Question 1

A company has a multi-node Windows legacy application that runs on premises. The application uses a network shared folder as a centralized configuration repository to store configuration files in .xml format. The company is migrating the application to Amazon EC2 instances. As part of the migration to AW developer must identify a solution that provides high availability for the repository.

Which solution will meet this requirement MOST cost-effectively?

Accepted Answer

Amazon S3 is a service that provides highly scalable, durable, and secure object storage. The developer can create an S3 bucket to host the repository migrate the existing .xml files to the S3 bucket. The developer can update the application code to use the AWS SDK to read and write configuration files This solution will meet the requirement of high availability for the repository in a cost-effective way. References:

- ? [Amazon Simple Storage Service (S3)]
- ? [Using AWS SDKs with Amazon S3]

Question 2

A developer has been asked to create an AWS Lambda function that is invoked any time updates are made to items in an Amazon DynamoDB table. The function has been created and appropriate permissions have been added to the Lambda execution role Amazon DynamoDB streams have been enabled for the table, but invoked.

the function 15 still not being Which option would enable DynamoDB table updates to invoke the Lambda function?

Accepted Answer

This solution allows the Lambda function to be invoked by the DynamoDB stream whenever updates are made to items in the DynamoDB table. Event source mapping is a feature of Lambda that enables a function to be triggered by an event source, such as a DynamoDB stream, an Amazon Kinesis stream, or an Amazon Simple Queue Service (SQS) queue. The developer can configure event source mapping for the Lambda function using the AWS Management Console, the AWS CLI, or the AWS SDKs. Changing the StreamViewType parameter value to NEW\_AND\_OLD\_IMAGES for the DynamoDB table will not affect the invocation of the Lambda function, but only change the information that is written to the stream record. Mapping an Amazon Simple Notification Service ( SNS) topic to the DynamoDB stream will not invoke the Lambda function directly, but require an additional subscription from the Lambda function to the S Increasing the maximum runtime (timeout) setting of the Lambda function will not affect the invocation of the Lambda function, but only change how long function can run before it is terminated.

Reference: [Using AWS Lambda with Amazon DynamoDB], [Using AWS Lambda with Amazon SNS]

Question 3

An application that runs on AWS receives messages from an Amazon Simple Queue Service (Amazon SQS) queue and processes the messages in batches. The application sends the data to another SQS queue to be consumed by another legacy application. The legacy system can take up to 5 minutes to process some transaction data. A developer wants to ensure that there are no out-of-order updates in the legacy system. The developer cannot alter the behavior of the legacy system.

Which solution will meet these requirements?

Accepted Answer

? An SQS FIFO queue is a type of queue that preserves the order of messages and ensures that each message is delivered and processed only once1. This is suitable for the scenario where the developer wants to ensure that there are no out-of-order updates in the legacy system.

? The visibility timeout value is the amount of time that a message is invisible in the queue after a consumer receives it2. This prevents other consume processing the same message simultaneously. If the consumer does not delete the message before the visibility timeout expires, the message becomes visib again and another consumer can receive it2.

shared folder.

? In this scenario, the developer needs to configure the visibility timeout value to be longer than the maximum processing time of the legacy system, wh minutes. This will ensure that the message remains invisible in the queue until the legacy system finishes processing it and deletes it. This will preve out-of-order processing of messages by the legacy system.

Question 4

A company has an application that is hosted on Amazon EC2 instances The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket A developer turns on S3 Block Public Access for the S3 bucket After this change, users report errors when they attempt to dow implement a solution so that only users who are signed in to the application can access objects in t

## objects The developer needs to S3 bucket.

Which combination of steps will meet these requirements in the MOST secure way? (Select TWO.)

Accepted Answer

The most secure way to allow the EC2 instances to access the S3 bucket is to use an EC2 instance profile and role with an appropriate policy that grant necessary permissions. This way, the EC2 instances can use temporary security credentials that are automatically rotated and do not need to store any ac keys on the instances. To allow the users who are signed in to the application to download objects from the S3 bucket, the application can use the S3 GeneratePresignedUrl API call to create a pre-signed URL that grants temporary access to a specific object. The pre-signed URL can be returned to the us can then use it to download the object within a specified time period. References

- ? Use Amazon S3 with Amazon EC2
- ? How to Access AWS S3 Bucket from EC2 Instance In a Secured Way
- ? Sharing an Object with Others

Question 5

A company runs a payment application on Amazon EC2 instances behind an Application Load Balance The EC2 instances run in an Auto Scaling group across multiple Availability Zones The application needs to retrieve application secrets during the application startup environment variables These secrets must be encrypted at rest and need to be rotated every month.

Which solution will meet these requirements with the LEAST development effort?

Accepted Answer

AWS Secrets Manager is a service that enables the secure management and rotation of secrets, such as database credentials, API keys, or passwords. By u Secrets Manager, the company can avoid hardcoding secrets in the application code or properties files, and instead retrieve them programmatically during application startup. Secrets Manager also supports automatic rotation of secrets by using AWS Lambda functions or built-in rotation templates. The compa provision a customer master key (CMK) to encrypt the secrets and use the AWS SDK or CLI to export the secrets as environment variables. References:

- ? What Is AWS Secrets Manager? - AWS Secrets Manager
- ? Rotating Your AWS Secrets Manager Secrets - AWS Secrets Manager
- ? Retrieving a Secret - AWS Secrets Manager

Question 6

A developer is creating an application that will store personal health information (PHI). The PHI needs to be encrypted at all times. An encrypted Amazo MySQL DB instance is storing the data. The developer wants to increase the performance of the application by caching frequently accessed data while addi ability to sort or rank the cached datasets.

Which solution will meet these requirements?

Accepted Answer

and export the secrets as

## We recommend you to try the PREMIUM AWS-Certified-Developer-Associate Dumps From Exambible

Amazon ElastiCache is a service that offers fully managed in-memory data stores that are compatible with Redis or Memcached. The developer can create a ElastiCache for Redis instance and enable encryption of data in transit and at rest. This will ensure that the PHI is encrypted at all times. The develo frequently accessed data in the cache and use Redis features such as sorting and ranking to enhance the performance of the application.

References:

? [What Is Amazon ElastiCache? - Amazon ElastiCache]

? [Encryption in Transit - Amazon ElastiCache for Redis]

- ? [Encryption at Rest - Amazon ElastiCache for Redis]

Question 7

A developer is creating an AWS CloudFormation template to deploy Amazon EC2 instances across multiple AWS accounts. The developer must choose the EC2 instances from a list of approved instance types.

How can the developer incorporate the list of approved instance types in the CloudFormation template?

Accepted Answer

In the CloudFormation template, the developer should create a parameter with the list of approved EC2 instance types as AllowedValues. This way, users select the instance type they want to use when launching the CloudFormation stack, but only from the approved list.

Question 8

A developer is working on a Python application that runs on Amazon EC2 instances. The developer wants to enable tracing of application requests to debug performance issues in the code.

Which combination of actions should the developer take to achieve this goal? (Select TWO)

Accepted Answer

This solution will meet the requirements by using AWS X-Ray to enable tracing of application requests to debug performance issues in the code. AWS X-Ra service that collects data about requests that the applications serve, and provides tools to view, filter, and gain insights int The developer can install the AWS X-Ray daemon on the EC2 instances, which is a software that listens for traffic on UDP port 2000, gathers raw segment and relays it to the X-Ray API. The developer can also install and configure the AWS X-Ray SDK for Python in the application, which is a library that en instrumenting Python code to generate and send trace data to the X-Ray daemon. Option A is not optimal because it will install the Amazon CloudWatch age the EC2 instances, which is a software that collects metrics and logs from EC2 instances and on- premises servers, not application performance data. Opt not optimal because it will configure the application to write JSON-formatted logs to /var/log/cloudwatch, which is not a valid path or destination for logs. Option D is not optimal because it will configure the application to write trace data to /var/log/xray, which is also not a valid path or destinat data.

References: [AWS X-Ray], [Running the X-Ray Daemon on Amazon EC2]

Question 9

A developer must use multi-factor authentication (MFA) to access data in an Amazon S3

bucket that is in another AWS account. Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?

Accepted Answer

The AssumeRole API operation returns a set of temporary security credentials that can be used to access resources in another AWS account. The developer specify the MFA device serial number and the MFA token code in the request parameters. This option enables the developer to use MFA to access data in an bucket that is in another AWS account. The other options are not relevant or effective for this scenario. References

? AssumeRole

- ? Requesting Temporary Security Credentials

Question 10

A financial company must store original customer records for 10 years for legal reasons. A complete record contains personally identifiable information According to local regulations, PII is available to only certain people in the company and must not be shared with third parties. The company needs to m records available to third-party organizations for statistical analysis without sharing the PII.

A developer wants to store the original immutable record in Amazon S3. Depending on who accesses the S3 document, the document should be returned as is with all the PII removed. The developer has written an AWS Lambda function to remove the PII from the document. The function is named removePii. What should the developer do so that the company can meet the PII requirements while maintaining only one copy of the document?

Accepted Answer

S3 Object Lambda allows you to add your own code to process data retrieved from S3 before returning it to an application. You can use an AWS Lambda fun to modify the data, such as removing PII, redacting confidential information, or resizing images. You can create an S3 Object Lambda access point and as with your Lambda function. Then, you can use the access point to request objects from S3 and get the modified data back. This way, you can maintain only copy of the original document in S3 and apply different transformations depending on who accesses it. Reference: Using AWS Lambda with Amazon S3