Question 1

A developer designed an application on an Amazon EC2 instance The application makesAPI requests to objects in an Amazon S3 bucketWhich combination of steps will ensure that the application makes the API requests in theMOST secure manner? (Select TWO.)

A. Create an IAM user that has permissions to the S3 bucket. Add the user to an 1AMgroup

B. Create an IAM role that has permissions to the S3 bucket

C. Add the IAM role to an instance profile. Attach the instance profile to the EC2 instance.

D. Create an 1AM role that has permissions to the S3 bucket Assign the role to an 1AMgroup

E. Store the credentials of the IAM user in the environment variables on the EC2 instance

Answer: B,C

Question 2

A developer is using AWS Step Functions to automate a workflow The workflow defineseach step as an AWS Lambda function task The developer notices that runs of the StepFunctions state machine fail in the GetResource task with either anUlegalArgumentException error or a TooManyRequestsException errorThe developer wants the state machine to stop running when the state machine encountersan UlegalArgumentException error. The state machine needs to retry the GetResourcetask one additional time after 10 seconds if the state machine encounters aTooManyRequestsException error. If the second attempt fails, the developer wants thestate machine to stop running.How can the developer implement the Lambda retry functionality without addingunnecessary complexity to the state machine'?

A. Add a Delay task after the GetResource task. Add a catcher to the GetResource task.Configure the catcher with an error type of TooManyRequestsException. Configure thenext step to be the Delay task Configure the Delay task to wait for an interval of 10 secondsConfigure the next step to be the GetResource task.

B. Add a catcher to the GetResource task Configure the catcher with an error type ofTooManyRequestsException. an interval of 10 seconds, and a maximum attempts value of1. Configure the next step to be the GetResource task.

C. Add a retrier to the GetResource task Configure the retrier with an error type ofTooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of1.

D. Duplicate the GetResource task Rename the new GetResource task to TryAgain Add acatcher to the original GetResource task Configure the catcher with an error type ofTooManyRequestsException. Configure the next step to be TryAgain.

Answer: C

Question 3

A developer creates a static website for their department The developer deploys the staticassets for the website to an Amazon S3 bucket and serves the assets with AmazonCloudFront The developer uses origin access control (OAC) on the CloudFront distributionto access the S3 bucketThe developer notices users can access the root URL and specific pages but cannotaccess directories without specifying a file name. For example, /products/index.html works,but /products returns an error The developer needs to enable accessing directories withoutspecifying a file name without exposing the S3 bucket publicly.Which solution will meet these requirements'?

A. Update the CloudFront distribution's settings to index.html as the default root object isset

B. Update the Amazon S3 bucket settings and enable static website hosting. Specify indexhtml as the Index document Update the S3 bucket policy to enable access. Update theCloudFront distribution's origin to use the S3 website endpoint

C. Create a CloudFront function that examines the request URL and appends index.htmlwhen directories are being accessed Add the function as a viewer request CloudFrontfunction to the CloudFront distribution's behavior.

D. Create a custom error response on the CloudFront distribution with the HTTP error codeset to the HTTP 404 Not Found response code and the response page path to /index htmlSet the HTTP response code to the HTTP 200 OK response code

Answer: A

Question 4

A company has an existing application that has hardcoded database credentials Adeveloper needs to modify the existing application The application is deployed in two AWSRegions with an active-passive failover configuration to meet company’s disaster recoverystrategyThe developer needs a solution to store the credentials outside the code. The solution mustcomply With the company's disaster recovery strategyWhich solution Will meet these requirements in the MOST secure way?

A. Store the credentials in AWS Secrets Manager in the primary Region. Enable secretreplication to the secondary Region Update the application to use the Amazon ResourceName (ARN) based on the Region.

B. Store credentials in AWS Systems Manager Parameter Store in the primary Region.Enable parameter replication to the secondary Region. Update the application to use theAmazon Resource Name (ARN) based on the Region.

C. Store credentials in a config file. Upload the config file to an S3 bucket in me primaryRegion. Enable Cross-Region Replication (CRR) to an S3 bucket in the secondary region.Update the application to access the config file from the S3 bucket based on the Region.

D. Store credentials in a config file. Upload the config file to an Amazon Elastic File System(Amazon EFS) file system. Update the application to use the Amazon EFS file systemRegional endpoints to access the config file in the primary and secondary Regions.

Answer: A

Question 5

A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account. Which AWS Security Token Service (AWS STS)API operation should the developer use with the MFA information to meet thisrequirement?

A. AssumeRoleWithWebidentity

B. GetFederationToken

C. AssumeRoleWithSAML

D. AssumeRole

Answer: D