A.  

Change the CloudFront Viewer protocol policy from "HTTP and HTTPS" to "HTTPS only."

B.  

Add a Lambda function that uses the KMS key to decrypt the data fields before saving the data to the database.

C.  

Enable encryption on the DB cluster by using the same KMS key that is used in CloudFront.

D.  

Request and deploy a new SSL certificate to use with the CloudFront distribution.

A.  

Use an AWS KMS managed encryption key to encrypt the database.

B.  

Create a symmetric customer managed AWS KMS key. Use the key to encrypt the database.

C.  

Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager, and enable managed rotation. Use the key to encrypt the database.

D.  

Create a 256-bit AES-GCM encryption key. Store the key in AWS Secrets Manager. Configure an AWS Lambda function to perform key rotation. Use the key to encrypt the database.

A.  

Set the Deployment Preference Type to Canary10Percent10Minutes. Set the AutoPublishAlias property to the Lambda alias.

B.  

Set the Deployment Preference Type to LinearlOPercentEvery10Minutes. Set AutoPubIishAIias property to the Lambda alias.

C.  

Set the Deployment Preference Type to CanaryIOPercentIOMinutes. Set the PreTraffic and PostTraffic properties to the Lambda alias.

D.  

Set the Deployment Preference Type to LinearlOPercentEveryIOMinutes. Set PreTraffic and Post Traffic properties to the Lambda alias.

A.  

Configure the CloudFront cache Update the application to return cached content based upon the default request headers.

B.  

Override the cache method in me selected stage of API Gateway Select the POST method.

C.  

Save the latest request response in Lambda /tmp directory Update the Lambda function to check the /tmp directory

D.  

Save the latest request m AWS Systems Manager Parameter Store Modify the Lambda function to take the latest request response from Parameter Store

A.  

Create a different Amazon CloudWatch Logs stream for each microservice.

B.  

Create an AWS CloudTrail trail to log all the API calls.

C.  

Configure VPC Flow Logs to track the communications between the microservices.

D.  

Use AWS Cloud Map to map the interactions of the microservices.

A.  

Create a DynamoDB global secondary index (GSI) on the table. Use CustomerID as the partition key. Use the specified CustomerID value to run a query on the table.

B.  

Create a DynamoDB global secondary index (GSI) on the table. Use CustomerID as the sort key. Use a filter expression to perform a scan operation on the table to match on the specified CustomerID value.

C.  

Create a DynamoDB local secondary index (LSI) on the table. Use CustomerID as the sort key. Run a PartiQL query on the table with a SELECT statement where CustomerID equals the specified CustomerID value.

D.  

Create a DynamoDB local secondary index (LSI) on the table. Use CustomerID as the partition key. Use the specified CustomerID value to run a query on the table.

A.  

Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.

B.  

Store the API credentials in a local code variable. Push the code to a secure Git repository. Use the local code variable at runtime to make the API call.

C.  

Store the API credentials as an object in a private Amazon S3 bucket. Restrict access to the S3 object by using IAM policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.

D.  

Store the API credentials in an Amazon DynamoDB table. Restrict access to the table by using resource-based policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.

A.  

Change the capacity mode from provisioned to on-demand.

B.  

Double the number of shards until the throttling errors stop occurring.

C.  

Change the partition key from service name to creation timestamp.

D.  

Use a separate Kinesis stream for each service to generate the logs.

A.  

Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a dynamic CloudFront origin that automatically maps the request of each device to the corresponding photo variant.

B.  

Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a Lambda@Edge function to route requests to the corresponding photo vacant by using request headers.

C.  

Create a Lambda@Edge function that optimizes the photos upon request and returns the photos as a response. Change the CloudFront TTL cache policy to the maximum value possible.

D.  

Create a Lambda@Edge function that optimizes the photos upon request and returns the photos as a response. In the same function store a copy of the processed photos on Amazon S3 for subsequent requests.

A.  

AssumeRoleWithWebidentity

B.  

GetFederationToken

C.  

AssumeRoleWithSAML

D.  

AssumeRole

A.  

Create an IAM role with S3 read permissions in Account B.

B.  

Update the instance profile IAM role in Account A with S3 read permissions.

C.  

Make the S3 bucket public with limited access for Account A.

D.  

Configure the bucket policy in Account B to grant permissions to the instance profile role.

E.  

Add a trust policy that allows s3:Get* permissions to the IAM role in Account B.

A.  

AWS Trusted Advisor

B.  

Amazon CloudWatch

C.  

AWS X-Ray

D.  

AWS CloudTrail

A.  

The developer did not successfully create the new AWS account.

B.  

The developer added a new tag to the Docker image.

C.  

The developer did not update the Docker image tag to a new version.

D.  

The developer pushed the changes to a new Docker image tag.

A.  

Add the permissions to an 1AM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.

B.  

Add the permissions inline to an 1AM group. Attach the group to the EC2 instance profile.

C.  

Add the permissions to an 1AM policy. Attach the policy to a user. Attach the user to the EC2 instance profile.

D.  

Add the permissions to an 1AM policy. Use 1AM web identity federation to access the S3 bucket with the policy.

A.  

Use an identity provider to securely authenticate with the application.

B.  

Create an AWS Lambda function to create an 1AM user when a user accesses the application.

C.  

Create credentials using AWS KMS and apply these credentials to users when using the application.

D.  

Use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access to resources.

A.  

Rewrite the application code to stream application logs to Amazon SNS Configure an SNS topic to send a notification when the number of errors exceeds the defined threshold within a 5-minute period

B.  

Configure a subscription filter on the CloudWatch Logs log group. Configure the filter to send an SNS notification when the number of errors exceeds the defined threshold within a 5-minute period.

C.  

Install and configure the Amazon Inspector agent on the EC2 instances to monitor for errors Configure Amazon Inspector to send an SNS notification when the number of errors exceeds the defined threshold within a 5-minute period

D.  

Create a CloudWatch metric filter to match the application error pattern in the log data. Set up a CloudWatch alarm based on the new custom metric. Configure the alarm to send an SNS notification when the number of errors exceeds the defined threshold within a 5-minute period.

A.  

CloudFormation serverless intrinsic functions

B.  

AWS Elastic Beanstalk

C.  

AWS Serverless Application Model (AWS SAM)

D.  

AWS Cloud Development Kit (AWS CDK)

A.  

{"Version": "2012-10-17","Statement": [{"Sid": "statement1","Effect": "Allow","Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],"Resource": ["arn:aws:s3:::companybucket"]}]}

B.  

{"Version": "2012-10-17","Statement": [{"Sid": "statement1","Effect": "Allow","Action": ["s3:CreateBucket", "s3:GetBucketLocation"],"Resource": "arn:aws:s3:::companybucket"}]}

C.  

{"Version": "2012-10-17","Statement": [{"Sid": "statement1","Effect": "Allow","Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:PutObjectRetention"],"Resource": "arn:aws:s3:::companybucket"}]}

D.  

{"Version": "2012-10-17","Statement": [{"Sid": "statement1","Effect": "Allow","Action": ["s3:GetObject", "s3:PutObject"],"Resource": ["arn:aws:s3:::companybucket"]}]}

A.  

Configure a Lambda function destination with a failure condition Specify Lambda function as the destination type Specify the error-handling Lambda function's Amazon Resource Name (ARN) as the resource

B.  

Enable AWS X-Ray active tracing on the initial Lambda function. Configure X-Ray to capture stack traces of the failed invocations. Invoke the error-handling Lambda function by including the stack traces in the event object.

C.  

Configure a Lambda function trigger with a failure condition Specify Lambda function as the destination type Specify the error-handling Lambda function's Amazon Resource Name (ARN) as the resource

D.  

Create a status check alarm on the initial Lambda function. Configure the alarm to invoke the error-handling Lambda function when the alarm is initiated. Ensure that the alarm passes the stack trace in the event object.

A.  

Add an UnmaskConfig property to the Operation property of the data protection policy. Specify the role that the fraud detection account must assume.

B.  

Add the logs:Unmask permission to the IAM role that the fraud detection account must assume.

C.  

Add the data protection policy to the CloudWatch log group that captures logs for the HTTP API.

D.  

Add the data protection policy to the CloudWatch log group in the account that hosts the application.

E.  

Add the data protection policy to the IAM role that the fraud detection account must assume.

A.  

Use AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.

B.  

Retrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.

C.  

Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.

D.  

Store the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.

A.  

Use AWS SAM CLI commands in AWS CodeDeploy lo invoke the Lambda functions to lest the deployment

B.  

Declare the EventlnvokeConfig on the Lambda functions in the AWS SAM templates with OnSuccess and OnFailure configurations.

C.  

Enable gradual deployments through AWS SAM templates.

D.  

Set the deployment preference type to Canary10Percen130Minutes Use hooks to test the deployment.

E.  

Set the deployment preference type to Linear10PefcentEvery10Minutes Use hooks to test the deployment.

A.  

Install the Kinesis Producer Library {KPL) to ingest data into the data stream.

B.  

Switch to on-demand capacity mode for the data stream. Specify a partition key when writing data to the data stream.

C.  

Decrease the amount of time that data is kept in the data stream by using the DecreaseStreamRetention Period API operation.

D.  

Increase the shard count in the data stream by using the UpdateShardCount API operation.

A.  

Retrieve the credentials from variables that are hardcoded in the buildspec.yml file. Configure an AWS Lambda function to rotate the credentials.

B.  

Retrieve the credentials from an environment variable that is linked to a SecureString parameter in AWS Systems Manager Parameter Store. Configure Parameter Store for automatic rotation.

C.  

Retrieve the credentials from an environment variable that is linked to an AWS Secrets Manager secret. Configure Secrets Manager for automaticrotation.

D.  

Retrieve the credentials from an environment variable that contains the connection string in plaintext. Configure an Amazon EventBridge event to rotate the credentials.

A.  

Change the SQS standard queue to an SQS FIFO queue by using the SQS message deduplication ID.

B.  

Set up a dead-letter queue.

C.  

Set the maximum concurrency limit of the Lambda function to 1.

D.  

Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.

A.  

Increase the Lambda function's memory.

B.  

Include the entire AWS SDK for .NET in the Lambda function's deployment package.

C.  

Include only the AWS SDK for .NET modules for DynamoDB and Amazon S3 in the Lambda function's deployment package.

D.  

Configure the Lambda function to download the AWS SDK for .NET from an S3 bucket at runtime.

A.  

Create an IAM user for the application. Configure the application to load the IAM user's credentials as environment variables. Use the IAM user's credentials to interact with AWS services.

B.  

Create an IAM user for the application. Populate an AWS Secrets Manager secret with the IAM user's AWS credentials. Use the secret to interact with AWS services.

C.  

Create an IAM role for the application. Configure the application to call the AWS STS GetFederationToken API. Use the STS credentials to interact with AWS services.

D.  

Create an IAM role for the application. Configure the application to call the AWS STS AssumeRole API. Use the STS credentials to interact with AWS services.

A.  

Use the TestState API to invoke only the HTTP Task. Set the inspection level to TRACE.

B.  

Use the TestState API to invoke the state machine. Set the inspection level to DEBUG.

C.  

Use the data flow simulator to invoke only the HTTP Task. View the request and response data.

D.  

Change the log level of the state machine to ALL. Run the state machine.

A.  

Grant the Lambda execution role permission to write logs to Amazon CloudWatch Logs.

B.  

Enable CloudWatch Lambda Insights and redeploy the function.

C.  

Enable AWS X-Ray active tracing for the function.

D.  

Add CloudWatch as a trusted identity in the Lambda execution role.

A.  

Increase the reserved concurrency of the Lambda function.

B.  

Increase the size of the RDS database to facilitate an increased number of database connections each hour.

C.  

Move the database connection and close statement out of the handler. Place the connection in the global space.

D.  

Replace Amazon RDS with Amazon DynamoDB to implement control over the number of writes per second.

A.  

Use AWS CodeDeploy to deploy the function code

B.  

Use Lambda layers to package and load dependencies.

C.  

Increase the memory size of the function.

D.  

Use Amazon S3 to host the function dependencies

A.  

"Condition": { "ArnLike": { "aws":"arn:aws:states:ap-south-1:111111111111:stateMachine" } }

B.  

"Condition": { "ArnLike": { "aws":"arn:aws:states:ap-south-1:*:stateMachine" } }

A.  

Configure AWS Global Accelerator for Amazon S3.

B.  

Move all Amazon S3 objects into a single object prefix.

C.  

Partition Amazon S3 objects by object prefixes.

D.  

Configure AWS Direct Connect for Amazon S3.

A.  

Add a bucket policy to the S3 bucket to deny S3 actions when the aws:SecureTransport condition is equal to false.

B.  

Add a bucket policy to the S3 bucket to deny S3 actions when the s3:x-amz-acl condition is equal to public-read.

C.  

Add an 1AM policy to the 1AM users to enforce the usage of the AWS SDK.

D.  

Add an 1AM policy to the 1AM users that allows S3 actions when the s3:x-amz-acl condition is equal to bucket-owner-read.

A.  

Create an Amazon S3 bucket. Store the public key in the root of the S3 bucket. Log in to each server. Copy the private key from the S3 bucket to the appropriate directory of each server.

B.  

Create an Amazon S3 bucket. Store the public key in the root of the S3 bucket. Create a script to copy the private key from the S3 bucket to the appropriate directory of each server. Use Systems Manager Run Command to run the script on all Linux servers.

C.  

Upload the new SSH key pair to AWS Secrets Manager as a new secret. Grant the team members permissions to download the secret into the appropriate directory of each server.

D.  

Upload the new SSH key pair to AWS Systems Manager Parameter Store. Make each key a new parameter. Grant the team members permissions to download the parameters into the appropriate directory of each server.

A.  

Create an Amazon EventBridge rule Configure the rule with a pattern to match the S3 object created event

B.  

Schedule an Amazon EventBridge rule to run a new Lambda function to scan the S3 bucket.

C.  

Add a trigger to the existing Lambda function. Set the trigger type to EventBridge Select the Amazon EventBridge rule.

D.  

Create a new Lambda function to scan the S3 bucket for recently added S3 objects

E.  

Add S3 Lifecycle rules to invoke the existing Lambda function

A.  

Deploy an Amazon EC2 instance based on Linux, and edit its /etc/confab file by adding a command to periodically invoke the lambda function

B.  

Configure an environment variable named PERIOD for the Lambda function. Set the value to 600.

C.  

Create an Amazon EventBridge rule that runs on a regular schedule to invoke the Lambda function.

D.  

Create an Amazon Simple Notification Service (Amazon SNS) topic that has a subscription to the Lambda function with a 600-second timer.

A.  

Use Amazon Athena to run a job on the S3 buckets that contain the affected data. Filter the findings by using the SensitiveData:S30bject/Personal finding type.

B.  

Use Amazon Made to run a job on the S3 buckets that contain the affected data. Filter the findings by using the SensitiveData:S30bject/Financial finding type.

C.  

Use Amazon Made to run a job on the S3 buckets that contain the affected data. Filter the findings by using the SensitiveData:S30bject/Personal finding type.

D.  

Use Amazon Athena to run a job on the S3 buckets that contain the affected data. Filter the findings by using the SensitiveData:S30bject/Financial finding type.

A.  

The Lambda function's concurrency limit has been exceeded.

B.  

The DynamoDB table requires a global secondary index (GSI) to support writes.

C.  

The Lambda function does not have IAM permissions to write to DynamoDB.

D.  

The DynamoDB table is not running in the same Availability Zone as the Lambda function.

A.  

Create an AWS Lambda function that runs in the same VPC as the API application. Configure the function as an EventBridge target. Use the function to send events to the API.

B.  

Create an internet-facing Application Load Balancer (ALB) in front of the API application. Associate a security group with rules that block access from all external sources except for EventBridge. Configure the ALB as an EventBridge target.

C.  

Create an internet-facing Network Load Balancer (NLB) in front of the API application. Associate a security group with rules that block access from all external sources except for EventBridge. Configure the NLB as an EventBridge target.

D.  

Use the application API endpoint in the VPC as a target for EventBridge. Send events directly to the application API endpoint from EventBridge.

A.  

Add a configuration file in TOML format to group configuration entries to every environment. Add a table for each testing and staging environment. Deploy updates to the environments by using the sam deploy command and the --config-env flag that corresponds to the each environment.

B.  

Create additional AWS SAM templates for each testing and staging environment. Write a custom shell script that uses the sam deploy command and the --template-file flag to deploy updates to the environments.

C.  

Create one AWS SAM configuration file that has default parameters. Perform updates to the testing and staging environments by using the —parameter-overrides flag in the AWS SAM CLI and the parameters that the updates will override.

D.  

Use the existing AWS SAM template. Add additional parameters to configure specific attributes for the serverless function and database table resources that are in each environment. Deploy updates to the testing and staging environments by using the sam deploy command.

A.  

Create an SOS FIFO queue. Enable message deduplication on the SOS FIFO queue.

B.  

Reduce the maximum Lambda concurrency that the SOS queue can invoke.

C.  

Use Lambda's temporary storage to keep track of processed message identifiers.

D.  

Configure a message group ID for every sent message. Enable message deduplication on the SQS standard queue.

A.  

Install the AWS CLI. Configure the AWS CLI by using an I AM user name and password.

B.  

Install the AWS CLI. Configure the AWS CLI by using an SSH key.

C.  

Install the AWS CLI. Configure the AWS CLI by using an 1AM user access key and secret key.

D.  

Install an AWS software development kit (SDK). Configure the SDK by using an X.509 certificate.

A.  

CodeDeploy restores the last successful deployment from a snapshot stored in Amazon S3.

B.  

CodeDeploy switches Amazon Route 53 alias records back to the previous green deployment.

C.  

CodeDeploy redeploys the last known stable version of the application as a new deployment with a new deployment ID.

D.  

AWS CodePipeline promotes the most recent SUCCEEDED deployment to production.

A.  

Use the Scan API and a filter expression to match on the key.

B.  

Use the GetItem API with a request parameter for key that contains the partition key name and specific key value.

C.  

Use the ExecuteStatement API and a filter expression to match on the key.

D.  

Use the GetItem API and a PartiQL statement to match on the key.

E.  

Use the ExecuteStatement API and a PartiQL statement to match on the key.

A.  

Attach the CloudWatchAgentAdminPolicy managed IAM policy to the IAM role that is associated with the EC2 instance profile. Provision a NAT gateway in a public subnet.

B.  

Add a user data script to install and start up the CloudWatch agent automatically when the EC2 instances are first booted up.

C.  

Attach the CloudWatchAgentServerPolicy managed IAM policy to the IAM role that is associated with the EC2 instance profile. Provision a VPC interface endpoint for CloudWatch.

D.  

Attach the CloudWatchReadOnlyAccess managed IAM policy to the IAM role that is associated with the EC2 instance profile. Provision a VPC interface endpoint for CloudWatch.

A.  

Create an 1AM role that has administrative access to AWS. Attach the role to the EC2 instance.

B.  

Create an 1AM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.

C.  

Create an 1AM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.

D.  

Create an 1AM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.

A.  

Call GetItem before calling PutItem.

B.  

Enable TTL on the table.

C.  

Use a conditional put with attribute_exists(transactionId).

D.  

Use a conditional put with attribute_not_exists(transactionId).

A.  

Create a separate CloudFormation template for each EC2 instance type in the list.

B.  

In the Resources section of the CloudFormation template, create resources for each EC2 instance type in the list.

C.  

In the CloudFormation template, create a separate parameter for each EC2 instance type in the list.

D.  

In the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.

A.  

Create a standard parameter in AWS Systems Manager Parameter Store Set Expiation and Expiration Notification policy types.

B.  

Create a standard parameter in AWS Systems Manager Parameter Store Create an AWS Lambda function to expire the configuration and to send Amazon Simple Notification Service (Amazon SNS) notifications.

C.  

Create an advanced parameter in AWS Systems Manager Parameter Store Set Expiration and Expiration Notification policy types.

D.  

Create an advanced parameter in AWS Systems Manager Parameter Store Create an Amazon EC2 instance with a corn job to expire the configuration and to send notifications.

A.  

Amazon S3 with encrypted files prefixed with “config”

B.  

AWS Secrets Manager secrets with a tag that is named SecretString

C.  

AWS Systems Manager Parameter Store SecureString parameters

D.  

CloudFormation NoEcho parameters

A.  

Add custom attributes as annotations in the segment document.

B.  

Add custom attributes as metadata in the segment document.

C.  

Add custom attributes as new segment fields in the segment document.

D.  

Create new sampling rules that are based on custom attributes.

A.  

Download the AWS X-Ray daemon. Install the daemon on an EC2 instance. Ensure that the EC2 instance allows UDP traffic on port 2000.

B.  

Configure an interface VPC endpoint to allow traffic to reach the global AWS X-Ray daemon on TCP port 2000.

C.  

Enable AWS X-Ray. Configure Amazon CloudWatch to push logs to X-Ray.

D.  

Add the AWS X-Ray software development kit (SDK) to the microservices. Use X-Ray to trace requests that each microservice makes.

E.  

Set up Amazon CloudWatch metric streams to collect streaming data from the microservices.

A.  

Generate the reports and then store the reports as Amazon DynamoDB items that have a specified TTL. Generate a URL that retrieves the reports from DynamoDB. Provide the URL to customers through the web application.

B.  

Generate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Attach the reports to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe the customer to email notifications from Amazon SNS.

C.  

Generate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Generate a presigned URL that contains an expiration date Provide the URL to customers through the web application. Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports.

D.  

Generate the reports and then store the reports in an Amazon RDS database with a date stamp. Generate an URL that retrieves the reports from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records that have expired date stamps.

A.  

AWS managed policy

B.  

Inline policy

C.  

IAM trust relationship

D.  

AWS STS

A.  

Configure the S3 bucket to send the event notifications to an Amazon SNS topic. Subscribe each department's SQS queue to the SNS topic. Configure subscription filter policies.

B.  

Update the Lambda function to write the file location to a single shared SQS queue. Configure the shared SQS queue to send the file reference to each department's SQS queue.

C.  

Update the Lambda function to send the file location to each department's SQS queue.

D.  

Configure the S3 bucket to send the event notifications to each department's SQS queue.

A.  

Specify the disable-rollback option during the update-stack operation.

B.  

Unset the CloudFormation stack failure options.

C.  

Add an AWS CodeBuild stage to CodePipeline to run the aws apigateway create-deployment AWS CLI command.

D.  

Add an action to CodePipeline to run the aws cloudfront create-invalidation AWS CLI command.

A.  

Create a data access IAM role. Allow the Lambda function to assume the data access role. Configure the role to allow the sts:TagSession action.

B.  

Create a data access IAM role. Allow the Lambda function execution role to assume the data access role.

C.  

Configure a policy for the data access IAM role to allow access to DynamoDB and Amazon S3 only for data that corresponds with the tenant session tag.

D.  

Create a resource-based policy for the DynamoDB table to restrict access based on the principal tag of the IAM role that the Lambda function assumes.

E.  

Create a resource control policy (RCP) that allows access to the S3 bucket by using the aws:PrincipalTag global condition key.

F.  

Configure the Lambda function to assume the data access IAM role that has the tenant name as a session tag. Use the assumed role credentials to access data.

A.  

Provision an Amazon ElastiCache (Memcached) cluster. Implement a lazy-loading caching strategy.

B.  

Provision an Amazon ElastiCache (Redis OSS) cluster. Implement a write-through caching strategy.

C.  

Provision an Amazon ElastiCache (Memcached) cluster. Implement a write-through caching strategy.

D.  

Provision an Amazon ElastiCache (Redis OSS) cluster. Implement a lazy-loading caching strategy.

A.  

Store database credentials and API keys in AWS Secrets Manager. Use AWS managed AWS KMS keys. Set up automatic key rotation. Use the AWS SDK to retrieve secrets.

B.  

Store the database credentials and API keys in AWS Secrets Manager. Use customer managed AWS KMS keys. Set up automatic key rotation. Create a key policy in the application to retrieve secrets by using the AWS SDK.

C.  

Store the database credentials in the application code. Separate credentials by using environment-specific branches that have restricted access to the code repositories.

D.  

Store the database credentials and API keys as parameters in AWS Systems Manager Parameter Store. Encrypt the credentials and API keys with AWS managed AWS KMS keys. Use the AWS SDK to retrieve secrets.

A.  

Create an Amazon RDS instance, then implement session handling at the application level to leverage a database inside the RDS database instance for session data storage.

B.  

Implement a shared file system solution across the underlying Amazon EC2 instances, then implement session handling at the application level to leverage the shared file system for session data storage.

C.  

Create an Amazon ElastiCache (Memcached) cluster, then implement session handling at the application level to leverage the cluster for session data storage.

D.  

Create an Amazon DynamoDB table, then implement session handling at the application level to leverage the table for session data storage.

A.  

A Lambda function cannot be registered as a target for an ALB.

B.  

A Lambda function can be registered with an ALB using AWS Management Console only.

C.  

The permissions to invoke the Lambda function are missing.

D.  

Cross-zone is not enabled on the ALB.

A.  

Configure a Lambda@Edge function to identify and encrypt the sensitive fields. Associate the function with the CloudFront distribution.

B.  

Create an RSA key pair. Configure the CloudFront distribution to use field-level encryption directly.

C.  

Create an AWS KMS key. Update the Lambda function to encrypt the data before inserting the data into DynamoDB. Configure the function to decrypt the data after retrieval.

D.  

Create a new resource on the existing REST API and add a new POST method to the new resource. Configure the POST method to invoke the Lambda function and an AWS KMS key to encrypt the sensitive data fields.

A.  

Configure the CloudFormation template to reference the API endpoint in the DefinitionSubstitutions property for the AWS StepFunctions StateMachme resource.

B.  

Configure the CloudFormation template to store the API endpoint in an environment variable for the AWS::StepFunctions::StateMachine resourc Configure the state machine to reference the environment variable

C.  

Configure the CloudFormation template to store the API endpoint in a standard AWS: SecretsManager Secret resource Configure the state machine to reference the resource

D.  

Configure the CloudFormation template to store the API endpoint in a standard AWS::AppConfig;:ConfigurationProfile resource Configure the state machine to referencethe resource.

A.  

Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received.

B.  

Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.

C.  

Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status.

D.  

Configure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user.

A.  

Build the application by using shell scripts to create .zip files for each Lambda function. Manually upload the .zip files to the AWS Management Console.

B.  

Build the application by using the AWS Serverless Application Model (AWS SAM). Use a continuous integration and continuous delivery (CI/CD) pipeline and the SAM CLI to deploy the Lambda functions.

C.  

Build the application by using shell scripts to create .zip files for each Lambda function. Upload the .zip files. Deploy the .zip files as Lambda functions by using the AWS CLI in a continuous integration and continuous delivery (CI/CD) pipeline.

D.  

Build a container for each Lambda function. Store the container images in AWS CodeArtifact. Deploy the containers as Lambda functions by using the AWS CLI in a continuous integration and continuous delivery (CI/CD) pipeline.

A.  

Store files in Amazon EFS Standard, then transition to EFS Standard-I

A.  

B.  

Store files in Amazon S3 Glacier Deep Archive for 90 days, then transition to S3 Glacier Flexible Retrieval.

C.  

Store files in Amazon EBS for 90 days, then transition to S3 Glacier Deep Archive.

D.  

Store files in Amazon S3 Glacier Instant Retrieval for 90 days, then transition to S3 Glacier Flexible Retrieval.

A.  

Configure an Amazon SQS queue to contain messages about each step that a Lambda function must perform. Configure the Lambda functions to run sequentially based on the order of messages in the SQS queue.

B.  

Configure an Amazon SNS topic to contain notifications about each step that a Lambda function must perform. Subscribe the Lambda functions to the SNS topic. Use subscription filters based on the step that each Lambda function must perform.

C.  

Configure an AWS Step Functions state machine to invoke the Lambda functions in a specific order.

D.  

Configure Amazon EventBridge Scheduler schedules to invoke the Lambda functions in a specific order.

A.  

Implement retries with exponential backoff.

B.  

Use a PutRecord API instead of PutRecords.

C.  

Reduce the frequency and/or size of the requests.

D.  

Use Amazon SNS instead of Kinesis.

E.  

Reduce the number of KCL consumers.

A.  

AWS X-Ray

B.  

Amazon CloudWatch

C.  

Amazon VPC flow logs

D.  

Amazon OpenSearch Service

A.  

Update the policy of the IAM user to allow the s3:EncryptionConfiguration action.

B.  

Update the bucket policy of the S3 bucket to allow the IAM user to upload objects.

C.  

Update the policy of the IAM user to allow the kms:GenerateDataKey action.

D.  

Update the ACL of the S3 bucket to allow the IAM user to upload objects.

A.  

Create a custom AWS CloudFormation public registry extension. Reference a GitHub repository that hosts the open source modules in the extension. Configure CloudFormation to scan the repository once each day. Write an AWS SAM template to redeploy the three Lambda functions upon a scan notification change.

B.  

Create an Amazon CloudFront distribution with an Amazon S3 bucket as the origin. Upload the patched modules to Amazon S3 when needed. Modify each Lambda function to download the patched modules from the CloudFront distribution during cold starts.

C.  

Launch an Amazon EC2 instance. Host a private open source module registry on the EC2 instance. Upload the modified open source modules to the private registry when needed. Modify each Lambda function deployment script to download the modules from the private registry. Redeploy the three Lambda functions.

D.  

Create a Lambda layer with the open source modules. Modify all three Lambda functions to use the layer. Remove the open source modules from each Lambda function. Patch the Lambda layer with the modified open source modules when needed. Update the Lambda functions to reference the new layer version.

A.  

Package the application into a zip file by using a command line tool Upload the package to Amazon S3

B.  

Package the application into a container image by using the Docker CLI. Upload the image to Amazon Elastic Container Registry (Amazon ECR)

C.  

Deploy the application to an Amazon EC2 instance by using AWS CodeDeploy.

D.  

Deploy the application to Amazon Elastic Kubernetes Service (Amazon EKS) on AWS Fargate

E.  

Deploy the application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate

A.  

Use AWS KMS t0 encrypt traffic between cloudFront and the web application.

B.  

Set the Origin Protocol Policy to "HTTPS Only".

C.  

Set the Origin’s HTTP Port to 443.

D.  

Set the Viewer Protocol Policy to "HTTPS Only" or Redirect HTTP to HTTPS"

E.  

Enable the CloudFront option Restrict Viewer Access.

A.  

Migrate the secret credentials to Amazon RDS parameter groups. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key Turn on secret rotation. Use 1AM policies and roles to grant AWS KMS permissions to access Amazon RDS.

B.  

Migrate the credentials to AWS Systems Manager Parameter Store. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use 1AM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager

C.  

Migrate the credentials to ECS Fargate environment variables. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key Turn on secret rotation. Use 1AM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager.

D.  

Migrate the credentials to AWS Secrets Manager. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key Turn on secret rotation Use 1AM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager by using keys.

A.  

AWS CloudTrail

B.  

AWS Trusted Advisor

C.  

Amazon VPC Flow Logs

D.  

Network access control lists

E.  

AWS Config rules

A.  

Migrate from Amazon RDS to Amazon Aurora MySQL. Use an Aurora Auto Scaling policy to scale read replicas based on CPU consumption.

B.  

Migrate from Amazon RDS to Amazon Aurora MySQL. Use an Aurora Auto Scaling policy to scale read replicas based on the number of database connections.

C.  

Create an Amazon SQS queue. Publish transactions to the queue. Set the queue to invoke the Lambda function. Turn on enhanced fanout for the Lambda function.

D.  

Create an Amazon SQS queue. Publish transactions to the queue. Set the queue to invoke the Lambda function. Set the reserved concurrency of the Lambda function to be less than the number of database connections.

A.  

Transfer the data from the NFS share to an Amazon EBS volume. Upload the container images to Amazon ECR.

B.  

Transfer the data from the NFS share to an Amazon EFS file system. Upload the container images to Amazon ECR.

C.  

Create an Amazon ECS cluster and configure each node to mount the Amazon EBS volume.

D.  

Create an Amazon EKS cluster and configure each node to mount the Amazon EBS volume.

E.  

Create an Amazon EKS cluster and configure each node to mount the Amazon EFS file system.

A.  

Use Amazon CloudFront with signed URLs for Amazon S3.

B.  

Create a dedicated Amazon CloudFront Distribution for each customer.

C.  

Use Amazon CloudFront with AWS Lambda@Edge.

D.  

Use Amazon API Gateway and AWS Lambda to control access to an S3 bucket.

A.  

Write a Git pre-commit hook that runs the test before every commit. Ensure that each developer who is working on the project has the pre-commit hook instated locally. Review the test report and resolve any issues before pushing changes to AWS CodeCommit.

B.  

Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage after the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of Codebuild to integrate the report with the CodoBuild console. View the test results in CodeBuild Resolve any issues.

C.  

Add a new stage to the pipeline. Use AWS CodeBuild at the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage it any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in codeBuild Resolve any issues.

D.  

Add a new stage to the pipeline. Use Jenkins as the provider. Configure CodePipeline to use Jenkins to run the unit tests. Write a Jenkinsfile that fails the stage if any test does not pass. Use the test report plugin for Jenkins to integrate the repot with the Jenkins dashboard. View the test results in Jenkins. Resolve any issues.

A.  

{ if( $input.params(‘integration’) == "mock" ) "statusCode": 404 else "statusCode": 500 end }

B.  

{ if( $input.params('scope') == "internal" ) "statusCode": 200 else "statusCode": 500 end }

C.  

{ if( $input.path("integration") ) "statusCode": 200 else "statusCode":404 end }

D.  

{ if( $context.integration.status ) "statusCode": 200 else "statusCode": 500 end }

A.  

Manually create a new version of the API keys in AWS Secrets Manager and update the keys in the external REST services.

B.  

Manually retrieve the new version of the API keys from AWS Secrets Manager and update the keys in the external REST services.

C.  

Roll back to the last known working version of the API keys in AWS Secrets Manager.

D.  

Fix and reinvoke the AWS Lambda rotation function to generate a new version of the API keys in AWS Secrets Manager and update the keys in the external REST services.

A.  

Increase the page size for each request by setting the Limit parameter to be higher than the default value Configure the application to retry any request that exceeds the provisioned throughput.

B.  

Create a global secondary index (GSI). Set query attribute to be the partition key of the index

C.  

Perform a parallel scan operation by issuing individual scan requests in the parameters specify the segment for the scan requests and the total number of segments for the parallel scan.

D.  

Turn on read capacity auto scaling for the DynamoDB table. Increase the maximum read capacity units (RCUs).

A.  

Update the application code. In the code, add a rule to scan all the objects in the S3 bucket every day and to delete objects after 90 days.

B.  

Create an AWS Lambda function. Program the Lambda function to scan all the objects in the S3 bucket every day and to delete objects after 90 days.

C.  

Create an S3 Lifecycle rule for the S3 bucket to expire objects after 90 days.

D.  

Partition the S3 objects with a // key prefix. Create an AWS Lambda function to remove objects that have prefixes that have reached the expiration date.

A.  

Implement Kinesis Data Firehose data transformation as an AWS Lambda function. Configure the function to remove the customer identifiers. Set an Amazon S3 bucket as the destination of the delivery stream.

B.  

Launch an Amazon EC2 instance. Set the EC2 instance as the destination of the delivery stream. Run an application on the EC2 instance to remove the customer identifiers. Store the transformed data in an Amazon S3 bucket.

C.  

Create an Amazon OpenSearch Service instance. Set the OpenSearch Service instance as the destination of the delivery stream. Use search and replace to remove the customer identifiers. Export the data to an Amazon S3 bucket.

D.  

Create an AWS Step Functions workflow to remove the customer identifiers. As the last step in the workflow, store the transformed data in an Amazon S3 bucket. Set the workflow as the destination of the delivery stream.

A.  

Retry the batch operation immediately.

B.  

Retry the batch operation with exponential backoff and randomized delay.

C.  

Update the application to use an AWS software development kit (AWS SDK) to make the requests.

D.  

Increase the provisioned read capacity of the DynamoDB tables that the operation accesses.

E.  

Increase the provisioned write capacity of the DynamoDB tables that the operation accesses.

A.  

Retrieve the AWS CloudTrail events for the resource mysql-db where the event name is DeleteDBInstance. Inspect each event.

B.  

Retrieve the Amazon CloudWatch log events from the most recent log stream within the rds/mysql-db log group. Inspect the log events.

C.  

Retrieve the AWS X-Ray trace summaries. Filter by services with the name mysql-db. Inspect the ErrorRootCauses values within each summary.

D.  

Retrieve the AWS Systems Manager deletions inventory. Filter the inventory by deletions that have a TypeName value of RDS. Inspect the deletion details.

A.  

Enable S3 Transfer Acceleration on the bucket. Use the appropriate endpoint.

B.  

Call the CreateMultipartUpload API in the Lambda functions to upload the files in pieces.

C.  

Implement the retry with a backoff pattern in the Lambda functions.

D.  

Set up an S3 Lifecycle policy to automatically move the media files to the S3 Intelligent-Tiering storage class.

A.  

Write the files to Amazon S3 Glacier Deep Archive. Add the S3 location of the files to the SQS queue.

B.  

Write the files to Amazon S3 Standard. Add the S3 location of the files to the SQS queue.

C.  

Write the files to an Amazon Elastic Block Store (Amazon EBS) General Purpose SSD volume. Add the EBS location of the files to the SQS queue.

D.  

Write messages that contain the contents of the uploaded files to the SQS queue.

A.  

Update the CloudFront distribution's settings to index.html as the default root object is set

B.  

Update the Amazon S3 bucket settings and enable static website hosting. Specify index html as the Index document Update the S3 bucket policy to enable access. Update the CloudFront distribution's origin to use the S3 website endpoint

C.  

Create a CloudFront function that examines the request URL and appends index.html when directories are being accessed Add the function as a viewer request CloudFront function to the CloudFront distribution's behavior.

D.  

Create a custom error response on the CloudFront distribution with the HTTP error code set to the HTTP 404 Not Found response code and the response page path to /index html Set the HTTP response code to the HTTP 200 OK response code

A.  

Configure AWS Secrets Manager versions to store different copies of the same credentials across multiple environments

B.  

Create a new parameter version in AWS Systems Manager Parameter Store for each environment Store the environment-specific credentials in the parameter version.

C.  

Configure the environment variables in the application code Use different names for each environment type

D.  

Configure AWS Secrets Manager to create a new secret for each environment type. Store the environment-specific credentials in the secret

A.  

A read-through cache

B.  

A write-behind cache

C.  

A lazy-loading cache

D.  

A write-through cache

A.  

Package the application code into a .zip file. Use the AWS Management Console to upload the .zip file and deploy the packaged application.

B.  

Package the application code into a .tar file. Use the AWS Management Console to create a new application version from the .tar file. Update the environment by using the AWS CLI.

C.  

Package the application code into a .tar file. Use the AWS Management Console to upload the .tar file and deploy the packaged application.

D.  

Package the application code into a .zip file. Use the AWS CLI to create a new application version from the .zip file and to update the environment.

E.  

Package the application code into a .zip file. Use the AWS Management Console to create a new application version from the .zip file. Rebuild the environment by using the AWS CLI.

A.  

Put the sensitive data into a CloudFormation parameter. Encrypt the CloudFormation templates by using an AWS Key Management Service (AWS KMS) key.

B.  

Put the sensitive data into an Amazon S3 bucket Update the CloudFormation templates to download the object from Amazon S3 during bootslrap.

C.  

Put the sensitive data into AWS Systems Manager Parameter Store as a secure string parameter. Update the CloudFormation templates to use dynamic references to specify template values.

D.  

Put the sensitive data into Amazon Elastic File System (Amazon EPS) Enforce EFS encryption after file system creation. Update the CloudFormation templates to retrieve data from Amazon EFS.

A.  

Create a new API by using the Amplify CLI's amplify import api command. Select REST as the service to use. Add the existing schema to the new API.

B.  

Create a new API in Amazon API Gateway by using the existing schema. Use the Amplify CLI's amplify add api command. Select the API as the application's backend environment.

C.  

Create a new API in AWS AppSync by using the existing schema. Use the Amplify CLI's amplify import api command. Select the API as the application's backend environment.

D.  

Create a new API by using the Amplify CLI's amplify add api command. Select GraphQL as the service to use. Add the existing schema to the new API.

A.  

Publish the data to Amazon Simple Queue Service (Amazon SQS).

B.  

Publish the data to Amazon Data Firehose.

C.  

Publish the data to Amazon EventBridge.

D.  

Publish the data to Amazon Kinesis Data Streams.

A.  

Configure the Amazon CloudWatch agent to push logs to Amazon CloudWatch Logs by using port 443.

B.  

Configure the Elastic Beanstalk .ebextensions directory to track the memory usage of the instances.

C.  

Configure the Amazon CloudWatch agent to track the memory usage of the instances.

D.  

Configure an Amazon CloudWatch dashboard to track the memory usage of the instances.

A.  

Encrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in Secrets Manager.

B.  

Encrypt the environment variables by using AWS Key Management Service (AWS KMS) customer managed keys. Enable automatic key rotation.

C.  

Encrypt the environment variables by using AWS Key Management Service (AWS KMS) AWS managed keys. Configure a custom AWS Lambda function to automate key rotation.

D.  

Encrypt the environment variables by using AWS Systems Manager Parameter Store. Set up automatic rotation in Parameter Store.

A.  

Enable SSL connections to Kinesis.

B.  

Use Amazon Kinesis Consumer Library.

C.  

Encrypt the data once it is at rest with a Lambda function.

D.  

Enable server-side encryption in Kinesis Data Streams.

A.  

Create one Lambda function. Upload one zip file that contains code to handle video compression and decompression to the function. Include the codec library in the zip file.

B.  

Create two Lambda functions. Upload one zip file that contains code to handle video compression to one function. Upload a second zip file that contains code for video decompression to the second function. Include the codec library in both zip files.

C.  

Create two Lambda functions. Upload one zip file that contains code to handle video compression to one function. Upload a second zip file that contains code for video decompression to the second function. Create one Lambda layer for the codec library. Add the layer to both functions.

D.  

Create two Lambda functions. Build one container image that contains code to handle video compression and a second image that contains video decompression code. Add the codec library to both images. Upload the images to Amazon ECR. Use the containers to create the Lambda functions.

A.  

Create a resource-based policy for the DynamoDB table to deny access based on attributes.

B.  

Create an AWS KMS customer managed key and use it to encrypt the table.

C.  

Create an AWS KMS customer managed key and use envelope encryption to encrypt PII attributes in the table.

D.  

Enable attribute-based access control (ABAC) for the DynamoDB table by using resource tags.

E.  

Update the function to use a projection expression when querying the table to control which attributes are returned.

A.  

Configure an AWS Lambda function to copy the secret to each Region. Configure Amazon EventBridge to trigger the Lambda function to update the copies of the secret when the primary secret is updated.

B.  

Configure the application in all Regions to retrieve the secret value directly from the primary Region by using the secret's ARN. Configure the application to cache the secret value locally.

C.  

Enable replication for the secret in the primary Region. Ensure that the application can access the appropriate secret ARN in each Region where the secret is replicated.

D.  

Create a new secret in each Region. Ensure that the application can access the appropriate secret ARN in each Region where the secret is replicated.

A.  

Edit the RDS for MySQL cluster by adding a cache node. Configure the cache endpoint instead of the duster endpoint in the application.

B.  

Create an Amazon ElastiCache (Redis OSS) cluster. Update the application code to use the ElastiCache (Redis OSS) cluster endpoint.

C.  

Create an Amazon DynamoDB Accelerator (DAX) cluster in front of the RDS for MySQL cluster. Configure the application to connect to the DAX endpoint instead of the RDS endpoint.

D.  

Configure the RDS for MySQL cluster to add a standby instance in a different Availability Zone. Configure the application to read the data from the standby instance.

A.  

Obtain the request identifier from the AWS request ID field in the context object. Configure the application to write logs to standard output.

B.  

Obtain the request identifier from the AWS request ID field in the event object. Configure the application to write logs to a file.

C.  

Obtain the request identifier from the AWS request ID field in the event object. Configure the application to write logs to standard output.

D.  

Obtain the request identifier from the AWS request ID field in the context object. Configure the application to write logs to a file.

A.  

Create a Lambda layer to store the external library Configure the Lambda function to use the layer

B.  

Create an Amazon S3 bucket Upload the external library into the S3 bucket. Mount the S3 bucket folder in the Lambda function Import the library by using the proper folder in the mount point.

C.  

Load the external library to the Lambda function's /tmp directory during deployment of the Lambda package. Import the library from the /tmp directory.

D.  

Create an Amazon Elastic File System (Amazon EFS) volume. Upload the external library to the EFS volume Mount the EFS volume in the Lambda function. Import the library by using the proper folder in the mount point.

A.  

Configure the SQS queue as a dead-letter queue for the Lambda function.

B.  

Create code that uses the AWS SDK to call the SQS SendMessage operation to add the invocation details to the SQS queue. Add the code to the end of the Lambda function.

C.  

Add two asynchronous invocation destinations to the Lambda function: one destination for successful invocations and one destination for failed invocations. Configure the SQS queue as the destination for each type. Create an Amazon CloudWatch alarm based on the DestinationDeliveryFailures metric to catch any message that cannot be delivered.

D.  

Add a single asynchronous invocation destination to the Lambda function to capture successful invocations. Configure the SQS queue as the destination. Create an Amazon CloudWatch alarm based on the DestinationDeliveryFailures metric to catch any message that cannot be delivered.

A.  

Create the DynamoDB table with encryption set to None. Code the application to use the key to decrypt the data when the application reads from the table. Code the application to use the key to encrypt the data when the application writes to the table.

B.  

Store the key by using AW5 KMS. Choose an AVVS KMS customer managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.

C.  

Store the key by using AWS KMS. Create the DynamoDB table with default encryption. Include the kms:Encrypt parameter with the Amazon Resource Name (ARN) of the AWS KMS key when using the DynamoDB SDK.

D.  

Store the key by using AWS KMS. Choose an AWS KMS AWS managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.

A.  

Use the AWS SAM CLI to package and deploy the SAM application to the pre-production AWS account. Specify the debug parameter.

B.  

Use the AWS SAM CLI to package and create a change set against the pre-production AWS account. Execute the change set in a new AWS account designated for a development environment.

C.  

Use the AWS SAM CLI to package and deploy the SAM application to a new AWS account designated for a development environment.

D.  

Update the CloudFormation stack in the pre-production account. Add a separate stage that points to a new AWS account designated for a development environment.

A.  

Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret

B.  

Store the Root CA Cert as a Secure Sting parameter in aws Systems Manager Parameter Store Create a resource-based policy. Add IAM users to allow access to the policy.

C.  

Store the Root CA Cert in an Amazon S3 bucket. Create a resource- based policy to allow access to the bucket.

D.  

Refactor the Lambda code to load the Root CA Cert from the Root CA Certs location. Modify the runtime trust store inside the Lambda function handler.

E.  

Refactor the Lambda code to load the Root CA Cert from the Root CA Cert's location. Modify the runtime trust store outside the Lambda function handler.

A.  

Export the existing API to an OpenAPI file. Create a new API Import the OpenAPI file Modify the new API to add request validation. Perform the tests Modify the existing API to add request validation. Deploy the existing API to production.

B.  

Modify the existing API to add request validation. Deploy the updated API to a new API Gateway stage Perform the tests Deploy the updated API to the API Gateway production stage.

C.  

Create a new API Add the necessary resources and methods including new request validation. Perform the tests Modify the existing API to add request validation. Deploy the existing API to production.

D.  

Clone the exiting API Modify the new API lo add request validation. Perform the tests Modify the existing API to add request validation Deploy the existing API to production.

A.  

Write the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.

B.  

Write the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.

C.  

Write the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API

D.  

Write the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API

A.  

Change the StreamViewType parameter value to NEW_AND_OLOJMAGES for the DynamoDB table.

B.  

Configure event source mapping for the Lambda function.

C.  

Map an Amazon Simple Notification Service (Amazon SNS) topic to the DynamoDB streams.

D.  

Increase the maximum runtime (timeout) setting of the Lambda function.

A.  

Encrypt the data by using a symmetric key. Provide the key to the external company.

B.  

Sign the data by using a symmetric key. Provide the key to the external company.

C.  

Sign the data by using the private key of an asymmetric key pair. Provide the public key to the external company.

D.  

Sign the data by using the public key of an asymmetric key pair. Provide the private key to the external company.

A.  

Create an AWS Lambda function. Use API Gateway proxy integration to return constant HTTP responses.

B.  

Create an Amazon EC2 instance that serves the backend REST API by using an AWS CloudFormation template.

C.  

Customize the API Gateway stage to select a response type based on the request.

D.  

Use a request mapping template to select the mock integration response.

A.  

Create a DynamoDB Accelerator (DAX) cluster. Update the application to send read requests to the DAX endpoint.

B.  

Increase the provisioned throughput of the table.

C.  

Reduce the frequency of write requests by using error retries and exponential backoff.

D.  

Reduce control plane operations that occur during peak usage hours by consolidating the DynamoDB tables and indexes.

E.  

Change the table's capacity mode to on-demand.

A.  

All-at-once deployment

B.  

Canary deployment

C.  

In-place deployment

D.  

Linear deployment

A.  

Contact AWS Support for a limit increase.

B.  

Use the AWS CLI to get the metrics.

C.  

Analyze the applications and remove the API call.

D.  

Retry the call with exponential backoff.

A.  

Use a rolling deployment to deploy the new version.

B.  

Use a rolling deployment with additional batches to deploy the new version.

C.  

Use an all-at-once deployment to deploy the new version.

D.  

Deploy the new version to a new environment. Use a blue/green deployment.

A.  

The S3 event notification does not activate for files that are larger than 1.000 MB.

B.  

The resource-based policy for the Lambda function does not have the required permissions to be invoked by Amazon S3.

C.  

Lambda functions cannot be invoked directly from an S3 event.

D.  

The S3 bucket needs to be made public.

A.  

Add a Delay task after the GetResource task. Add a catcher to the GetResource task. Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be the Delay task Configure the Delay task to wait for an interval of 10 seconds Configure the next step to be the GetResource task.

B.  

Add a catcher to the GetResource task Configure the catcher with an error type of TooManyRequestsException. an interval of 10 seconds, and a maximum attempts value of 1. Configure the next step to be the GetResource task.

C.  

Add a retrier to the GetResource task Configure the retrier with an error type of TooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of 1.

D.  

Duplicate the GetResource task Rename the new GetResource task to TryAgain Add a catcher to the original GetResource task Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be TryAgain.

A.  

Add an --enable-terminal ion-protection command line option to the create-stack command and the update-stack command.

B.  

Add a -disable-roll back command line option to the create-stack command and the update-stack command

C.  

Add a —parameters ParameterKey=P reserve Resources. ParameterVaIue=True command line option to the create-stack command and the update-stack command.

D.  

Add a -tags Key=PreserveResources.VaIue=True command line option to the create-stack command and the update-stack command.

A.  

Change to asynchronous Lambda function invocation.

B.  

Cache the translated newsletters in the Lambda /tmp directory.

C.  

Enable TranslateText API caching.

D.  

Change the Lambda function to use parallel processing.

A.  

Generate a presigned URL when a picture is uploaded. Save the URL in an Amazon DynamoDB table. Return the URL to the browser when the employee logs in.

B.  

Save the picture's S3 key in an Amazon DynamoDB table. Create an Amazon S3 VPC endpoint to allow the employees to download pictures once they log in.

C.  

Encode a picture using base64. Save the base64 string in an Amazon DynamoDB table. Allow the browser to retrieve the string and convert it to a picture.

D.  

Save the picture's S3 key in an Amazon DynamoDB table. Use a function to generate a presigned URL every time an employee logs in. Return the URL to the browser.

A.  

Create an AWS KMS customer managed key. Use the KMS Encrypt operation to encrypt the PHI data before storing the PHI data in the database.

B.  

Generate a 256-bit AES encryption key. Store the key in base64-encoded format in the application source code. Use the encryption key to encrypt the PHI data before storing the PHI data in the database.

C.  

Configure the database to use an AWS KMS managed key for encryption.

D.  

Create an AWS KMS customer managed key. Use envelope encryption to encrypt the PHI data. Store the encrypted key in the same database record that stores the PHI data.

A.  

Configure Amazon S3 events to invoke the Lambda function when each file is uploaded. Log processed transaction IDs to Amazon DynamoDB.

B.  

Move the application logic to a single Amazon EC2 instance to handle processing more effectively.

C.  

Use Amazon EventBridge Scheduler to run the Lambda function every 5 minutes to scan the S3 bucket.

D.  

Poll the Amazon S3 bucket continuously by using the Lambda function and each object's LastModified timestamp.

A.  

Refactor the Lambda function into two functions. Configure one function to transform the data and one function to load the data into the DynamoDB table. Create an Amazon Simple Queue Service (Amazon SQS) queue in between the functions to hold the items as messages and to invoke the second function.

B.  

Turn on auto scaling for the DynamoDB table. Use Amazon CloudWatch to monitor the table's read and write capacity metrics and to track consumed capacity.

C.  

Create an alias for the Lambda function. Configure provisioned concurrency for the application to use.

D.  

Refactor the Lambda function into two functions. Configure one function to store the data in the DynamoDB table. Configure the second function to process the data and update the items after the data is stored in DynamoDB. Create a DynamoDB stream to invoke the second function after the data isstored.

A.  

Increase the Lambda function’s timeout value.

B.  

Configure the Lambda function to not move images that are larger than 2 M

B.  

C.  

Request a concurrency quota increase for the Lambda function.

D.  

Configure provisioned concurrency for the Lambda function.

A.  

Create four access points that allow access to the central S3 bucket. Assign an access point to each web application bucket.

B.  

Create a bucket policy that allows access to the central S3 bucket. Attach the bucket policy to the central S3 bucket.

C.  

Create a cross-origin resource sharing (CORS) configuration that allows access to the central S3 bucket. Add the CORS configuration to the central S3 bucket.

D.  

Create a Content-MD5 header that provides a message integrity check for the central S3 bucket. Insert the Content-MD5 header for each web application request.

A.  

Use a multi-AZ Amazon RDS deployment. Increase the number of connections that the code makes to the database or increase the connection pool size if a connection pool is in use.

B.  

Use a multi-AZ Amazon RDS deployment. Modify the code so that queries access the secondary RDS instance.

C.  

Deploy Amazon RDS with one or more read replicas. Modify the application code so that queries use the URL for the read replicas.

D.  

Use open source replication software to create a copy of the MySQL database on an Amazon EC2 instance. Modify the application code so that queries use the IP address of the EC2 instance.

A.  

Confirm that the capacity providers for the container have been provisioned and are properly sized.

B.  

Confirm that the target group port matches the port mappings in the ECS task definition.

C.  

Confirm that a hosted zone associated with the ALB matches a hosted zone that is referenced in the ECS task definition.

D.  

Confirm that the ALB listener on the mapped port has a default action that redirects to the application's health check path endpoint.

E.  

Confirm that the ALB listener on the mapped port has a default action that forwards to the correct target group.

A.  

Manually instrument the X-Ray SDK in the application code.

B.  

Use the X-Ray auto-instrumentation agent.

C.  

Use Amazon Macie to detect and hide PII. Call the X-Ray API from AWS Lambda.

D.  

Use AWS Distro for Open Telemetry.

A.  

CodeDeployDefault ECSCanary10Percent15Minutes

B.  

CodeDeployDefault LambdaCanary10Percent5Minutes

C.  

CodeDeployDefault LambdaCanary10Percent15Minutes

D.  

CodeDeployDefault ECSLinear10PercentEvery1 Minutes

A.  

Create an AWS CodeCommt project. Add the repository package's build and test commands to the protects buildspec

B.  

Create an AWS CodeBuid project. Add the repository package's build and test commands to the projects buildspec

C.  

Create an AWS CodeDeploy protect. Add the repository package's build and test commands to the project's buildspec

D.  

Add an action to the source stage. Specify the newly created project as the action provider. Specify the build attract as the actions input artifact.

E.  

Add a new stage to the pipeline alter the source stage. Add an action to the new stage. Speedy the newly created protect as the action provider. Specify the source artifact as the action's input artifact.

A.  

Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:Decrypt permissions to the Lambda function execution roles.

B.  

Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:Decrypt permission to the Lambda function execution roles.

C.  

Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.

D.  

Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.

A.  

Change the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.

B.  

Set up a dead-letter queue.

C.  

Set the maximum concurrency limit of the AWS Lambda function to 1

D.  

Change the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.

A.  

Enable Amazon EBS volume encryption with an AWS KMS key in the Lambda function configuration so that all storage attached to the Lambda function is encrypted.

B.  

Set up the Lambda function with a role and key policy to access an AWS KMS key. Use the key to generate a data key used to encrypt all data prior to writing to Amp storage.

C.  

Use OpenSSL to generate a symmetric encryption key on Lambda startup. Use this key to encrypt the data prior to writing to /tmp.

D.  

Use an on-premises hardware security module (HSM) to generate keys, where the Lambda function requests a data key from the HSM and uses that to encrypt data on all requests to the function.

A.  

Configure the application to retrieve database credentials from the secret in the primary Region.

B.  

Replicate the secret to the secondary Region and configure the application to retrieve credentials from the replica secret.

C.  

Replicate the secret and promote the replica to a standalone secret.

D.  

Store the database endpoint and credentials as a secret and connect to the secret.

E.  

Store credentials in environment variables in the secondary Region.

A.  

Store the API key as an AWS Secrets Manager secret. Encrypt the secret with an AWS managed KMS key.

B.  

Store the API key as an AWS Systems Manager Parameter Store String parameter.

C.  

Store the API key as an AWS Systems Manager Parameter Store SecureString parameter. Encrypt the parameter with a customer managed KMS key.

D.  

Store the API key in a Lambda environment variable. Encrypt the environment variable with an AWS managed KMS key.

E.  

Store the API key in a Lambda environment variable. Encrypt the environment variable with a customer managed KMS key.

A.  

Add an AWS Secrets Manager GenerateSecretString resource to the CloudFormation template. Set the value to reference new credentials to the Cloudformation resource.

B.  

Use the AWS SDK ssm PutParameter operation in the Lambda function from the existing, custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set ma parameter type to SecureString.

C.  

Add an AWS Systems Manager Parameter Store resource to the CloudFormation template. Set the CloudFormation resource value to reference the new credentials Set the resource NoEcho attribute to true.

D.  

Use the AWS SDK ssm PutParameter operation in the Lambda function from the existing custom resources to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter NoEcho attribute to true.

A.  

Create a data access IAM role that allows the sts:TagSession action.

B.  

Allow the Lambda execution role to assume the data access role.

C.  

Configure IAM policies on the data access role to allow S3 and DynamoDB access only when resource attributes match the tenant session tag.

D.  

Create a resource-based policy on DynamoDB based on principal tags.

E.  

Create a resource control policy (RCP) for the S3 bucket.

F.  

Configure the Lambda function to assume the data access role and pass the tenant name as a session tag.

A.  

Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”.

B.  

Define a resource-based policy on the S3 bucket to allow access when a request meets the condition “aws:SecureTransport”: “false”.

C.  

Define a role-based policy on the other accounts' roles to deny access when a request meets the condition of “aws:SecureTransport”: “false”.

D.  

Define a resource-based policy on the KMS key to deny access when a request meets the condition of “aws:SecureTransport”: “false”.

A.  

Server-side encryption with Amazon S3 managed keys (SSE-S3)

B.  

Server-side encryption with AWS KMS managed keys (SSE-KMS}

C.  

Server-side encryption with customer-provided keys (SSE-C)

D.  

Server-side encryption with self-managed keys

A.  

Configure secret replication for each secret. Add us-east-1 as a replication Region. Choose an AWS KMS key in us-east-1 to encrypt the replicated secrets.

B.  

Create a new secret in us-east-1 for each secret. Configure secret replication in us-east-1. Set the source to be the corresponding secret in us-west-1. Choose an AWS KMS key in us-west-1 to encrypt the replicated secrets.

C.  

Create a replication rule for each secret. Set us-east-1 as the destination Region. Configure the rule to run during secret rotation. Choose an AWS KMS key in us-east-1 to encrypt the replicated secrets.

D.  

Create a Secrets Manager lifecycle rule to replicate each secret to a new Amazon S3 bucket in us-west-1. Configure an S3 replication rule to replicate the secrets to us-east-1.

A.  

Define an array that includes the environment variables under the environment parameter within the service definition.

B.  

Define an array that includes the environment variables under the environment parameter within the task definition.

C.  

Define an array that includes the environment variables under the entryPoint parameter within the task definition.

D.  

Define an array that includes the environment variables under the entryPoint parameter within the service definition.

A.  

Perform a Scan operation on the Orders table. Provide a QueryFilter condition to filter to only the items where the OrderSource attribute is equal to the MobileApp value.

B.  

Create a local secondary index (LSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.

C.  

Create a global secondary index (GSI) with OrderSource as the sort key. Perform a Query operation by using MobileApp as the key.

D.  

Create a global secondary index (GSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.

A.  

Deploy the API Gateway REST API to all the required AWS accounts. Use the same custom domain name for all the gateway endpoints so that a single SCM webhook can be used for all events from all accounts.

B.  

Deploy the API Gateway REST API to all the receiver AWS accounts. Create as many SCM webhooks as the number of AWS accounts.

C.  

Grant permission to the central AWS account for EventBridge to access the receiver AWS accounts. Add an EventBridge event bus on the receiver AWS accounts as the targets to the existing EventBridge rule.

D.  

Convert the API Gateway type from REST API to HTTP API.

A.  

Amazon Cloudfront

B.  

Amazon ElastiCache to Memcached

C.  

Amazon ElastiCache for Redis in cluster mode

D.  

Amazon DynamoDB Accelerate (DAX)

A.  

A global secondary index (GSl) with Product ID as the partition key and Product Rating as the sort key

B.  

A global secondary index (GSl) with Product ID as the partition key and Review ID as the sort key

C.  

A local secondary index (LSI) with Product ID as the partition key and Product Rating as the sort key

D.  

A local secondary index (LSI) with Review ID as the partition key and Product ID as the sort key

A.  

CacheHitCount

B.  

IntegrationLatency

C.  

CacheMissCount

D.  

Latency

E.  

Count

A.  

Create a schedule group in Amazon EventBridge Scheduler to invoke the Lambda function.

B.  

Configure provisioned concurrency for the Lambda function to have the necessary number of execution environments.

C.  

Use the $LATEST version of the Lambda function.

D.  

Configure reserved concurrency for the Lambda function to have the necessary number of execution environments.

E.  

Deploy changes, and publish a new version of the Lambda function.

A.  

Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:Decrypt permissions to the Lambda function execution roles.

B.  

Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:Decrypt permission to the Lambda function execution roles.

C.  

Create customer managed keys for all Lambda functions. Use the new customer managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.

D.  

Create AWS managed keys for all Lambda functions. Use the new AWS managed keys to encrypt the environment variables. Add kms:CreateGrant permission and kms:Encrypt permission to the Lambda function execution roles.

A.  

BeforeInstall -> ApplicationStop -> ApplicationStart -> AfterInstall

B.  

ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart

C.  

BeforeInstall -> ApplicationStop -> ValidateService -> ApplicationStart

D.  

ApplicationStop -> BeforeInstall -> ValidateService -> ApplicationStart

A.  

Rewrite the application to be cloud native and to run on AWS Lambda, where the logs can be reviewed in Amazon CloudWatch

B.  

Set up centralized logging by using Amazon OpenSearch Service, Logstash, and OpenSearch Dashboards

C.  

Scale down the application to one larger EC2 instance where only one instance is recording logs

D.  

Install the unified Amazon CloudWatch agent on the EC2 instances Configure the agent to push the application logs to CloudWatch

A.  

Encode each employee's contact information and photos using Base64. Store the information in an Amazon DynamoDB table using a sort key.

B.  

Store each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3.

C.  

Use Amazon Cognito user pools to implement the employee directory in a fully managed software-as-a-service (SaaS) method.

D.  

Store employee contact information in an Amazon RDS DB instance with the photos stored in Amazon Elastic File System (Amazon EFS).

A.  

Add local secondary indexes (LSis) for the trading data.

B.  

Store the trading data m Amazon S3 and use S3 Transfer Acceleration.

C.  

Add retries with exponential back off for DynamoDB queries.

D.  

Use DynamoDB Accelerator (DAX) to cache the trading data.