AWS Certification Developer Associate 2024 past questions and answers

1. Have the application generate short-lived presigned S3 PUT URLs for authorized uploads.
2. Embed an IAM user's access key and secret key in the browser application.
3. Route every upload through an always-on EC2 instance that writes to S3.
4. Make the bucket public for writes and ask the browser to use the object URL.

Answer: A. Have the application generate short-lived presigned S3 PUT URLs for authorized uploads.

A presigned URL grants time-limited access to a specific S3 operation without exposing AWS credentials or proxying the file through a server. Embedded credentials and public writes are insecure, while an always-on upload server adds unnecessary cost and operations.

1. Read the table first and then write the order, without a condition on the write.
2. Use the client request ID as the item key and issue a conditional PutItem that succeeds only when the key does not already exist.
3. Write the order to a second table and periodically remove duplicates with a scheduled Lambda function.
4. Use eventually consistent reads after every write to prevent duplicate requests.

Answer: B. Use the client request ID as the item key and issue a conditional PutItem that succeeds only when the key does not already exist.

A conditional PutItem keyed by the request ID makes creation atomic, so a retry cannot create another item; the API can treat a conditional-check failure as an already-processed request. A read-then-write sequence has a race, and eventual consistency or later cleanup does not prevent duplicate creation.

1. Set the queue retention period to one minute.
2. Set the batch size to one and disable retries for the event source mapping.
3. Enable partial batch response reporting and return the message identifiers that failed processing.
4. Delete the entire batch from the queue before processing any message.

Answer: C. Enable partial batch response reporting and return the message identifiers that failed processing.

With partial batch responses enabled, the function reports only failed message identifiers, allowing successfully processed messages to remain acknowledged. A whole-batch failure would retry successful messages, while deleting the batch first risks losing unprocessed work.

1. An API key for each user and usage-plan quotas as the authentication mechanism.
2. An IAM user for each mobile user and a permanent access key in the application.
3. A Lambda function that decodes token strings but does not verify their signatures.
4. An API Gateway Cognito user-pool authorizer for the API method.

Answer: D. An API Gateway Cognito user-pool authorizer for the API method.

An API Gateway Cognito authorizer validates user-pool tokens and makes the validated claims available to the integration. API keys are not user authentication, and distributing IAM credentials or skipping signature verification is insecure.

1. Amazon EventBridge, using an event bus and rules that route matching events to consumer targets.
2. Amazon EBS, using a shared volume that each consumer polls.
3. AWS CloudTrail, using management events as the application's message broker.
4. Amazon Route 53, using DNS records to distribute event payloads.

Answer: A. Amazon EventBridge, using an event bus and rules that route matching events to consumer targets.

EventBridge decouples producers from consumers and routes events to targets through rules that can filter event details. EBS, CloudTrail, and Route 53 are not application event-bus services.