Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 561Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation test against the newly deployed tasks (the green task set) before any production traffic is shifted. If the validation test fails, the deployment must automatically roll back. The developer is defining the AppSpec file in YAML format and configuring the IAM permissions. Which of the following configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the validation Lambda function ARN under the BeforeAllowTraffic hook in the hooks section of the AppSpec file.; Grant the CodeDeploy service role the lambda:InvokeFunction permission for the validation Lambda function.

Answer

Defining the validation Lambda function ARN under the BeforeAllowTraffic hook and granting the CodeDeploy service role the lambda:InvokeFunction permission.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook inside the ECS AppSpec file to point to the validation Lambda function, and ensuring the CodeDeploy service role has the lambda:InvokeFunction permission to run it. The BeforeAllowTraffic hook executes after the green task set is provisioned but before production traffic shifts, enabling testing and automatic rollback on failure.

Step-by-Step Solution

1
Identify the target compute platform and the required validation timing.
The target platform is Amazon ECS and the validation must run before production traffic is shifted.
This establishes that we must use ECS-compatible AppSpec lifecycle hooks.
2
Determine the correct AppSpec hook and execution format for ECS.
For ECS, AppSpec lifecycle hooks can only target AWS Lambda functions, and the BeforeAllowTraffic hook runs before the production traffic shifts.
This rules out using shell scripts (which are EC2-only) and EC2-specific hooks like ValidateService.
3
Determine the required IAM permissions.
CodeDeploy executes the lifecycle hook, so the CodeDeploy service role requires permission to invoke the validation Lambda function.
This distinguishes it from ECS Task Execution permissions, as the task is not the caller of the validation function.

Key Concept

AWS CodeDeploy ECS Blue/Green lifecycle hooks and IAM permissions
Question 562Question →

A team is building a serverless document collaboration portal where users edit documents concurrently. The portal needs to manage transient user presence indicators (e.g., 'User X is online') that expire automatically after 5 minutes of user inactivity. The developer wants to minimize storage costs and avoid running unnecessary compute resources to clean up expired session records. Which approach should the developer take to meet these requirements?

Show answer & explanation

Answer: Store the presence states in an Amazon DynamoDB table and enable Time to Live (TTL) on a timestamp attribute representing the expiration time.

Answer

Store the presence states in an Amazon DynamoDB table and enable Time to Live (TTL) on a timestamp attribute representing the expiration time.
The correct approach is to store the presence states in an Amazon DynamoDB table and enable Time to Live (TTL). DynamoDB TTL allows developers to define a timestamp attribute indicating when an item should expire. DynamoDB automatically deletes these items in the background, typically within 48 hours of expiration, without consuming provisioned read or write throughput. This completely eliminates the need for custom clean-up code, minimizes storage costs, and scale-out overhead.

Step-by-Step Solution

1
Identify the nature of the application data.
The presence indicators represent transient, high-velocity session-like state data.
Understanding the access pattern and lifecycle of the data helps select the most cost-effective storage and cleanup strategy.
2
Evaluate the requirement for automatic, resource-efficient deletion of data after 5 minutes.
DynamoDB Time to Live (TTL) automatically identifies and purges expired items at no additional cost and without consuming throughput.
This avoids custom scheduled cleanup scripts (like cron-triggered Lambda functions running scans) which consume read capacity and compute resources.
3
Rule out storage solutions that are not designed for transient user states or that lack persistence guarantees.
Systems Manager Parameter Store is for configuration/secrets, and Lambda local memory does not persist state reliably.
This ensures the architecture conforms to AWS best practices for state management and serverless design.

Key Concept

Session state expiration using Amazon DynamoDB Time to Live (TTL)
Question 563Question →

A developer is implementing a security strategy for an application. The application needs to retrieve a database password and also encrypt application audit logs (average size 2 MB2\text{ MB}) locally before archiving them to Amazon S3. The database password requires automatic rotation. The audit logs must be encrypted client-side using a customer managed key (KMS key) in AWS KMS. Which combination of services and KMS operations should the developer use to meet these requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.

Answer

Store the database password in AWS Secrets Manager to enable automatic rotation. For the audit logs, call GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the logs locally with the plaintext key, and store the encrypted data key alongside the encrypted logs in S3.
The correct approach uses AWS Secrets Manager for the database password because it provides out-of-the-box automatic rotation. For the audit logs, since the payload size (2 MB2\text{ MB}) exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, the application must use envelope encryption. The GenerateDataKey API returns both the plaintext data key (used to encrypt the file locally) and the ciphertext data key (stored alongside the encrypted logs for future decryption).

Step-by-Step Solution

1
Select the appropriate secrets management service.
AWS Secrets Manager is selected because it natively supports database credential rotation, whereas Systems Manager Parameter Store does not.
Meeting the requirement for automatic rotation of the database password.
2
Determine the encryption method for the 2 MB2\text{ MB} audit logs.
The Encrypt API has a 4 KB4\text{ KB} limit, so client-side envelope encryption must be used.
Enabling the encryption of large files that exceed the KMS direct encryption payload limit.
3
Identify the correct KMS API call for envelope encryption.
GenerateDataKey is chosen because it returns the plaintext key needed for local encryption and the ciphertext key for storage.
Obtaining the necessary keys to encrypt the data locally and decrypt it later.

Key Concept

AWS KMS Envelope Encryption and Secrets Management
Estimated Time:1m 30s
Question 564Question →

A developer is implementing security for a new Amazon API Gateway REST API. The API has two specific endpoints:

1. `POST /orders`: Used by a mobile application where users authenticate via Amazon Cognito User Pools.
2. `GET /dashboard/metrics`: Used by an administrative reporting service running on Amazon ECS tasks.

Which TWO actions should the developer take to configure authorization for these endpoints with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure the `POST /orders` method to use an Amazon Cognito User Pools authorizer to validate incoming tokens.; Configure the `GET /dashboard/metrics` method to use `AWS_IAM` authorization, and grant the ECS task role permission to invoke the API.

Answer

Configure the POST /orders method to use an Amazon Cognito User Pools authorizer, and configure the GET /dashboard/metrics method to use AWS_IAM authorization while granting the ECS task role permission to invoke the API.
For the POST /orders endpoint, using a built-in Amazon Cognito User Pools authorizer is the recommended path because it requires zero custom code to validate Cognito-issued tokens. For the GET /dashboard/metrics endpoint, AWS_IAM authorization allows the administrative service running on ECS to leverage its IAM task role to sign requests with Signature Version 4, offering a secure, native method to control access without API keys or token exchange.

Step-by-Step Solution

1
Analyze the requirement for the POST /orders endpoint to authenticate mobile users authenticated with Amazon Cognito User Pools.
Identify that API Gateway offers a native Cognito User Pools authorizer.
This authorizer directly validates JWT tokens from Cognito without custom code, minimizing operational overhead.
2
Analyze the requirement for the GET /dashboard/metrics endpoint to secure access for an administrative service on Amazon ECS.
Identify that the service uses an IAM role and API Gateway supports native AWS_IAM authorization.
AWS_IAM authorization allows callers to sign requests with SigV4 and enables native access control via IAM policies.
3
Configure permissions for the ECS task role to invoke the GET /dashboard/metrics endpoint.
Grant execute-api:Invoke permission on the API resource to the ECS task role.
This secures access based on the principle of least privilege.

Key Concept

API Gateway Security and Authorization using built-in Cognito and IAM authorizers
Question 565Question →

A developer is configuring a database connection for a new application. The database credentials must be rotated automatically every 15 days, and the developer wants to use native integration with Amazon RDS to rotate them without writing custom rotation code. Which AWS service should the developer use to store the credentials?

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager
AWS Secrets Manager is designed for storing and managing secrets, offering built-in integration with Amazon RDS to automatically rotate database credentials without requiring custom code.

Step-by-Step Solution

1
Identify the requirement for automatic credential rotation every 15 days.
Automatic rotation is a native feature of AWS Secrets Manager but is not natively supported by Systems Manager Parameter Store.
Secrets Manager provides out-of-the-box rotation support for popular database services like Amazon RDS.
2
Evaluate the requirement for native RDS integration without writing custom rotation code.
AWS Secrets Manager provides built-in rotation templates for RDS, whereas other services would require writing custom rotation logic.
Using native RDS integration simplifies the operational overhead of rotation.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store features, specifically automatic rotation and database integration.
Estimated Time:45s
Question 566Question →

A developer deployed an infrastructure stack using AWS CloudFormation. Later, a system administrator manually modified the port settings of an Amazon EC2 Security Group directly in the Amazon VPC Console to troubleshoot a connection issue. The developer needs to identify which specific configurations in the deployed stack no longer match the CloudFormation template definition. Which CloudFormation feature should the developer use to achieve this?

Show answer & explanation

Answer: Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.

Answer

Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.
Drift detection is a native CloudFormation feature designed to identify stack resources that have been modified outside of CloudFormation management (out-of-band). It compares the actual state of the resource properties with the expected state defined in the template.

Step-by-Step Solution

1
Analyze the scenario to identify that an out-of-band manual modification has been made to a CloudFormation-managed resource.
The Security Group state has diverged from the template definition.
This establishes that the core issue is configuration drift.
2
Select the CloudFormation feature that inspects and reports on manual deviations.
CloudFormation drift detection is identified as the correct tool.
Drift detection compares stack resource property values against the expected template values to detect differences.

Key Concept

CloudFormation Drift Detection
Estimated Time:45s
Question 567Question →

A developer is implementing a session state store for a web application to allow the application instances to scale horizontally. The application needs to retrieve a user's session record using a unique Session ID. Which approach provides the most efficient and cost-effective design for retrieving these session states?

Show answer & explanation

Answer: Store the session states in Amazon DynamoDB and retrieve them using the GetItem or Query API operations with the Session ID as the partition key.

Answer

Store the session states in Amazon DynamoDB and retrieve them using the GetItem or Query API operations with the Session ID as the partition key.
Storing session data in Amazon DynamoDB and retrieving it using direct key lookups (GetItem or Query) is the AWS best practice for session state management. The Session ID has high cardinality, making it an excellent partition key that distributes requests evenly across partitions, ensuring consistent performance and low latency.

Step-by-Step Solution

1
Identify the requirements for the session store.
The session store needs to hold dynamic session data retrieved via a unique Session ID, support horizontal scaling, and remain cost-effective and efficient.
This sets the criteria for evaluating the database engine and access patterns.
2
Evaluate the database and operation options.
DynamoDB is a key-value store suitable for session state. Retrieving items directly via partition key (GetItem/Query) scales efficiently and keeps read costs low.
Accessing items by key prevents scanning the entire dataset and optimizes RCU usage.

Key Concept

Storing session state in a distributed database like DynamoDB using partition keys for efficient, scalable lookups.
Question 568Question →

A developer is designing a security architecture for a corporate mobile application that accesses backend microservices through an Amazon API Gateway REST API. The application requirements specify that all API requests must be secured using AWS Signature Version 4 (SigV4) signing, and users must obtain temporary AWS IAM credentials after authenticating with a third-party Identity Provider (IdP). Which configuration should the developer implement to authorize these requests at the API Gateway level with the least administrative effort?

Show answer & explanation

Answer: Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).

Answer

Configure the API Gateway methods to use AWS_IAM authorization. Authenticate users through an Amazon Cognito identity pool to exchange their third-party IdP token for temporary AWS credentials, and use those credentials to sign requests using Signature Version 4 (SigV4).
Configuring API Gateway to use AWS_IAM authorization requires clients to sign their requests with AWS Signature Version 4 (SigV4). By integrating the third-party Identity Provider (IdP) with an Amazon Cognito identity pool (federated identities), the application can exchange the IdP authentication token for temporary, limited-privilege AWS credentials. The client can then use these credentials to sign the API requests, providing secure, native API Gateway authorization with minimal operational overhead.

Step-by-Step Solution

1
Enable AWS_IAM authorization on the API Gateway REST API resource methods.
API Gateway will reject any unsigned requests or requests not signed with valid AWS Signature Version 4 (SigV4) credentials.
To enforce SigV4 authentication at the API Gateway level, ensuring only authorized AWS identities can access the backend.
2
Set up an Amazon Cognito identity pool and configure the third-party Identity Provider (IdP) as an authentication provider.
Users authenticate with the IdP and obtain an ID token, which the application exchanges with the Cognito identity pool for temporary AWS IAM credentials.
To map external federated identities to temporary AWS IAM credentials for the client application.
3
Sign the API Gateway HTTP requests using the retrieved temporary AWS IAM credentials in the client application.
The client successfully sends SigV4-signed requests that API Gateway validates against the IAM permissions associated with the Cognito identity pool's authenticated role.
To complete the SigV4 handshake and securely access the authorized API Gateway endpoints.

Key Concept

API Gateway AWS_IAM authorization secures endpoints by requiring clients to sign requests with AWS Signature Version 4 (SigV4) credentials. Combining this with Cognito Identity Pools allows external authenticated identities to obtain the temporary credentials needed for SigV4 signing.
Estimated Time:1m 30s
Question 569Question →

A developer is packaging a Python application for deployment to AWS Elastic Beanstalk. The application requires a custom Unix user to be created on the host Amazon EC2 instances during environment provisioning. To automate this, the developer creates a configuration file named `01_user.config` containing the user definition. However, after deploying the application source bundle to the Elastic Beanstalk environment, the user is not created and the configuration is ignored.

The layout of the deployed application zip file is as follows:

/
├── application.py
├── requirements.txt
└── config/
└── .ebextensions/
└── 01_user.config

Which action must the developer take to ensure Elastic Beanstalk applies the configuration?

Show answer & explanation

Answer: Move the `.ebextensions` directory to the root of the application source bundle.

Answer

Move the `.ebextensions` directory to the root of the application source bundle.
For AWS Elastic Beanstalk to apply customization settings defined in `.config` files, the `.ebextensions` directory must be at the root of the application source bundle. Placing it inside a folder such as `config/` will cause Elastic Beanstalk to ignore the configurations.

Step-by-Step Solution

1
Analyze the zip file structure of the deployed application.
The `.ebextensions` directory is located inside a `config/` subdirectory.
AWS Elastic Beanstalk scans the root directory of the application source bundle for a folder specifically named `.ebextensions`.
2
Determine the correct directory path and name requirements for configuration files.
The folder must be named `.ebextensions` (with a leading dot) and must be at the root level.
If the folder is placed in a subdirectory or does not have the leading dot, the Elastic Beanstalk platform engine will skip parsing any `.config` files inside it.
3
Move the directory to the root level and deploy the application.
The configuration file will be parsed and the custom user will be successfully created.
Placing the folder at the root matches the expected path pattern that the Elastic Beanstalk host agent searches for during provisioning.

Key Concept

AWS Elastic Beanstalk requires configuration files to be placed in a directory named `.ebextensions` at the root of the application source bundle.
Estimated Time:1m 30s
Question 570Question →

A developer is configuring a blue/green deployment for an Amazon Elastic Container Service (Amazon ECS) service using AWS CodeDeploy and an Application Load Balancer (ALB). The service runs 44 tasks under normal operation. The developer must run automated integration tests against the new version of the application (the replacement task set) in the production environment before routing any live production traffic to it.

Which configuration should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure a test listener on the ALB that points to the replacement target group, specify this listener in the CodeDeploy deployment group, and run the integration tests during the AfterAllowTestTraffic lifecycle hook.

Answer

Configure a test listener on the ALB that points to the replacement target group, specify this listener in the CodeDeploy deployment group, and run the integration tests during the AfterAllowTestTraffic lifecycle hook.
The correct configuration utilizes a dedicated test listener on the Application Load Balancer (ALB) to route traffic specifically to the replacement target group hosting the Green task set. By specifying this test listener in AWS CodeDeploy, developers can target the new deployment for testing. The AfterAllowTestTraffic lifecycle hook runs immediately after the test listener starts directing traffic to the replacement task set, providing the ideal phase to execute automated validation tests before any live production traffic is shifted.

Step-by-Step Solution

1
Identify the mechanism for routing test traffic in AWS CodeDeploy ECS blue/green deployments.
A dedicated test listener must be configured on the Application Load Balancer to direct traffic to the replacement (Green) target group.
This isolates test traffic from production traffic, preventing real users from hitting the unverified deployment.
2
Determine the appropriate lifecycle hook in the AppSpec file to execute the automated integration tests.
The AfterAllowTestTraffic hook is selected.
This hook runs after the test listener starts directing traffic to the replacement task set, allowing test traffic to reach the new version for validation.
3
Verify that the selected hook and listener combination meets all constraints without exposing the new version to production traffic.
The configuration successfully validates the Green task set using the test listener, and only starts shifting production traffic after tests complete successfully.
This satisfies the zero-downtime and pre-traffic validation requirements.

Key Concept

ECS Blue/Green Deployment Validation with CodeDeploy
Question 571Question →

A developer is writing an AWS Lambda function that queries a relational database. To improve the function's performance, the developer wants to reuse the database connection across multiple invocations. How should the developer initialize the database connection client to achieve this?

Show answer & explanation

Answer: Initialize the database connection client outside the Lambda handler function.

Answer

Initialize the database connection client outside the Lambda handler function.
Initializing the database connection client outside of the Lambda handler function allows the connection to be established once during the cold start initialization phase. When subsequent invocations reuse the execution context (warm starts), the initialized database client is already available in memory, eliminating connection setup overhead.

Step-by-Step Solution

1
Analyze how AWS Lambda handles execution context reuse.
AWS Lambda reuses the execution context (the environment running the function) for subsequent invocations if they happen within a short period (warm starts).
This behavior allows variables and objects declared outside the handler to remain in memory and be reused.
2
Determine where to place resource-intensive initialization logic.
Database clients and connection pools should be declared outside the handler function scope.
Code outside the handler is executed once during the cold start initialization phase, while code inside the handler runs on every single invocation.

Key Concept

AWS Lambda Execution Context Reuse
Question 572Question →

A developer needs to expose a public HTTP endpoint that allows mobile clients to send telemetry data directly to an Amazon SQS queue. To minimize latency, cost, and maintenance, the developer wants to avoid using custom compute resources such as AWS Lambda functions for processing the requests. Which integration type and configuration in Amazon API Gateway should the developer choose to meet these requirements?

Show answer & explanation

Answer: An AWS Service integration, specifying Amazon SQS as the backend service, setting the Action to SendMessage, and using an integration request mapping template to format the client payload.

Answer

An AWS Service integration, specifying Amazon SQS as the backend service, setting the Action to SendMessage, and using an integration request mapping template to format the client payload.
The correct choice is to use an AWS Service integration. API Gateway natively supports direct integration with other AWS services. By setting SQS as the backend, specifying the SendMessage action, and using VTL mapping templates, API Gateway can transform incoming JSON client payloads into the query string format required by the SQS SendMessage API. This bypasses the need for an intermediate Lambda function entirely.

Step-by-Step Solution

1
Analyze the backend integration constraints.
The solution must integrate API Gateway directly with Amazon SQS without using custom compute resources (like Lambda functions) to minimize cost, maintenance, and latency.
This rules out Lambda Proxy integrations.
2
Evaluate API Gateway integration types.
Identify that AWS Service integration is the native mechanism in API Gateway to interact directly with other AWS services.
This allows API Gateway to call the SQS API directly.
3
Configure the request transformation.
Use an integration request mapping template (VTL) to map the incoming JSON telemetry payload to the required SQS SendMessage format.
The client application does not need to know the SQS-specific protocol details.

Key Concept

AWS Service Integration in Amazon API Gateway
Estimated Time:1m 30s
Question 573Question →

A developer is designing a REST API using Amazon API Gateway that integrates directly with an Amazon DynamoDB table using an AWS service integration. The API needs to expose a POST method to insert customer records. To optimize throughput and performance, the developer wants to ensure that:

1. Incoming payloads are validated against a specific JSON schema, and requests with invalid structures are rejected with a 400400 Bad Request response before the integration is invoked.
2. The DynamoDB response, which contains the raw database attributes, is transformed into a simplified, customer-facing JSON format before being returned to the client.

Which two configuration steps must the developer perform in API Gateway to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a model representing the schema of the payload, assign the model to the method request, and enable request validation for the request body in the method settings.; Configure an integration response for the 200200 HTTP status code, and write a mapping template using Velocity Template Language (VTL) to transform the DynamoDB response into the desired format.

Answer

To reject requests with invalid structures before the integration is invoked, the developer should create a model representing the schema of the payload, assign it to the method request, and enable request validation for the request body. To transform the DynamoDB response into a simplified, customer-facing JSON format, the developer should configure an integration response for the 200 HTTP status code and write a Velocity Template Language (VTL) mapping template.
To automatically reject malformed payloads before invoking the backend, API Gateway's Request Validator must be used in conjunction with a defined JSON schema model linked to the method request. To transform the response of a non-proxy AWS service integration (such as DynamoDB), a VTL mapping template must be defined within the integration response for the 200 HTTP status code. Together, these steps satisfy both validation and payload transformation requirements without invoking intermediate code.

Step-by-Step Solution

1
Define the request schema model
A JSON schema model is created in API Gateway that specifies the required attributes and types for the incoming customer record.
This establishes the structure against which incoming payloads will be validated.
2
Enable request validation on the Method Request
The request validator is configured to check the request body, and the schema model is associated with the POST method request.
This ensures that API Gateway intercepts invalid payloads and immediately returns a 400 Bad Request error to the client, preventing the integration from being called.
3
Configure the Integration Response mapping template
An integration response for the 200 status code is created, containing a VTL template to parse the raw DynamoDB return attributes.
Since this is an AWS service integration (non-proxy), response transformation must occur at the Integration Response stage using VTL to map DynamoDB attributes to clean customer-facing JSON.

Key Concept

API Gateway input validation and non-proxy integration response mapping templates
Question 574Question →

A developer is configuring an Amazon API Gateway REST API with a Lambda proxy integration. The developer needs to access the query string parameters sent by the client within the backend AWS Lambda function. How should the developer retrieve these parameters from the incoming request?

Show answer & explanation

Answer: Access the parameters from the queryStringParameters property of the input JSON event passed to the Lambda function.

Answer

Access the parameters from the queryStringParameters property of the input JSON event passed to the Lambda function.
In a Lambda proxy integration, API Gateway automatically formats the client's HTTP request details into a single JSON object and passes it to the backend Lambda function as the event parameter. Within this event payload, the query parameters are populated in the 'queryStringParameters' object, allowing direct access inside the function code.

Step-by-Step Solution

1
Identify the API Gateway integration type configured in the scenario.
The integration type is Lambda proxy integration.
The integration type determines how request data is formatted and forwarded to the backend service.
2
Examine how client request data is passed in Lambda proxy integrations.
API Gateway passes the entire request as a structured JSON object to the first parameter (the event object) of the Lambda handler.
Understanding the input structure allows the developer to locate request metadata and parameter fields.
3
Access the specific key mapped to query parameters in the event structure.
Query parameters are nested under the 'queryStringParameters' property of the input event object.
This is the standard integration contract for Lambda proxy requests in API Gateway.

Key Concept

Lambda Proxy Integration Request Structure
Question 575Question →

A developer is packaging a web application to be deployed on AWS Elastic Beanstalk. The application requires custom environment configurations and package installations during deployment. To achieve this, which directory at the root of the application source bundle must contain the custom configuration files?

Show answer & explanation

Answer: .ebextensions

Answer

The directory named '.ebextensions' must be placed at the root of the application source bundle to store Elastic Beanstalk configuration files.
The correct option is '.ebextensions'. AWS Elastic Beanstalk searches for configuration files (which must end in '.config') in a directory named '.ebextensions' located at the root of the application source bundle. This allows developers to configure environment options, install packages, and create files on the EC2 instances.

Step-by-Step Solution

1
Identify the purpose of Elastic Beanstalk configuration files.
The files (ending in '.config') are used to customize the software, packages, and environment properties of the EC2 instances in the Elastic Beanstalk environment.
This is a standard way to manage configuration as code in Elastic Beanstalk.
2
Determine the required directory name and location in the application zip/source bundle.
The directory must be named '.ebextensions' (with a leading dot) and positioned at the root level of the source bundle.
Elastic Beanstalk agent runs scripts to parse this specific directory during deployment; any other location or misspelled directory name is ignored.

Key Concept

AWS Elastic Beanstalk configuration files must be stored in the '.ebextensions' folder at the root of the application source bundle.
Question 576Question →

A developer is building a mobile application that uses Amazon Cognito for user authentication. The backend is exposed through an Amazon API Gateway REST API. The developer needs to secure the API so that only authenticated users can access the endpoints. The authentication mechanism must validate JSON Web Tokens (JWTs) issued by Cognito, require no custom authorizer code, and introduce minimal latency. Which API Gateway authorization method should the developer implement?

Show answer & explanation

Answer: An Amazon Cognito User Pools authorizer

Answer

An Amazon Cognito User Pools authorizer
The correct answer is the Amazon Cognito User Pools authorizer. API Gateway provides built-in integration with Cognito User Pools to validate identity tokens (IDs) or access tokens returned from Cognito. This requires no custom coding, operates at the API Gateway level to block unauthorized requests, and minimizes overhead.

Step-by-Step Solution

1
Identify the authentication source and token type.
The application uses Amazon Cognito for user authentication and receives JWTs.
This narrows the choices down to Cognito-integrated methods.
2
Evaluate the operational overhead and custom code requirement.
Amazon API Gateway offers a built-in Cognito User Pools authorizer that directly validates JWTs without requiring custom code.
This rules out a Lambda authorizer, which requires custom verification code, and Cognito Identity Pools, which are for AWS credential vending.

Key Concept

Amazon API Gateway Cognito User Pools Authorizer
Estimated Time:45s
Question 577Question →

A developer is building a mobile application that requires users to sign in using their email addresses or social identity providers such as Google or Facebook. Once signed in, the application needs to maintain a user directory and manage user profiles. Which Amazon Cognito feature should the developer implement to meet these authentication and directory requirements?

Show answer & explanation

Answer: Cognito User Pools

Answer

Cognito User Pools
The option identifying Cognito User Pools is correct because User Pools act as a user directory that manages sign-up, sign-in, and user profiles. They support federation with social identity providers like Google and Facebook out of the box.

Step-by-Step Solution

1
Analyze the application requirements.
The application needs user sign-in via email/password and social providers, user directory maintenance, and profile management.
Identifying the target capability (authentication and directory) helps narrow down the AWS services designed for user management.
2
Evaluate Amazon Cognito capabilities.
Cognito User Pools provide user directories, sign-up/sign-in flows, and profile management, whereas Identity Pools provide authorization to AWS resources.
Distinguishing between authentication (User Pools) and authorization (Identity Pools) is key to selecting the correct Cognito component.

Key Concept

Distinction between Cognito User Pools and Identity Pools
Estimated Time:45s
Question 578Question →

A developer is building a mobile application that requires users to authenticate before they can upload files directly to a private Amazon S3 bucket. The application must support user registration and sign-in, and provide temporary, limited-privilege AWS credentials to authenticated users for S3 uploads. Which combination of Amazon Cognito features should the developer use to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Authenticate users using a Cognito User Pool, and then exchange the user pool tokens for temporary credentials using a Cognito Identity Pool.

Answer

Authenticate users using a Cognito User Pool, and then exchange the user pool tokens for temporary credentials using a Cognito Identity Pool.
The correct architecture uses a Cognito User Pool for user sign-in and directory management (authentication) and a Cognito Identity Pool to exchange those identity tokens for temporary, limited-privilege AWS credentials to access S3 (authorization). This is the standard, low-overhead pattern recommended by AWS.

Step-by-Step Solution

1
Identify authentication requirement.
Amazon Cognito User Pools are selected to manage user sign-up, sign-in, and directory storage.
User Pools act as the Identity Provider (IdP) to authenticate users and issue JSON Web Tokens (JWTs).
2
Identify authorization requirement for AWS resources (S3).
Amazon Cognito Identity Pools (Federated Identities) are selected to exchange identity tokens for temporary AWS credentials.
Identity Pools map authenticated user identities to IAM roles, allowing direct and secure access to AWS services like S3.

Key Concept

Separation of concerns between Cognito User Pools (authentication/directory) and Cognito Identity Pools (authorization/temporary credentials).
Question 579Question →

A developer needs to configure a deployment strategy for an application running on AWS Elastic Beanstalk. The application must maintain 100%100\% of its capacity to handle traffic during the deployment process. Due to budget constraints, the developer must minimize the cost of temporary resources launched during the deployment, ruling out a complete duplicate environment or a double-capacity deployment. Which deployment policy should the developer configure?

Show answer & explanation

Answer: Rolling with additional batch

Answer

Rolling with additional batch
The Rolling with additional batch deployment policy launches a new batch of instances with the updated application version first. Once the new batch passes health checks, Elastic Beanstalk updates a batch of the old instances. This process continues until all instances are updated. Because the additional batch is created first, the environment's capacity never drops below 100%100\%, and the additional cost is limited only to the size of the temporary batch rather than a full duplicate environment.

Step-by-Step Solution

1
Analyze capacity requirements.
The application must maintain 100%100\% capacity during deployment, which rules out policies that reduce instance count or take instances offline (such as All at once or standard Rolling).
Ensuring capacity requirements are prioritized first helps filter out policies that cause downtime or reduced capacity.
2
Analyze budget constraints and temporary resource usage.
The requirement to minimize the cost of temporary resources rules out the Immutable policy, which doubles the instance footprint by creating a full replica Auto Scaling group.
Evaluating cost constraints separates policies that maintain capacity using small incremental batches from those using full environment duplication.
3
Select the optimal Elastic Beanstalk deployment policy.
Rolling with additional batch is selected because it keeps full capacity by launching a small extra batch of instances first, avoiding the high cost of duplicating the entire environment.
This strategy satisfies both the 100%100\% capacity constraint and the cost-efficiency constraint.

Key Concept

AWS Elastic Beanstalk Deployment Policies
Estimated Time:1m 30s
Question 580Question →

An application running on Amazon ECS (Fargate) is configured to use AWS CodeDeploy for blue/green deployments. The application resides behind an Application Load Balancer (ALB). The developer needs to configure the deployment pipeline to meet the following requirements:

* The deployment must begin by routing exactly 10%10\% of production traffic to the new task set (replacement task set), and then route the remaining 90%90\% of traffic after exactly 1010 minutes if the deployment remains stable.
* Before any production traffic is routed to the new task set, an automated test suite must run via an AWS Lambda function to validate the deployment's health.
* The deployment must automatically roll back if a specified Amazon CloudWatch alarm is triggered during the 1010-minute baking period.

Which TWO configurations must the developer implement to satisfy these requirements?

Select all that apply

Show answer & explanation

Answer: Set the deployment configuration in the CodeDeploy deployment group to CodeDeployDefault.ECSCanary10Min10Percent.; In the AppSpec file, define the validation Lambda function under the BeforeAllowTraffic lifecycle hook.

Answer

The developer must configure the deployment group to use the CodeDeployDefault.ECSCanary10Min10Percent strategy and define the validation Lambda function under the BeforeAllowTraffic hook in the AppSpec file.
The correct configurations specify using the CodeDeployDefault.ECSCanary10Min10Percent strategy to route the initial 10%10\% of traffic and wait 1010 minutes before routing the rest. Additionally, specifying the BeforeAllowTraffic hook in the AppSpec file ensures the validation Lambda function runs after the new task set is initialized but before production traffic is directed to it.

Step-by-Step Solution

1
Determine the traffic routing requirements.
Initial 10%10\% routing followed by the remaining 90%90\% after a 1010-minute baking period is a Canary pattern (specifically Canary 10% 10Min). Linear routing is ruled out.
Linear configurations shift traffic incrementally at each interval, whereas Canary configurations shift traffic in two distinct phases.
2
Identify the correct lifecycle hook for running validation tests.
The validation tests must run before any production traffic shifts. The BeforeAllowTraffic hook is the correct ECS deployment hook.
In ECS blue/green deployments, BeforeAllowTraffic executes after tasks are provisioned but before production traffic starts shifting. Other hooks like ValidateService are not supported on ECS, and AfterAllowTraffic runs too late.

Key Concept

ECS Blue/Green deployment traffic routing and lifecycle hook orchestration in AWS CodeDeploy
PreviousPage 29 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin