AWS Certified Developer - Associate practice questions

Question 1

A developer is being asked to keep Lambda deployment packages small while still sharing a heavy third-party dependency across a dozen functions. The developer is evaluating Lambda layers based on the documented use cases. Which two outcomes does the Lambda layers documentation explicitly list?

Accepted Answer

Layers reduce the size of your deployment packages by letting you put function dependencies in a layer instead of including them with your function code in the deployment package.

Accepted Answer

Layers let you separate core function logic from dependencies and update your function dependencies independent of your function code, and vice versa.

Answer

Layers automatically rotate IAM credentials for the function at runtime so the function code never has to call STS. Layers ship code and data, not credentials, and do not perform STS rotation.

Answer

Layers replace the need for any function code at all and run the layer's contents as the handler entry point. A layer is supplementary code; the function still needs a handler that the runtime can invoke.

Answer

Layers force every consuming function to redeploy in lockstep whenever the layer changes, which the docs frame as the main benefit. The docs frame independent updates of function and dependencies as the benefit, which is the opposite of lockstep.

Question 2

A developer is troubleshooting why an IAM user whose identity-based policy explicitly allows s3:DeleteObject still receives AccessDenied after the bucket's resource-based policy added an explicit Deny for that user. The developer is reviewing the IAM policy evaluation logic documentation. Within the same account, how does AWS resolve this conflict?

Accepted Answer

The bucket policy's explicit Deny overrides the Allow, so the delete is denied.

Answer

The identity-based Allow wins because it attaches directly to the IAM user.

Answer

AWS unions both policies, so the Allow prevails and the object is removed now.

Answer

Whichever policy statement was edited last wins, so access depends on edit order.

Question 3

A developer is being asked whether Amazon ECR can scan container images for software vulnerabilities directly, or whether the team needs a separate vulnerability scanner. The developer is reading the Amazon ECR documentation. Which capability does the documentation describe?

Accepted Answer

Image scanning helps in identifying software vulnerabilities in your container images, and each repository can be configured to scan on push.

Answer

ECR scanning runs only during pull, never on push. The documentation describes scanning on push, contradicting pull-only.

Answer

ECR does not perform any vulnerability scanning and the customer must integrate an external scanner. The documentation explicitly describes built-in image scanning.

Answer

ECR scanning is exclusively a CloudWatch Metrics feature and produces no per-image findings. The documentation describes image-specific vulnerability findings, not a metrics-only output.

Question 4

A developer is being asked how Lambda samples requests for X-Ray active tracing, because a teammate expects a trace for every invocation. The developer is reading the Lambda X-Ray documentation. Which sampling rule does the documentation describe?

Accepted Answer

If you've enabled Active tracing for your function, Lambda automatically sends traces to X-Ray for sampled requests, and the sampling rate is 1 request per second and 5 percent of additional requests.

Answer

Lambda sends no traces at all unless the caller passes an X-Ray header on the request. With Active tracing enabled, Lambda emits sampled traces independent of inbound headers.

Answer

Lambda always sends a trace for every invocation regardless of sampling. The documentation explicitly describes a 1-request-per-second plus 5% sampling rule, contradicting always-on tracing.

Answer

Lambda's sampling rule is configurable per-function with no default. The documented default is 1 request per second plus 5% of additional requests.

Question 5

A developer is being asked what a Lambda layer actually contains on disk, because a colleague has confused layers with container images. The developer is reviewing the Lambda layers documentation. Which description matches a Lambda layer?

Accepted Answer

A Lambda layer is a .zip file archive that contains supplementary code or data, and layers usually contain library dependencies, a custom runtime, or configuration files.

Answer

A Lambda layer is a running EC2 instance that the function dials into over a VPC endpoint at cold start. Layers are static archives mounted into the execution environment, not running compute resources.

Answer

A Lambda layer is a managed RDS database attached to the function for shared state across invocations. Layers carry static code or data, not a relational database.

Answer

A Lambda layer is a CloudFormation stack template that the function applies at startup to provision resources. Layers package code and data; they do not provision other AWS resources at startup.

Question 6

A developer is troubleshooting why an IAM user in another AWS account cannot read objects from an S3 bucket even though the user has an identity-based policy granting s3:GetObject. The developer is reviewing the IAM identity-vs-resource policy documentation. Which policy type does the documentation say is required on the resource to grant cross-account access in this case?

Accepted Answer

Resource-based policies are attached to a resource, and several services support them including Amazon S3 buckets, Amazon SQS queues, VPC endpoints, AWS KMS encryption keys, and Amazon DynamoDB tables and streams, and they specify who has access to the resource and what actions they can perform on it.

Answer

A VPC endpoint policy is the same as a resource-based policy on the bucket itself. Endpoint policies and bucket policies are distinct constructs, even if both can scope access.

Answer

Only an identity-based policy on the foreign user is needed; resource-based policies are deprecated and S3 ignores them. S3 bucket policies are explicitly listed as supported resource-based policies, contradicting the deprecation claim.

Answer

AWS Organizations service control policies act as resource-based policies on S3 buckets. SCPs are organizational permission guardrails, not resource-based policies attached to a bucket.

Question 7

A developer is being asked which section of a CloudFormation template is required for every template, because a colleague has authored a template containing only Parameters and is wondering why it is rejected. The developer is reading the CloudFormation template sections documentation. Which section does the documentation describe as required?

Accepted Answer

The Resources section is required in every CloudFormation template and forms the core of the template, and this section specifies the stack resources and their properties, such as an Amazon EC2 instance or an Amazon S3 bucket.

Answer

The Outputs section is required in every CloudFormation template. The documentation describes Outputs as optional, with Resources as the required core.

Answer

The Parameters section is required in every CloudFormation template and contains all stack inputs. The documentation explicitly says the Resources section is required, not Parameters.

Answer

The Conditions section is required in every CloudFormation template. The documentation lists Conditions as optional, with Resources as the only required section.

Question 8

A developer is being asked to accelerate large file uploads to a single S3 bucket from customers located on different continents. The developer is reading the S3 Transfer Acceleration documentation. Which capability does the documentation describe?

Accepted Answer

Amazon S3 Transfer Acceleration is a bucket-level feature that enables fast, easy, and secure transfers of files over long distances between your client and an S3 general purpose bucket, and it takes advantage of the globally distributed edge locations in Amazon CloudFront.

Answer

S3 Transfer Acceleration routes uploads through Direct Connect circuits rather than CloudFront edge locations. The documentation explicitly says Transfer Acceleration uses CloudFront edge locations.

Answer

S3 Transfer Acceleration is an account-level feature that applies to every bucket and cannot be enabled per bucket. The documentation describes Transfer Acceleration as a bucket-level feature, not account-level.

Answer

S3 Transfer Acceleration replaces multipart upload entirely and forbids parallel parts. Transfer Acceleration improves long-distance throughput and complements multipart; it does not forbid parallel parts.

Question 9

A developer needs to support a query pattern in DynamoDB that reuses the base table's partition key but a different sort key, and a teammate asks whether a global secondary index or a local secondary index fits. The developer is reading the secondary indexes documentation. Which index type matches the local secondary index definition?

Accepted Answer

Local secondary index — An index that has the same partition key as the base table, but a different sort key.

Answer

An index whose partition key and sort key can both be different from the base table, with queries spanning all partitions. That description matches a GSI, not an LSI.

Answer

A standalone DynamoDB table created by AWS DMS to mirror the base table at the same partition key. LSIs are intra-table indexes, not mirror tables.

Answer

A read-only export to Amazon S3 created via DynamoDB Streams that surfaces an alternate sort key. LSIs are queryable in-table indexes, not S3 exports.

Question 10

A team is being asked to read Secrets Manager secrets and Parameter Store parameters from a Lambda function and is worried about adding the AWS SDK just for the fetch. The developer is reading the AWS documentation on retrieving secrets in Lambda. Which mechanism does the documentation describe?

Accepted Answer

You can use the AWS Parameters and Secrets Lambda Extension to retrieve and cache AWS Secrets Manager secrets and Parameter Store parameters in Lambda functions without using an SDK, and the extension can retrieve both Secrets Manager secrets and Parameter Store parameters.

Answer

Secrets must always be read using the full AWS SDK from inside the handler, with no caching available. The documentation describes a Lambda extension that caches values without using an SDK, contradicting the SDK-only claim.

Answer

Secrets must be embedded in environment variables, and the extension is deprecated. The documentation explicitly recommends the extension for retrieving secrets and parameters, not embedding them in env vars.

Answer

Secrets can only be read by mounting EFS into the function and storing them as files. The documented mechanism is the Parameters and Secrets Lambda Extension, not an EFS file mount.

Question 11

An organization is adopting infrastructure as code for a serverless workload and is evaluating AWS SAM before standardizing on it. Which description best characterizes what AWS SAM actually is?

Accepted Answer

An open-source IaC framework whose shorthand declares CloudFormation and serverless resources that deploy as infrastructure.

Answer

A managed continuous delivery service that models the build, test, and deploy stages needed to release a serverless application.

Answer

A managed artifact repository that stores and shares a serverless application's package dependencies for build tools and pipelines.

Answer

A deployment service that automates releases to EC2 instances, Lambda functions, and Amazon ECS services and can roll them back.

Question 12

A developer is being asked why a Lambda function intermittently throws a connection error on its first invocation in a while, and the senior engineer suspects an idle persistent connection. The developer is reading the Lambda best practices documentation. Which guidance does the documentation give for persistent connections?

Accepted Answer

Use a keep-alive directive to maintain persistent connections, since Lambda purges idle connections over time and attempting to reuse an idle connection when invoking a function will result in a connection error.

Answer

The fix is to disable execution environment reuse globally so every invocation pays a fresh connection cost. The documentation recommends keep-alive to preserve reuse, not disabling reuse.

Answer

Lambda never purges idle connections, so the error must be coming from the upstream database alone. The documentation explicitly says Lambda purges idle connections, contradicting never-purges.

Answer

Persistent connections cannot be used from Lambda at all and every invocation must open a fresh connection. The documentation describes using a keep-alive directive to maintain persistent connections, contradicting a fresh-connection-only rule.

Question 13

A developer is evaluating when to switch from a single PUT to multipart upload for objects in S3, and a teammate proposes a fixed 1 GB threshold. The developer is reviewing the multipart upload best-practices guidance. What size threshold does the S3 documentation explicitly call out?

Accepted Answer

It's a best practice to use multipart upload for objects that are 100 MB or larger instead of uploading them in a single operation, to take advantage of improved throughput from parallel parts.

Answer

Multipart upload is the only allowed upload method regardless of object size, because PutObject was retired. PutObject is still available; multipart is recommended for large objects, not mandatory for all.

Answer

Multipart upload is only valid for objects above 5 TB, which is the documented per-object maximum. The 5 TB figure is the per-object maximum size, not the recommended multipart threshold.

Answer

Multipart upload is only valid for objects below 5 MB, which is the documented per-part minimum. The 5 MB minimum applies to part size, not the trigger to switch to multipart.

Question 14

A team is evaluating API Gateway and must choose between REST APIs and HTTP APIs for an endpoint that needs API keys, per-client throttling, and AWS WAF integration. The team is reading the API Gateway REST-versus-HTTP documentation. Which option fits?

Accepted Answer

REST APIs, because they support API keys, per-client throttling, and WAF integration.

Answer

HTTP APIs, because they add API keys, throttling, and WAF at a much lower price point.

Answer

HTTP APIs, since request validation and private endpoints are HTTP-only features here.

Answer

Either type works, since API keys and WAF integration behave identically on both APIs.

Question 15

A developer is being asked what a CodeDeploy deployment configuration actually is, because the team is comparing it to a CodePipeline stage. The developer is reading the CodeDeploy deployment configurations documentation. Which description matches a deployment configuration?

Accepted Answer

A deployment configuration is a set of rules and success and failure conditions used by CodeDeploy during a deployment, and these rules and conditions are different depending on whether you deploy to an EC2/On-Premises, AWS Lambda, or Amazon ECS compute platform.

Answer

A deployment configuration is an alias for a CodePipeline stage. The two concepts are distinct: pipeline stages orchestrate phases, while deployment configurations are CodeDeploy-specific rule sets.

Answer

A deployment configuration is a single fixed setting that applies identically across EC2, Lambda, and ECS. The documentation explicitly says the rules are different per compute platform.

Answer

A deployment configuration is an IAM permission boundary applied to the CodeDeploy service role. IAM permission boundaries are not deployment configurations; deployment configurations are CodeDeploy rule sets.

AWS Certified Developer - Associate

Sample questions

Sources

Similar exams