Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 501Question →

A developer is building a containerized microservice deployed on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The microservice requires access to:

1. A sensitive API key for a third-party SaaS service that requires scheduled rotation every 3030 days.
2. A non-sensitive log level configuration setting (e.g., INFO, DEBUG) that varies between development and production environments.

Which combination of actions should the developer take to configure these parameters securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic.; Store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic, and store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.
For the sensitive third-party API key, storing it in AWS Secrets Manager allows the developer to configure an AWS Lambda function to handle the required custom 3030-day rotation logic. For the non-sensitive log level configuration, AWS Systems Manager Parameter Store is a cost-effective and simple solution that avoids unnecessary Secrets Manager costs.

Step-by-Step Solution

1
Analyze secret rotation requirements
Identify that the third-party API key requires automated rotation every 3030 days, which is a native feature of AWS Secrets Manager using a custom AWS Lambda function.
Parameter Store does not offer built-in secret rotation schedules, making Secrets Manager the appropriate choice for the API key.
2
Analyze non-sensitive configuration requirements
Identify that the log level setting is non-sensitive and varies per environment, which maps perfectly to AWS Systems Manager Parameter Store String parameters.
Using Parameter Store for non-sensitive data is cost-effective (no cost for standard parameters) compared to AWS Secrets Manager.

Key Concept

Selecting between AWS Secrets Manager and AWS Systems Manager Parameter Store based on sensitivity and rotation requirements.
Question 502Question →

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. During task startup, the container fails to launch. The ECS service events reveal that the task is unauthorized to pull the application image from Amazon Elastic Container Registry (ECR). In addition, the container is configured to retrieve a database secret from AWS Secrets Manager at startup, which is also failing. The developer verifies that the IAM policy attached to the ECS Task Role (task_role_arn) has the necessary ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and secretsmanager:GetSecretValue permissions.

What action should the developer take to resolve these authorization failures?

Show answer & explanation

Answer: Attach the required permissions to the ECS Task Execution Role instead of the ECS Task Role.

Answer

Attach the required permissions to the ECS Task Execution Role instead of the ECS Task Role.
The Amazon ECS container agent makes the API calls to pull the container image from Amazon ECR and to retrieve secrets from AWS Secrets Manager during the task bootstrap phase. These operations occur before the application container is running. Therefore, the permissions must be attached to the ECS Task Execution Role, not the ECS Task Role (which is used by the application code once running).

Step-by-Step Solution

1
Identify the entity performing the unauthorized actions during the task bootstrap phase.
Determine that the Amazon ECS container agent (not the application code) pulls the image from Amazon ECR and retrieves secrets from AWS Secrets Manager.
Understanding which entity performs these tasks is essential to choosing the correct IAM role.
2
Distinguish between the ECS Task Role and the ECS Task Execution Role.
The ECS Task Role is assumed by the containers after they start to make AWS API calls from application code. The ECS Task Execution Role is used by the ECS container agent to perform actions on behalf of the task before the container runs.
Matching the bootstrap permissions to the correct role prevents authorization errors during initialization.
3
Move the permissions to the correct role.
Attach the Amazon ECR and Secrets Manager permissions to the ECS Task Execution Role.
This grants the ECS container agent the authority to pull the container image and read the secret required to start the task.

Key Concept

ECS Task Role vs. ECS Task Execution Role permissions
Question 503Question →

A developer uses the AWS Serverless Application Model (SAM) to deploy a serverless application. The template defines an AWS::Serverless::Function resource with an Api event source, as shown in the following snippet:

yaml
Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
CreateOrder:
Type: Api
Properties:
Path: /orders
Method: post

The application deploys successfully. However, when clients send a POST request to /orders, the API Gateway returns a 502 Bad Gateway status code, and the Lambda function execution logs show that the function ran and completed successfully without errors.

Which of the following describes the cause of this issue and the correct resolution?

Show answer & explanation

Answer: The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.

Answer

The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.
The default integration type configured by AWS SAM when using the Api event source is the Lambda proxy integration. Under this model, API Gateway passes the raw request directly to the Lambda function, and expects the Lambda function to return a response matching a specific JSON format (specifically containing 'statusCode' and 'body' fields). If the function returns a raw string or an unsupported format, API Gateway cannot map the response, resulting in a 502 Bad Gateway error. Modifying the Lambda function to return the correct JSON structure resolves the issue.

Step-by-Step Solution

1
Analyze the error symptoms and deployment state.
The application deployed successfully, but requests result in a 502 Bad Gateway error, and Lambda logs show successful execution with no runtime exceptions.
This rules out deployment-time issues like missing transforms, and rules out internal Lambda execution errors or timeouts.
2
Identify the integration type defined by the AWS SAM Api event source.
By default, defining an Api event source under AWS::Serverless::Function sets up an Amazon API Gateway REST API with Lambda Proxy Integration.
Understanding the defaults of AWS SAM configurations helps pinpoint the expectations of the API Gateway integration.
3
Verify response formatting requirements for Lambda Proxy Integration.
API Gateway Proxy Integration expects the Lambda function output to be a JSON object with at least a 'statusCode' and a 'body' property.
Returning a plain string instead of the structured JSON payload causes API Gateway to fail parsing, leading to a 502 Bad Gateway response.

Key Concept

AWS SAM defaults to configuring API Gateway Lambda Proxy Integrations for Api events, which requires backend Lambda functions to return a specific JSON response format containing 'statusCode' and 'body'.
Question 504Question →

A developer is monitoring a payment processing application deployed on Amazon EC2. The Unified CloudWatch Agent is configured to stream application logs to a CloudWatch Logs log group named `/aws/ec2/PaymentService`. The application outputs logs in the following JSON format:

{
"timestamp": "2026-07-14T12:00:00Z",
"status": "FAILED",
"executionTimeMs": 4500,
"errorDetails": {
"category": "GatewayTimeout",
"attempt": 3
}
}

The developer needs to create a CloudWatch Alarm that triggers when there are more than 5 occurrences of failed executions due to a `GatewayTimeout` where the number of attempts is greater than 2 within a 5-minute window.

Which of the following actions should the developer take to implement this monitoring solution? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a CloudWatch Logs metric filter on the `/aws/ec2/PaymentService` log group with the filter pattern `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }`.; Create a CloudWatch Alarm that monitors the custom metric generated by the metric filter, configuring it to trigger when the metric value is greater than 5 within an evaluation period of 5 minutes.

Answer

The developer should create a CloudWatch Logs metric filter using the JSON syntax `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }` and create a CloudWatch Alarm that monitors the metric and triggers when it is greater than 5 over a 5-minute evaluation period.
The correct options involve creating a metric filter with JSON syntax and establishing an alarm based on that filter's metric. The JSON syntax `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }` correctly parses the log structure to filter relevant log entries, and the alarm monitors the resulting metric over the 5-minute interval.

Step-by-Step Solution

1
Analyze the log structure to determine the appropriate CloudWatch Logs filter syntax.
The log format is JSON with nested fields under `errorDetails`.
Since the log is structured JSON, the developer must use CloudWatch Logs JSON filter syntax using curly braces `{}` rather than space-delimited square brackets `[]`.
2
Define the JSON filter pattern using standard property selectors.
The pattern is defined as `{ .status = "FAILED" && .errorDetails.category = "GatewayTimeout" && $.errorDetails.attempt > 2 }`.
This matches events where the top-level field `status` equals `FAILED`, the nested field `category` equals `GatewayTimeout`, and the nested field `attempt` is strictly greater than 2.
3
Configure a CloudWatch Alarm on the custom metric created by the metric filter.
A CloudWatch Alarm is configured to monitor the custom metric, evaluating if the metric exceeds the threshold of 5 within a 5-minute window.
Alarms are required to notify or take action when a metric crosses a specified threshold over a defined period of time.

Key Concept

CloudWatch Logs Metric Filters syntax and structure for JSON logs
Question 505Question →

A developer is deploying a serverless backend using AWS SAM. The configuration file `template.yaml` contains the following definition:

yaml
Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: app.handler
Runtime: python3.12
CodeUri: src/
Events:
GetData:
Type: HttpApi
Properties:
Path: /data
Method: GET

During the deployment process, the CloudFormation stack creation fails with the message `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the developer notes that the python handler code currently returns a plain text string `'Success'`, which will cause integration failure when invoked through the API Gateway endpoint.

Which two actions must the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Add `Transform: AWS::Serverless-2016-10-31` at the root of the template file.; Modify the python handler to return a dictionary with `statusCode` and `body` keys, where `body` is a JSON-formatted string.

Answer

The correct actions are to add the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template file, and to update the python handler to return a dictionary with `statusCode` and `body` keys.
Adding the Transform declaration allows the AWS CloudFormation service to parse the serverless resources. Returning a dictionary with the status code and JSON body conforms to the Lambda Proxy integration format required by the API Gateway HTTP API configuration.

Step-by-Step Solution

1
Diagnose the CloudFormation parsing failure.
The `Unrecognized resource type: AWS::Serverless::Function` error occurs because CloudFormation does not natively understand the `AWS::Serverless` namespace without the SAM translator. Adding `Transform: AWS::Serverless-2016-10-31` at the template root resolves this.
The Transform declaration instructs CloudFormation to invoke the SAM translator to convert the simplified SAM syntax into standard CloudFormation resources.
2
Diagnose the API Gateway integration failure.
By default, API Gateway event sources declared on SAM Functions use Lambda Proxy Integration, which expects the Lambda function to return a structured JSON response containing `statusCode` and a string `body`.
If the function returns a raw string, API Gateway cannot map it to an HTTP response, resulting in an integration error (HTTP 502).

Key Concept

AWS SAM templates must include the Transform declaration to allow CloudFormation to interpret serverless resources, and Lambda functions integrated with API Gateway HTTP APIs must adhere to the Lambda Proxy Integration response format.
Question 506Question →

An application deployed on Amazon ECS using AWS Fargate starts successfully, but the application code fails with an AccessDeniedException when attempting to read messages from an Amazon SQS queue. The developer verifies that the SQS queue policy does not explicitly deny access. The task definition currently includes an IAM role specified in the executionRoleArn parameter which has the AmazonSQSReadOnlyAccess policy attached. Which of the following actions should the developer take to resolve this authorization failure?

Show answer & explanation

Answer: Specify an IAM role with SQS permissions in the taskRoleArn parameter of the task definition.

Answer

Specify an IAM role with SQS permissions in the taskRoleArn parameter of the task definition.
The correct answer is to specify the SQS permission policy on the task role (taskRoleArn). The ECS Task Role is designed to grant AWS API permissions to the application code running inside the container. In contrast, the ECS Task Execution Role (executionRoleArn) is used by the ECS container agent for actions like pulling container images from Amazon ECR and sending logs to CloudWatch.

Step-by-Step Solution

1
Identify the distinction between the ECS Task Execution Role and the ECS Task Role.
The Task Execution Role is used by the ECS container agent (e.g., to pull ECR images, send logs to CloudWatch, retrieve secrets), whereas the Task Role is assumed by the application code running inside the container.
Resolving permission issues requires identifying which role credentials the failing API call is using.
2
Locate where application-level permissions are configured in the ECS task definition.
The parameter taskRoleArn holds the IAM role containing permission policies for AWS services like SQS, S3, or DynamoDB invoked by the application.
Configuring permissions on executionRoleArn will result in authorization failures for the containerized application.
3
Assign the correct IAM role with SQS permissions to the taskRoleArn parameter and deploy the task.
The containerized application successfully receives credentials with sqs:ReceiveMessage permissions from the task metadata endpoint.
This links the correct permissions to the running application process.

Key Concept

ECS Task Role vs Task Execution Role permission boundaries
Estimated Time:1m 30s
Question 507Question →

A developer is building a multi-tenant SaaS administration portal. The portal must allow enterprise users to authenticate via their corporate SAML Identity Provider (IdP). Once authenticated, the portal needs to make authorized REST API calls to Amazon API Gateway, where access is controlled based on the user's groups. Additionally, the portal must allow the client application to directly upload diagnostic log files to a tenant-specific folder in a private Amazon S3 bucket.

Which TWO actions should the developer take to implement authentication and authorization for this portal?

Select all that apply

Show answer & explanation

Answer: Create an Amazon Cognito User Pool integrated with the SAML IdP to manage user authentication, and configure an Amazon API Gateway Cognito authorizer to secure the REST API using the ID token.; Create an Amazon Cognito Identity Pool associated with the User Pool, and map the authenticated user identity to an IAM role that grants write permissions to the tenant-specific S3 folder.

Answer

To implement authentication and authorization, the developer must create a User Pool integrated with the SAML IdP and use an API Gateway Cognito authorizer, while also using an Identity Pool to obtain temporary credentials for S3 uploads.
The correct architecture uses a Cognito User Pool for federating with the SAML IdP and managing user login. The ID tokens issued by the User Pool are verified by the API Gateway Cognito authorizer to protect the API. The Identity Pool then exchanges the User Pool tokens for temporary, scoped IAM credentials, enabling the client application to directly upload logs to Amazon S3 securely.

Step-by-Step Solution

1
Configure the authentication layer by creating an Amazon Cognito User Pool.
Allows integration with the external corporate SAML Identity Provider (IdP) to authenticate users and generate standard OIDC tokens (ID and access tokens).
This establishes the identity directory and federates corporate authentication.
2
Secure the Amazon API Gateway REST API endpoints using the Cognito User Pool.
Configuring a Cognito authorizer on the REST API resources validates the ID token passed in the Authorization header.
This enforces API authorization based on Cognito groups and claims without custom Lambda code.
3
Set up the authorization layer for external AWS resources by creating an Amazon Cognito Identity Pool.
Links the Identity Pool to the User Pool as an authentication provider, mapping users to specific IAM roles.
This generates temporary AWS credentials required for direct S3 API interaction from the client web application.

Key Concept

Amazon Cognito User Pools vs Identity Pools integration with API Gateway and S3
Question 508Question →

An application logs processing metrics to Amazon CloudWatch Logs in JSON format. A developer needs to write an Amazon CloudWatch Logs Insights query to analyze application performance. The query must only include log events where the `durationMs` field is present. Additionally, the query must calculate both the average and the 95th percentile of `durationMs` grouped in 10-minute intervals. Which TWO CloudWatch Logs Insights query clauses must the developer include to meet these requirements?

Select all that apply

Show answer & explanation

Answer: filter ispresent(durationMs); stats avg(durationMs), pct(durationMs, 95) by bin(10m)

Answer

The correct query clauses are the filter clause with the ispresent function and the stats clause using the avg and pct functions grouped by the bin function.
The filter clause utilizing the ispresent function correctly filters for events where the specific field exists. The stats clause correctly calculates the average using avg and the percentile using pct, and groups them in 10-minute buckets using the bin function.

Step-by-Step Solution

1
Identify the clause needed to filter log events based on the existence of a field.
The query must use the filter command combined with the ispresent(field) function.
This excludes log events that do not contain the target field from the calculation.
2
Determine the correct aggregation functions for average and percentile calculations.
Use the avg() function for average and the pct() function for percentiles.
CloudWatch Logs Insights query syntax specifies avg and pct (or percentile) as the supported aggregation operations.
3
Determine the syntax to group logs into temporal buckets.
Use the by bin(10m) clause.
The bin function is required to group aggregate statistics into discrete time buckets like 10-minute intervals.

Key Concept

Writing syntactically correct CloudWatch Logs Insights queries to filter and aggregate log data.
Question 509Question →

A developer is deploying a microservice as an Amazon ECS task on AWS Fargate. The microservice needs to read configuration files from an Amazon S3 bucket. The developer creates an IAM role with the necessary S3 permissions and associates it with the ECS Task Definition as the `taskRoleArn`. However, when the container starts, the application logs show an error indicating that the task is unable to retrieve temporary credentials to access Amazon S3.

The trust policy currently configured on the IAM role is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the IAM role configuration will resolve this issue?

Show answer & explanation

Answer: Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.

Answer

Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.
The correct action is to change the principal service in the trust policy to `ecs-tasks.amazonaws.com`. In Amazon ECS, when running tasks on Fargate or EC2, the Amazon ECS container agent makes the call to assume the IAM role defined as `taskRoleArn` on behalf of the container. The service principal representing these ECS tasks is `ecs-tasks.amazonaws.com`. Using `ecs.amazonaws.com` is incorrect because it represents the core Amazon ECS service scheduler itself (used for registering container instances or updating service status), which does not have permission to assume the task role.

Step-by-Step Solution

1
Identify the entity attempting to assume the IAM role.
The application is running as an Amazon ECS task.
We must verify the correct service principal required by the runtime environment.
2
Check the service principal specified in the trust policy.
The current trust policy specifies `ecs.amazonaws.com`.
We need to ensure that the correct service is authorized to assume the role.
3
Modify the service principal to match the ECS task runtime service.
Update the trust policy's Principal Service to `ecs-tasks.amazonaws.com`.
This allows the ECS task container agent to retrieve temporary security credentials for S3 access.

Key Concept

IAM Role Trust Policy Service Principals
Question 510Question →

A logistics routing application named ShipVerify processes shipment status updates and writes them to an Amazon DynamoDB table. The table uses ShipmentID as the partition key. During peak delivery hours, the application experiences a surge in updates for a small subset of high-volume merchant shipments. This results in frequent ProvisionedThroughputExceededException errors, even though the overall write capacity units consumed by the table are well below the provisioned limits. Which of the following actions should the developer take to resolve this issue?

Show answer & explanation

Answer: Redesign the partition key schema by appending a random suffix to the partition key value for high-volume shipments to distribute writes across multiple partition keys.

Answer

Redesign the partition key schema by appending a random suffix to the partition key value for high-volume shipments to distribute writes across multiple partition keys.
The correct answer is correct because appending a random suffix to the partition key (write sharding) distributes writes across multiple partitions. This prevents a single partition key from absorbing all the write volume and exceeding the per-partition throughput limit of DynamoDB.

Step-by-Step Solution

1
Analyze the error metrics and access patterns on the DynamoDB table.
Identify that the ProvisionedThroughputExceededException is concentrated on a small set of partition keys (hot keys) due to high-volume merchant shipments.
To pinpoint if the throttling is a result of hot partition limits rather than total table capacity limits.
2
Determine the strategy for distributing writes to resolve the hot partition.
Decide on appending a random suffix to the ShipmentID key value for high-volume shipments.
To distribute the writes for the same logical shipment across multiple physical partitions, which stays within individual partition throughput limits.
3
Adjust the write logic in the application to write keys with a random suffix, and query accordingly.
Traffic is successfully balanced across multiple partitions, eliminating ProvisionedThroughputExceededException errors.
To apply the write sharding design pattern which scales write throughput horizontally across partitions.

Key Concept

Write sharding using random suffixes to distribute traffic on a hot partition key in DynamoDB.
Question 511Question →

A developer is configuring an AWS Lambda function to process events from an Amazon S3 bucket. The developer creates an IAM role named S3ProcessorRole with the necessary permissions policy to read from the S3 bucket. However, when attempting to associate the role with the Lambda function, the developer receives the following error:

An error occurred (InvalidParameterValueException) when updating the function's configuration: KMS or signature validation failed or the provided execution role cannot be assumed by Lambda.

The current trust policy configured on the S3ProcessorRole is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following steps are required to resolve this error and enable the Lambda function to successfully read from the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the trust policy of S3ProcessorRole to specify "Service": "lambda.amazonaws.com" instead of "Service": "ec2.amazonaws.com".; Attach an identity-based permissions policy to S3ProcessorRole that allows the s3:GetObject action on the target S3 bucket resource.

Answer

Update the trust policy of the IAM role to use the 'lambda.amazonaws.com' service principal and attach an identity-based permissions policy allowing 's3:GetObject' on the S3 bucket.
To resolve the error, the Lambda service must be allowed to assume the IAM role. This is done by specifying the Lambda service principal ('lambda.amazonaws.com') in the trust policy's Principal block. Additionally, to allow the Lambda function to read from the S3 bucket once the role is assumed, the role must have an identity-based permission policy that grants the 's3:GetObject' permission on the target S3 bucket.

Step-by-Step Solution

1
Analyze the error message showing the execution role cannot be assumed by Lambda.
Determine that the Lambda service principal is missing from the trust policy.
An execution role requires a trust relationship that allows the service (Lambda) to assume it.
2
Update the trust policy of the S3ProcessorRole.
Modify the service principal to 'lambda.amazonaws.com' with the action 'sts:AssumeRole'.
This enables the Lambda service to assume the execution role when invoking the function.
3
Define the permissions required by the Lambda function code.
Attach an identity-based policy allowing 's3:GetObject' on the target S3 bucket resource.
Once assumed, the role needs permissions to perform the actual S3 read operation.

Key Concept

IAM trust policies vs permissions policies for service execution roles
Question 512Question →

A developer is planning a deployment strategy for a high-traffic production application hosted on AWS Elastic Beanstalk. The application must maintain its full provisioned instance capacity during the deployment to avoid performance degradation. Additionally, if the new application version fails initial health checks, the environment must immediately roll back to the previous version without performing a secondary deployment process.

Which two Elastic Beanstalk deployment strategies will meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic splitting

Answer

The Immutable and Traffic splitting deployment strategies satisfy both the capacity and rollback requirements.
The Immutable and Traffic splitting deployment strategies both deploy the new application version to a separate, temporary Auto Scaling group while keeping the original instances fully operational. This satisfies the requirement to maintain 100% capacity. If the update fails health checks, both strategies achieve an immediate rollback by redirecting traffic away from the new instances and terminating the temporary Auto Scaling group, without needing a secondary rolling update.

Step-by-Step Solution

1
Analyze capacity constraints during the deployment process.
The application must maintain 100% of its provisioned instance capacity. This rules out strategies like Rolling, which temporarily take active instances out of service, and All-at-once, which takes all instances offline.
Maintaining capacity prevents performance degradation under high traffic.
2
Analyze rollback constraints on health check failure.
The rollback must be immediate and not require another deployment process. This rules out Rolling with additional batch, because reverting requires performing another rolling update deployment to push the old code back to the instances.
An immediate rollback minimizes the duration of any potential user impact.
3
Identify strategies that launch a temporary Auto Scaling group.
Immutable and Traffic splitting both launch a parallel Auto Scaling group to test the new version while keeping the original group untouched. This maintains capacity and allows instant rollback by redirecting traffic or terminating the temporary group.
These strategies isolate the new deployment from the existing running instances until verification succeeds.

Key Concept

Elastic Beanstalk Deployment Strategies
Question 513Question →

A developer is configuring a REST API in Amazon API Gateway to act as a front-end proxy for downloading images stored in an Amazon S3 bucket. The client will specify the image name using a path parameter named `imageName`. The developer wants to use a direct AWS Service integration to minimize latency and avoid invoking an AWS Lambda function.

Which two steps are required to configure this integration?

Select all that apply

Show answer & explanation

Answer: Configure an IAM role that allows the `s3:GetObject` action on the target S3 bucket, and set this role as the Execution Role in the Integration Request settings.; Set the Path Override in the Integration Request to `my-bucket/{image}` and add `image` to the URL Path Parameters mapped from `method.request.path.imageName`.

Answer

To configure a direct Amazon S3 integration in API Gateway without Lambda, you must set up an IAM execution role that allows the `s3:GetObject` action on the target S3 bucket, configure the Integration Request with a Path Override pointing to the bucket and object key placeholder, and map the method request path parameter to that placeholder in the URL Path Parameters section.
The correct steps involve configuring a direct AWS Service integration using an IAM execution role to authorize API Gateway to retrieve S3 objects, and mapping the client-supplied path parameter to the S3 request path override in the URL Path Parameters configuration.

Step-by-Step Solution

1
Configure the IAM execution role with necessary permissions.
An IAM role is created with a trust policy allowing API Gateway (`apigateway.amazonaws.com`) to assume it, and a permission policy granting `s3:GetObject` on the bucket resources (`arn:aws:s3:::my-bucket/*`).
API Gateway needs authorization to read objects from the private S3 bucket on behalf of incoming requests.
2
Set up the S3 integration in API Gateway.
The integration type is set to 'AWS Service', the AWS Service is set to 'Simple Storage Service (S3)', the HTTP method is set to 'GET', and the Execution Role is set to the IAM role ARN.
This establishes the direct connection between API Gateway and the Amazon S3 service without needing an intermediary Lambda function.
3
Map the path parameters for the S3 object key.
The Path Override is set to `my-bucket/{image}`, and the `image` parameter is added to URL Path Parameters with the value of `method.request.path.imageName`.
This dynamically resolves the S3 object key based on the client's request path parameter, ensuring the correct file is requested from S3.

Key Concept

AWS Service integration allows API Gateway to interact directly with other AWS services like Amazon S3 without incurring the latency and cost of a Lambda function, using IAM execution roles and request path overrides.
Question 514Question →

A developer is writing an appspec.yml file for an in-place deployment to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a shell script to gracefully stop the running web server application before the new deployment bundle is downloaded. Additionally, the script requires retrieving database credentials that must undergo automatic rotation. How should the developer configure the deployment to meet these requirements?

Show answer & explanation

Answer: Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.

Answer

Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.
The correct configuration is to target the ApplicationStop lifecycle hook. In an EC2 in-place deployment, ApplicationStop is the first hook to execute and runs before the new deployment bundle is downloaded (DownloadBundle phase). Additionally, AWS Secrets Manager is the correct service for retrieving the rotated database credentials, as it natively supports automatic rotation of secrets, unlike Systems Manager Parameter Store.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook for EC2 that runs before downloading files.
The ApplicationStop hook is identified as the first lifecycle event in an EC2 deployment, executing prior to the DownloadBundle event.
Running the shutdown script during ApplicationStop ensures the web server is stopped before the new package is downloaded or copied.
2
Select the appropriate secrets service that supports automatic rotation.
AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.
AWS Secrets Manager provides built-in, automated credential rotation, meeting the security rotation requirement directly.
3
Configure the script to retrieve the secret at runtime.
The shell script uses the AWS CLI to fetch the secrets from Secrets Manager dynamically using the permissions assigned to the EC2 instance profile.
This avoids hardcoding credentials in the appspec.yml or deployment bundle, maintaining compliance with security best practices.

Key Concept

CodeDeploy EC2 Deployment Lifecycle Hooks and Secrets Management
Estimated Time:1m 30s
Question 515Question →

A developer is configuring an AWS CodeDeploy blue/green deployment for a microservice on Amazon ECS. The deployment must execute a validation Lambda function named `run-integration-tests` immediately after the load balancer routes test traffic to the replacement task set, but before production traffic is shifted. Additionally, the Lambda function needs to retrieve a database credential that must be rotated automatically every 30 days.

Here is a snippet of the AppSpec file being used:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/api-service:2"
LoadBalancerInfo:
ContainerName: "api"
ContainerPort: 8080
Hooks:
- <HOOK_NAME>: "arn:aws:lambda:us-east-1:123456789012:function:run-integration-tests"

Which combination of CodeDeploy lifecycle hook and AWS service configuration will satisfy these requirements?

Show answer & explanation

Answer: Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager

Answer

Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager
The correct configuration uses the AfterAllowTestTraffic hook to trigger the validation Lambda function. In an Amazon ECS deployment, AfterAllowTestTraffic runs after the test listener starts routing traffic to the replacement task set, allowing validation tests to execute before production traffic is shifted. Storing the database password in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets (such as database credentials), whereas Systems Manager Parameter Store does not provide built-in automatic rotation.

Step-by-Step Solution

1
Identify the target deployment platform and the phase where validation tests must run.
The target platform is Amazon ECS. To validate the replacement tasks using test traffic before production traffic is routed, the AfterAllowTestTraffic hook must be used.
AfterAllowTestTraffic executes immediately after test traffic begins routing to the replacement task set, providing the correct window for integration tests.
2
Determine the service to store the database credential based on the security requirements.
AWS Secrets Manager is selected because the database credential requires automatic rotation.
AWS Secrets Manager supports built-in automatic rotation for database credentials, while Systems Manager Parameter Store is primarily for configuration management and does not support native automatic rotation.
3
Validate the IAM service role trust policy requirements for CodeDeploy.
The CodeDeploy service role must allow the 'codedeploy.amazonaws.com' service principal to assume the role.
Configuring the trust policy for 'ecs.amazonaws.com' instead of 'codedeploy.amazonaws.com' will prevent CodeDeploy from assuming the role to perform the deployment.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS and credential rotation using AWS Secrets Manager.
Estimated Time:1m 30s
Question 516Question →

A developer is using AWS SAM to build a serverless application. The application defines a Lambda function that needs to consume messages from an Amazon SQS queue. The developer is writing the `template.yaml` file and wants to ensure that the template is parsed correctly as an AWS SAM template and that the Lambda function is granted only the minimum necessary permissions to poll the queue. Which of the following actions should the developer take in the `template.yaml` file to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Include `Transform: AWS::Serverless-2016-10-31` at the root level of the template file.; Add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.

Answer

The correct actions are to include the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file and to add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.
To successfully deploy an AWS SAM application, the template must include the `Transform` declaration at the root level so that CloudFormation can translate the serverless resources. Additionally, to grant the Lambda function the ability to read from the SQS queue with least privilege, the pre-defined `SQSPollerPolicy` template should be added directly under the function's `Policies` property.

Step-by-Step Solution

1
Identify the requirement for AWS SAM template parsing.
Confirm that the `Transform: AWS::Serverless-2016-10-31` header must be included at the top-level root of the template.
Without this declaration, AWS CloudFormation will not trigger the SAM translator, causing deployment to fail when encountering serverless resource types.
2
Determine the appropriate IAM configuration for SQS integration.
Select the `SQSPollerPolicy` SAM policy template and place it in the function's `Policies` property.
This policy template grants the exact minimum permissions (such as `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes`) required for the Lambda service to poll the SQS queue.

Key Concept

AWS SAM template structure requirements and SAM policy templates for IAM permission management.
Question 517Question →

A developer is attempting to deploy an AWS Lambda function that reads data from an Amazon DynamoDB table. The developer has created an IAM role named `DynamoDbReaderRole` with a permissions policy that grants `dynamodb:GetItem` and `dynamodb:Query` access. However, when the developer tries to deploy the Lambda function and associate it with `DynamoDbReaderRole` using the AWS CLI, the deployment fails with an error indicating that Lambda is not authorized to assume the role, and that the developer is not authorized to perform `iam:PassRole` on the resource.

Which TWO actions must the developer take to successfully deploy the Lambda function? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Modify the trust policy of `DynamoDbReaderRole` to allow the `lambda.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach an IAM policy to the developer's IAM user or role that allows the `iam:PassRole` action on `DynamoDbReaderRole`.

Answer

To successfully deploy the Lambda function, the developer must modify the trust policy of the role to allow the Lambda service principal to assume it, and attach an IAM policy to their own user or role that grants permission to pass the role.
The correct configuration requires two actions. First, the trust policy of the execution role must trust the `lambda.amazonaws.com` service principal so that AWS Lambda can assume the role when running the function. Second, the developer's IAM identity must have permission to perform `iam:PassRole` on the execution role, which authorizes the developer to associate this specific role with the Lambda service during deployment.

Step-by-Step Solution

1
Analyze the two error messages: one related to the service not being authorized to assume the role, and the other related to the user not being authorized to perform `iam:PassRole`.
Identify that the Lambda service principal must be allowed to assume the role, and the developer's user identity must have permission to pass the role.
This isolates the two distinct IAM configurations required: the trust policy on the role and the permissions policy on the developer.
2
Configure the trust relationship for the execution role.
The trust policy of `DynamoDbReaderRole` is updated to allow `sts:AssumeRole` for `lambda.amazonaws.com`.
This allows the Lambda service to assume the execution role when invoking the function.
3
Grant the developer authorization to assign the role to the Lambda function.
An IAM policy with `iam:PassRole` on the role's ARN is attached to the developer's IAM user or group.
This allows the developer to pass the role to AWS Lambda during the creation or update of the function.

Key Concept

The combination of the service trust policy (which defines who can assume the role) and the `iam:PassRole` permission (which authorizes a user to pass the role to a service) is required for successful service role association.
Estimated Time:1m 30s
Question 518Question →

A developer is configuring a blue/green deployment for an application on Amazon ECS using AWS CodeDeploy. The deployment must execute a validation test suite to verify the application's health using a test traffic port before the production traffic is routed to the new task set. Additionally, CodeDeploy must be configured with the necessary permissions to manage the ECS deployment. Which of the following configurations must the developer perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.; Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct options involve configuring the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a validation Lambda function on the test port, and setting up the CodeDeploy service role's trust policy to allow the codedeploy.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Identify the correct AppSpec lifecycle hook for Amazon ECS validation tests.
Determine that the AfterAllowTestTraffic hook is executed after the test traffic port is directed to the replacement task set, which is the correct time to run validation tests.
ECS deployments use specific hooks like AfterAllowTestTraffic to validate the replacement task set using a test port before moving production traffic.
2
Establish the necessary IAM permissions for CodeDeploy to perform the deployment.
Identify that the CodeDeploy service role must have a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role.
Without this trust policy, CodeDeploy will fail to assume the role and will not be able to interact with Amazon ECS to manage the deployment.

Key Concept

AWS CodeDeploy ECS Deployment Configuration
Question 519Question →

A developer is configuring an Amazon ECS task definition to run a containerized application on AWS Fargate. The application code needs to query an Amazon DynamoDB table. Additionally, the ECS container agent must pull the container image from Amazon ECR and send container logs to Amazon CloudWatch Logs. Which configuration of IAM roles meets these requirements with the least privilege?

Show answer & explanation

Answer: Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).

Answer

Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).
The correct configuration uses the Task Role (taskRoleArn) to grant the application code running inside the container permissions to access DynamoDB. Meanwhile, the Task Execution Role (executionRoleArn) grants the ECS container agent permissions to pull the container image from ECR and send logs to CloudWatch. This follows the principle of least privilege and separates infrastructure permissions from application permissions.

Step-by-Step Solution

1
Identify the credentials needed by the application itself.
The application code queries DynamoDB, which requires read/query permissions on the DynamoDB table.
Application-level permissions must be associated with the ECS Task Role (taskRoleArn).
2
Identify the credentials needed by the ECS container agent.
The agent needs to pull the container image from ECR and create/write log streams in CloudWatch Logs.
Infrastructure/agent-level permissions must be associated with the ECS Task Execution Role (executionRoleArn).
3
Configure the trust relationship for the roles.
Both roles must have a trust policy allowing the ecs-tasks.amazonaws.com service principal to assume them.
This allows the ECS service to pass these temporary credentials to the tasks and the agent.

Key Concept

Separation of concerns between ECS Task Role and ECS Task Execution Role
Estimated Time:1m 30s
Question 520Question →

A developer is setting up a deployment pipeline to update a serverless application. The developer is configuring AWS CodeDeploy to perform a Canary deployment of an AWS Lambda function. The deployment process must execute a test Lambda function to validate the deployment before any production traffic is shifted to the new version. Additionally, the CodeDeploy service must be granted the minimal permissions required to orchestrate the deployment on behalf of the developer.

Which configuration steps must the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the appspec.yaml file, define the validation function name under the BeforeAllowTraffic hook within the Hooks section.; Attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

To configure the deployment, the developer must define the validation function under the BeforeAllowTraffic hook in the appspec.yaml file, and attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume it.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook in the appspec.yaml file to run a validation Lambda function before traffic shifting begins, and setting up an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to invoke the validation function and orchestrate the deployment.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for Lambda deployments.
The BeforeAllowTraffic lifecycle hook is identified as the correct place to run a validation Lambda function before traffic is shifted.
For Lambda deployments, CodeDeploy only supports BeforeAllowTraffic and AfterAllowTraffic hooks, and they must point to validation Lambda functions.
2
Identify the required IAM configuration for the CodeDeploy service role.
A service role with a trust policy allowing codedeploy.amazonaws.com to assume the role is required.
CodeDeploy needs permissions to perform actions (like shifting traffic and invoking validation functions) on your behalf, which is accomplished by assuming the service role.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM service roles for Lambda deployments.
Estimated Time:2m 0s
PreviousPage 26 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin