamoDB as a data store and a Web Identity Federation for authorization and authentication. Each item in the DynamoDB table contains the attributes for individual user’s game data such as user ID, game scores, and top score where the user ID is the partition key. The developer must control user access to specific data items based on their IDs. In doing so, users will only be able to obtain items that they own.

Which of the following solutions must be implemented by the developer?

Answer 20

Modify the IAM Policy associated with the Identity provider’s role by adding a dynamodb:LeadingKeys condition key.
\\\\\\\\\\\\\\\\\\\\
In the given scenario, we are only required to restrict access to specific items in the table based on User Id which is the partition key. We can achieve this by inserting a dynamodb:LeadingKeys condition key to the IAM policy associated with the Identity provider’s role.

Question 21

A company plans to conduct an online survey to distinguish the users who bought its product from those who didn’t. The survey will be processed by Step Functions which comprises four states that will manage the application logic and error handling of the state machine. It is required to aggregate all the data that passes through the nodes if the process fails.

What should the company do to meet the requirements?

Answer 21

Include a Catch field in the state machine definition to capture the errors. Then, use ResultPath to include each node’s input data with its output.
\\\\\\\\\\\\\\\\\\\\
ResultPath - A path that determines what input is sent to the state specified in the Next field.

Question 22

A developer is building an AWS Lambda-based Java application that optimizes pictures uploaded to an S3 bucket. Upon running several tests, the Lambda function shows a cold start of about 5 seconds.

Which of the following could the developer do to reduce the cold start time? (Select TWO.)

Answer 22

• Reduce the deployment package’s size by including only the needed modules from the AWS SDK for Java.
• Increase the memory allocation setting for the Lambda function.
  \\\\\\\\\\\\\\\\

Question 23

An application uses the PutObject operation in parallel to upload hundreds of thousands of objects per second to an S3 bucket. To meet security compliance, the developer uses the server-side encryption in AWS KMS (SSE-KMS) to encrypt objects as they get stored in the S3 bucket. There is a noticeable performance degradation after making the change.

Which of the following is the most likely cause of the problem?

Answer 23

The API request rate has exceeded the quota for AWS KMS API operations.
\\\\\\\\\\\\\\\
AWS KMS throttles the requests if you exceed a combined total of 5,500 (or 10,000 or 30,000 depending upon your AWS Region) uploads or downloads per second of S3 objects encrypted with SSE-KMS.

Question 24

A university is gradually migrating some of its physical documents to the AWS cloud. They will start by moving their alumnus’ historical records to Amazon S3. The storage solution should provide a secure and durable object storage with the lowest cost.

Which of the following types of S3 storage should you recommend?

Answer 24

Amazon S3 Glacier Deep Archive.
\\\\\\\\\\\\\\\\\\\\\
Amazon S3 Glacier and S3 Glacier Deep Archive are designed to be the lowest-cost Amazon S3 storage classes, allowing you to archive large amounts of data at a very low cost. This makes it feasible to retain all the data you want for use cases like data lakes, analytics, IoT, machine learning, compliance, and media asset archiving. You pay only for what you need, with no minimum commitments or up-front fees.

Question 25

An application has a feature that displays GIFs based on keyword inputs. The code streams random GIF links from an external API to your local machine. When run, the application’s process takes longer than expected. You are suspecting that the new function sendRequest() you added is the culprit.

Which of the following actions should you do to determine the latency of the function?

Answer 25

Using AWS X-Ray, define an arbitrary subsegment inside the code to instrument the function.
\\\\\\\\\\\\\\\\\\\\\\\\\\\\
You can define arbitrary subsegments to instrument specific functions or lines of code in your application.

Question 26

A developer plans to use AWS Elastic Beanstalk to deploy a microservice application. The application will be implemented in a multi-container Docker environment.

How should the developer configure the container definitions in the environment?

Answer 26

Configure the container definitions in the Dockerrun.aws.json file.
\\\\\\\\\\\\\\\\\\\

Question 26

A developer has an application that stores sensitive data to an Amazon DynamoDB table. AWS KMS must be used to encrypt the data before sending it to the table and to manage the encryption keys.

Which of the following features are supported when using AWS KMS? (Select TWO.)

Answer 26

• Re-enabling disabled keys
• Creation of symmetric and asymmetric keys
  \\\\\\\\\\\\\
  automatic key rotation is only supported in symmetric KMS keys.

you can only import your own key material into symmetric keys, not asymmetric keys.

you can only use AWS CloudHSM as a custom key store for AWS KMS

Question 27

A team of developers needs permission to launch EC2 instances with an instance role that will allow them to update items in a DynamoDB table. Each developer has access to IAM users that belongs in the same IAM group.

Which of the following steps must be done to implement the solution?

Answer 27

Create an IAM role with an IAM policy that will allow access to the DynamoDB table. Add the EC2 service to the trust policy of the role. Create a custom policy with iam:PassRole permission. Attach the policy to the IAM group.
\\\\\\\\\\\\\\\
If the developers don’t have iam:PassRole permission, he or she can’t associate a role with the instance during launch.

The PassRole permission helps you make sure that a user doesn’t pass a role to an EC2 instance where the role has more permissions than you want the user to have. For example, Alice might be allowed to perform only EC2 and S3 actions. If Alice could pass a role to the EC2 instance that allows additional actions, she could log into the instance, get temporary security credentials via the role she passed, and make calls to AWS that you don’t intend.

Question 28

A developer has been instructed to automate the creation of the snapshot of an existing Amazon EC2 instance. The engineer created a script that uses the AWS Command Line Interface (CLI) to run the necessary API call. He is getting an InvalidInstanceID.NotFound error whenever the script is run.

What is the most likely cause of the error?

Answer 28

The AWS Region name used to configure the AWS CLI does not match the region where the instance lives.
\\\\\\\\\\\
Since it was mentioned in the scenario that the EC2 instance already exists, we can conclude that there is a mismatch in the AWS Region configured in the CLI. It means that the EC2 instance is located in another Region which is why the developer got the error message.

Question 28

A developer is building an application with Amazon DynamoDB as its database. The application needs to group the PUT, UPDATE, and DELETE actions into a single all-or-nothing operation to make changes against multiple items in the DynamoDB table.

Which DynamoDB operation should the developer use?

Answer 28

TransactWriteItems
\\\\\\\\\\\
With Amazon DynamoDB transactions, you can group multiple actions together and submit them as a single all-or-nothing TransactWriteItems or TransactGetItems operation.

TransactWriteItems is a synchronous and idempotent write operation that groups up to 25 write actions in a single all-or-nothing operation. These actions can target up to 25 distinct items in one or more DynamoDB tables within the same AWS account and in the same Region. The aggregate size of the items in the transaction cannot exceed 4 MB. The actions are completed atomically so that either all of them succeed or none of them succeeds.

Question 29

An application executes GET operations to various AWS services. The development team is using AWS X-Ray to trace all the calls made to AWS. As one of the developers, you are responsible for maintaining a particular block of code on the application. To save time, you only want to record data associated with the code to group the traces in the AWS console.

Which of the following X-Ray features should you use?

Answer 29

Annotations.
\\\\\\\\
Annotations are simple key-value pairs that are indexed for use with filter expressions. Use annotations to record data that you want to use to group traces in the console, or when calling the GetTraceSummaries API.

Metadata are key-value pairs with values of any type, including objects and lists, but that is not indexed. You commonly use metadata to record data that you want to store in the trace but don’t need to search for traces.

Question 30

A Lambda function is being developed to process a 50MB gzip-compressed file that will be uploaded to an S3 bucket on a daily basis. The function must have access to a storage location where it can load and unzip the file. After processing, the file will be delivered to another S3 bucket.

Which solution can the developer implement that requires the LEAST effort and cost?

Answer 30

Download the file to the /tmp directory. From there, consume and process the data before sending it to the S3 bucket.
\\\\\\\\\\\\\\
The Lambda execution environment provides ephemeral storage for your code to use at /tmp. This space has a size that can be set between 512 MB (free) and 10,240 MB. For this feature, you are charged for the storage you configure over the 512 MB free limit for the duration of your function invokes.

In the scenario, the /tmp directory can be used as a staging area for unzipping the file. Also, since the file size is relatively small (50MB), even when unzipped, the default 512 MB should be enough for the job, making the solution the best option in terms of effort and cost.

Question 31

An application is used to upload images to an Amazon S3 bucket. Once an event occurs, a Lambda function is triggered to compress the photos. However, it has been discovered that the processing time of the function is longer than expected.

Which change will improve the processing time of the function most effectively?

Answer 31

Increase the memory allocation of the function.
\\\\\\\\\\\\
Allocating more memory to a Lambda function also increases the amount of CPU, network, and other resources allocated to it. By provisioning more memory, you can improve the performance and speed of your function while potentially reducing your costs. You should benchmark your use case to determine where the breakeven point is for running faster and using more memory vs running slower and using less memory.

Question 32

A development team wants to move its continuous integration (CI) system into AWS. The system is built using Github as the code repository. Each code push triggers a webhook that causes the CI software to compile the source code and runs a test to check if the changes broke anything before deploying.

What AWS services can the development team use?

Answer 32

Replace Github, webhook, and the CI Software with AWS CodeCommit, AWS Lambda, and AWS CodeBuild respectively.
\\\\\\\\\\\
AWS CodeCommit is a fully-managed source control service that hosts secure Git-based repositories. It makes it easy for teams to collaborate on code in a secure and highly scalable ecosystem.

AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy.

Question 33

An application is hosted in the us-east-1 region. The app needs to be recreated on the us-east-2, ap-northeast-1, and ap-southeast-1 region using the same Amazon Machine Image (AMI). As the developer, you have to use AWS CloudFormation to rebuild the application using a template.

Which of the following actions is the most suitable way to configure the CloudFormation template for the scenario?

Answer 33

Copy the AMI of the instance from the us-east-1 region to the us-east-2, ap-northeast-1, and ap-southeast-1 region. Then, add a Mappings section wherein you will define the different Image Id for the three regions. Use the region name as the key in mapping to its correct Image Id. Lastly, use the Fn::FindInMap function to retrieve the desired Image Id from the region key.

Question 34

A developer is managing an Application Load Balancer that targets a Lambda function. The developer needs to obtain all values of identical query parameters key that is supplied in a request.

How can the developer implement this?

Answer 34

Enable the multi-value headers on the Application Load Balancer.
\\\\\\\\\\\\\\
Application Load Balancers provide two advanced options that you may want to configure when you use ALBs with AWS Lambda: support for multi-value headers and health check configurations. You can set up these options in Target Groups section on the Amazon EC2 console.

Question 35

A startup has recently opened an AWS account to develop a cloud-native web application. The CEO wants to improve the security of the account by implementing the best practices in managing access keys in AWS.

Which actions follow the security best practices in IAM? (Select TWO.)

Answer 35

• Delete any access keys to your AWS account root user.
• Use IAM roles for applications that need access to AWS services.
  \\\\\\\\\\\\\\\\\\\

Question 36

Some static assets stored in an S3 bucket need to be accessed by a user on the development account. The S3 bucket is in the production account. According to the company policy, the sharing of full credentials between accounts is prohibited.

What steps should be done to delegate access across the two accounts? (Select THREE.)

Answer 36

• On the production account, create an IAM role and specify the development account as a trusted entity.
• Set the policy that will grant access to S3 for the IAM role created in the production account
• Log in to the development account and create a policy that will use STS to assume the IAM role in the production account. Attach the policy to corresponding IAM users.

Question 37

A developer is building a new feature for an application deployed on an EC2 instance in the N. Virginia region. A co-developer suggests to upload the code on Amazon S3 and use CodeDeploy to deploy the new version of the application. The deployment fails during the DownloadBundle deployment lifecycle event with the UnknownError: not opened for reading error.

What is the possible cause of this?

Answer 37

The EC2 instance’s IAM profile does not have the permissions to access the application code in Amazon S3.
\\\\\\\\\\\\\\\\
An EC2/On-Premises deployment hook is executed once per deployment to an instance. You can specify one or more scripts to run in a hook. Each hook for a lifecycle event is specified with a string on a separate line. Here are descriptions of the hooks available for use in your AppSpec file.

Question 38

Several development teams worldwide will be collaboratively working on a project hosted on an AWS Elastic Beanstalk environment. The developers need to be able to deploy incremental code updates without re-uploading the entire project.

Which of the following actions will reduce the upload and deployment time with the LEAST amount of effort?

Answer 38

Create an AWS CodeCommit repository and allow access to all developers. Deploy the code to Elastic Beanstalk.
\\\\\\\\\\\\

Question 39

A developer is writing an application that will download hundreds of media files. Each file must be encrypted with a unique encryption key within the application before storing it in an S3 bucket. The developer needs a cost-effective solution with low management overhead.

Which of the following is the most suitable solution?

Answer 39

Use the GenerateDataKey API command to generate a data key for each file to encrypt them. Store the encrypted data key and the file.
\\\\\\\\\\\\\\\
The GenerateDataKey generates a unique symmetric data key for client-side encryption. This operation returns a plaintext copy of the data key and a copy that is encrypted under a customer master key (CMK) that you specify. You can use the plaintext key to encrypt your data outside of AWS KMS and store the encrypted data key with the encrypted data.

GenerateDataKey returns a unique data key for each request. The bytes in the plaintext key are not related to the caller or the CMK.

Question 40

A company uses a Linux, Apache, MySQL, and PHP (LAMP) web service stack to host an on-premises application for its car rental business. The manager wants to move its operation into the Cloud using Amazon Web Services.

Which combination of services could be used to run the application that will require the least amount of configuration?

Answer 40

Amazon EC2 and Amazon Aurora.
\\\\\\\\\\\\\\\
You can install an Apache web server with PHP and MySQL support on your Amazon Linux instance (sometimes called a LAMP web server or LAMP stack). You can use this server to host a static website or deploy a dynamic PHP application that reads and writes information to a database.

To decouple the database from the application, you can choose from the AWS Database services that support MySQL (e.g., Amazon RDS, Amazon Aurora)

From the options given, we can deploy a LAMP web server by using an EC2 instance and an Amazon Aurora database for MySQL.

Question 41

A San Francisco-based tech startup is building a cross-platform mobile app that can notify the user of upcoming astronomical events. Your mobile app authenticates with the Identity Provider (IdP) using the provider’s SDK and Amazon Cognito. Once the end-user is authenticated with the IdP, the OAuth or OpenID Connect token returned from the IdP is passed by your app to Amazon Cognito.

Which of the following is returned for the user to provide a set of temporary, limited-privilege AWS credentials?

Answer 41

Cognito ID
\\\\\\\\
You can use Amazon Cognito to deliver temporary, limited-privilege credentials to your application so that your users can access AWS resources. Amazon Cognito identity pools support both authenticated and unauthenticated identities. You can retrieve a unique Amazon Cognito identifier (identity ID) for your end-user immediately if you’re allowing unauthenticated users or after you’ve set the login tokens in the credentials provider if you’re authenticating users.

Question 42

A company has a serverless application on AWS. They are using AWS Lambda for business logic and Amazon API Gateway for handling client requests. They have published a version of the AccountService:Prod function with the alias AccountService:Beta. The internal team wants to test these updates before promoting them to production without impacting live users.

Which configuration should the company take?

Answer 42

Create a new stage named ‘Beta’ in Amazon API Gateway and use stage variables to reference the Lambda functions in Prod and Beta.
\\\\\\
With deployment stages in API Gateway, you can manage multiple release stages for each API, such as alpha, beta, and production. Using stage variables you can configure an API deployment stage to interact with different backend endpoints.

For example, your API can pass a GET request as an HTTP proxy to the backend web host (for example, http://example.com). In this case, the backend web host is configured in a stage variable so that when developers call your production endpoint, API Gateway calls example.com. When you call your beta endpoint, API Gateway uses the value configured in the stage variable for the beta stage, and calls a different web host (for example, beta.example.com). Similarly, stage variables can be used to specify a different AWS Lambda function name for each stage in your API.

In the scenario, by creating a new stage named ‘Beta’, the company can safely test updates by routing internal traffic to this stage, which will reference the AccountService:Beta version of the Lambda function. This will allow testers to invoke the new version of the function while end users continue to access the stable, production-ready AccountService:Prod version via the ‘Prod’ stage.

Question 43

A company is planning to launch an online cross-platform game that expects millions of users. The developer wants to use an in-house authentication system for user identification. Each user identifier must be kept consistent across devices and platforms.

How can the developer achieve this?

Answer 43

Use developer-authenticated identities in Amazon Cognito to generate unique identifiers for the users.
\\\\\\\\\
Amazon Cognito supports developer authenticated identities, in addition to web identity federation through Facebook (Identity Pools), Google (Identity Pools), Login with Amazon (Identity Pools), and Sign in with Apple (Identity Pools). With developer authenticated identities, you can register and authenticate users via your own existing authentication process, while still using Amazon Cognito to synchronize user data and access AWS resources. Using developer authenticated identities involves interaction between the end-user device, your backend for authentication, and Amazon Cognito.

Developers can use their own authentication system with Cognito. What this means is that your app can benefit from all of the features of Amazon Cognito while utilizing your own authentication system. This works by your app requesting a unique identity ID for your end-users based on the identifier you use in your own authentication system. You can use the Cognito identity ID to save and synchronize user data across devices with the Cognito sync service or retrieve temporary, limited-privilege AWS credentials to securely access your AWS resources.

The process is simple, you first request a token for your users by using the server-side Cognito API for developer authenticated identities. Cognito then creates a valid token for your users. You can then exchange this token with Amazon Secure Token Service for AWS credentials.

With developer authenticated identities, a new API, GetOpenIdTokenForDeveloperIdentity, was introduced. This API call replaces the use of GetId and GetOpenIdToken (APIs needed in the basic authflow) from the device and should be called from your backend as part of your own authentication API. Because this API call is signed by your AWS credentials, Cognito can trust that the user identifier supplied in the API call is valid. This replaces the token validation Cognito performs with public providers.

Question 44

An update was made on an AWS Lambda-based application. It is invoked by an API Gateway endpoint with caching enabled to improve latency requests. The developer expected to get the latest data as a response when he tested the application. However, he kept getting stale data upon trying many times.

What should the developer do that will require the LEAST amount of effort to resolve the issue? (Select TWO.)

Answer 44

• Include Cache-Control: max-age=0 HTTP header on the API request.
• Grant permission to the client to invalidate caching when there’s a request using the IAM execution role.
  \\\\\\\\\
  A client of your API can invalidate an existing cache entry and reload it from the integration endpoint for individual requests. The client must send a request that contains the Cache-Control: max-age=0 header. The client receives the response directly from the integration endpoint instead of the cache, provided that the client is authorized to do so. This replaces the existing cache entry with the new response, which is fetched from the integration endpoint.

To grant permission for a client, attach a policy of the following to an IAM execution role for the user.

This policy allows the API Gateway execution service to invalidate the cache for requests on the specified resource (or resources).
\\\\\\\
Although “no-cache” is a valid value for the Cache-Control HTTP header, it is not the right value when invalidating API Gateway cache. The Cache-Control: max-age=0 header must be used.

Question 45

A startup is integrating an event-driven alerting tool with a third-party platform. The platform requires a publicly accessible HTTPS endpoint to receive webhook requests, which will be processed by a Lambda function.

Given that the platform signs each request with a secret key and includes it in the headers, the developer must ensure that the Lambda function executes the domain logic only when a webhook request comes from a valid user.

Which action would satisfy the requirement with the least amount of development effort?

Answer 45

Create a Lambda function URL. Attach a resource-based policy to the function allowing anyone to invoke it only if the “lambda:FunctionUrlAuthType”: “NONE” condition is present. Write a custom authorization logic based on a signature provided in the HTTP headers.
\\\\\\\\\\\\\\\\\\\
If you need a simple way to configure an HTTPS endpoint in front of your Lambda function without having to learn and configure additional services besides Lambda, you can use Lambda function URLs. This can be useful in cases where you need to implement a simple webhook handler or form validator that runs within an individual Lambda function and does not require additional functionality beyond processing incoming requests.

By using Lambda function URLs, you can directly invoke your Lambda function using a simple HTTPS request without needing to set up and configure additional services like API Gateway. This approach can be a simple and efficient way to handle incoming requests and integrate with other services or third-party platforms that require a publicly accessible HTTPS endpoint.

There are two types of authorization available for Lambda function URLs:

AWS_IAM - the function URL can only be invoked by an IAM user or role with the necessary permissions. This can be useful in cases where you need to restrict access to the Lambda function to a specific set of users or roles within your organization.

NONE - anyone can invoke the Lambda function using the URL. This approach can be useful in cases where you want to make the Lambda function publicly accessible and do not require any additional authentication or authorization beyond the URL. However, you may still need to validate the incoming requests in the Lambda function to ensure that the request comes from a trusted source.

By setting the “lambda:FunctionUrlAuthType” condition to “NONE,” the function will be publicly accessible without requiring any additional authentication. However, you still need to write custom authorization logic to verify the signature provided in the HTTP headers and ensure that the request is coming from a valid user.

Question 46

A developer is building an application that uses Amazon CloudFront to distribute thousands of images stored in an S3 bucket. The developer needs a fast and cost-efficient solution that will allow him to update the images immediately without waiting for the object’s expiration date.

Which solution meets the requirements?

Answer 46

Update the images by using versioned file names.
\\\\\\\\\\
When you update existing files in a CloudFront distribution, AWS recommends that you include some sort of version identifier either in your file names or in your directory names to give yourself better control over your content. This identifier might be a date-time stamp, a sequential number, or some other method of distinguishing two versions of the same object.

For example, instead of naming a graphic file image.jpg, you might call it image_1.jpg. When you want to start serving a new version of the file, you’d name the new file image_2.jpg, and you’d update the links in your web application or website to point to image_2.jpg. Alternatively, you might put all graphics in an images_v1 directory and, when you want to start serving new versions of one or more graphics, you’d create a new images_v2 directory, and you’d update your links to point to that directory. With versioning, you don’t have to wait for an object to expire before CloudFront begins to serve a new version of it, and you don’t have to pay for object invalidation.

Question 47

A company wants to know how its monolithic application will perform on a microservice architecture. The Lead Developer has deployed the application on Amazon ECS using the EC2 launch type. He terminated the container instance after testing; however, the container instance still appears as a resource in the ECS cluster.

What is the possible cause of this?

Answer 47

When a container instance is terminated in the stopped state, the container instance is not automatically deregistered from the cluster.
\\\\\\\\\\
If you terminate a container instance in the RUNNING state, that container instance is automatically removed or deregistered from the cluster. However, if you terminate a container instance in the STOPPED state, that container instance isn’t automatically removed from the cluster.

To deregister your container instance from the cluster, you should deregister it after terminating it in the STOPPED state by using the Amazon ECS Console or AWS Command Line Interface. The deregistered container instance will no longer appear as a resource in your Amazon ECS cluster.

Question 48

The Customer and Payment service components of a microservices application have two separate DynamoDB tables. New items inserted into the Customer service table must be dynamically updated in the Payment service table.

How can the Payment service get near real-time updates?

Answer 48

Enable DynamoDB Streams to stream all the changes from the Customer service table and trigger a Lambda function to update the Payment service table.

Question 49

A developer is building a serverless API composed of an API Gateway and several Lambda functions. All resources are defined using Cloud Development Kit (CDK) L2 constructs. The developer wants to test some of the Lambda functions in their local environment.

Given that AWS SAM and AWS CDK are already configured locally, what combination of actions must the developer do? (Select TWO.)

Answer 49

• Run the cdk synth command and indicate the stack name of Lambda functions to be tested.
• Execute the sam local invoke command and specify the location of the synthesized CloudFormation template and identifier of each function.
  \\\\\\\\\\
  The sam local invoke command allows you to test AWS Lambda functions locally by emulating the Lambda execution environment. However, to test resources defined in AWS CDK, you must first convert the CDK constructs into a format that SAM can understand. This is where the cdk synth command comes into play. It synthesizes or “compiles” your CDK application into an AWS CloudFormation template.

By running cdk synth, you generate the necessary CloudFormation template that sam local invoke can be used to locally execute and test your Lambda functions.

Question 50

A developer is testing a Lambda function that was created from a CloudFormation template. While the function executes without errors, it isn’t generating logs in Amazon CloudWatch Logs, and the developer cannot find associated log streams or log groups.

Upon inspection, the following observations were made:

The function’s code contains appropriate logging statements.

The Lambda function is associated with an execution role that establishes a trusted relationship with the Lambda service; however, this role has no permissions assigned.

The Lambda function does not have any resource-based policies.

Which configuration must be done to resolve the issue?

Answer 50

Update the execution role by adding the AWSLambdaBasicExecutionRole managed policy.
\\\\\\\
A Lambda function’s execution role is an AWS Identity and Access Management (IAM) role that grants the function permission to access AWS services and resources. For example, you might create an execution role that has permission to send logs to Amazon CloudWatch and upload trace data to AWS X-Ray.

The AWSLambdaBasicExecutionRole is a managed policy provided by AWS that includes permissions essential for a Lambda function to create and write logs to Amazon CloudWatch Logs. These permissions include permissions to Log actions such as logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.

When you create a Lambda function using the AWS Management Console, the execution role that AWS automatically creates for you often includes this managed policy. However, when defining a Lambda function via a CloudFormation template or other Infrastructure as Code (IAC) methods, you might need to explicitly attach this policy to the function’s execution role to ensure that it has the appropriate logging permissions.

Question 51

A developer has enabled the lifecycle policy of an application deployed in Elastic Beanstalk. The lifecycle is set to limit the application version to 15 versions. The developer wants to keep the source code in an S3 bucket, yet, it gets deleted.

What change should the developer do?

Answer 51

Configure the retention setting to retain the source bundle in S3.
\\\\\\
Each time you upload a new version of your application with the Elastic Beanstalk console or the EB CLI, Elastic Beanstalk creates an application version. If you don’t delete versions that you no longer use, you will eventually reach the application version quota and be unable to create new versions of that application.

You can avoid hitting the quota by applying an application version lifecycle policy to your applications. A lifecycle policy tells Elastic Beanstalk to delete application versions that are old or to delete application versions when the total number of versions for an application exceeds a specified number.

Elastic Beanstalk applies an application’s lifecycle policy each time you create a new application version and deletes up to 100 versions each time the lifecycle policy is applied. Elastic Beanstalk deletes old versions after creating the new version and does not count the new version towards the maximum number of versions defined in the policy.

Question 52

A company is running an Artificial Intelligence (AI) software for its automotive clients using the AWS Cloud. The software is used for identifying road obstructions for autonomous driving and predicting failure on vehicle components. The company wants to extend its usage and access based on different levels (students, professionals, and hobbyist developers) by exposing an API through API Gateway. The company should regulate access to the API and monetize it by charging based on usage.

What should the company do?

Answer 52

Create three Usage Plans. Specify a quota and throttle requests according to the level of access.
\\\\\\\
A usage plan specifies who can access one or more deployed API stages and methods—and also how much and how fast they can access them. The plan uses API keys to identify API clients and meters access to the associated API stages for each key. It also lets you configure throttling limits and quota limits that are enforced on individual client API keys.

This feature allows developers to build and monetize APIs and to create ecosystems around them. You can create usage plans for different levels of access (Bronze, Silver, and Gold), different categories of users (Student, Individual, Professional, or Enterprise), and so forth.

Question 53

A developer needs to build a queueing mechanism for an application that will run on AWS. The application is expected to consume SQS messages that are larger than 256 KB and up to 1 GB in size.

How should the developer manage the SQS messages?

Answer 53

Use Amazon S3 and the Amazon SQS Extended Client Library for Java.
\\\\\\
o manage large Amazon Simple Queue Service (Amazon SQS) messages, you can use Amazon Simple Storage Service (Amazon S3) and the Amazon SQS Extended Client Library for Java. This is especially useful for storing and consuming messages up to 2 GB. Unless your application requires repeatedly creating queues and leaving them inactive or storing large amounts of data in your queues, consider using Amazon S3 for storing your data.

You can use the Amazon SQS Extended Client Library for Java to do the following:

• Specify whether messages are always stored in Amazon S3 or only when the size of a message exceeds 256 KB
• Send a message that references a single message object stored in an S3 bucket
• Retrieve the message object from an S3 bucket
• Delete the message object from an S3 bucket

You can use the Amazon SQS Extended Client Library for Java to manage Amazon SQS messages using Amazon S3 only with the AWS SDK for Java. You can’t do this with the AWS CLI, the Amazon SQS console, the Amazon SQS HTTP API, or any of the other AWS SDKs.

Question 54

A development team is building a website that displays an analytics dashboard. The team uses AWS CodeBuild to compile the website from a source code residing on Github. A member was instructed to configure CodeBuild to run with a proxy server for privacy and security reasons. A RequestError timeout error appears on CloudWatch whenever CodeBuild is accessed.

Which is a possible solution to resolve the issue?

Answer 54

Modify the proxy element of the buildspec.yml file on the source code root directory.
\\\\\\
You can use AWS CodeBuild with a proxy server to regulate HTTP and HTTPS traffic to and from the Internet. To run CodeBuild with a proxy server, you install a proxy server in a public subnet and CodeBuild in a private subnet in a VPC.

Below are possible causes of error when running CodeBuild with a proxy server:

ssl-bump is not configured properly.

Your organization’s security policy does not allow you to use ssl-bump.

Your buildspec.yml file does not have proxy settings specified using a proxy element.

If you do not use ssl-bump for an explicit proxy server, add a proxy configuration to your buildspec.yml using a proxy element.

version: 0.2
proxy:
upload-artifacts: yes
logs: yes

Question 55

A Ruby developer is looking to offload some of the processing on his application to the AWS cloud without managing any servers. The submodules must be written in Ruby, which mainly invokes API calls to an external web service. The response from the API call is parsed and stored in a MongoDB database.

What should he do to develop the Lambda function in his preferred programming language?

Answer 55

Create a Lambda function with a supported runtime version for Ruby.
\\\\\\\\
AWS Lambda natively supports Java, Go, PowerShell, Node.js, C#, Python, and Ruby code, and provides a Runtime API, which allows you to use any additional programming languages to author your functions.

You can use the custom runtime to create a Lambda function if your preferred language is not available. You can implement an AWS Lambda runtime in any programming language. A runtime is a program that runs a Lambda function’s handler method when the function is invoked. You can include a runtime in your function’s deployment package in the form of an executable file named bootstrap.

Because AWS Lambda supports Ruby by default, there’s no additional configuration needed.

Question 56

A developer wants to cut down the execution time of the scan operation on a DynamoDB table during periods of low demand without interfering with typical workloads. The operation consumes half of the strongly consistent read capacity units within regular operating hours.

How can the developer improve this scan operation?

Answer 56

Perform a rate-limited parallel scan operation.
\\\\\\\\\\\
By default, the Scan operation processes data sequentially. Amazon DynamoDB returns data to the application in 1 MB increments, and an application performs additional Scan operations to retrieve the next 1 MB of data.

The larger the table or index being scanned, the more time the Scan takes to complete. In addition, a sequential Scan might not always be able to fully use the provisioned read throughput capacity: Even though DynamoDB distributes a large table’s data across multiple physical partitions, a Scan operation can only read one partition at a time. For this reason, the throughput of a Scan is constrained by the maximum throughput of a single partition.

To address these issues, the Scan operation can logically divide a table or secondary index into multiple segments, with multiple application workers scanning the segments in parallel. Each worker can be a thread (in programming languages that support multithreading) or an operating system process. To perform a parallel scan, each worker issues its own Scan request with the following parameters:

To make the most of your table’s provisioned throughput, you’ll want to use the Parallel Scan API operation so that your scan is distributed across your table’s partitions. But be careful that your scan doesn’t consume your table’s provisioned throughput and cause the critical parts of your application to be throttled. To avoid throttling, you need to rate-limit your client application.

Question 57

A development team needs to deploy an application revision into three environments: Test, Staging, and Production. The application should be deployed into the Test environment first, then Staging, and then Production.

Which approach will conveniently allow the team to deploy the application into different environments?

Answer 57

Create multiple deployment groups for each environment using AWS CodeDeploy.
\\\\\\\\
In an EC2/On-Premises deployment, a deployment group is a set of individual instances targeted for deployment. A deployment group contains individually tagged instances, Amazon EC2 instances in Amazon EC2 Auto Scaling groups, or both.

You can associate more than one deployment group with an application in CodeDeploy. This makes it possible to deploy an application revision to different sets of instances at different times. For example, you might use one deployment group to deploy an application revision to a set of instances tagged Test where you ensure the code’s quality. Next, you deploy the same application revision to a deployment group with instances tagged Staging for additional verification. Finally, when you are ready to release the latest application to customers, you deploy to a deployment group that includes instances tagged Production.

Question 58

A developer is managing several microservices built using API Gateway and AWS Lambda. The Developer wants to deploy new updates to one of the APIs. He wants to ensure a smooth transition between the versions by giving users enough time to migrate to the new version before retiring the previous one.

Which solution should the developer implement?

Answer 58

Implement the updates and publish a new version of the Lambda function. Specify the new version in the API Gateway target resource then redeploy it to a new stage.
\\\\\\\\\\\
To deploy an API, you create an API deployment and associate it with a stage. A stage is a logical reference to a lifecycle state of your API (for example, dev, prod, beta, v2). API stages are identified by the API ID and stage name. They’re included in the URL that you use to invoke the API. Each stage is a named reference to an API deployment and is made available for client applications to call.

In the scenario, you can apply the new updates to the backend Lambda function and publish it as a new version. Then, update the integration request of the target API resource by replacing the old Lambda function ARN with the new version’s ARN. Finally, deploy the resource to a new stage and use the new Invoke URL in your application. This way, existing users will be able to access both versions. You can retire the old version eventually after all users have migrated to the new one.

Question 59

A developer has a Python script that relies on the low-level BatchGetItem API to fetch large amounts of data from a DynamoDB table. The script often encounters responses with partial results. A significant portion of the data appears under UnprocessedKeys.

Which approaches can the developer implement to handle data retrieval MOST reliably? (Select TWO.)

Answer 59

• Implement an exponential backoff algorithm with a randomized delay between retries of the batch request.
• Use the AWS software development kit (AWS SDK) to send batch requests.
  \\\\\\\\\
  single BatchGetItem operation can retrieve up to 16 MB of data, which can contain as many as 100 items.

BatchGetItem returns a partial result if:

• The response size limit is exceeded
• The table’s provisioned throughput is exceeded
• More than 1MB per partition is requested
• An internal processing failure occurs.

For example, if you ask to retrieve 100 items, but each individual item is 300 KB in size, the system returns 52 items (so as not to exceed the 16 MB limit). It also returns an appropriate UnprocessedKeys value so you can get the next page of results. If desired, your application can include its own logic to assemble the pages of results into one dataset.

If none of the items can be processed due to insufficient provisioned throughput on all of the tables in the request, then BatchGetItem returns a ProvisionedThroughputExceededException. If at least one of the items is successfully processed, then BatchGetItem completes successfully while returning the keys of the unread items in UnprocessedKeys.

If DynamoDB returns any unprocessed items, you should retry the batch operation on those items. It’s recommended that you use an exponential backoff algorithm. Exponential backoff is a technique where, if a request to a server fails, you wait a bit before retrying. If it keeps failing, you wait longer each time. The main idea is to reduce the frequency of calls over time, which helps avoid overloading the server, giving it a better chance to recover and respond successfully.

If you retry the batch operation immediately, the underlying read or write requests can still fail due to throttling on the individual tables. Adding progressively longer waits between retries using exponential backoff can make the individual requests in the batch much more likely to succeed. You can implement an exponential backoff yourself in your code or simply use the AWS SDK, which comes with automatic retry logic and exponential backoff.