All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is building a mobile application where users authenticate via Amazon Cognito. The backend services are exposed through an Amazon API Gateway REST API. The developer needs to restrict access to the API endpoints so that only successfully authenticated users from a specific Amazon Cognito User Pool can call the API. The mobile client sends the id_token in the Authorization header. Which configuration represents the most operationally efficient and secure solution?

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Cognito User Pool, validates the signature of the incoming token, and returns an IAM policy.

Configure an API Gateway Cognito Authorizer pointing to an Amazon Cognito Identity Pool, mapping the token to temporary AWS credentials to authorize the requests.

Configure a Lambda Proxy Integration for the API methods, and implement custom code within the backend Lambda function to inspect the Authorization header and validate the token.

Show answer & explanation

Answer: Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

Answer

Configure an API Gateway Cognito Authorizer pointing to the Amazon Cognito User Pool, and set the Authorization header as the token source.

The correct answer configures a native API Gateway Cognito Authorizer referencing the User Pool. This approach allows API Gateway to automatically and natively validate token signatures, audiences, and expiration, offloading the security checks from the backend application code and saving operational costs.

Step-by-Step Solution

Identify the authentication source and token format.

Amazon Cognito User Pool id_token (JWT).

Knowing that users authenticate via User Pools and produce standard JWTs helps choose the appropriate native integration.

Select the API Gateway authorization type that natively handles Cognito JWT verification.

API Gateway Cognito Authorizer.

A Cognito Authorizer allows API Gateway to directly validate token signatures, expiration, and audiences without invoking custom code or Lambda functions.

Configure the token source in API Gateway.

Set token source to the 'Authorization' header.

This instructs API Gateway to extract the id_token from the Authorization header of the incoming HTTP request.

Key Concept

API Gateway Cognito Authorizer

Estimated Time:1m 30s

Question 582Question →

A developer is deploying an AWS Lambda function inside a private subnet of a Virtual Private Cloud (VPC) to access an Amazon RDS database. The Lambda function also needs to connect to an external payment processor's public API over the internet. Which configuration should the developer use to allow the Lambda function to access the internet?

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Configure the Lambda function to run inside the private subnet without configuring a NAT Gateway or VPC endpoints, assuming the default subnet routing allows outbound internet traffic.

Modify the IAM execution role's trust policy of the Lambda function to permit direct public internet connections to external IP ranges.

Store the payment processor's API key in AWS Systems Manager Parameter Store and enable automatic rotation to open an internet-bound route.

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

Answer

Configure a NAT Gateway in a public subnet, and add a route in the private subnet's route table that directs internet-bound traffic to the NAT Gateway.

The correct option correctly states that a NAT Gateway must be configured in a public subnet and the private subnet's route table updated to direct destination

0.0.0.0/0

traffic to the NAT Gateway. This allows Lambda functions inside the private subnet to establish outbound connections to the internet without exposing them to inbound internet traffic.

Step-by-Step Solution

Identify that the Lambda function is running inside a private subnet and needs to connect to the public internet.

The Lambda function does not have a public IP address and cannot directly route traffic to an Internet Gateway.

AWS Lambda functions configured in a VPC are assigned private IP addresses only.

Select the appropriate network gateway that allows outbound-only internet access for private subnet resources.

Identify a NAT Gateway placed in a public subnet of the same VPC.

A NAT Gateway translates the private IP addresses of resources in private subnets to a public IP to communicate with the internet.

Update the routing table associated with the private subnet containing the Lambda function.

Add a route for

0.0.0.0/0

pointing to the NAT Gateway's ID.

This routes all non-VPC bound traffic (internet traffic) securely to the NAT Gateway.

Key Concept

VPC Routing and NAT Gateway for private subnet resources

Estimated Time:1m 0s

Question 583Question →

A developer is implementing client-side encryption for an application that processes large database backups with an average size of $15$ GB before uploading them to an Amazon S3 bucket. To comply with corporate security policies, the developer must use AWS KMS and envelope encryption. Which sequence of operations should the developer implement to encrypt the backup files?

Retrieve a symmetric encryption key from AWS Secrets Manager using the GetSecretValue API, encrypt the database backup locally using this key, and upload the encrypted backup along with the secret version ID.

Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.

Call the Encrypt API operation on AWS KMS directly, passing the database backup as the plaintext parameter, and upload the resulting ciphertext to the Amazon S3 bucket.

Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to obtain an encrypted data key, use the encrypted data key to encrypt the database backup locally, and upload the encrypted backup.

Show answer & explanation

Answer: Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.

Answer

The correct approach uses the GenerateDataKey API to obtain both a plaintext key (used for local encryption of the 15 GB file) and an encrypted data key (saved alongside the encrypted file). Discarding the plaintext key from memory after use adheres to the principle of least privilege and prevents memory scraping attacks.

Step-by-Step Solution

Request a data key from AWS KMS.

The application calls the GenerateDataKey API, receiving a plaintext data key and an encrypted data key.

This initiates the envelope encryption process by obtaining the required cryptographic keys.

Perform local encryption using the plaintext key.

The database backup is encrypted locally on the application server.

Because the database backup is 15 GB, it exceeds the 4 KB limit of the KMS Encrypt API and must be encrypted locally.

Clean up memory and upload artifacts.

The plaintext key is deleted from the application memory, and the encrypted backup file and the encrypted data key are uploaded to the S3 bucket.

Erasing the plaintext key from memory minimizes the risk of key exposure. The encrypted data key can be decrypted by KMS later when the backup needs to be restored.

Key Concept

AWS KMS Envelope Encryption

Estimated Time:2m 0s

Question 584Question →

A company runs a high-traffic web application on AWS Elastic Beanstalk. The development team has created a new version of the application that requires custom environment properties and packages a shell script that must run on the underlying EC2 instances during deployment. The deployment must satisfy the following requirements:
- The application must maintain 100% of its serving capacity during the deployment to prevent latency spikes.
- In the event of a deployment failure (such as a health check timeout on the new version), the environment must automatically revert to the previous version with zero downtime and no manual intervention.
- The custom shell script must execute successfully during the deployment before the new version starts receiving production traffic.

Which deployment strategy and configuration action should the developer use to meet these requirements?

Configure the deployment policy to Immutable. Place the configuration file for the shell script inside a directory named .ebextensions at the root of the application source bundle.

Configure the deployment policy to Rolling with additional batch. Place the configuration file for the shell script inside a directory named .ebextensions at the root of the application source bundle.

Configure the deployment policy to Immutable. Place the configuration file for the shell script inside a directory named ebextensions at the root of the application source bundle.

Configure the deployment policy to All at once. Place the configuration file for the shell script inside a directory named .ebextensions at the root of the application source bundle.

Show answer & explanation

Answer: Configure the deployment policy to Immutable. Place the configuration file for the shell script inside a directory named .ebextensions at the root of the application source bundle.

Answer

Configure the deployment policy to Immutable and place the configuration file inside a directory named .ebextensions at the root of the application source bundle.

The Immutable deployment policy fulfills the requirement of maintaining 100% capacity by launching a temporary Auto Scaling group alongside the original one. It also satisfies the automatic rollback requirement because if the health checks fail on the new instances, Elastic Beanstalk automatically deletes the temporary Auto Scaling group, leaving the original instances untouched. Additionally, placing the configuration files in a directory named exactly .ebextensions at the root of the application source bundle ensures that Elastic Beanstalk parses and executes the custom scripts.

Step-by-Step Solution

Analyze the capacity requirement during deployment.

The requirement is to maintain 100% serving capacity. This rules out 'All at once' and standard 'Rolling' policies (which take instances out of service), leaving 'Rolling with additional batch' and 'Immutable' as candidates.

Maintaining capacity avoids performance degradation during updates.

Analyze the rollback requirement.

The environment must automatically and immediately revert on failure with no manual intervention. 'Rolling with additional batch' does not support automated rollback (it halts and requires a manual rollback deployment). Only 'Immutable' automatically terminates the new temporary Auto Scaling group on failure, achieving instant rollback with zero impact on the active group.

An Immutable deployment isolates the new version in a separate Auto Scaling group during validation, allowing safe and automatic cleanup if it fails.

Determine the correct folder path for Elastic Beanstalk configuration files.

Elastic Beanstalk configuration files must reside in the .ebextensions/ folder at the root of the application source bundle. A directory named ebextensions (without the leading dot) will be ignored by Elastic Beanstalk.

Elastic Beanstalk's platform agent specifically looks for the hidden .ebextensions directory to execute configuration scripts.

Key Concept

AWS Elastic Beanstalk deployment policies and .ebextensions configuration

Question 585Question →

A developer needs to encrypt a 5 GB file on an application server using AWS KMS client-side envelope encryption. Which AWS KMS API action should the developer call to obtain both the plaintext data key for local encryption and the encrypted copy of the data key for storage?

Encrypt

GenerateDataKey

GenerateDataKeyWithoutPlaintext

GetSecretValue

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey

The correct action is GenerateDataKey because it returns a plaintext data key for immediate local encryption and an encrypted version of the data key that can be safely stored alongside the encrypted file.

Step-by-Step Solution

Identify the size of the dataset and the encryption model.

The file size is 5 GB, which exceeds the 4 KB direct encryption limit of AWS KMS, requiring client-side envelope encryption.

Large files must be encrypted locally using a data key to avoid network overhead and KMS API payload size limits.

Determine the API call that provides the required keys for envelope encryption.

The developer needs a plaintext data key to perform the local encryption and an encrypted data key to save with the ciphertext.

Envelope encryption relies on having both the plaintext key to encrypt the payload and the encrypted key to bundle with the data for future decryption.

Select the correct KMS API action that returns both keys in a single request.

The GenerateDataKey API action returns both the plaintext data key and the encrypted ciphertext data key.

This single API call satisfies the security workflow without requiring subsequent decryption or extra round trips.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:45s

Question 586Question →

A developer has configured an AWS Lambda function to run inside the private subnets of a VPC so that it can securely query an Amazon RDS PostgreSQL DB instance. The Lambda function also needs to write application execution logs to an Amazon DynamoDB table. During testing, the Lambda function successfully queries the database but times out when trying to write to DynamoDB.

Which configuration change will resolve this connection issue in the most secure and cost-effective manner?

Move the Lambda function to the public subnets of the VPC and enable the public IP assignment setting in the VPC configuration.

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

Update the Lambda function's IAM execution role trust policy to allow the DynamoDB service principal to assume the role.

Store the DynamoDB connection metadata in AWS Secrets Manager instead of Systems Manager Parameter Store and configure automatic rotation.

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

Answer

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

The correct answer is to create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets. A Gateway VPC Endpoint allows private subnets within a VPC to establish a secure, private connection to DynamoDB. The traffic remains within the AWS network, which avoids NAT Gateway processing fees, hourly charges, and the need for public IP addresses or internet routing, making it the most cost-effective and secure solution.

Step-by-Step Solution

Analyze the timeout error occurring during the DynamoDB call.

Determine that the Lambda function in the private subnet lacks a network route to public AWS services.

Lambda functions in private subnets cannot access public AWS endpoints directly without a NAT Gateway or a VPC Endpoint.

Compare connectivity options for accessing DynamoDB from the private subnet.

Identify that a Gateway VPC Endpoint is the most secure and cost-effective method to route traffic directly to DynamoDB.

VPC Endpoints route traffic over the private AWS network, avoiding the data transfer and hourly costs associated with NAT Gateways.

Configure the Gateway VPC Endpoint for DynamoDB.

Associate the endpoint with the route tables of the private subnets where the Lambda function resides.

Associating the endpoint adds the prefix list route to the subnet route tables, allowing traffic to DynamoDB to be routed through the endpoint.

Key Concept

VPC Endpoint configuration for secure and private access to AWS services from private subnets.

Estimated Time:1m 30s

Question 587Question →

An application is deployed on Amazon ECS using the AWS Fargate launch type within private subnets of a custom VPC. The application needs to securely establish a connection to an Amazon Aurora PostgreSQL database located in a database private subnet, using credentials that are automatically rotated. Additionally, the application must connect to an external third-party API on the public internet to process payments. Which configuration steps should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.

Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.

Update the route table of the application's private subnets to route outbound traffic (0.0.0.0/0) directly to an Internet Gateway.

Modify the trust policy of the ECS task role to permit network traffic on port 5432 from the VPC CIDR block.

Save the database credentials in AWS Systems Manager Parameter Store and configure the built-in automatic rotation for the parameters.

Show answer & explanation

Answer: Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.; Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.

Answer

The correct configurations are to deploy a NAT gateway in a public subnet and configure the application private subnet route table to point 0.0.0.0/0 traffic to it, and to update the database security group to permit inbound connections on port 5432 from the ECS task security group.

To allow private ECS Fargate tasks to reach the internet-facing payment API, a NAT Gateway is required in a public subnet with a corresponding route in the private subnet route table. To enable connectivity to the Aurora PostgreSQL database, the database's security group must permit inbound traffic on port 5432 from the security group assigned to the ECS tasks, ensuring only authorized tasks can connect.

Step-by-Step Solution

Determine the requirements for outbound internet access from private subnets.

Identify that AWS Fargate tasks running in private subnets cannot communicate directly with the internet. They require a NAT Gateway deployed in a public subnet with a corresponding route in the private subnet's route table pointing outbound traffic (0.0.0.0/0) to the NAT Gateway.

This configuration enables the tasks to connect to the external payment API while keeping them in private subnets.

Determine the requirements for secure database access within the VPC.

Configuring the security group of the target database to accept traffic on the database port from the source security group of the Fargate tasks.

Referencing security groups instead of IP ranges maintains dynamic, secure access and satisfies least-privilege security standards.

Evaluate the credentials rotation and identity configurations.

Identify that automatic secrets rotation is a feature of AWS Secrets Manager, not Systems Manager Parameter Store, and that IAM trust policies govern role assumption rather than network ports.

This rules out the invalid distractors targeting parameter storage and IAM configuration.

Key Concept

VPC security group referencing and private routing configurations for secure outbound and database traffic.

Question 588Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to connect to an Amazon RDS database in another private subnet and call an external third-party API over the public internet.

Which two network and security configurations are required to establish these connections?

Select all that apply

Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.

Route traffic destined for the internet (

0.0.0.0/0

) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.

Add a route pointing to an Internet Gateway (

0.0.0.0/0

) directly in the route table of the Lambda function's private subnet.

Modify the Lambda execution role's IAM trust policy to grant the database connection permission.

Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation of the parameter to secure the connection.

Show answer & explanation

Answer: Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.; Route traffic destined for the internet ( $0.0.0.0/0$ ) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.

Answer

To establish the required connections, the RDS security group must be configured to allow inbound traffic on the database port from the Lambda function's security group, and a route to a NAT Gateway in a public subnet must be added to the private subnet's route table to allow outbound internet access for external API calls.

The correct configurations involve setting up an inbound security group rule on the RDS database that allows traffic from the Lambda function's security group, and routing internet-bound traffic from the private subnet to a NAT Gateway. This ensures the Lambda function can securely access the database inside the VPC and access external APIs over the internet.

Step-by-Step Solution

Configure database security group rules.

The RDS security group is updated to allow inbound traffic on the database port, referencing the security group of the Lambda function as the source.

This establishes secure, restricted communication between the Lambda function and the RDS database without opening the database to the entire subnet.

Configure private subnet routing for internet access.

A route for

0.0.0.0/0

is added to the private subnet's route table, pointing to a NAT Gateway in a public subnet.

Since the Lambda function is in a private subnet and does not have a public IP address, it cannot access the internet directly. Routing traffic through a NAT Gateway allows outbound-only internet access to call external APIs.

Key Concept

VPC security and connectivity configurations for AWS Lambda, involving Security Groups and NAT Gateways.

Question 589Question →

A developer is migrating a Node.js web application to an AWS Elastic Beanstalk environment running on an Amazon Linux 2023 platform. The application requires two specific configurations:
1. It must execute a custom shell script named `configure-auth.sh` to download and configure an SSL certificate *after* the application files are extracted and staged on the host, but *before* the application process is launched.
2. It must configure a system environment variable named `DB_MAX_CONN` with a value of `100` across all instances.

Which two actions should the developer take to successfully deploy these customizations? (Select TWO.)

Select all that apply

Place the script `configure-auth.sh` in the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has execute permissions.

Create a configuration file named `db.config` containing the option settings for the `aws:elasticbeanstalk:application:environment` namespace and place it in the `.ebextensions/` directory at the root of the source bundle.

Create a configuration file named `db.config` containing the environment settings and place it in a folder named `ebextensions/` (without the leading dot) at the root of the source bundle.

Place the script `configure-auth.sh` in the `.ebextensions/hooks/predeploy/` directory of the application source bundle.

Define the `DB_MAX_CONN` environment variable in the application's package manager configuration (such as `package.json` for Node.js) under a custom Elastic Beanstalk section.

Show answer & explanation

Answer: Place the script `configure-auth.sh` in the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has execute permissions.; Create a configuration file named `db.config` containing the option settings for the `aws:elasticbeanstalk:application:environment` namespace and place it in the `.ebextensions/` directory at the root of the source bundle.

Answer

The developer must place the script in the `.platform/hooks/predeploy/` directory with execution permissions, and place the environment variable configuration file in the `.ebextensions/` directory.

The correct options state that the hook script must be located in `.platform/hooks/predeploy/` with execution permissions, and the configuration file for the environment variable must be located in `.ebextensions/` at the root of the source bundle. Under Amazon Linux 2 and Amazon Linux 2023 platforms, Elastic Beanstalk uses `.platform/hooks/predeploy/` to run custom scripts after the source bundle has been extracted and staged but before the application process is executed. The `.ebextensions/` directory containing configuration files is the standard mechanism to set environment variables through the `aws:elasticbeanstalk:application:environment` namespace.

Step-by-Step Solution

Determine the platform hook structure for Amazon Linux 2023.

Identify that script files must be placed in the `.platform/hooks/` subdirectories to execute during lifecycle stages (specifically `predeploy` for actions after staging but before running).

Elastic Beanstalk's Amazon Linux 2 and Amazon Linux 2023 platforms use `.platform/hooks/` instead of older platform hooks methods.

Ensure script execution permission.

Add execution permission (`chmod +x`) to `configure-auth.sh` before archiving the bundle.

Scripts in platform hooks must be executable to run successfully.

Determine environment variable configuration location.

Identify that the standard configuration directory is `.ebextensions/` (with a leading dot).

Elastic Beanstalk reads configuration files matching `*.config` in the `.ebextensions/` directory at the root of the source bundle.

Specify namespace and variable value.

Use `aws:elasticbeanstalk:application:environment` configuration namespace to set `DB_MAX_CONN` to `100`.

This is the correct namespace to inject system environment variables into the application runtime.

Key Concept

AWS Elastic Beanstalk Amazon Linux 2/2023 Platform Customization via .platform and .ebextensions

Estimated Time:3m 0s

Question 590Question →

A developer is designing a new mobile application that allows users to sign up, sign in, and upload their personal fitness data files directly to a private Amazon S3 bucket. To ensure high security and scalability, the application must verify user identities, support social identity providers, and obtain temporary AWS credentials with fine-grained access policies restricted to each user's specific S3 folder (e.g., s3://fitness-app-data/user-id/). Which architecture represents the most secure and standard way to implement this authentication and authorization flow?

Authenticate users through an Amazon Cognito User Pool. Exchange the resulting identity token with an Amazon Cognito Identity Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.

Authenticate users through an Amazon Cognito Identity Pool to manage the user directory and federation. Exchange the resulting session token with an Amazon Cognito User Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.

Authenticate users through an Amazon Cognito User Pool. Call an Amazon API Gateway endpoint secured by a custom Lambda Authorizer that validates the identity token, calls AWS Security Token Service (STS) to generate temporary credentials, and returns them to the mobile application.

Authenticate users through an Amazon Cognito User Pool. Configure the application to use the User Pool client's client secret to directly assume an IAM role whose trust policy references the Cognito User Pool's Client ID.

Show answer & explanation

Answer: Authenticate users through an Amazon Cognito User Pool. Exchange the resulting identity token with an Amazon Cognito Identity Pool to obtain temporary AWS credentials, which are mapped to an IAM role that grants access to the specific S3 folder.

Answer

The correct solution leverages Cognito User Pools to handle user sign-up, sign-in, and federation (authentication), yielding an ID token. This token is then provided to Cognito Identity Pools, which maps it to an IAM role to retrieve temporary, limited-privilege AWS credentials (authorization). This allows the mobile application to securely upload files directly to S3 using the temporary credentials, optimizing performance and security.

Step-by-Step Solution

Use Amazon Cognito User Pools to authenticate the user.

The user authenticates and the client application receives JSON Web Tokens (JWTs), specifically ID and Access tokens.

User Pools are designed to manage directories, handle user registration, and authenticate users.

Pass the received ID token to an Amazon Cognito Identity Pool.

The Identity Pool authenticates the token against the configured User Pool identity provider.

Identity Pools validate external identity provider tokens (like Cognito User Pools, Google, or Facebook) to establish identity.

Acquire temporary AWS credentials from the Identity Pool.

The Identity Pool assumes the associated IAM role and returns temporary AWS credentials (Access Key, Secret Key, and Session Token) to the mobile application.

This grants the client temporary, restricted access to AWS resources directly.

Use the temporary credentials to upload the fitness data files directly to the Amazon S3 bucket.

The client performs a secure, direct upload to the S3 folder mapping to the user's Cognito identity ID.

This minimizes backend application server overhead by offloading file uploads directly to S3.

Key Concept

Amazon Cognito User Pools vs. Identity Pools integration for AWS resource access.

Estimated Time:2m 0s

Question 591Question →

A developer needs to deploy a new version of a high-traffic web application to an AWS Elastic Beanstalk environment. The deployment must satisfy the following requirements:
- The environment must maintain $100\%$ of its current instance capacity during the deployment to prevent performance degradation.
- In the event of a deployment failure, the rollback process must be quick and have zero impact on the active, healthy instances currently serving production traffic.
- Custom environment properties and configuration files must be applied automatically as part of the application source bundle.

Which deployment strategy and configuration approach should the developer use?

Use the Rolling deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

Use the Rolling with additional batch deployment policy, and place the configuration files in an ebextensions folder at the root of the source bundle.

Use the Immutable deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

Use the All at once deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

Show answer & explanation

Answer: Use the Immutable deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

Answer

Use the Immutable deployment policy, and place the configuration files in a .ebextensions folder at the root of the source bundle.

The Immutable deployment policy ensures that a completely new set of instances (in a temporary Auto Scaling group) is created to deploy the new version alongside the existing instances. This maintains

100\%

capacity of the original environment during the deployment. If the deployment fails, Elastic Beanstalk terminates the new Auto Scaling group, causing zero impact to the original, running instances and allowing an instant rollback. Custom configuration files must be located in a folder named .ebextensions (with a leading dot) at the root of the application source bundle to be processed by Elastic Beanstalk.

Step-by-Step Solution

Analyze the capacity requirement during deployment

The requirement specifies that the application must maintain

100\%

capacity during deployment. This rules out the Rolling policy, which reduces instance capacity as it updates batches.

To maintain

100\%

capacity, the deployment policy must provision additional instances before taking existing ones out of service or updating them.

Analyze the rollback and failure recovery requirement

The rollback must be instant and have zero impact on the existing running instances. Rolling with additional batch requires a rolling rollback to redeploy the previous version, whereas Immutable creates a parallel Auto Scaling group that can be instantly terminated upon failure without touching the original instances.

Immutable deployment offers the cleanest and fastest rollback mechanism because the original production environment remains untouched until the new version passes health checks.

Verify the configuration file directory naming convention

Elastic Beanstalk requires configuration files to be placed in a folder named .ebextensions (with a leading dot) at the root of the source bundle. Misnaming it as ebextensions causes the configuration to be ignored.

Elastic Beanstalk specifically scans for the .ebextensions directory at the root level of the application zip archive during provisioning.

Key Concept

AWS Elastic Beanstalk Deployment Policies and Configuration Files

Question 592Question →

A developer is implementing a microservice using an AWS Lambda function that retrieves database credentials from AWS Secrets Manager and then connects to an Amazon RDS PostgreSQL database. The RDS database is hosted in private subnets within a VPC. To secure the database connection, the developer configures the Lambda function to run inside the same VPC and private subnets. However, during testing, the Lambda function execution times out during the SDK client initialization and call to Secrets Manager.

Which configuration change should the developer implement to resolve this issue while maintaining the most secure architecture?

Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.

Modify the Lambda function configuration to associate it with public subnets and enable public IP address assignment to allow it to communicate directly with the public endpoint of AWS Secrets Manager.

Update the trust policy of the Lambda function's IAM execution role to trust the AWS Secrets Manager service principal (secretsmanager.amazonaws.com), allowing it to push credentials to the execution environment.

Migrate the database credentials from AWS Secrets Manager to the AWS Systems Manager Parameter Store as a SecureString, since Parameter Store is natively accessible within private subnets without additional routing configurations.

Show answer & explanation

Answer: Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.

Answer

The correct configuration is to create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets. This registers Elastic Network Interfaces (ENIs) with private IP addresses in the VPC subnets that route traffic directly to AWS Secrets Manager over the AWS internal network. By allowing outbound HTTPS (port

443

) from the Lambda function's security group to the VPC endpoint's security group, the Lambda function can resolve the endpoint privately and securely retrieve the database credentials.

Step-by-Step Solution

Analyze the network path of the Lambda function running inside the private VPC subnets.

The Lambda function has access to VPC resources (like the RDS database) but lacks direct access to the public internet because there is no NAT Gateway or internet gateway routing in the private route table.

By default, AWS service endpoints like AWS Secrets Manager are public, requiring internet access or a private endpoint to connect from within a VPC.

Determine the most secure method to access AWS Secrets Manager without routing traffic over the public internet.

Identify that AWS PrivateLink allows creating Interface VPC Endpoints inside the VPC subnets.

VPC Endpoints provide private, secure access to AWS services by assigning private IP addresses from the VPC subnets directly to the endpoint.

Configure the security groups for both the Lambda function and the Interface VPC Endpoint.

The Lambda function's security group must allow outbound HTTPS (port

443

) to the VPC endpoint, and the VPC endpoint's security group must allow inbound HTTPS (port

443

) from the Lambda function.

Security groups are stateful and must explicitly allow the necessary traffic directions to establish the TCP connection.

Key Concept

VPC Endpoints (AWS PrivateLink) enable private connectivity between VPC resources and supported AWS services without internet traversal.

Estimated Time:2m 0s

Question 593Question →

A developer is designing a serverless multi-tenant SaaS application. The frontend client sends requests to an Amazon API Gateway REST API backed by AWS Lambda. The application uses an external OpenID Connect (OIDC) identity provider for user authentication. The API must validate the signature and expiration of the incoming JSON Web Token (JWT). In addition, access to specific resource paths and HTTP methods must be dynamically controlled based on the user's tenant ID and user role claims embedded in the JWT. The backend Lambda function needs to receive these validated claims to perform tenant-specific business logic without re-decoding or re-validating the token. Which solution meets these requirements with the lowest latency and follows security best practices?

Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.

Configure a Cognito User Pools Authorizer on API Gateway and federate the external OIDC identity provider with the user pool. In the backend Lambda function, extract the JWT from the authorization header, manually decode it, and validate its signature. Use custom code in the backend Lambda function to enforce path-based authorization and log tenant activity.

Configure a Cognito Identity Pool and integrate the external OIDC identity provider. Have the client exchange the OIDC JWT for temporary AWS credentials using the Cognito Identity Pool, configure the API Gateway API to use IAM Authorization, and parse the OIDC JWT inside the backend Lambda function to retrieve the tenant ID and user role for logging.

Create a Lambda Token Authorizer in API Gateway to validate the JWT. In the authorizer function, return an IAM policy allowing access. Since the Lambda Proxy Integration does not support forwarding custom authorizer metadata directly, configure a custom integration mapping template to extract the JWT claims from the header and map them to a custom JSON payload sent to the backend Lambda function.

Show answer & explanation

Answer: Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.

Answer

The correct solution uses a Lambda Request Authorizer to perform custom validation of an external OIDC token and dynamically generate an IAM policy based on the claims (tenant ID and user role) extracted from the token. By returning these claims in the context object of the authorizer's response, API Gateway automatically passes them to the backend Lambda function via the requestContext.authorizer property of the proxy integration event. This keeps latency low, prevents the backend from having to parse or validate the token again, and enforces authorization at the API Gateway layer.

Step-by-Step Solution

Select the appropriate API Gateway authorizer type for external OIDC JWT validation and dynamic routing/authorization policy generation.

A Lambda Request Authorizer is selected because it receives request details (path, method, headers) along with the token, allowing it to perform custom OIDC JWT signature validation and dynamically generate a fine-grained IAM policy.

Cognito User Pools authorizers cannot dynamically generate customized IAM policies based on custom claims for arbitrary external OIDC tokens directly, and Cognito Identity Pools add unnecessary latency by requiring a token-to-credential exchange.

Design the Lambda Authorizer logic to validate the JWT and extract claims.

The Lambda Authorizer validates the JWT signature against the external IdP's JWKS endpoint and verifies the claims.

Validation must occur at the API Gateway level to reject unauthorized traffic before it reaches the backend, saving cost and minimizing latency.

Generate the IAM policy and the context map in the authorizer response.

The authorizer returns an IAM Policy allowing/denying access to specific method ARNs based on user role and tenant, along with a custom context map containing the user's tenant ID and role.

API Gateway uses the returned IAM policy to authorize the request and passes the context map to the backend integration.

Forward the claims to the backend Lambda function via Lambda Proxy Integration.

The backend Lambda function accesses the context properties directly via the requestContext.authorizer event path (e.g., event.requestContext.authorizer.tenantId).

This eliminates the need for custom mapping templates or decoding the token again in the backend Lambda function.

Key Concept

API Gateway Lambda Authorizers with custom context propagation

Question 594Question →

A developer is designing a Single Page Application (SPA) that requires user authentication through external social identity providers (IdPs). Once authenticated, the SPA must perform two operations:
1. Make HTTP requests to a backend REST API hosted on Amazon API Gateway, which requires access control based on user group membership.
2. Upload user-profile images directly to an Amazon S3 bucket folder specific to each authenticated user (`s3://user-profiles-bucket/uploads/user-id/`).

The developer wants to implement a solution that minimizes custom backend code, maintains a native OAuth 2.0 flow, and adheres to the principle of least privilege.

Which combination of configuration steps meets these requirements?

Configure a Cognito User Pool with the social IdPs and use the Authorization Code Flow with PKCE. Integrate API Gateway using a Cognito User Pool Authorizer. Configure a Cognito Identity Pool with the User Pool as the provider, and assign an authenticated IAM role with a policy allowing `s3:PutObject` on the S3 path using the `${cognito-identity.amazonaws.com:sub}` policy variable.

Configure a Cognito User Pool with the social IdPs. Create a custom API Gateway Lambda Authorizer to validate the token and perform custom group checks. Have the Lambda Authorizer call `sts:AssumeRole` on a role trusting API Gateway, and return the temporary credentials to the SPA to perform S3 uploads.

Configure a Cognito Identity Pool to federate directly with the social IdPs, bypassing the Cognito User Pool. Use API Gateway with IAM Authorization. Assign an IAM role to the Identity Pool that allows `s3:PutObject` on the S3 path using the `${cognito-idp.amazonaws.com:sub}` policy variable.

Configure a Cognito User Pool and a Cognito Identity Pool. Integrate API Gateway with a Cognito User Pool Authorizer. In the Cognito Identity Pool, configure the authenticated IAM role trust policy to trust the API Gateway service principal (`apigateway.amazonaws.com`) and configure the permission policy to allow `s3:PutObject` using the `${aws:username}` variable.

Show answer & explanation

Answer: Configure a Cognito User Pool with the social IdPs and use the Authorization Code Flow with PKCE. Integrate API Gateway using a Cognito User Pool Authorizer. Configure a Cognito Identity Pool with the User Pool as the provider, and assign an authenticated IAM role with a policy allowing `s3:PutObject` on the S3 path using the `${cognito-identity.amazonaws.com:sub}` policy variable.

Answer

The correct solution uses a Cognito User Pool for user authentication (directory) with social IdPs and the OAuth 2.0 Authorization Code Flow with PKCE, which is the recommended flow for SPAs. API Gateway natively integrates with Cognito User Pools using a built-in Cognito User Pool Authorizer, which validates the JWT ID or access token without custom code. For S3 access, a Cognito Identity Pool is used to exchange the User Pool token for temporary AWS credentials. The IAM policy for the authenticated role uses the `${cognito-identity.amazonaws.com:sub}` context variable to restrict users to their own folders.

Step-by-Step Solution

Authenticate the user in the Single Page Application using an OAuth 2.0 flow.

The SPA uses the Authorization Code Flow with PKCE with the Cognito User Pool to securely obtain ID, Access, and Refresh tokens.

PKCE is the security standard for SPAs to prevent authorization code interception attacks.

Authorize requests to the REST API hosted on Amazon API Gateway.

A Cognito User Pool Authorizer validates the ID token passed in the Authorization header and passes group membership information to backend integration context.

This utilizes a native, built-in authorizer that requires zero custom code, maximizing cost-effectiveness and security.

Acquire temporary AWS credentials for direct S3 upload.

The SPA exchanges the User Pool tokens for temporary AWS credentials via a Cognito Identity Pool.

Cognito User Pools handle authentication (identity directory), while Cognito Identity Pools handle authorization (generating temporary AWS credentials for AWS services).

Apply a fine-grained access control policy to the S3 bucket.

The authenticated IAM role's policy restricts access to the user's specific folder using the `${cognito-identity.amazonaws.com:sub}` variable.

This variable dynamically resolves to the user's unique Cognito Identity ID, enforcing least privilege access control.

Key Concept

Cognito User Pools manage user directory and authentication, while Cognito Identity Pools grant temporary AWS credentials to authenticated users. API Gateway integrates natively with User Pools using Cognito User Pool Authorizers.

Question 595Question →

A developer is implementing local client-side envelope encryption for sensitive reports in a microservice before uploading them to Amazon S3. To optimize costs and network overhead, the developer aims to generate a unique data key for each report using a customer managed key in AWS KMS. However, during integration testing, the developer observes that each file encryption requires two sequential AWS KMS API calls, which is causing latency and doubling API billing. The current implementation performs `kmsClient.generateDataKeyWithoutPlaintext(...)` followed by `kmsClient.decrypt(...)`. Which modification to the code should the developer make to reduce the integration to a single AWS KMS API call per report?

Replace the `generateDataKeyWithoutPlaintext` call with `encrypt` using the customer managed key to directly encrypt the report payload, and use the `decrypt` call to decrypt it upon retrieval.

Store a pre-generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, retrieve it with a single call, and use the KMS `decrypt` API only to verify its integrity.

Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.

Change the second call to `reEncrypt` to convert the ciphertext data key into a format readable by the local encryption utility, bypassing the need for a plaintext key.

Show answer & explanation

Answer: Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.

Answer

The correct solution is to change the API call to `generateDataKey`. Under envelope encryption, the client requires the plaintext data key to encrypt the payload locally, and the ciphertext data key to store alongside the encrypted payload. The `generateDataKey` operation returns both in a single response, removing the need for a separate, subsequent call to the `decrypt` API to extract the plaintext key.

Step-by-Step Solution

Analyze the purpose of the current KMS API calls.

The application calls `generateDataKeyWithoutPlaintext` which only returns the encrypted (ciphertext) data key. Because it lacks the plaintext key to encrypt the payload, it must make a second call using the `decrypt` API.

Understanding the current behavior helps identify where the redundant call originates.

Select the appropriate KMS API operation for client-side envelope encryption.

Identify that the `generateDataKey` API operation returns both the plaintext data key and the ciphertext data key in a single payload.

This operation satisfies the requirements of envelope encryption by providing the plaintext key immediately for local encryption while providing the ciphertext key for storage.

Refactor the code to eliminate the secondary call.

Replace the initial call with `generateDataKey`, use the returned plaintext key to encrypt the file locally, discard the plaintext key from memory after use, and save the ciphertext key to Amazon S3 alongside the encrypted report.

This reduces the integration to a single KMS API request, minimizing latency and API costs by

50\%

Key Concept

AWS KMS Envelope Encryption Workflow Optimization

Question 596Question →

A developer is implementing an AWS Lambda function that must query an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager and send HTTP POST requests to an external API endpoint over the public internet.

Which network and security configuration should the developer implement to meet these requirements securely while adhering to the principle of least privilege?

Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port

5432

to the database security group and outbound HTTPS traffic on port

443

. Configure the private subnets' route table to route

0.0.0.0/0

traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port

5432

only from the Lambda function's security group.

Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port

5432

to the database security group and outbound HTTPS traffic on port

443

. Configure the private subnets' route table to route

0.0.0.0/0

traffic directly to the Internet Gateway. Configure the database security group to allow inbound traffic on port

5432

only from the Lambda function's security group.

Deploy the Lambda function in the public subnets to ensure it has native internet access to reach Secrets Manager and the external API. Store the database credentials in Systems Manager Parameter Store as a standard String parameter. Configure the database security group to allow inbound traffic on port

5432

from the public subnet CIDR blocks.

Deploy the Lambda function in the private subnets. Configure the database security group to allow inbound traffic on port

5432

from

0.0.0.0/0

. Attach an IAM policy to the Lambda execution role that allows the `sts:AssumeRole` action on the database, and modify the database's IAM trust policy to trust the Lambda function's execution role.

Show answer & explanation

Answer: Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port $5432$ to the database security group and outbound HTTPS traffic on port $443$ . Configure the private subnets' route table to route $0.0.0.0/0$ traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port $5432$ only from the Lambda function's security group.

Answer

Deploy the Lambda function in the private subnets, configure a NAT Gateway in a public subnet to route

0.0.0.0/0

traffic, and associate a security group with the Aurora database that allows inbound traffic on port

5432

only from the Lambda security group.

The correct network configuration places both the Lambda function and the database in private subnets. Outbound internet access for the Lambda function (to access the external payment gateway and public Secrets Manager endpoints) is enabled by routing

0.0.0.0/0

traffic through a NAT Gateway in a public subnet. Database access is securely restricted at the network layer by configuring the database's security group to allow inbound connections on port

5432

only from the Lambda function's security group.

Step-by-Step Solution

Determine the placement of the Lambda function and the database.

Both resources are placed inside private VPC subnets to isolate them from direct public internet exposure.

This is required to protect the database and application layer in accordance with the AWS Well-Architected Framework.

Provide outbound internet connectivity for the Lambda function.

Route the private subnets'

0.0.0.0/0

traffic to a NAT Gateway situated in a public subnet.

The Lambda function needs internet access to communicate with the external API and public endpoints for Secrets Manager, but it lacks public IP addresses itself.

Configure the security groups for secure, localized communication.

Allow outbound port

5432

and port

443

traffic on the Lambda security group, and configure the database security group to allow inbound port

5432

traffic only when originating from the Lambda security group.

This implements the principle of least privilege by strictly restricting database access to the Lambda function at the network layer.

Key Concept

AWS Lambda VPC networking, Security Group referencing, and NAT Gateway routing for private-to-public subnet communication.

Question 597Question →

A developer is securing a new Amazon API Gateway REST API. The developer wants to restrict access so that only authenticated users from an Amazon Cognito User Pool can call the API. Which TWO configuration steps are required to set up this built-in authorization mechanism?

Select all that apply

Create an API Gateway authorizer of type Cognito and configure it with the Amazon Cognito User Pool details.

Set the authorization type of the API method to the Cognito authorizer that was created.

Create an API Gateway authorizer of type Cognito and configure it with the Amazon Cognito Identity Pool ID.

Create an API Gateway Lambda authorizer to manually decode and validate the Cognito JSON Web Token (JWT).

Enable Lambda proxy integration and write custom logic in the backend function to validate the client's IAM credentials.

Show answer & explanation

Answer: Create an API Gateway authorizer of type Cognito and configure it with the Amazon Cognito User Pool details.; Set the authorization type of the API method to the Cognito authorizer that was created.

Answer

To implement native Amazon Cognito User Pools authorization for an API Gateway REST API, the developer must first create an authorizer of type Cognito linked to the Cognito User Pool, and then configure the target API methods to use this authorizer.

To secure an API using built-in Cognito validation, API Gateway requires setting up a Cognito authorizer that targets the Cognito User Pool containing the user identities, and then configuring the API methods to enforce this authorization setting.

Step-by-Step Solution

Define a Cognito user pool authorizer in API Gateway

API Gateway is configured with the metadata of the User Pool to validate incoming tokens.

This establishes the link between API Gateway and the Cognito User Pool identity provider.

Configure the API method to use the authorizer

The authorization setting on the method execution is updated to the newly created authorizer.

This secures the specific endpoint, ensuring incoming requests are automatically validated using the Cognito token before routing to the integration backend.

Key Concept

API Gateway Cognito User Pools Authorizer configuration

Question 598Question →

A developer needs to configure an update strategy for an application running on AWS Elastic Beanstalk. The application must maintain $100\%$ of its provisioned capacity throughout the deployment process to avoid performance degradation. Which two Elastic Beanstalk deployment policies will ensure that capacity is never reduced during the update? (Select TWO)

Select all that apply

Immutable

Rolling with additional batch

Rolling

All at once

Blue/Green

Show answer & explanation

Answer: Immutable; Rolling with additional batch

Answer

The Immutable and Rolling with additional batch deployment policies both ensure that capacity is never reduced during the update.

The Immutable and Rolling with additional batch deployment policies both maintain

100\%

of the environment's provisioned capacity during an update. Immutable launches a temporary Auto Scaling group to deploy the new version, while Rolling with additional batch launches an extra batch of instances before updating existing ones. In both cases, the existing healthy capacity is never reduced.

Step-by-Step Solution

Analyze the capacity requirement during deployment

The application requires

100\%

of its provisioned capacity to be active at all times.

To prevent performance degradation during the update process.

Evaluate in-environment Elastic Beanstalk deployment policies

Immutable deployment deploys to a new temporary Auto Scaling group before switching, and Rolling with additional batch launches an extra batch of instances before updating existing ones. Both keep existing instances fully operational.

To select the strategies that do not take existing capacity offline without replacement.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on environment capacity.

Question 599Question →

A developer is designing a new web application where users must register and log in. Once authenticated, the application needs to retrieve temporary AWS credentials to allow the client-side code to download user-specific files directly from an Amazon S3 bucket.

Which two Amazon Cognito features should be configured to meet these requirements? (Select TWO.)

Select all that apply

An Amazon Cognito user pool to handle user registration, sign-in, and profile management.

An Amazon Cognito identity pool to exchange authentication tokens for temporary AWS credentials.

An Amazon API Gateway Lambda authorizer to generate and return temporary AWS Security Token Service (STS) credentials.

An IAM trust policy applied directly to the user pool client to authorize read access to Amazon S3.

An Amazon Cognito user pool client configured with an inline IAM policy to delegate access keys directly to the client browser.

Show answer & explanation

Answer: An Amazon Cognito user pool to handle user registration, sign-in, and profile management.; An Amazon Cognito identity pool to exchange authentication tokens for temporary AWS credentials.

Answer

Configure an Amazon Cognito user pool for user registration, authentication, and sign-in, and an Amazon Cognito identity pool to exchange authentication tokens for temporary AWS credentials.

To build this solution, the developer must configure an Amazon Cognito user pool for authentication (user registration and sign-in) and an Amazon Cognito identity pool for authorization (exchanging user pool tokens for temporary AWS credentials to access S3).

Step-by-Step Solution

Determine the service needed for user authentication, registration, and directory management.

Identify that Amazon Cognito user pools act as the identity provider to authenticate users and manage their profiles.

User pools are specifically designed to handle authentication flows, sign-ups, and password management.

Determine how to authorize authenticated users to access AWS resources like Amazon S3 directly from the client.

Identify that Amazon Cognito identity pools are required to exchange the user pool token for temporary AWS credentials.

Identity pools map authenticated users to IAM roles, granting temporary, limited-privilege credentials via AWS STS.

Key Concept

Distinction between authentication (Cognito User Pools) and authorization/temporary credentials (Cognito Identity Pools)

Question 600Question →

A shipping company is developing a web application that allows customers to track their cargo packages. The application must prompt users to register and log in to view their tracking history. After logging in, the client application must make authorized requests to a backend API hosted on Amazon API Gateway. The developer wants to use a standard, built-in solution to authenticate users and validate their login tokens without writing custom authentication code. Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool to handle user registration, authentication, and token generation.

Create a built-in Cognito User Pool Authorizer in Amazon API Gateway to validate the incoming tokens.

Configure an Amazon Cognito Identity Pool to authenticate the users and issue JSON Web Tokens (JWTs) to the client application.

Deploy a custom Amazon API Gateway Lambda Authorizer to decode and validate the tokens generated by Cognito.

Modify the IAM trust policy of the backend API Gateway to trust the Cognito User Pool identity provider client.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration, authentication, and token generation.; Create a built-in Cognito User Pool Authorizer in Amazon API Gateway to validate the incoming tokens.

Answer

The developer should configure an Amazon Cognito User Pool to handle user registration and authentication, and create a built-in Cognito User Pool Authorizer in Amazon API Gateway to validate the incoming tokens.

To fulfill the requirements, an Amazon Cognito User Pool must be used because it provides the user directory, sign-up, sign-in, and issues the JSON Web Tokens (JWTs) needed for authentication. Then, the API Gateway Cognito User Pool Authorizer should be used because it is the built-in, no-code mechanism to validate these tokens at the API gateway layer.

Step-by-Step Solution

Set up a user directory.

Create an Amazon Cognito User Pool to manage user registration, authentication flows, and token issuance.

User Pools act as the identity provider that authenticates users and generates JSON Web Tokens (JWTs).

Secure the API Gateway endpoint.

Configure a built-in Cognito User Pool Authorizer on the API Gateway resource/method.

This native authorizer validates the JWTs generated by the User Pool directly within the API Gateway layer without requiring custom Lambda functions.

Key Concept

Amazon Cognito User Pools vs. Identity Pools, and native API Gateway integration

Estimated Time:1m 0s

PreviousPage 30 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept