Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 1261Question →

A developer needs to update a web application running on an AWS Elastic Beanstalk environment. The update must be performed with zero downtime. Due to strict budget constraints, the environment must not provision any additional Amazon EC2 instances during the deployment process. The development team is willing to accept a temporary reduction in application capacity while the update is in progress. Which deployment strategy should the developer configure?

Show answer & explanation

Answer: Rolling

Answer

Rolling
The Rolling deployment strategy updates instances in-place in batches. Because it uses the existing instances to perform the update and does not launch additional instances, it complies with the budget constraint. It keeps the remaining instances in service during the batch updates, satisfying the zero-downtime requirement at the expense of a temporary reduction in capacity.

Step-by-Step Solution

1
Analyze the requirements and constraints in the scenario.
Requirements identified: 1. Zero downtime. 2. No additional EC2 instances allowed due to budget. 3. Temporary capacity reduction is acceptable.
Understanding the constraints is necessary to eliminate unsuitable deployment options.
2
Evaluate the available AWS Elastic Beanstalk deployment policies against the constraints.
All-at-once causes downtime. Immutable and Rolling with additional batch launch new EC2 instances. Rolling updates existing instances in batches without provisioning extra instances.
To find the strategy that satisfies both zero-downtime and zero additional instance creation.
3
Select the strategy that meets all constraints.
Rolling is the correct selection as it updates instances in-place in batches, incurring no extra instance costs and maintaining service availability at reduced capacity.
Ensures the selected option fulfills the application requirements.

Key Concept

AWS Elastic Beanstalk deployment policies allow developers to balance application availability, capacity, and cost during updates.
Question 1262Question →

A developer is designing a collaborative document editing web application. The application authenticates users using an Amazon Cognito User Pool. The backend APIs are hosted on Amazon API Gateway. The developer wants to restrict access to a specific API Gateway resource method (POST /documents) so that only users belonging to the 'Editors' Cognito User Pool group can invoke it.

Which TWO configurations would allow the developer to implement this group-based authorization?

Select all that apply

Show answer & explanation

Answer: Configure the API Gateway resource method to use AWS_IAM authorization. Configure an Amazon Cognito Identity Pool to map Cognito User Pool groups to distinct IAM roles, and configure the application to sign the API requests with the temporary credentials obtained from the Identity Pool.; Create an API Gateway Lambda Authorizer. Program the Lambda function to validate the User Pool JWT token, extract the cognito:groups claim, and dynamically generate an IAM policy that grants or denies execution permissions for the method based on the group membership.

Answer

The developer can implement group-based authorization by configuring the API Gateway method to use AWS_IAM authorization combined with a Cognito Identity Pool mapping groups to IAM roles, or by implementing an API Gateway Lambda Authorizer that inspects the cognito:groups claim inside the JWT token to generate a dynamic IAM policy.
Group-based authorization in Amazon API Gateway cannot be natively enforced using only the built-in Cognito User Pool authorizer. To restrict resource access to specific Cognito groups, two approaches are valid. The first is to set up a Cognito Identity Pool that maps User Pool groups to distinct IAM roles, secure the API Gateway methods with AWS_IAM, and have the client sign requests using temporary credentials. The second is to implement an API Gateway Lambda Authorizer. This custom authorizer validates the token, extracts the group claims from the token's claims, and outputs an IAM policy that allows or denies the execution of the requested method.

Step-by-Step Solution

1
Determine where the authorization check should occur.
Authorization should occur at the API Gateway layer before invoking backend resources to avoid unnecessary invocation costs and latency.
This rules out executing database checks or calling identity administration APIs inside the backend integration.
2
Evaluate Cognito Identity Pools role-mapping.
Cognito Identity Pools allow mapping Cognito User Pool groups directly to IAM roles. These roles contain policies that permit or deny actions on API Gateway resource methods (execute-api:Invoke).
The client uses these mapped roles to obtain temporary AWS credentials and signs the HTTP request to API Gateway.
3
Evaluate custom Lambda Authorizers.
A Lambda Authorizer intercepts API requests, decodes the JWT token sent by the client, reads the groups from the token payload, and constructs a standard IAM policy dynamically.
This provides fine-grained control directly in code without requiring clients to obtain temporary AWS credentials.

Key Concept

Amazon Cognito Group-Based API Authorization
Estimated Time:1m 30s
Question 1263Question →

A web-based partner portal hosted on `https://partner.datasync.io` receives a `502 Bad Gateway` error and a CORS block message in the browser console when sending a `PATCH` request to an Amazon API Gateway REST API. The API is configured with a Lambda Proxy integration. The developer checks the Amazon CloudWatch logs and confirms that the backend Lambda function executed successfully and returned the following JSON structure:

{
"statusCode": 200,
"body": "{\"message\": \"Update successful\"}"
}

Which action should the developer take to resolve this error?

Show answer & explanation

Answer: Modify the Lambda function response to include the Access-Control-Allow-Origin header in a headers object within the returned JSON.

Answer

Modify the Lambda function response to include the Access-Control-Allow-Origin header in a headers object within the returned JSON.
In a Lambda Proxy integration, API Gateway expects the backend Lambda function to return a structured JSON response that includes status code, headers, and body. Because the integration bypasses API Gateway's integration response mappings, the Lambda function is solely responsible for returning the `Access-Control-Allow-Origin` header in its response. Without this header, the browser blocks the response, leading to a CORS policy violation and a client-side error.

Step-by-Step Solution

1
Analyze the error context and integration type.
The endpoint uses a Lambda Proxy integration, meaning API Gateway expects the backend Lambda function to format its output exactly as a JSON object containing statusCode, body, and optionally headers.
Determining the integration type dictates whether API Gateway mapping templates (custom integration) or the Lambda function code (proxy integration) must supply the CORS headers.
2
Inspect the backend Lambda function output.
The function returns statusCode and body but is missing the headers object with Access-Control-Allow-Origin.
For proxy integrations, the browser's CORS requirements are satisfied only if the backend code explicitly provides the Access-Control headers in the returned payload.
3
Update the returned JSON object in the Lambda code.
The function now returns: { "statusCode": 200, "headers": { "Access-Control-Allow-Origin": "https://partner.datasync.io" }, "body": "..." }.
This payload format complies with both the API Gateway proxy integration contract and the browser's CORS policy, resolving the error.

Key Concept

Handling CORS and response formatting in API Gateway Lambda Proxy integrations.
Question 1264Question →

A logistics tracking application named PackTrack records real-time delivery status updates for packages. The underlying Amazon DynamoDB table uses `PackageID` as the partition key and `StatusTimestamp` as the sort key. A fleet monitoring dashboard needs to display all deliveries that are currently delayed. To retrieve this data, the dashboard runs a weekly batch process using a `Scan` operation with a `FilterExpression` on the `DeliveryStatus` attribute where the value equals `DELAYED`. As package volume increases, the scan operation consistently throws `ProvisionedThroughputExceededException` errors, causing the dashboard to load partially or fail entirely, despite the developer scaling up the table's read capacity units (RCUs). Which of the following is the most cost-effective and appropriate solution to resolve this throttling issue?

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with DeliveryStatus as the partition key and StatusTimestamp as the sort key, and update the dashboard to query the GSI instead of scanning the base table.

Answer

Create a Global Secondary Index (GSI) with DeliveryStatus as the partition key and StatusTimestamp as the sort key, and update the dashboard to query the GSI instead of scanning the base table.
The correct option is to create a Global Secondary Index (GSI) with DeliveryStatus as the partition key and query it. A Scan operation in DynamoDB reads every item in the table and then applies the filter, which consumes massive amounts of Read Capacity Units (RCUs) and leads to throttling as the table grows. By creating a GSI with DeliveryStatus as the partition key, the application can perform a Query operation instead. A Query only reads the items that match the partition key, consuming significantly fewer RCUs and resolving the throttling issue in a cost-effective manner.

Step-by-Step Solution

1
Analyze the cause of the ProvisionedThroughputExceededException.
Identify that the dashboard is using a Scan operation with a FilterExpression to locate specific records (delayed packages) rather than querying them directly.
Scan operations read the entire table before filtering out results, which consumes RCUs proportional to the size of the table rather than the number of matching items.
2
Select a strategy to convert the Scan into a Query.
Since the partition key of the base table is PackageID (high cardinality but not matching the query criteria), a secondary index is required to query by DeliveryStatus.
A Global Secondary Index (GSI) allows redefining the partition key to DeliveryStatus, enabling efficient Query operations.
3
Create the GSI and update the application logic.
Create a GSI with DeliveryStatus as the partition key and StatusTimestamp as the sort key. Modify the dashboard code to execute a Query against this GSI.
Querying the GSI retrieves only the relevant items matching 'DELAYED', which dramatically reduces RCU consumption and resolves throttling.

Key Concept

Resolving DynamoDB throttling issues by replacing inefficient Scan operations with targeted Query operations on a Global Secondary Index (GSI).
Question 1265Question →

A developer is designing the backend for a real-time ridesharing application. The application requires two distinct state management components:

1. A temporary queue for passenger-to-driver matching that requires fast, in-memory operations and support for sorted data structures.
2. A persistent data store for user session configurations (such as notification preferences) that must automatically expire after 3030 days of user inactivity.

Which combination of actions should the developer take to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Use Amazon ElastiCache for Redis to store and manage the passenger-to-driver matching queues.; Use Amazon DynamoDB to store user session configurations and configure DynamoDB Time to Live (TTL) on the expiration attribute.

Answer

Use Amazon ElastiCache for Redis to manage the temporary queues, and use Amazon DynamoDB with Time to Live (TTL) to store the persistent user session configurations.
The correct combination uses Amazon ElastiCache for Redis to store temporary passenger-to-driver matching queues since Redis native data types (like Sorted Sets) are designed for sorting and sub-millisecond latency. For persistent session state storage, Amazon DynamoDB is the industry-standard choice because it can scale horizontally and has a native Time to Live (TTL) feature that automatically expires items after 3030 days without consuming read or write capacity.

Step-by-Step Solution

1
Analyze the temporary queue requirement.
Identify that the queues need in-memory performance and support for sorted data structures.
Amazon ElastiCache for Redis is chosen because it supports Sorted Sets, which are perfect for queue ranking and ordering.
2
Analyze the session storage and auto-expiration requirement.
Identify that the database must store persistent session settings and expire them cost-effectively after 3030 days of inactivity.
Amazon DynamoDB with Time to Live (TTL) enabled automatically handles deletion of expired items at no extra cost and without consuming throughput capacity.

Key Concept

Selecting appropriate caching and session state management services based on data structure, persistence, and expiration requirements.
Estimated Time:2m 0s
Question 1266Question →

A developer is troubleshooting a local C# (.NET) console application that uses the AWS SDK for .NET to read objects from an Amazon S3 bucket. The developer has configured the AWS CLI on their workstation with a named profile called `dev-profile` containing valid AWS credentials. However, when executing the application locally, it throws an `AmazonServiceException` indicating that the credentials cannot be found. No environment variables are set on the workstation, and the SDK is initialized using default client configuration. Which of the following actions is the most secure and appropriate way to resolve this credential error for local development?

Show answer & explanation

Answer: Set the AWS_PROFILE environment variable to dev-profile in the local shell environment.

Answer

Set the AWS_PROFILE environment variable to dev-profile in the local shell environment.
The correct answer is to set the AWS_PROFILE environment variable to the named profile. The default credential provider chain in the AWS SDK for .NET automatically checks for this variable. If set, it overrides the default profile search and reads the credentials from the matching named block in the shared AWS credentials file. This avoids exposing secrets and requires no modification of the application code.

Step-by-Step Solution

1
Analyze how the AWS SDK for .NET searches for credentials locally.
The default credential provider chain searches environment variables, followed by the shared credentials file (~/.aws/credentials).
Understanding the lookup order helps identify why the named profile was not automatically detected.
2
Identify the root cause of the credential lookup failure.
Since no environment variables are set, the SDK looks for the default profile in the credentials file, but the credentials are saved under the named profile dev-profile.
Named profiles are ignored by default unless explicitly requested via configuration or environment variables.
3
Select the correct mechanism to configure the profile name without changing the source code.
Exporting the AWS_PROFILE environment variable pointing to dev-profile ensures the default chain locates the credentials.
Setting the environment variable is non-intrusive, secure, and adheres to standard configuration precedence.

Key Concept

AWS SDK Credential Provider Chain and Named Profiles
Question 1267Question →

A digital library application retrieves book metadata from an Amazon DynamoDB table. During a reading campaign, a few popular books receive a high volume of read requests, causing DynamoDB read throttling. The developer wants to implement a caching solution to reduce read latency to sub-milliseconds for these popular books with minimal changes to the application code.

Which two actions should the developer take to resolve the throttling and meet the performance requirements? (Select two.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon DynamoDB Accelerator (DAX) cluster.; Configure the application to use the DAX SDK client instead of the standard DynamoDB client.

Answer

To resolve read throttling and achieve sub-millisecond read latency with minimal application changes, the developer should create an Amazon DynamoDB Accelerator (DAX) cluster and configure the application to use the DAX SDK client.
Creating an Amazon DynamoDB Accelerator (DAX) cluster and configuring the application to use the DAX SDK client is the correct approach. DAX is an in-memory, write-through cache that is API-compatible with DynamoDB. Replacing the standard client with the DAX client requires minimal code changes and routes read operations through the cache, reducing read latency to sub-milliseconds and offloading the read volume from the database table.

Step-by-Step Solution

1
Identify the caching solution that integrates with DynamoDB with minimal code changes.
Amazon DynamoDB Accelerator (DAX) is selected as the dedicated, API-compatible caching service for DynamoDB.
Unlike general-purpose caching systems, DAX does not require application logic to manage cache population or invalidation.
2
Provision the cache cluster.
A DAX cluster is created in the same region as the DynamoDB table.
The DAX cluster will serve as the read cache in front of the DynamoDB table.
3
Configure the client application.
The application code is updated to instantiate the DAX client library instead of the default AWS SDK DynamoDB client.
The DAX client routes read and write operations directly to the DAX cluster, fallbacking to DynamoDB automatically.

Key Concept

DynamoDB Accelerator (DAX) caching implementation
Estimated Time:1m 0s
Question 1268Question →

A developer has configured an AWS Lambda function in Account A (123456789012) to access resources in Account B (987654321098) by assuming an IAM role named CrossAccountAccessRole in Account B. The developer attached an IAM policy to the Lambda execution role in Account A that permits the sts:AssumeRole action. However, when the Lambda function runs and attempts to assume the role, the API call fails with an AccessDenied error.

The trust policy for CrossAccountAccessRole in Account B is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to resolve this error?

Show answer & explanation

Answer: Modify the trust policy of CrossAccountAccessRole in Account B to specify the ARN of the Lambda function's execution role from Account A as the principal.

Answer

Modify the trust policy of CrossAccountAccessRole in Account B to specify the ARN of the Lambda function's execution role from Account A as the principal.
The correct action is to modify the trust policy of the role in Account B to trust the ARN of the Lambda execution role in Account A. When a Lambda function runs, it uses its execution role's credentials to call other AWS services. In this case, the SDK call to assume the cross-account role comes from the Lambda execution role, not the Lambda service principal. Therefore, the trust policy of the target role in Account B must list the execution role's ARN as the trusted principal.

Step-by-Step Solution

1
Determine the identity calling the sts:AssumeRole API.
The AWS SDK call within the running Lambda function uses the credentials of the Lambda function's execution role from Account A.
When code runs inside Lambda, it adopts the execution role's permissions, so any outgoing API calls are signed by that role.
2
Analyze the trust policy of the target role in Account B.
The current trust policy only trusts the service principal 'lambda.amazonaws.com'.
This allows the Lambda service itself to assume the role, but not the specific execution role of a function.
3
Update the trust policy in Account B to allow the cross-account assumption.
Change the principal from 'lambda.amazonaws.com' to the ARN of the Lambda execution role from Account A.
This establishes trust between the target role in Account B and the calling role in Account A, resolving the AccessDenied error.

Key Concept

IAM Role Trust Policies vs. Permissions Policies
Question 1269Question →

A developer is deploying updates to an AWS CloudFormation stack. The update fails due to a configuration error, initiating an automatic rollback. However, the rollback fails because a security group managed by the stack was manually attached to an EC2 instance outside of CloudFormation, placing the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to successfully complete the rollback and return the stack to a stable state. Which action should the developer take to resolve this issue?

Show answer & explanation

Answer: Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Answer

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.
When a resource deletion blocks a stack rollback, the correct procedure is to use the 'Continue update rollback' operation. This action allows the developer to skip the specific resource that is failing to roll back. CloudFormation will mark that resource's state as skipped and proceed to complete the rollback for the rest of the stack, bringing it back to a stable UPDATE_ROLLBACK_COMPLETE status. Afterward, the developer must manually clean up the skipped resource.

Step-by-Step Solution

1
Identify the cause of the rollback failure.
Determine that the security group cannot be deleted because it is still in use by an out-of-band EC2 instance.
You must identify which resource is blocking the rollback before deciding on the recovery path.
2
Use the CloudFormation console or AWS CLI to execute the 'Continue update rollback' action.
Specify the security group in the list of resources to skip during the rollback operation.
Skipping the blocked resource allows CloudFormation to successfully complete the rollback process for all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.
3
Perform manual remediation of the skipped resource.
Manually detach the security group from the out-of-band EC2 instance and clean up the association.
Since the resource was skipped, it remains in its current state and must be manually aligned with the desired state once the stack is stable.

Key Concept

Resolving UPDATE_ROLLBACK_FAILED states by skipping blocked resources during the Continue Update Rollback operation.
Question 1270Question →

A developer is configuring an AWS Lambda function in Account A (111122223333) to send logs and processing data directly to an Amazon SQS queue located in Account B (444455556666). The Lambda function is associated with an IAM execution role named LambdaSQSSenderRole. When the Lambda function attempts to call the SQS SendMessage API, it receives an AccessDeniedException. Which two actions are required to resolve this authorization issue and allow the Lambda function to send messages to the queue? (Select two.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the LambdaSQSSenderRole in Account A that allows the sqs:SendMessage action on the ARN of the SQS queue in Account B.; Configure the queue policy on the SQS queue in Account B to allow the sqs:SendMessage action with the Principal set to the LambdaSQSSenderRole ARN.

Answer

Attach an IAM policy to the LambdaSQSSenderRole in Account A that allows the sqs:SendMessage action on the ARN of the SQS queue in Account B, and configure the queue policy on the SQS queue in Account B to allow the sqs:SendMessage action with the Principal set to the LambdaSQSSenderRole ARN.
For cross-account access to resource-based services like SQS, permissions must be granted on both sides. The caller in Account A (the Lambda execution role) must be allowed by its identity policy to send messages to the external queue. Simultaneously, the resource policy in Account B (the SQS queue policy) must allow the execution role from Account A to write to the queue.

Step-by-Step Solution

1
Configure identity-based policy in Account A
The Lambda function's execution role has outbound permissions to send messages to the external SQS queue.
By default, IAM execution roles do not have permission to write to resources in other accounts. An identity-based policy must explicitly grant the sqs:SendMessage action on the destination SQS queue ARN.
2
Configure resource-based policy in Account B
The SQS queue allows incoming messages from the execution role in Account A.
For cross-account access, both the identity-based policy in the source account and the resource-based policy in the target account must permit the access. The SQS queue policy must specify the IAM role ARN as the principal.

Key Concept

Cross-account resource access requires authorization in both the source account's identity-based policy and the target account's resource-based policy.
Question 1271Question →

An online banking application retrieves user transaction history using an Amazon DynamoDB table. During end-of-month processing, users experience high query latencies, and the application log shows frequent `ProvisionedThroughputExceededException` errors on read operations. The primary key structure uses a partition key of `UserId` and a sort key of `TransactionTimestamp`. The developer plans to implement Amazon DynamoDB Accelerator (DAX) to achieve sub-millisecond read latency and alleviate the read workload on the DynamoDB table. The application code currently initiates reads with the parameter `ConsistentRead` set to `true`.

Which combination of actions must the developer take to resolve the performance issue and successfully utilize caching? (Select two.)

Select all that apply

Show answer & explanation

Answer: Modify the application's query requests to use eventually consistent reads by setting the `ConsistentRead` parameter to `false`.; Initialize the DAX client in the application code and configure it to route requests to the DAX cluster endpoint.

Answer

To resolve the performance issue and enable caching, the developer must modify query requests to use eventually consistent reads by setting the consistent read parameter to false, and configure the application SDK to initialize the DAX client pointing to the DAX cluster endpoint.
To successfully leverage Amazon DynamoDB Accelerator (DAX) caching to reduce read latency and read throughput consumption, two main adjustments are required. First, the application must perform eventually consistent reads. Strongly consistent reads bypass the DAX cache and are routed directly to DynamoDB, consuming read capacity units. Setting the consistent read parameter to false enables caching. Second, the application must be updated to initialize the DAX client and target the DAX cluster endpoint so that queries go through the DAX cache layer instead of directly to DynamoDB.

Step-by-Step Solution

1
Identify why the DAX cache is being bypassed despite cluster deployment.
Strongly consistent reads (ConsistentRead=true) always bypass DAX caching and are sent directly to DynamoDB.
DAX does not serve strongly consistent reads from its cache to guarantee strong consistency, resulting in table RCU consumption.
2
Switch read queries to eventually consistent reads.
ConsistentRead parameter is set to false in the read API options.
Eventually consistent reads allow DAX to serve the data from its item or query cache, avoiding calls to the underlying table.
3
Configure the application to route requests through DAX.
The SDK's standard DynamoDB client is replaced with the DAX client, configured with the DAX cluster endpoint.
Without targeting the DAX cluster endpoint, the application will continue to query the DynamoDB endpoint directly.

Key Concept

Amazon DynamoDB Accelerator (DAX) configuration, caching behavior for strongly consistent reads, and client initialization best practices.
Question 1272Question →

A developer is configuring an AWS CodeBuild project to build a containerized application. The build process must retrieve a database credential that undergoes automatic rotation every 3030 days. In addition, the source code repository holds a custom build specification file at the path `build-configs/custom-buildspec.yml` instead of the root directory.

Which two configurations must the developer perform to ensure the build project executes successfully?

Select all that apply

Show answer & explanation

Answer: Configure the CodeBuild project settings by specifying `build-configs/custom-buildspec.yml` in the buildspec configuration path.; Store the database credential in AWS Secrets Manager and reference it in the `secrets-manager` section under the `env` sequence in the buildspec file.

Answer

The developer must configure the CodeBuild project settings to point to the custom buildspec path, and store the database credential in AWS Secrets Manager while referencing it in the buildspec's env section.
To successfully execute this build project, the developer must specify the custom buildspec location (`build-configs/custom-buildspec.yml`) in the CodeBuild project configuration because CodeBuild defaults to looking for a file named `buildspec.yml` in the root directory. Additionally, because the database credential requires automatic rotation, it must be stored in AWS Secrets Manager (which supports rotation) and retrieved in the buildspec file using the `secrets-manager` parameter within the `env` section.

Step-by-Step Solution

1
Determine the correct storage and retrieval mechanism for a rotated database credential.
Choose AWS Secrets Manager over Systems Manager Parameter Store.
The requirement specifies that the credential undergoes automatic rotation, which is natively supported by AWS Secrets Manager.
2
Determine the configuration needed to handle the custom buildspec file location.
Explicitly set the buildspec path in the CodeBuild project settings to `build-configs/custom-buildspec.yml`.
By default, CodeBuild looks for a file named `buildspec.yml` at the root of the repository. Any custom path or filename must be declared in the project settings.

Key Concept

Configuring custom buildspec paths in AWS CodeBuild and integrating AWS Secrets Manager for secrets requiring automatic rotation.
Estimated Time:1m 30s
Question 1273Question →

A developer is using AWS CodeDeploy to perform an in-place deployment of an application to an EC2 Auto Scaling group containing 44 running instances. The application must maintain at least 75%75\% of its traffic-serving capacity during the deployment process to handle regular user traffic. The developer also wants to avoid launching any new EC2 instances to minimize additional costs.

Which of the following CodeDeploy configurations will meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The CodeDeployDefault.OneAtATime default deployment configuration; A custom deployment configuration with the minimum healthy hosts parameter set to a host count of 33

Answer

The correct configurations are the CodeDeployDefault.OneAtATime default deployment configuration and a custom deployment configuration with the minimum healthy hosts parameter set to a host count of 33.
The correct options are the default configuration that updates one host at a time and the custom configuration that specifies a minimum of 33 healthy hosts. With a desired capacity of 44 instances, maintaining 75%75\% capacity means at least 33 instances must remain online and healthy during the deployment. The configuration that deploys to one instance at a time will update exactly 11 instance, leaving 33 active (75%75\%). Similarly, setting the custom minimum healthy hosts to a host count of 33 explicitly forces CodeDeploy to maintain 33 healthy instances throughout the process.

Step-by-Step Solution

1
Calculate the number of healthy instances required to meet the 75%75\% capacity threshold.
For a fleet of 44 instances, 75%75\% capacity requires at least 33 instances to remain healthy and online (4×0.75=34 \times 0.75 = 3).
To understand the minimum healthy host constraint needed for the deployment configuration.
2
Analyze the default and custom CodeDeploy configurations against the calculated constraint.
CodeDeployDefault.OneAtATime updates 11 instance at a time, leaving 33 online (75%75\%). A custom configuration with minimum healthy hosts set to a host count of 33 explicitly guarantees 33 online instances.
To identify which specific configurations satisfy the target constraint of keeping at least 33 instances healthy.

Key Concept

AWS CodeDeploy deployment configurations and minimum healthy hosts settings for EC2 deployments
Question 1274Question →

An application deployed on AWS Batch needs to retrieve two types of configuration values: database credentials that must be automatically rotated every 30 days, and non-sensitive application settings (such as logging levels and API endpoints) that do not require rotation. Which combination of actions should the developer take to retrieve these values securely, cost-effectively, and with minimal operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in rotation templates.; Store the logging level and API endpoints in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured, and store the non-sensitive parameters (logging level and API endpoints) in AWS Systems Manager Parameter Store.
The correct strategy combines AWS Secrets Manager and AWS Systems Manager Parameter Store. Storing database credentials in AWS Secrets Manager allows utilizing its native automatic rotation feature to change passwords every 30 days without custom scripts. Storing non-sensitive configuration data, such as logging levels and API endpoints, in Parameter Store is highly cost-effective and avoids the monthly per-secret cost of Secrets Manager.

Step-by-Step Solution

1
Analyze rotation and security requirements.
Database credentials require secure storage and automatic rotation, while logging levels and API endpoints are non-sensitive and do not require rotation.
This determines which AWS service provides the best combination of security, features, and cost efficiency.
2
Select the service for credentials.
AWS Secrets Manager is chosen for the database credentials.
Secrets Manager has built-in integration to rotate credentials automatically and securely.
3
Select the service for non-sensitive configurations.
AWS Systems Manager Parameter Store is chosen for logging levels and API endpoints.
Parameter Store is more cost-effective for configuration data that does not require rotation or advanced secrets management features.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost optimization.
Estimated Time:1m 30s
Question 1275Question →

An organization is setting up a continuous integration pipeline. The build phase is executed by AWS CodeBuild using a custom IAM service role. However, during the initial run, the build fails immediately before executing any build phases, throwing an error that CodeBuild is not authorized to assume the specified service role. Which of the following actions will resolve this issue?

Show answer & explanation

Answer: Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

Answer

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.
The correct answer is to modify the trust policy of the IAM service role. AWS CodeBuild requires a service role to perform actions on your behalf. For CodeBuild to assume this role, the role's trust policy must explicitly allow the 'codebuild.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. Without this trust relationship, CodeBuild cannot run the build project and fails immediately during initialization.

Step-by-Step Solution

1
Identify the service principal for AWS CodeBuild.
The service principal is codebuild.amazonaws.com.
AWS services require trust relationships defined by their specific service principal to assume IAM roles.
2
Locate the trust policy of the CodeBuild service role in the IAM console.
The trust policy is found under the 'Trust relationships' tab of the role.
The trust policy determines which entities are trusted to assume the role.
3
Update the trust policy document to include the service principal with sts:AssumeRole permission.
CodeBuild is now authorized to assume the role, and the build starts successfully.
Allowing the service principal in the trust policy resolves the authorization failure during CodeBuild initialization.

Key Concept

AWS CodeBuild service role trust policy configuration
Question 1276Question →

An application deployed via an AWS CloudFormation stack requires a database password that must be rotated automatically every 30 days. Additionally, operators occasionally make direct manual changes to the security group rules associated with the stack, which causes drift between the physical resources and the template definition. Which two actions should the developer take to manage these requirements?

Select all that apply

Show answer & explanation

Answer: Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.; Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Answer

To securely manage the password and handle out-of-band configuration changes, the developer should store the password in AWS Secrets Manager with automatic rotation enabled and reference it in the CloudFormation template using dynamic references. In addition, the developer should use AWS CloudFormation drift detection to identify manual modifications and update the template or resource properties to align them.
The correct approach involves using AWS Secrets Manager to store the database password with automatic rotation and reference it securely in CloudFormation using dynamic references. Additionally, using CloudFormation drift detection helps developers identify out-of-band modifications to resources and synchronize the stack configuration, avoiding deployment failures.

Step-by-Step Solution

1
Determine the storage and rotation method for the password.
AWS Secrets Manager is selected because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Satisfies the security requirement for automatic 30-day rotation.
2
Reference the stored password in the CloudFormation template.
Use dynamic references to retrieve the password from Secrets Manager at deployment time.
Avoids hardcoding sensitive passwords in the CloudFormation template.
3
Resolve resource drift caused by manual changes.
Run drift detection on the stack to identify differences, and update the template or import the actual resources to align them.
Prevents future stack updates from failing due to conflicts with manual modifications.

Key Concept

AWS CloudFormation Drift Detection and AWS Secrets Manager Dynamic References
Question 1277Question →

A developer is optimizing a reporting service that retrieves product catalog listings from an Amazon DynamoDB table. The service frequently executes the same Query operations to retrieve items by category. To reduce latency, the developer deploys an Amazon DynamoDB Accelerator (DAX) cluster and updates the application code to use the DAX SDK client. While individual GetItem operations now exhibit sub-millisecond latency, the Query operations continue to experience high latency and consume the table's Provisioned Throughput. Which modification should the developer make to ensure the Query operations are successfully cached by DAX?

Show answer & explanation

Answer: Configure the Query operations in the application code to perform eventually consistent reads by setting the ConsistentRead parameter to false.

Answer

Configure the Query operations in the application code to perform eventually consistent reads by setting the ConsistentRead parameter to false.
DAX does not cache strongly consistent reads (such as Query or Scan operations where ConsistentRead is set to true). These requests are passed through directly to the underlying DynamoDB table. To utilize the DAX query cache, the developer must configure the client to perform eventually consistent reads by setting ConsistentRead to false.

Step-by-Step Solution

1
Analyze the DAX caching behavior for strongly consistent vs eventually consistent reads.
Identify that DAX does not cache strongly consistent reads (where ConsistentRead is set to true) and passes them through to DynamoDB.
To understand why Query operations are bypassing the DAX cache and consuming DynamoDB RCUs.
2
Change the configuration of the Query operation in the application code.
Set the ConsistentRead parameter to false for the query calls.
This allows DAX to cache the results of the Query operations in its query cache, serving subsequent identical requests from memory.

Key Concept

DAX Query Cache Consistency Requirements
Question 1278Question →

A developer is using the AWS Serverless Application Model (AWS SAM) CLI to test an AWS Lambda function locally by running the `sam local invoke` command. The Lambda function, written in Node.js, uses the AWS SDK for JavaScript (v3) to read from an Amazon DynamoDB table in the cloud.

When the developer runs the function locally, the SDK operations fail with an `AccessDeniedException`. The developer has already configured a local AWS CLI profile named `developer-local` in the `~/.aws/credentials` file on the host machine. This profile possesses all necessary permissions to access the DynamoDB table. The developer has also set the environment variable `AWS_PROFILE=developer-local` on the host command line.

Which actions should the developer take to ensure the locally running function has access to the credentials? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Invoke the Lambda function locally by passing the profile name using the `--profile developer-local` parameter with the `sam local invoke` command.; Create a JSON file containing the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` from the profile, and pass this file to the command using the `--env-vars` parameter.

Answer

To resolve the credential issue, the developer can either pass the profile name to the SAM CLI using the `--profile` parameter, or pass the credentials via a JSON file containing environment variables using the `--env-vars` parameter.
When running local Lambda functions with AWS SAM CLI (`sam local invoke`), the runtime environment executes inside a Docker container. This container is isolated and does not inherit host environment variables like `AWS_PROFILE` or host directories like `~/.aws` by default. To supply credentials, the developer can use the `--profile` flag, which instructs SAM CLI to read the specified profile's credentials from the host and mount/pass them to the container. Alternatively, the developer can write the credentials to a JSON file as environment variables and specify it using `--env-vars` to inject those values into the container environment.

Step-by-Step Solution

1
Analyze why the local Lambda execution is failing to find credentials.
Identify that the Lambda function is running inside a Docker container managed by the AWS SAM CLI, which does not automatically inherit the environment variables (like `AWS_PROFILE`) or credentials folder (`~/.aws`) of the host machine.
Container isolation prevents the local runtime from accessing host credentials unless they are explicitly passed or mounted.
2
Evaluate methods to pass the host's AWS CLI credentials into the container environment.
The AWS SAM CLI provides two standard mechanisms: the `--profile` flag to mount and use credentials from a specific host profile, and the `--env-vars` flag to supply environment variables (such as `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`) from a JSON file.
Using these mechanisms correctly satisfies the SDK's credential provider chain inside the container without compromising security.

Key Concept

AWS SAM local development container credential propagation
Question 1279Question →

A developer is implementing an AWS Lambda function in Account A (123456789012123456789012) that needs to assume a specific IAM role named `TargetTaskRole` within the same account to perform administrative tasks. The Lambda function is configured with an execution role named `LambdaExecutionRole`.

The current trust policy of `TargetTaskRole` is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

During execution, the function code calls `sts:AssumeRole` for `TargetTaskRole` and fails with the following error:
`An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::123456789012:assumed-role/LambdaExecutionRole/my-function is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::123456789012:role/TargetTaskRole`

Which of the following configurations are required to resolve this error? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a permissions policy to the execution role `LambdaExecutionRole` that allows the `sts:AssumeRole` action on `arn:aws:iam::123456789012:role/TargetTaskRole`.; Update the trust policy of `TargetTaskRole` to add the execution role ARN `arn:aws:iam::123456789012:role/LambdaExecutionRole` as a trusted principal.

Answer

To resolve the AccessDenied error, the developer must grant the Lambda execution role permissions to assume the target role by adding an identity-based permissions policy, and configure the target role's trust policy to trust the Lambda execution role's ARN.
To assume an IAM role, permissions must be granted on both sides: the caller's permission policy must allow calling `sts:AssumeRole` on the target role, and the target role's trust policy must specify the caller's ARN as a trusted principal.

Step-by-Step Solution

1
Add an identity-based permissions policy to the execution role.
The Lambda execution role has permission to invoke the `sts:AssumeRole` API on the target role resource.
By default, IAM roles do not have permissions to assume other roles.
2
Modify the target role's trust policy.
The target role trusts the execution role's ARN as a principal.
An IAM role can only be assumed by identities that are explicitly listed in its trust relationship policy.

Key Concept

IAM trust relationships and permission boundaries when assuming roles.
Question 1280Question →

A developer is building a command-line interface (CLI) tool that internal engineers will use to upload software builds directly to a private Amazon S3 bucket. The engineers authenticate with the company's external OpenID Connect (OIDC) identity provider. The CLI tool needs to obtain temporary AWS credentials to write to the S3 bucket directly.

Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.

Answer

Configure an Amazon Cognito Identity Pool, register the OIDC identity provider, and link it to an IAM role that grants write access to the S3 bucket.
The correct configuration uses an Amazon Cognito Identity Pool to federate with the OIDC identity provider. This pool directly exchanges OIDC tokens for temporary AWS IAM credentials, allowing the CLI tool to call the Amazon S3 PutObject API directly using an associated IAM role with minimum operational overhead and no custom code.

Step-by-Step Solution

1
Determine the authentication source and the authorization target.
The CLI authentication is managed by an external OpenID Connect (OIDC) identity provider, and the target is Amazon S3, which requires AWS IAM credentials.
Establishing the input and output requirements helps choose the right Cognito resource.
2
Differentiate between Cognito User Pools and Identity Pools for AWS resource authorization.
Cognito User Pools manage user directory and authentication tokens (JWTs), while Cognito Identity Pools exchange external identity tokens for temporary AWS credentials.
Since the CLI tool must authenticate directly to Amazon S3 using AWS credentials, an Identity Pool is the required service.
3
Select the configuration that minimizes custom integration and operational overhead.
Configuring a Cognito Identity Pool to map OIDC users to an IAM role is a native, serverless configuration requiring zero custom code.
This meets the objective of minimizing operational overhead and avoiding unnecessary intermediate proxies.

Key Concept

Amazon Cognito Identity Pools (Federated Identities) are used to exchange credentials from external identity providers (such as OIDC, SAML, or social IdPs) for temporary, limited-privilege AWS credentials to directly access AWS resources like Amazon S3.
PreviousPage 64 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin