WGU D321| 1
WGU D321 — AWS DEVELOPER | COMPREHENSIVE
OBJECTIVE ASSESSMENT | STUDY GUIDE | LATEST
UPDATE 2026/2027 | PRACTICE QUESTIONS AND
ANSWERS | EXAM REVIEW
Table of Contents
1. Development with AWS Services: Core Services and SDKs
2. Development with AWS Services: AWS Lambda and Serverless
3. Development with AWS Services: Data Stores and Application Integration
4. Security: Authentication, Authorization, and IAM
5. Security: Encryption and Key Management
6. Security: Managing Sensitive Data
7. Deployment: Application Artifacts and CI/CD
8. Deployment: Testing and Automation
9. Troubleshooting and Optimization: Root Cause Analysis and Observability
10. Troubleshooting and Optimization: Performance and Cost Optimization
, WGU D321| 2
Question 1: A developer is writing an application that will run on an Amazon EC2 instance
and needs to access an Amazon S3 bucket. What is the MOST secure way to provide the
application with the necessary credentials?
A. Store the AWS access key and secret key in the application source code.
B. Store the credentials in a configuration file on the EC2 instance.
C. Attach an IAM role to the EC2 instance with the appropriate S3 permissions.
D. Use the AWS root user credentials for the application.
Correct Answer: C. Attach an IAM role to the EC2 instance with the appropriate S3
permissions.
IAM roles provide temporary credentials to EC2 instances, eliminating the need to store
long-term credentials on the instance. This follows the security best practice of using
temporary credentials and least privilege. Storing credentials in code or files is insecure, and
using root credentials violates AWS security best practices.
Question 2: A developer is creating a serverless application using AWS Lambda. The function
needs to be invoked when a new object is uploaded to an Amazon S3 bucket. Which S3
feature should the developer use?
A. S3 Lifecycle policies
B. S3 Event notifications
C. S3 Transfer Acceleration
D. S3 Versioning
Correct Answer: B. S3 Event notifications
S3 Event notifications can trigger AWS Lambda functions when specific events occur, such as
an object being created (PUT). Lifecycle policies manage object storage classes, Transfer
Acceleration speeds up uploads, and Versioning keeps multiple versions of objects.
Question 3: A developer is using the AWS SDK for Python (Boto3) to interact with
DynamoDB. The developer needs to retrieve an item from a table using its primary key.
Which API call should be used?
A. Query
B. Scan
C. GetItem
D. BatchGetItem
, WGU D321| 3
Correct Answer: C. GetItem
GetItem retrieves a single item from a DynamoDB table by its primary key. Query retrieves
multiple items based on a key condition, Scan reads the entire table, and BatchGetItem
retrieves multiple items from one or more tables using their primary keys.
Question 4: A developer is designing a microservices architecture where services
communicate asynchronously. Which AWS service should be used to decouple the services
and ensure reliable message delivery?
A. Amazon SNS
B. Amazon SQS
C. AWS Step Functions
D. Amazon Kinesis
Correct Answer: B. Amazon SQS
Amazon SQS is a fully managed message queuing service that enables asynchronous
communication between microservices. It decouples producers and consumers, stores
messages durably, and ensures reliable delivery. SNS is a pub/sub service, Step Functions
orchestrates workflows, and Kinesis is for real-time streaming.
Question 5: A developer needs to store session state for a web application that runs on
multiple EC2 instances behind an Application Load Balancer. The session data must be
accessible to all instances and persist if an instance fails. Which AWS service is MOST
appropriate?
A. Amazon S3
B. Amazon DynamoDB
C. Amazon EBS
D. Amazon EC2 Instance Store
Correct Answer: B. Amazon DynamoDB
DynamoDB is a fully managed NoSQL database that provides fast, predictable performance
and is ideal for storing session state. It is accessible from all EC2 instances, persists
independently of instance lifecycle, and scales automatically. EBS volumes are tied to a
single AZ, and Instance Store is ephemeral.
Question 6: A developer is writing a Lambda function that needs to access a relational
database in a private subnet of a VPC. What configuration is required?
A. Attach the Lambda function to the VPC with the appropriate subnet and security group.
, WGU D321| 4
B. Store the database credentials in environment variables.
C. Use an Elastic IP address for the Lambda function.
D. Configure the Lambda function to use a NAT gateway.
Correct Answer: A. Attach the Lambda function to the VPC with the appropriate
subnet and security group.
To access resources in a VPC, a Lambda function must be configured with VPC settings,
including the subnet(s) and security group(s) that allow communication with the database.
Environment variables store configuration but do not provide network access. Lambda
functions do not have Elastic IPs, and a NAT gateway is needed for outbound internet access,
not for accessing private resources.
Question 7: A developer is using AWS CloudFormation to define infrastructure as code.
Which section of a CloudFormation template is used to declare the AWS resources to be
created?
A. Parameters
B. Resources
C. Outputs
D. Mappings
Correct Answer: B. Resources
The Resources section is the only required section in a CloudFormation template and
declares the AWS resources to be created (e.g., EC2 instances, S3 buckets, DynamoDB
tables). Parameters accept input values, Outputs return values, and Mappings define static
values.
Question 8: A developer wants to use infrastructure as code to define a serverless application
with Lambda functions, API Gateway, and DynamoDB tables. Which AWS service is
specifically designed for this purpose?
A. AWS CloudFormation
B. AWS Elastic Beanstalk
C. AWS SAM (Serverless Application Model)
D. AWS OpsWorks
Correct Answer: C. AWS SAM (Serverless Application Model)
AWS SAM is an open-source framework built on CloudFormation that is specifically
designed for building serverless applications. It provides simplified syntax for defining
WGU D321 — AWS DEVELOPER | COMPREHENSIVE
OBJECTIVE ASSESSMENT | STUDY GUIDE | LATEST
UPDATE 2026/2027 | PRACTICE QUESTIONS AND
ANSWERS | EXAM REVIEW
Table of Contents
1. Development with AWS Services: Core Services and SDKs
2. Development with AWS Services: AWS Lambda and Serverless
3. Development with AWS Services: Data Stores and Application Integration
4. Security: Authentication, Authorization, and IAM
5. Security: Encryption and Key Management
6. Security: Managing Sensitive Data
7. Deployment: Application Artifacts and CI/CD
8. Deployment: Testing and Automation
9. Troubleshooting and Optimization: Root Cause Analysis and Observability
10. Troubleshooting and Optimization: Performance and Cost Optimization
, WGU D321| 2
Question 1: A developer is writing an application that will run on an Amazon EC2 instance
and needs to access an Amazon S3 bucket. What is the MOST secure way to provide the
application with the necessary credentials?
A. Store the AWS access key and secret key in the application source code.
B. Store the credentials in a configuration file on the EC2 instance.
C. Attach an IAM role to the EC2 instance with the appropriate S3 permissions.
D. Use the AWS root user credentials for the application.
Correct Answer: C. Attach an IAM role to the EC2 instance with the appropriate S3
permissions.
IAM roles provide temporary credentials to EC2 instances, eliminating the need to store
long-term credentials on the instance. This follows the security best practice of using
temporary credentials and least privilege. Storing credentials in code or files is insecure, and
using root credentials violates AWS security best practices.
Question 2: A developer is creating a serverless application using AWS Lambda. The function
needs to be invoked when a new object is uploaded to an Amazon S3 bucket. Which S3
feature should the developer use?
A. S3 Lifecycle policies
B. S3 Event notifications
C. S3 Transfer Acceleration
D. S3 Versioning
Correct Answer: B. S3 Event notifications
S3 Event notifications can trigger AWS Lambda functions when specific events occur, such as
an object being created (PUT). Lifecycle policies manage object storage classes, Transfer
Acceleration speeds up uploads, and Versioning keeps multiple versions of objects.
Question 3: A developer is using the AWS SDK for Python (Boto3) to interact with
DynamoDB. The developer needs to retrieve an item from a table using its primary key.
Which API call should be used?
A. Query
B. Scan
C. GetItem
D. BatchGetItem
, WGU D321| 3
Correct Answer: C. GetItem
GetItem retrieves a single item from a DynamoDB table by its primary key. Query retrieves
multiple items based on a key condition, Scan reads the entire table, and BatchGetItem
retrieves multiple items from one or more tables using their primary keys.
Question 4: A developer is designing a microservices architecture where services
communicate asynchronously. Which AWS service should be used to decouple the services
and ensure reliable message delivery?
A. Amazon SNS
B. Amazon SQS
C. AWS Step Functions
D. Amazon Kinesis
Correct Answer: B. Amazon SQS
Amazon SQS is a fully managed message queuing service that enables asynchronous
communication between microservices. It decouples producers and consumers, stores
messages durably, and ensures reliable delivery. SNS is a pub/sub service, Step Functions
orchestrates workflows, and Kinesis is for real-time streaming.
Question 5: A developer needs to store session state for a web application that runs on
multiple EC2 instances behind an Application Load Balancer. The session data must be
accessible to all instances and persist if an instance fails. Which AWS service is MOST
appropriate?
A. Amazon S3
B. Amazon DynamoDB
C. Amazon EBS
D. Amazon EC2 Instance Store
Correct Answer: B. Amazon DynamoDB
DynamoDB is a fully managed NoSQL database that provides fast, predictable performance
and is ideal for storing session state. It is accessible from all EC2 instances, persists
independently of instance lifecycle, and scales automatically. EBS volumes are tied to a
single AZ, and Instance Store is ephemeral.
Question 6: A developer is writing a Lambda function that needs to access a relational
database in a private subnet of a VPC. What configuration is required?
A. Attach the Lambda function to the VPC with the appropriate subnet and security group.
, WGU D321| 4
B. Store the database credentials in environment variables.
C. Use an Elastic IP address for the Lambda function.
D. Configure the Lambda function to use a NAT gateway.
Correct Answer: A. Attach the Lambda function to the VPC with the appropriate
subnet and security group.
To access resources in a VPC, a Lambda function must be configured with VPC settings,
including the subnet(s) and security group(s) that allow communication with the database.
Environment variables store configuration but do not provide network access. Lambda
functions do not have Elastic IPs, and a NAT gateway is needed for outbound internet access,
not for accessing private resources.
Question 7: A developer is using AWS CloudFormation to define infrastructure as code.
Which section of a CloudFormation template is used to declare the AWS resources to be
created?
A. Parameters
B. Resources
C. Outputs
D. Mappings
Correct Answer: B. Resources
The Resources section is the only required section in a CloudFormation template and
declares the AWS resources to be created (e.g., EC2 instances, S3 buckets, DynamoDB
tables). Parameters accept input values, Outputs return values, and Mappings define static
values.
Question 8: A developer wants to use infrastructure as code to define a serverless application
with Lambda functions, API Gateway, and DynamoDB tables. Which AWS service is
specifically designed for this purpose?
A. AWS CloudFormation
B. AWS Elastic Beanstalk
C. AWS SAM (Serverless Application Model)
D. AWS OpsWorks
Correct Answer: C. AWS SAM (Serverless Application Model)
AWS SAM is an open-source framework built on CloudFormation that is specifically
designed for building serverless applications. It provides simplified syntax for defining
