All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is building a serverless application using an Amazon API Gateway REST API with a Lambda custom (non-proxy) integration backend. The developer configures a custom Lambda authorizer to authenticate incoming requests. The authorizer successfully validates the bearer token and returns an IAM policy along with a context map containing key-value pairs, including a custom property named `tenantId`. However, the backend Lambda function receives `null` for the `tenantId` parameter during invocation.

Which configuration change must the developer implement to resolve this issue?

Define an API Gateway integration request mapping template that references the `$context.authorizer.tenantId` variable to build the JSON payload sent to the Lambda function.

Modify the backend Lambda function to retrieve the tenant identifier from the `event.requestContext.authorizer.tenantId` path of the incoming handler event.

Switch the API Gateway authorizer to a Cognito User Pool authorizer, which automatically maps and forwards all custom claims to custom integration backends.

Configure a method response header for `Access-Control-Allow-Headers` that includes the authorizer context key, enabling client headers to bypass integration mapping.

Show answer & explanation

Answer: Define an API Gateway integration request mapping template that references the `$context.authorizer.tenantId` variable to build the JSON payload sent to the Lambda function.

Answer

Define an API Gateway integration request mapping template that references the `$context.authorizer.tenantId` variable to build the JSON payload sent to the Lambda function.

Defining an API Gateway integration request mapping template is the correct resolution. In a Lambda custom (non-proxy) integration, API Gateway does not forward the raw request event or context metadata. The developer must define a mapping template to build the payload sent to the backend, mapping the authorizer context variable using `$context.authorizer.tenantId`.

Step-by-Step Solution

Identify the API Gateway integration type being used.

The API uses a Lambda custom (non-proxy) integration, which means API Gateway does not automatically forward the request payload or context metadata to the backend.

Understanding the difference between proxy and custom integrations is crucial for determining how data is passed to the backend.

Determine how custom authorizer context is exposed in API Gateway.

The Lambda authorizer's context map properties are available via the `$context.authorizer.keyName` variables in API Gateway mapping templates.

This allows referencing the specific `tenantId` property returned by the custom authorizer.

Configure the Integration Request mapping template.

Create a mapping template for the request content-type (e.g., `application/json`) that constructs a JSON payload containing the mapped context variable, which is then sent to the backend Lambda function.

This ensures the Lambda function receives the expected parameters in its event payload.

Key Concept

Custom Integration Mapping Templates and Authorizer Context

Question 202Question →

A developer is testing an application locally that uses the AWS SDK for JavaScript. The developer wants to ensure the SDK uses the correct IAM permissions. The following configurations exist on the developer's workstation:

* The environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are set to valid credentials for Developer A.
* The shared credentials file (~/.aws/credentials) contains a [default] profile for Developer B and a [testing] profile for Developer C.
* The environment variable AWS_PROFILE is set to testing.

The SDK client is initialized in the code without any custom credential configuration arguments. Which credentials will the AWS SDK use when making API calls?

The credentials for Developer C, because the AWS_PROFILE environment variable overrides other environment variables to load the specific profile configuration.

The credentials for Developer A, because environment variables have higher precedence in the SDK default credential provider chain than the shared credentials file.

The credentials for Developer B, because the default profile in the shared credentials file is always resolved before environment variables are evaluated.

The credentials retrieved from AWS Systems Manager Parameter Store under the name specified by the AWS_PROFILE environment variable.

Show answer & explanation

Answer: The credentials for Developer A, because environment variables have higher precedence in the SDK default credential provider chain than the shared credentials file.

Answer

The credentials for Developer A, because environment variables have higher precedence in the SDK default credential provider chain than the shared credentials file.

The correct answer is the option stating that the credentials for Developer A are used. In the AWS SDK default credentials provider chain, individual environment variables (specifically AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) have higher precedence than profile configurations in the shared credentials file. As a result, the SDK resolves Developer A's credentials and terminates its search.

Step-by-Step Solution

Analyze the SDK client initialization and check if custom credentials are provided.

The SDK is initialized without arguments, meaning it falls back to the default credentials provider chain.

This determines that the standard credential resolution order will be applied.

Check for environment variables containing explicit access keys.

AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are found containing credentials for Developer A.

Environment variables are evaluated at the beginning of the default credentials provider chain.

Determine if the resolution process stops or continues to other sources like AWS_PROFILE.

The credentials for Developer A are selected, and the search stops. The profiles in the shared credentials file are ignored.

Once the SDK resolves valid credentials in a high-precedence source, it stops searching further down the chain.

Key Concept

AWS SDK Default Credentials Provider Chain Precedence

Question 203Question →

A developer has deployed a containerized Node.js application inside a Docker container running on an Amazon EC2 instance. The application uses the AWS SDK for JavaScript to query an Amazon DynamoDB table. An IAM role with the necessary permissions is attached to the EC2 instance via an IAM instance profile. The EC2 instance is configured to require Instance Metadata Service Version 2 (IMDSv2).

While the application successfully accesses DynamoDB when executed directly on the EC2 host, it fails with a credential initialization error when running inside the Docker container. The container is running on the default bridge network.

Which of the following actions should the developer take to resolve this credential issue? (Select TWO.)

Select all that apply

Modify the EC2 instance metadata options to increase the response hop limit to 2 or more.

Run the Docker container using host network mode by specifying the `--network host` flag.

Generate static IAM access keys for the EC2 instance profile role and pass them as environment variables to the container.

Configure the container environment with the `AWS_ROLE_ARN` environment variable set to the ARN of the EC2 instance profile's IAM role.

Disable IMDSv2 on the EC2 instance and fallback to IMDSv1 to bypass the token request requirements.

Show answer & explanation

Answer: Modify the EC2 instance metadata options to increase the response hop limit to 2 or more.; Run the Docker container using host network mode by specifying the `--network host` flag.

Answer

To resolve the credential issue, the developer must either modify the EC2 instance metadata options to increase the response hop limit to 2 or more, or run the Docker container in host network mode using the `--network host` flag.

The credential retrieval failure is caused by the default IMDSv2 response hop limit of 1. When a container runs on the default bridge network, any traffic to the link-local metadata address must cross the container bridge, which counts as an IP hop. Consequently, the metadata response is dropped. The correct actions are to increase the metadata response hop limit to 2 or more on the EC2 instance, or to run the container using host network mode, which eliminates the bridge hop entirely.

Step-by-Step Solution

Analyze the execution environment and network path.

The application runs within a container on the default bridge network, which acts as a virtual gateway and introduces an additional IP routing hop between the container and the EC2 host's link-local address.

Understanding the network topology helps identify why packets are dropped.

Examine the default IMDSv2 settings.

Under IMDSv2, the default HTTP metadata response hop limit is set to 1. Since the bridge network adds a hop, the TTL of the IP packet containing the token response expires and the packet is dropped before reaching the container.

This explains why the application succeeds on the host but fails in the container.

Identify the configuration changes needed to allow containerized access.

Increasing the metadata response hop limit to 2 or more allows the token response to travel through the bridge interface. Alternatively, using host network mode avoids the bridge network hop entirely.

Both methods ensure that the token response successfully reaches the SDK client inside the container.

Key Concept

IMDSv2 Metadata Response Hop Limit in Containerized Environments

Question 204Question →

A developer is configuring a REST API in Amazon API Gateway to integrate with a backend AWS Lambda function. The API client requires a custom header named `X-Custom-Header` in the HTTP response, and the response body must be formatted in JSON. The developer decides to use a Lambda proxy integration to minimize API Gateway configuration overhead. Which two actions must the developer perform to ensure the client receives the expected response?

Select all that apply

Enable the Lambda proxy integration option in the API Gateway Method Execution settings.

Format the return object of the Lambda function to include a `headers` object with the `X-Custom-Header` key-value pair and stringify the JSON payload in the `body` field.

Configure an Integration Response mapping template in API Gateway to parse the Lambda function output and inject the `X-Custom-Header` header.

Configure a Gateway Response in API Gateway to append the `X-Custom-Header` header to all 200 OK responses.

Use a custom Lambda authorizer to inject the `X-Custom-Header` value into the context object and map it using a Method Response header setting.

Show answer & explanation

Answer: Enable the Lambda proxy integration option in the API Gateway Method Execution settings.; Format the return object of the Lambda function to include a `headers` object with the `X-Custom-Header` key-value pair and stringify the JSON payload in the `body` field.

Answer

Enable the Lambda proxy integration option in the API Gateway Method Execution settings, and format the return object of the Lambda function to include a `headers` object with the `X-Custom-Header` key-value pair and stringify the JSON payload in the `body` field.

The correct options involve enabling Lambda proxy integration in the method settings and constructing the response object correctly inside the Lambda function code. In a Lambda proxy integration, API Gateway passes the response directly from the Lambda function to the client without applying mapping templates. Therefore, the Lambda function itself must return the custom header in its response object's `headers` block and stringify the output payload under the `body` property.

Step-by-Step Solution

Analyze the integration type requirement.

The requirement specifies using Lambda proxy integration to minimize API Gateway configuration overhead.

Lambda proxy integration passes requests and responses through without modification by API Gateway mapping templates.

Determine the API Gateway configuration.

The developer must check the Lambda proxy integration option in the Integration Request settings for the API method.

This sets up the proxy integration pattern.

Determine the backend Lambda response format.

The Lambda function must return a JSON object containing `statusCode` (integer), `headers` (map of string to string), and `body` (stringified JSON).

API Gateway requires this specific output format from a proxy integration to construct the HTTP response for the client.

Key Concept

Amazon API Gateway Lambda Proxy Integration response format and configuration

Question 205Question →

A developer is configuring a REST API in Amazon API Gateway using a Lambda custom (non-proxy) integration. The API is secured by a custom Lambda authorizer that outputs a context variable named `tenantId`. The backend Lambda function needs to receive both the client's source IP address and the `tenantId` in its input payload. Furthermore, when the backend Lambda function throws an exception containing the string `EntityNotFound`, the API must return a $404$ Not Found status code to the client.

How should the developer configure API Gateway to meet these requirements?

Configure an Integration Request mapping template that maps `

context.identity.sourceIp` and `

context.authorizer.claims.tenantId` into the payload. Define a

404

Method Response, and configure an Integration Response with the Lambda Error Regex set to `.*EntityNotFound.*` mapped to the

404

Method Response.

Configure an Integration Request mapping template that maps `

context.identity.sourceIp` and `

context.authorizer.tenantId` into the payload sent to the backend function. Define a

404

Method Response. Create an Integration Response with the Lambda Error Regex set to `.*EntityNotFound.*` and map it to the

404

Method Response.

Configure a Lambda Proxy integration, and access `event.requestContext.identity.sourceIp` and `event.requestContext.authorizer.tenantId` in the backend function. Define a

404

Method Response and configure the Lambda Error Regex in the Integration Response to match `.*EntityNotFound.*`.

Configure an Integration Request mapping template that maps `

stageVariables.sourceIp` and `

context.authorizer.tenantId` into the payload. Define a custom Gateway Response of type `DEFAULT_5XX` with a mapping template to intercept the `EntityNotFound` error string and rewrite the status code to

404

Show answer & explanation

Answer: Configure an Integration Request mapping template that maps ` $context.identity.sourceIp` and `$ context.authorizer.tenantId` into the payload sent to the backend function. Define a $404$ Method Response. Create an Integration Response with the Lambda Error Regex set to `.*EntityNotFound.*` and map it to the $404$ Method Response.

Answer

Configure an Integration Request mapping template that maps `

context.identity.sourceIp` and `

context.authorizer.tenantId` into the payload sent to the backend function. Define a

404

Method Response. Create an Integration Response with the Lambda Error Regex set to `.*EntityNotFound.*` and map it to the

404

Method Response.

The correct option correctly identifies the use of an Integration Request mapping template with `

context.identity.sourceIp` and `

context.authorizer.tenantId` to pass the required dynamic parameters to the backend. It also correctly defines the

404

Method Response and the Integration Response with a regular expression (`.*EntityNotFound.*`) matching the backend exception to map it to the

404

client response code. This represents the standard process for request and response mapping in API Gateway custom integrations.

Step-by-Step Solution

Determine the correct integration type and request mapping variables.

Since the scenario specifies custom (non-proxy) integration, mapping templates are required. Identify `

context.identity.sourceIp` for the client IP and `

context.authorizer.tenantId` for the Lambda authorizer's context output.

Custom integrations do not pass the request context automatically, so the developer must explicitly map these context properties using VTL variables in the Integration Request mapping template.

Define the client-facing HTTP status code.

Create a Method Response for the HTTP status code

404

Before an Integration Response can map a backend result to a client status code, that status code must first be declared as an available Method Response for the resource method.

Configure the error selection pattern to map the Lambda exception.

Create an Integration Response with a selection pattern (Lambda Error Regex) of `.*EntityNotFound.*` and map it to the

404

Method Response.

When a custom Lambda integration throws an error, the error message returned is matched against the Lambda Error Regex. The regular expression matches the exception type or message to trigger the custom integration response and pass the

404

status code to the client.

Key Concept

API Gateway Custom Integration Response and Context Mapping

Question 206Question →

An AWS Lambda function is configured to run inside private subnets of a VPC in order to securely read data from an Amazon RDS DB instance. The function must also fetch data from a public weather API endpoint on the internet. Although database queries succeed, all HTTP requests to the public weather API fail with a timeout. Which of the following networking configurations will resolve this issue?

Associate a public IP address directly to the Elastic Network Interfaces (ENIs) assigned to the Lambda function.

Increase the execution timeout configuration of the Lambda function to the maximum value of 15 minutes.

Deploy a NAT Gateway in a public subnet of the VPC and route outbound internet traffic from the private subnets through the NAT Gateway.

Assign an IAM policy to the Lambda function execution role that allows the ec2:AssociateAddress action.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet of the VPC and route outbound internet traffic from the private subnets through the NAT Gateway.

Answer

Deploy a NAT Gateway in a public subnet of the VPC and route outbound internet traffic from the private subnets through the NAT Gateway.

The correct option correctly states that deploying a NAT Gateway in a public subnet and routing outbound internet traffic from the private subnets through it is the standard and recommended way to grant internet access to AWS Lambda functions running in a private VPC subnet.

Step-by-Step Solution

Analyze the networking environment of the Lambda function.

The function is running inside private subnets of a VPC, allowing it to communicate with the RDS database in the same VPC but blocking direct internet access.

By default, resources in a private subnet do not have a route to the internet.

Identify the requirement for outbound internet access.

To reach the public weather API, the Lambda function needs a way to route traffic out of the VPC to the internet securely.

An Internet Gateway cannot be used directly by private subnets as they lack public IP addresses.

Configure the VPC gateway and routing table.

Create a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route of 0.0.0.0/0 to the private subnet's route table pointing to the NAT Gateway.

This allows the private subnet resources to route internet traffic through the NAT Gateway while remaining protected from inbound internet connections.

Key Concept

AWS Lambda VPC networking and outbound internet connectivity requirements.

Estimated Time:1m 0s

Question 207Question →

A developer is deploying a containerized application to Amazon ECS on Amazon EC2. The application uses the AWS SDK to write data to an Amazon DynamoDB table. During local testing, the developer used a shared credentials file located at `~/.aws/credentials` inside the container. After deployment, the application fails to authenticate with DynamoDB because the SDK is still using the expired local credentials instead of the assigned ECS Task Role.

Which two actions should the developer take to resolve this issue and ensure the application correctly and securely utilizes IAM roles for authentication? (Select TWO.)

Select all that apply

Remove the shared credentials file from the container image.

Ensure the ECS task is configured with a Task Role that has the required DynamoDB permissions, allowing the ECS agent to inject the container credentials environment variable.

Hardcode the AWS access key and secret access key in the SDK client constructor.

Modify the EC2 instance profile's trust policy to allow the ECS task execution role to assume it.

Save the AWS credentials in AWS Systems Manager Parameter Store and retrieve them using the SDK at startup.

Show answer & explanation

Answer: Remove the shared credentials file from the container image.; Ensure the ECS task is configured with a Task Role that has the required DynamoDB permissions, allowing the ECS agent to inject the container credentials environment variable.

Answer

Remove the shared credentials file from the container image, and ensure the ECS task is configured with a Task Role that has the required DynamoDB permissions, allowing the ECS agent to inject the container credentials environment variable.

The AWS SDK credential provider chain prioritizes shared credentials files over ECS container credentials. Removing the local shared credentials file allows the chain to fall back to the container credentials provider. Ensuring that the task has an ECS Task Role configured allows the ECS agent to set the necessary container credentials environment variable, enabling the SDK to obtain temporary IAM credentials.

Step-by-Step Solution

Analyze the AWS SDK credential provider chain order of precedence.

The SDK looks for credentials first in environment variables, then in the shared credentials file (e.g., ~/.aws/credentials), then in ECS task credentials (via environment variables injected by the ECS agent), and finally in the EC2 instance profile.

Understanding the lookup order helps identify why the expired credentials in the container image are overriding the ECS Task Role.

Remove the overriding credential source.

By removing the ~/.aws/credentials file from the container image, the SDK will no longer find local credentials and will fall back to subsequent options in the chain.

This allows the credential provider chain to continue evaluating down to the container credentials.

Verify and apply the ECS Task Role configuration.

Assigning a Task Role to the ECS task definition causes the ECS agent to automatically inject the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable, which the SDK uses to fetch temporary credentials.

This provides the application with secure, temporary, and automatic credential rotation.

Key Concept

AWS SDK Credential Provider Chain Precedence

Estimated Time:2m 0s

Question 208Question →

A retail company has developed a mobile application where users authenticate using Amazon Cognito User Pools. The backend services are exposed through an Amazon API Gateway REST API. The company needs to restrict API access so that only authenticated users with a valid JSON Web Token (JWT) can invoke the API methods. The developer wants to implement this validation with the lowest development effort and without writing any custom authorization code. Which configuration should the developer choose to secure the API?

Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.

Create a custom Lambda authorizer that decodes, verifies, and validates the Cognito JSON Web Token (JWT) on every request.

Set up an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS credentials and secure the API using IAM authorization.

Enable a Lambda proxy integration and perform token decoding and validation manually inside the backend Lambda function.

Show answer & explanation

Answer: Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.

Answer

Configure a built-in API Gateway Cognito authorizer that directly validates the incoming user pool tokens.

Configuring a built-in API Gateway Cognito authorizer is the most operationally efficient solution. It natively integrates API Gateway with Amazon Cognito User Pools, allowing API Gateway to automatically validate the incoming JWT signature, expiration, and client ID. This requires zero custom code and incurs no additional Lambda execution costs for authorization.

Step-by-Step Solution

Analyze the requirement to secure an Amazon API Gateway REST API using tokens from Amazon Cognito User Pools.

Identify that the solution must validate Cognito JSON Web Tokens (JWTs).

Cognito User Pools issue JWTs upon successful user authentication.

Determine the approach that requires the lowest development effort and zero custom authorization code.

Select the built-in API Gateway Cognito authorizer.

The Cognito authorizer is a native, code-free integration within API Gateway that automatically validates JWT signature, expiration, and audience.

Key Concept

API Gateway Cognito User Pool Authorizer

Question 209Question →

A developer is configuring an AWS Lambda function inside a private subnet of a VPC. The Lambda function needs to read messages from an Amazon SQS queue and write records to an Amazon ElastiCache for Redis cluster located in another private subnet within the same VPC. The Lambda function is successfully writing to ElastiCache but is unable to connect to the Amazon SQS service. Which configuration change should the developer make to resolve this connectivity issue in the most secure manner?

Modify the IAM trust policy of the Lambda function's execution role to include the Amazon SQS service principal (sqs.amazonaws.com) as a trusted entity.

Move the Lambda function to a public subnet within the VPC to allow it to communicate directly with the public Amazon SQS endpoints.

Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Store the SQS queue URL in AWS Secrets Manager, and configure the Lambda function to retrieve it using the Secrets Manager API to bypass the network route.

Show answer & explanation

Answer: Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Answer

Create an interface VPC endpoint for Amazon SQS in the VPC, and update the security groups to allow traffic between the Lambda function and the endpoint.

Creating an interface VPC endpoint (powered by AWS PrivateLink) for Amazon SQS allows resources in private subnets to communicate privately with the service without traversing the public internet or needing a NAT Gateway. Since the Lambda function is in a private subnet, it can route SQS traffic through this private endpoint.

Step-by-Step Solution

Identify the destination endpoint requirements.

Amazon SQS is a public AWS service, which means a resource inside a private subnet without internet access cannot reach it directly.

The Lambda function needs a path to reach the public SQS API, which can be accomplished either via public internet routing (NAT Gateway) or a private path (VPC endpoint).

Select the most secure connectivity method that does not expose the traffic to the public internet.

An Interface VPC Endpoint for SQS (com.amazonaws.region.sqs) provides private, secure connectivity.

VPC endpoints use AWS PrivateLink to keep traffic within the AWS network, satisfying the security requirement.

Update security groups and routing to allow traffic.

Ensure the Lambda function's security group allows outbound traffic to the VPC endpoint, and the endpoint's security group allows inbound HTTPS traffic from the Lambda function.

Security groups are stateful and must explicitly allow the connection from the client to the endpoint.

Key Concept

Establishing private connectivity to public AWS services from within a VPC using Interface VPC Endpoints (AWS PrivateLink).

Estimated Time:1m 30s

Question 210Question →

A developer is designing a REST API using Amazon API Gateway. The API must support two distinct clients: a mobile application where users authenticate and receive JSON Web Tokens (JWTs) from Amazon Cognito, and a legacy third-party application that sends custom tokens that must be validated against an external database.

Which two authorization mechanisms should the developer configure on API Gateway to secure these client requests? (Select TWO.)

Select all that apply

Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application.

Configure a custom Lambda authorizer to parse and validate the legacy client application tokens.

Configure a Cognito Identity Pools authorizer to validate the JWTs sent by the mobile application.

Configure a custom Lambda authorizer to decode and validate the Cognito User Pool ID tokens.

Configure a Lambda proxy integration to validate the custom legacy client tokens within the backend integration.

Show answer & explanation

Answer: Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application.; Configure a custom Lambda authorizer to parse and validate the legacy client application tokens.

Answer

Configure a Cognito User Pools authorizer to validate the JWTs sent by the mobile application, and configure a custom Lambda authorizer to parse and validate the legacy client application tokens.

To secure the API requests, a native Cognito User Pools authorizer should be used for the mobile application since API Gateway natively decodes and validates Cognito JWTs. For the legacy client application, a custom Lambda authorizer is required to extract the token and perform custom validation logic against the external database.

Step-by-Step Solution

Determine the auth mechanism for the Cognito-authenticated mobile app.

Identify that the Cognito User Pools authorizer is a native, built-in feature of API Gateway designed to validate Cognito user pool tokens without extra code.

Reduces implementation overhead, avoids Lambda execution costs for auth, and complies with best practices.

Determine the auth mechanism for the legacy partner client using custom tokens.

Identify that a custom Lambda authorizer (token-based or request-based) is necessary to run the custom validation logic against the external database.

API Gateway does not natively support external database lookups for auth, making a Lambda authorizer the proper extension point.

Key Concept

Selecting native Cognito User Pools authorizers for Cognito JWTs and custom Lambda authorizers for custom token structures and external database lookups.

Question 211Question →

A developer is implementing a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline is located in Account A and uses an Amazon S3 bucket in Account A to store artifacts. The deployment stage is configured to deploy resources into Account B using an AWS CloudFormation action. During pipeline execution, the CloudFormation action in Account B fails with an Access Denied error when trying to retrieve the input artifact zip file from the S3 bucket in Account A. The IAM role used for the CloudFormation deployment in Account B has been granted read permission to the S3 bucket in Account A, and the S3 bucket policy in Account A permits access from Account B's deployment role.

Which configuration change is required to resolve this deployment failure?

Update the IAM trust policy of the CodePipeline service role in Account A to allow the deployment IAM role in Account B to assume it, and configure AWS Systems Manager Parameter Store in Account B to cache the S3 credentials.

Configure the S3 bucket in Account A to use a customer managed AWS KMS key instead of the default S3 managed key, grant the deployment IAM role in Account B permission to use the KMS key, and update the KMS key policy in Account A to trust Account B's deployment role.

Store the S3 bucket access credentials as a secret in AWS Secrets Manager in Account A, and configure the deployment IAM role in Account B to retrieve the secret by making a call to AWS Systems Manager Parameter Store.

Configure the deployment IAM role in Account B to trust the CodePipeline service role in Account A by updating its trust policy, and configure the CodePipeline service role in Account A to assume the deployment IAM role in Account B without a KMS key.

Show answer & explanation

Answer: Configure the S3 bucket in Account A to use a customer managed AWS KMS key instead of the default S3 managed key, grant the deployment IAM role in Account B permission to use the KMS key, and update the KMS key policy in Account A to trust Account B's deployment role.

Answer

For cross-account deployments in AWS CodePipeline, artifacts stored in the Amazon S3 bucket must be encrypted using a customer managed AWS KMS key. The default S3 managed key (aws/s3) cannot be shared cross-account because its key policy cannot be modified to grant access to external IAM roles. By configuring a customer managed KMS key, the developer can explicitly grant the deployment IAM role in the destination account permission to decrypt the artifacts.

Step-by-Step Solution

Determine why the access is denied despite correct IAM and bucket policies.

The default S3 encryption key (aws/s3) is managed by AWS and its policy cannot be modified to grant cross-account permissions.

Identify the root cause of cross-account decryption failures in CodePipeline.

Create a customer managed AWS KMS key in Account A to encrypt the S3 artifact bucket.

The S3 bucket's default encryption is updated to use the new customer managed key.

Allows custom key policies to be configured for cross-account access.

Update the KMS key policy in Account A and the IAM deployment role in Account B.

The deployment role in Account B can now decrypt the artifacts when CloudFormation runs in Account B.

Establishes secure, cross-account access to the build artifacts.

Key Concept

AWS CodePipeline Cross-Account Deployments and Artifact Encryption

Estimated Time:2m 30s

Question 212Question →

A developer needs to audit a production environment deployed via AWS CloudFormation because some resources may have been modified manually outside of the stack template. The developer wants to identify these out-of-band changes.

Which of the following actions should the developer perform to detect these modifications? (Select TWO.)

Select all that apply

Run drift detection on the entire CloudFormation stack from the AWS CloudFormation console or the AWS CLI.

Review the drift status details of the stack and individual resources to compare the actual and expected configurations.

Configure AWS Config to automatically update the CloudFormation stack template whenever an out-of-band change is made.

Review the AWS CloudTrail logs for a DeleteStack event to find the exact manual modifications and automatically restore them.

Execute the aws cloudformation rollback-stack CLI command to automatically sync the manual changes back to the template.

Show answer & explanation

Answer: Run drift detection on the entire CloudFormation stack from the AWS CloudFormation console or the AWS CLI.; Review the drift status details of the stack and individual resources to compare the actual and expected configurations.

Answer

Running drift detection on the CloudFormation stack and reviewing the drift status details to compare actual and expected configurations are the correct methods to identify manual changes.

To identify manual modifications made outside of CloudFormation, a developer can run drift detection on the stack. Reviewing the drift status details shows exactly which resources have drifted and how their actual configuration properties differ from the expected template configuration.

Step-by-Step Solution

Initiate a drift detection operation on the target stack.

CloudFormation scans the resources in the stack and compares them to the template definition.

This establishes the current state baseline and flags any discrepancies.

Review the drift status results in the console or CLI output.

The developer identifies modified properties, values, and status for drifted resources.

This provides granular details of the changes that were made manually outside of CloudFormation.

Key Concept

AWS CloudFormation Drift Detection

Question 213Question →

A developer is building a mobile application that allows employees to sign in using either their corporate SAML Identity Provider (IdP) or a local email-based account. Once authenticated, the application must download customized settings files directly from a private Amazon S3 bucket.

Which combination of Cognito resources and configurations is required to support this architecture? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool to manage user directories, local email authentication, and integration with the corporate SAML Identity Provider.

Configure an Amazon Cognito Identity Pool, register the User Pool as an authentication provider, and associate it with an IAM role that allows read access to the S3 bucket.

Configure an Amazon Cognito Identity Pool to maintain the user directory, handle password verification, and store custom user attributes.

Configure an Amazon API Gateway Lambda Authorizer to validate the user credentials and exchange Cognito tokens for AWS credentials to allow direct S3 API calls.

Modify the trust policy of the S3-access IAM role to set the Principal to the Cognito User Pool's regional endpoint domain so that authenticated users can assume the role directly.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to manage user directories, local email authentication, and integration with the corporate SAML Identity Provider.; Configure an Amazon Cognito Identity Pool, register the User Pool as an authentication provider, and associate it with an IAM role that allows read access to the S3 bucket.

Answer

Configure an Amazon Cognito User Pool to manage user directories, local email authentication, and integration with the corporate SAML Identity Provider; and configure an Amazon Cognito Identity Pool, register the User Pool as an authentication provider, and associate it with an IAM role that allows read access to the S3 bucket.

The correct solution involves configuring an Amazon Cognito User Pool to handle authentication, user profile storage, and integration with the SAML Identity Provider, while using an Amazon Cognito Identity Pool to swap the resulting tokens for temporary, fine-grained AWS credentials that grant access to S3. This separation of duties utilizes User Pools for identity directory and Identity Pools for AWS resource authorization.

Step-by-Step Solution

Select the component for user directory management and federation.

Identify that an Amazon Cognito User Pool is designed for authentication, user directory management, and integrating with external identity providers (like SAML or OIDC).

This meets the requirement of allowing employees to sign in using corporate SAML or email-based local accounts.

Select the component for AWS resource access and credential generation.

Identify that an Amazon Cognito Identity Pool is required to translate the authenticated identity (from the User Pool) into temporary AWS credentials.

This allows the application to directly and securely download files from the private Amazon S3 bucket using standard AWS SDK calls.

Verify the configuration and trust relationship.

Ensure the Identity Pool is registered with the User Pool, and the associated IAM role trusts the Identity Pool service principal to avoid trust policy misconfiguration.

The IAM role must trust 'cognito-identity.amazonaws.com' via web identity federation to permit clients to assume it and retrieve credentials.

Key Concept

Separating authentication (User Pools) from authorization for AWS resources (Identity Pools) in Amazon Cognito.

Estimated Time:1m 30s

Question 214Question →

A developer is configuring an AWS Lambda function to retrieve messages from an Amazon SQS queue. To follow the security principle of least privilege, the developer decides to create a custom IAM role for the Lambda function. Which of the following configurations are required to establish this access? (Select TWO.)

Select all that apply

An IAM permissions policy attached to the IAM role that allows the `sqs:ReceiveMessage` and `sqs:DeleteMessage` actions on the specific SQS queue ARN.

An IAM trust policy on the IAM role that allows the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Hardcoded AWS access keys and secret access keys stored in the Lambda function's environment variables to authenticate SDK client requests.

An IAM trust policy attached directly to the Lambda function resource that allows the SQS service principal to perform the `sts:AssumeRole` action.

A trust policy attached directly to the SQS queue that allows the queue to assume the Lambda function's execution role.

Show answer & explanation

Answer: An IAM permissions policy attached to the IAM role that allows the `sqs:ReceiveMessage` and `sqs:DeleteMessage` actions on the specific SQS queue ARN.; An IAM trust policy on the IAM role that allows the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Answer

The configurations required are: an IAM permissions policy attached to the IAM role that allows SQS actions on the queue ARN, and an IAM trust policy on the IAM role that allows the Lambda service principal to assume the role.

The correct options specify the two key components of an IAM execution role. First, the trust policy (trust relationship) is configured on the IAM role to allow the AWS Lambda service principal (lambda.amazonaws.com) to assume the role. Second, a permissions policy is attached to the IAM role to grant the permissions necessary for the function's code to run, which in this case includes actions such as reading and deleting messages from the specific SQS queue resource.

Step-by-Step Solution

Configure the trust relationship on the IAM role.

The trust policy allows the AWS Lambda service principal (lambda.amazonaws.com) to assume the role using the sts:AssumeRole action.

This enables the Lambda service to obtain temporary security credentials when executing the function.

Configure the permissions policy on the IAM role.

The identity-based permissions policy grants the role specific access to the SQS queue resource using actions like sqs:ReceiveMessage.

This enforces the principle of least privilege, ensuring the Lambda function can only perform authorized operations on designated resources.

Key Concept

IAM Roles, Permissions Policies, and Trust Policies

Estimated Time:1m 30s

Question 215Question →

A developer is configuring an AWS CodeBuild project for a repository that contains multiple build configurations. The developer needs the project to use a custom build specification file named `buildspec-dev.yml` located inside a nested folder named `config`. How should the developer configure CodeBuild to locate this file?

Move the file to a subdirectory named `build/` because CodeBuild automatically searches for any file ending in `.yml` within subdirectories.

Specify the relative path to the file, `config/buildspec-dev.yml`, in the buildspec override setting of the CodeBuild project configuration.

Define the custom path inside the trust policy of the IAM service role assigned to the CodeBuild project.

Store the entire content of `buildspec-dev.yml` as a secure string parameter in AWS Systems Manager Parameter Store and configure CodeBuild to retrieve it.

Show answer & explanation

Answer: Specify the relative path to the file, `config/buildspec-dev.yml`, in the buildspec override setting of the CodeBuild project configuration.

Answer

Specify the relative path to the file, `config/buildspec-dev.yml`, in the buildspec override setting of the CodeBuild project configuration.

To use a buildspec file that has a custom name or is not located in the root of the source directory, the developer must specify the relative path to the file in the buildspec override setting of the CodeBuild project configuration. This instructs CodeBuild where to look for the file within the source code repository.

Step-by-Step Solution

Identify the default behavior of AWS CodeBuild regarding the buildspec file.

By default, AWS CodeBuild looks for a file named `buildspec.yml` in the root directory of the source provider.

This is the default convention for running builds without extra configuration.

Determine how to modify the buildspec file name or location.

AWS CodeBuild provides a 'buildspec override' configuration option at the project level.

This configuration allows developers to specify a custom buildspec file name or path relative to the root of the source directory.

Apply the custom path to the CodeBuild project settings.

Enter the relative path `config/buildspec-dev.yml` in the project's buildspec settings.

This tells CodeBuild exactly where to locate the configuration file for the build execution.

Key Concept

AWS CodeBuild supports overriding the default buildspec file name and location by configuring the buildspec path relative to the repository root.

Estimated Time:1m 0s

Question 216Question →

A developer is designing a serverless document management system where users upload sensitive documents of approximately $500\text{ KB}$ each. The application must perform client-side envelope encryption on these documents before uploading them to an Amazon S3 bucket. The developer wants to use an AWS KMS customer managed key for this process.

Which of the following actions must the developer perform to encrypt the documents and prepare them for storage? (Select TWO.)

Select all that apply

Call the KMS `GenerateDataKey` API with the customer managed key to retrieve a plaintext data key and a ciphertext data key.

Encrypt the document locally using the plaintext data key, upload the encrypted document and the ciphertext data key to Amazon S3, and delete the plaintext data key from memory.

Call the KMS `Encrypt` API directly to encrypt the document payload, as customer managed keys support direct payload encryption up to

5\text{ MB}

Call the KMS `GenerateDataKeyWithoutPlaintext` API to retrieve the ciphertext data key, and use it to encrypt the document locally before uploading it to Amazon S3.

Store the encrypted document in Amazon S3, and save the plaintext data key in AWS Systems Manager Parameter Store with secure string parameters for future decryption.

Show answer & explanation

Answer: Call the KMS `GenerateDataKey` API with the customer managed key to retrieve a plaintext data key and a ciphertext data key.; Encrypt the document locally using the plaintext data key, upload the encrypted document and the ciphertext data key to Amazon S3, and delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain both the plaintext and ciphertext data keys. The document is encrypted locally using the plaintext data key, and both the encrypted document and ciphertext data key are stored in S3, while the plaintext data key is discarded from memory.

To implement client-side envelope encryption, the developer needs to generate a unique data key using the customer managed key. The KMS GenerateDataKey API returns both the plaintext data key (for immediate encryption) and the ciphertext data key (for storage). The document is encrypted locally using the plaintext key. After encryption, the encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is discarded from memory to prevent unauthorized access.

Step-by-Step Solution

Generate a data key from AWS KMS.

A plaintext data key and a ciphertext data key are obtained using the GenerateDataKey API and the customer managed key.

The plaintext data key is needed for local encryption, and the ciphertext data key is needed to decrypt the document later.

Perform local client-side encryption.

The document payload is encrypted using the plaintext data key.

Local encryption keeps the plaintext data secure before it is transmitted to S3.

Store the encrypted artifacts and clean up memory.

The encrypted document and ciphertext data key are uploaded to S3, and the plaintext data key is removed from memory.

Storing the ciphertext data key alongside the document ensures it can be decrypted later by calling KMS Decrypt, while discarding the plaintext key minimizes exposure risk.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 217Question →

A developer is configuring an Amazon ECS task definition to deploy a microservice on AWS Fargate. The microservice retrieves database credentials from AWS Secrets Manager by referencing the secret's ARN in the container definition's `secrets` parameter. Additionally, the application code inside the container reads messages from an Amazon SQS queue. The container uses the `awslogs` log driver to send standard output logs to Amazon CloudWatch Logs. Which configuration of IAM roles correctly implements the principle of least privilege for this deployment?

Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs. Configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.

Configure the Task Role with permissions to retrieve the database credentials from AWS Secrets Manager and read from the Amazon SQS queue. Configure the Task Execution Role with permissions to write to Amazon CloudWatch Logs. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.

Configure the Task Execution Role with permissions to write to Amazon CloudWatch Logs. Use Systems Manager Parameter Store with standard unencrypted parameters to store the database credentials, referencing them in the task definition environment variables, and grant the Task Role permission to read them. Configure the Task Role with permissions to read from the Amazon SQS queue.

Show answer & explanation

Answer: Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs. Configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.

Answer

Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs, configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue, and ensure both roles trust the ecs-tasks.amazonaws.com service principal.

The Task Execution Role grants the ECS agent permissions to pull container images, write logs to CloudWatch using the awslogs log driver, and retrieve secrets from AWS Secrets Manager. The Task Role grants permissions directly to the application running inside the container, allowing it to communicate with Amazon SQS. Both roles must have a trust relationship allowing the ecs-tasks.amazonaws.com service principal to assume them.

Step-by-Step Solution

Identify the actions performed by the Amazon ECS container agent during container initialization.

The agent pulls the container image, retrieves the database secret from AWS Secrets Manager to inject as an environment variable, and configures the awslogs log driver to stream stdout/stderr logs to CloudWatch Logs.

Actions performed by the ECS agent before the application runs must be authorized via the Task Execution Role.

Identify the actions performed by the application code running inside the container.

The application code makes calls using the AWS SDK to receive and delete messages from the Amazon SQS queue.

Actions performed by the application code itself must be authorized via the Task Role.

Determine the correct trust policy for the IAM roles to allow ECS to assume them.

The trust policy must allow the ecs-tasks.amazonaws.com service principal to assume the roles.

The ecs-tasks.amazonaws.com service principal is required for task-level execution and task role assumption, whereas ecs.amazonaws.com is used for the ECS service level operations.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, including proper IAM trust policies.

Estimated Time:2m 30s

Question 218Question →

A developer needs to encrypt database backup files, each approximately $45\text{ MB}$ in size, before uploading them to an Amazon S3 bucket. The security policy requires client-side encryption using a customer managed key in AWS KMS. Which of the following actions must the developer perform to implement client-side envelope encryption for these files? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation, passing the KMS key identifier, to obtain a plaintext data key and an encrypted data key.

Encrypt the file locally using the plaintext data key, upload the encrypted file and the encrypted data key to Amazon S3, and then delete the plaintext data key from memory.

Call the Encrypt API operation directly, passing the KMS key identifier and the entire

45\text{ MB}

file payload.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain the data key for local encryption of the backup files.

Configure AWS Systems Manager Parameter Store to automatically rotate the database credentials and generate a database backup key.

Show answer & explanation

Answer: Call the GenerateDataKey API operation, passing the KMS key identifier, to obtain a plaintext data key and an encrypted data key.; Encrypt the file locally using the plaintext data key, upload the encrypted file and the encrypted data key to Amazon S3, and then delete the plaintext data key from memory.

Answer

Call the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext key, and then delete the plaintext key from memory.

The correct options outline the standard KMS envelope encryption workflow. A developer calls the GenerateDataKey API operation to get both the plaintext key and the encrypted key. The plaintext key is used to encrypt the large payload locally, and then it is immediately deleted from memory. The encrypted data key is stored with the encrypted data for future decryption.

Step-by-Step Solution

Generate a unique data key using AWS KMS.

Obtained a plaintext data key and an encrypted version of the data key.

The developer must call GenerateDataKey. KMS returns both the plaintext key to encrypt the large data locally and the encrypted key to store alongside the data.

Encrypt the file locally and clean up the memory.

The file is securely encrypted using a symmetric algorithm, and the plaintext data key is removed from memory.

To prevent unauthorized access, the plaintext key is deleted immediately after the encryption is complete, leaving only the encrypted data and the encrypted key.

Key Concept

Envelope encryption involves generating a unique data key to encrypt large data payloads locally, then storing the encrypted data key alongside the encrypted data while discarding the plaintext key from memory.

Question 219Question →

A developer is deploying a containerized microservice to Amazon ECS using the Amazon EC2 launch type. The microservice application code needs to write records to an Amazon DynamoDB table and publish notifications to an Amazon SNS topic. The container also needs to send its standard output and error logs to Amazon CloudWatch Logs. How should the developer configure the IAM roles in the task definition to achieve this configuration securely?

Assign an IAM role with DynamoDB and SNS write permissions as the Task Execution Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Role.

Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Embed temporary AWS access credentials directly in the application code's initialization logic, and omit both the Task Role and Task Execution Role configurations.

Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and configure its IAM trust policy to trust the EC2 instance service principal (ec2.amazonaws.com) instead of the ECS tasks service principal (ecs-tasks.amazonaws.com).

Show answer & explanation

Answer: Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Answer

Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

The ECS Task Role is assumed by the containers themselves to grant permissions to the application code (e.g., writing to DynamoDB and publishing to SNS). The ECS Task Execution Role is assumed by the ECS agent to perform actions on behalf of the container instance, such as pulling the container image from ECR and sending container logs to CloudWatch Logs. Configuring these roles separately adheres to the principle of least privilege.

Step-by-Step Solution

Identify the credentials required by the application code running inside the container.

The application code calls DynamoDB and SNS APIs, which requires permissions to be granted via the ECS Task Role.

The Task Role provides temporary credentials specifically to the processes running inside the container.

Identify the credentials required by the ECS agent to manage the container lifecycle.

The ECS agent needs to push container logs to CloudWatch Logs, which requires permissions to be granted via the ECS Task Execution Role.

The Task Execution Role provides permissions for the ECS container agent to perform system-level tasks like pulling images and publishing logs.

Verify the trust relationships for both roles.

Both roles must trust the ECS tasks service principal (ecs-tasks.amazonaws.com) to allow ECS to assume them.

Without the correct trust policy, AWS services cannot assume the roles on behalf of the ECS task.

Key Concept

Delineation between Amazon ECS Task Role and Task Execution Role

Question 220Question →

A developer is writing an AWS Lambda function that retrieves database configurations from an external database on every invocation. The database queries are slow, causing high latency and occasionally leading to function timeouts. Which approach should the developer use to optimize the function's performance by caching the configurations across invocations?

Initialize the database connection and retrieve the configurations outside the Lambda handler function, storing them in global or static variables to reuse them across subsequent warm start invocations.

Declare the database connection and configuration variables inside the Lambda handler function, and increase the Lambda function timeout to 15 minutes to allow enough time for queries.

Store the database configurations in AWS Systems Manager Parameter Store, and configure Parameter Store to automatically rotate the database credentials every 30 days.

Store the configurations in an Amazon SQS queue, and set the queue's visibility timeout to be shorter than the Lambda function's timeout so that the configuration message is immediately recycled.

Show answer & explanation

Answer: Initialize the database connection and retrieve the configurations outside the Lambda handler function, storing them in global or static variables to reuse them across subsequent warm start invocations.

Answer

Declaring database connections and configuration variables in the global scope (outside the Lambda handler function) utilizes execution context reuse. During warm starts, Lambda reuses the existing container environment, allowing the application to bypass redundant initialization and query overhead by reading from the globally persisted variables.

Step-by-Step Solution

Analyze how AWS Lambda handles execution context reuse.

AWS Lambda preserves the execution context, including global variables and initialized SDK clients, for subsequent invocations on the same container (warm starts).

To identify where variables must be declared to persist across executions.

Determine where to place the configuration retrieval code.

Placing the connection initialization and retrieval code outside the handler method (in the global scope) ensures it runs only during cold starts.

This implements local caching of the configurations, preventing redundant database queries on warm invocations.

Key Concept

AWS Lambda Execution Context Reuse

PreviousPage 11 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept