Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 601Question →

A containerized microservice deployed on AWS Fargate inside a private VPC subnet needs to write transaction logs to an Amazon DynamoDB table and send real-time confirmation callbacks to an external payment processor at 198.51.100.50/32198.51.100.50/32. According to company security requirements, all database traffic must remain within the AWS network, and outbound traffic from the Fargate container must be restricted to only the payment processor and the DynamoDB service. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB, and associate it with the route table of the private subnet.; Configure the Fargate security group with outbound rules allowing HTTPS traffic on port 443443 to 198.51.100.50/32198.51.100.50/32 and to the AWS-managed prefix list representing DynamoDB.

Answer

Create a Gateway VPC Endpoint for DynamoDB associated with the private subnet's route table, and configure the Fargate security group with outbound rules allowing HTTPS traffic to the payment processor IP address and to the AWS-managed prefix list representing DynamoDB.
To secure DynamoDB traffic, a Gateway VPC Endpoint is created and associated with the private subnet's route table, which routes traffic to the service privately. To satisfy outbound restrictions, the Fargate task's security group is configured with egress rules allowing HTTPS traffic to the specific external payment processor IP address and to the AWS-managed prefix list representing DynamoDB.

Step-by-Step Solution

1
Create a Gateway VPC Endpoint for Amazon DynamoDB.
A gateway endpoint is provisioned in the VPC, associated with an AWS-managed prefix list representing DynamoDB.
Allows private connectivity to DynamoDB within the AWS network.
2
Associate the Gateway VPC Endpoint with the route table of the private subnet where Fargate runs.
The route table is updated with a route directing traffic for the DynamoDB prefix list to the Gateway VPC Endpoint.
Ensures that the private subnet's routing logic forwards database-bound requests directly to the endpoint.
3
Define outbound rules on the Fargate service security group.
An egress rule allows HTTPS (port 443443) traffic to destination 198.51.100.50/32198.51.100.50/32, and another egress rule allows traffic to the DynamoDB prefix list.
Enforces strict network boundaries, allowing outbound connections only to the payment processor and DynamoDB.

Key Concept

VPC Gateway Endpoints and security group prefix lists are used to route and restrict outbound traffic from private resources to specific AWS services and external targets.
Estimated Time:3m 0s
Question 602Question →

An application needs to encrypt large files locally before uploading them to Amazon S3. The developer decides to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. The developer calls the GenerateDataKey API operation.

Which two components are returned by this API call to enable envelope encryption? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A plaintext data key, which the application uses to encrypt the data.; An encrypted copy of the data key (ciphertext), which is stored with the encrypted data.

Answer

The API returns a plaintext data key for immediate encryption and an encrypted data key (ciphertext) to be stored alongside the encrypted data.
In client-side envelope encryption, the GenerateDataKey API operation returns a plaintext data key and an encrypted data key. The plaintext data key is used by the application to encrypt the files locally. The encrypted data key is stored alongside the encrypted files so that it can be sent back to KMS for decryption in the future.

Step-by-Step Solution

1
Analyze the request for client-side envelope encryption using the GenerateDataKey API.
The application needs to encrypt data locally, which requires a local key.
Understanding the core flow of envelope encryption where encryption happens on the client side using a locally generated symmetric key.
2
Determine the output of the GenerateDataKey API operation.
AWS KMS returns both the plaintext data key and the encrypted data key.
The plaintext key is required for immediate local encryption, and the encrypted key is required for future decryption when requesting KMS to decrypt it.

Key Concept

AWS KMS Envelope Encryption Workflow
Question 603Question →

A startup is deploying a web portal where authenticated customers can manage their profiles. The application front-end is a React application hosted on Amazon S3. The back-end consists of REST APIs hosted on Amazon API Gateway and powered by AWS Lambda. The developer must implement a secure sign-in mechanism for customers and ensure the REST APIs validate the user's authentication tokens. The solution must minimize custom development effort and optimize runtime efficiency.

Which two configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Set up an Amazon Cognito User Pool to serve as the user directory and handle user registration and login flows.; Configure a COGNITO_USER_POOLS authorizer on the Amazon API Gateway REST API to automatically validate the client's JSON Web Tokens.

Answer

To implement this architecture, the developer must set up an Amazon Cognito User Pool to act as the user directory and handle sign-in, and configure a native COGNITO_USER_POOLS authorizer on API Gateway to validate the client's JWTs.
Deploying an Amazon Cognito User Pool provides the required user directory, sign-in flow, and JWT token issuance. Combining this with the built-in COGNITO_USER_POOLS authorizer in API Gateway ensures that incoming JWTs are validated automatically without requiring any custom Lambda code, maintaining a cost-effective and low-maintenance configuration.

Step-by-Step Solution

1
Determine the user authentication and directory management service.
Choose Amazon Cognito User Pools.
Cognito User Pools serve as user directories and handle user signup, sign-in, and token generation natively.
2
Select the API Gateway authorizer that validates the Cognito JWTs with minimal code.
Choose the built-in API Gateway Cognito User Pools authorizer.
This authorizer natively validates Cognito user pool tokens without custom Lambda code, meeting the criteria for low custom effort and runtime efficiency.

Key Concept

Configuring secure authentication and authorization by integrating Amazon Cognito User Pools with API Gateway using the built-in authorizer.
Estimated Time:1m 30s
Question 604Question →

A microservice running on AWS Lambda needs to perform local client-side envelope encryption on application log files that range from 1010 MB to 5050 MB in size before storing them in an on-premises archive. The microservice must use a customer managed key in AWS KMS.

Which of the following configuration and SDK coding steps should the developer perform to implement this securely with minimum privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Call the `GenerateDataKey` API operation in the application code, using the plaintext data key to encrypt the log file locally, and discard the plaintext key from memory immediately after encryption.; Add `kms:GenerateDataKey` permissions to the Lambda function's IAM execution role for the specific ARN of the customer managed key.

Answer

To implement local client-side envelope encryption for large files with minimum privilege, the developer must call `GenerateDataKey` in the application code to obtain the plaintext and ciphertext data keys, and grant `kms:GenerateDataKey` permissions on the customer managed key to the Lambda execution role.
For files larger than 44 KB, local client-side envelope encryption must be utilized. Calling the `GenerateDataKey` API operation provides the plaintext key required to encrypt the logs locally and the ciphertext key to store along with the encrypted logs. The Lambda execution role must be granted permissions to execute `kms:GenerateDataKey` on the specific customer managed key's ARN to adhere to the principle of least privilege.

Step-by-Step Solution

1
Analyze the size of the data to be encrypted (1010 MB to 5050 MB) to determine the encryption method.
Direct encryption via the KMS `Encrypt` API is ruled out due to its 40964096 bytes limit, indicating that local client-side envelope encryption is required.
Understanding KMS payload limits is necessary to select the correct encryption workflow.
2
Determine the correct KMS API operation to generate encryption keys.
The application must call `GenerateDataKey` to retrieve both the plaintext data key (for local encryption) and the ciphertext data key (for storage).
Calling `GenerateDataKeyWithoutPlaintext` would not yield the plaintext key needed to perform the encryption.
3
Configure the Lambda execution role's IAM policy for least privilege access to the KMS key.
Allow the `kms:GenerateDataKey` action on the specific ARN of the customer managed key.
Granting permissions on AWS managed keys like `aws/s3` is incorrect because the key policies cannot be modified and the resource constraint must point to the customer managed key.

Key Concept

AWS KMS Envelope Encryption Workflow and IAM Permissions
Estimated Time:2m 0s
Question 605Question →

An organization is deploying a multi-tenant backend on Amazon API Gateway. The developer must implement security and authorization for two specific API resources:

1. A `/dashboard` resource that needs to validate identity tokens generated by an Amazon Cognito User Pool. The validation must be handled natively by API Gateway to minimize latency and avoid executing custom backend code.
2. A `/partner-integration` resource that must validate custom OAuth 2.0 tokens issued by a third-party partner's identity provider, using custom validation and database lookups.

Which TWO configuration steps should the developer perform to secure these resources?

Select all that apply

Show answer & explanation

Answer: Create a Cognito User Pools authorizer for the API and configure the `/dashboard` methods to use this authorizer.; Create a Lambda authorizer for the API and configure the `/partner-integration` methods to use it to validate the third-party tokens.

Answer

Create a Cognito User Pools authorizer for the dashboard resource, and a Lambda authorizer to handle the custom third-party token validation for the partner integration resource.
To authenticate requests using Amazon Cognito User Pools without writing custom code, API Gateway provides a built-in Cognito User Pools authorizer. For validating third-party OAuth 2.0 tokens that require custom logic and database lookups, a Lambda authorizer must be implemented.

Step-by-Step Solution

1
Analyze the requirements for the dashboard resource
The dashboard needs native validation of Amazon Cognito User Pool tokens without custom code, pointing to the built-in Cognito User Pools authorizer.
This offloads JWT validation to API Gateway directly.
2
Analyze the requirements for the partner integration resource
The partner integration requires custom database lookups and custom token validation for a third-party provider, pointing to a Lambda authorizer.
Built-in authorizers do not support custom third-party OAuth validation logic.

Key Concept

API Gateway provides native Cognito User Pools authorizers for built-in JWT verification and Lambda authorizers for custom authentication logic.
Question 606Question →

A development team is preparing to update an application hosted on AWS Elastic Beanstalk. The new version requires the installation of an OS-level utility (xml2) on the underlying EC2 instances. Additionally, to guarantee clean system states, the team requires that the update is only applied to newly provisioned instances rather than modifying the existing ones in-place. The update must maintain the application's full serving capacity throughout the deployment process, but the team wants to avoid performing a manual DNS redirection or CNAME swap. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a configuration file inside a directory named .ebextensions at the root level of the application source bundle to install the package.; Configure the deployment policy for the environment to use Immutable updates.

Answer

To meet the requirements, the developer must create a configuration file inside a directory named .ebextensions at the root level of the application source bundle, and configure the environment's deployment policy to use Immutable updates.
To satisfy the requirement of installing custom OS-level packages, the configuration file must be placed inside the .ebextensions directory at the root level of the source bundle. To satisfy the deployment requirements (clean instances, full serving capacity, and no manual CNAME swap), the Immutable deployment policy must be used. This policy provisions a secondary Auto Scaling group with the new version, merges it with the existing group once healthy, and then terminates all the old instances, ensuring no configuration residue exists.

Step-by-Step Solution

1
Determine the correct directory structure for Elastic Beanstalk customization files.
Identify that custom packages must be defined under a .ebextensions folder at the root level of the application source bundle.
Elastic Beanstalk ignores configuration folders that lack the leading dot, such as ebextensions.
2
Evaluate the deployment strategies against the zero-downtime, no CNAME-swap, and clean-instance constraints.
Identify that Immutable deployment provisions a temporary Auto Scaling group with new instances, validates health, and then merges them, terminating the old instances.
Rolling and Rolling with additional batch strategies update existing instances in-place, which leaves configuration residue. A CNAME swap requires manual environment creation and DNS redirection, which is forbidden by the scenario constraints.

Key Concept

AWS Elastic Beanstalk configuration files (.ebextensions) and environment deployment policies.
Question 607Question →

A digital media streaming service uses Amazon API Gateway to expose a REST API that retrieves subscriber profiles. The backend integration uses an AWS Lambda function with a proxy integration. The company uses a custom external identity provider that issues JSON Web Tokens (JWTs) to authenticated users. The developer must secure the API Gateway endpoints to ensure that only users with an active subscription (indicated by a claim named 'subscriptionStatus' with a value of 'active' inside the JWT payload) can access the API. The solution must minimize costs by preventing unauthorized requests from invoking the backend Lambda function, and must cache the authorization decision for 5 minutes. Which security configuration will meet these requirements?

Show answer & explanation

Answer: Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.

Answer

Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.
The correct solution involves configuring a Lambda token authorizer. A Lambda authorizer executes custom logic (such as checking if 'subscriptionStatus' is 'active' in the JWT payload) and returns an IAM policy. Because API Gateway evaluates this policy before invoking the integration backend, unauthorized requests are blocked early, preventing unnecessary backend executions. Enabling caching on the authorizer ensures that subsequent requests with the same token use the cached policy for 5 minutes, optimizing performance and reducing authorizer costs.

Step-by-Step Solution

1
Select the appropriate API Gateway authorization type for custom JWT validation and claim inspection.
Determine that a Lambda token authorizer (custom authorizer) is required because it allows running custom validation logic (such as checking the 'subscriptionStatus' claim value) on incoming JWTs, which built-in Cognito Authorizers or IAM Authorization cannot perform natively.
API Gateway Cognito Authorizers can validate JWT tokens from Cognito User Pools but cannot perform conditional authorization checks on custom claims before deciding to allow or deny the request.
2
Implement the authorization logic within the Lambda authorizer function.
The Lambda function receives the token, validates its signature, extracts the payload, checks if 'subscriptionStatus' is 'active', and generates an IAM policy with an Allow or Deny effect along with the user's principal ID.
API Gateway requires the Lambda authorizer to return an IAM policy document that explicitly allows or denies the execution of the API method.
3
Configure caching for the Lambda authorizer in the API Gateway console.
Enable caching, set the TTL (Time to Live) to 300 seconds (5 minutes), and specify the identity source header (e.g., method.request.header.Authorization) as the cache key.
Caching the policy document prevents API Gateway from invoking the Lambda authorizer function for subsequent requests containing the same token, minimizing latency and Lambda invocation costs.

Key Concept

API Gateway Custom Lambda Authorizers allow developers to validate incoming custom tokens (like JWTs from external providers) and perform fine-grained authorization checks based on claims before routing the request to the backend integration, with optional caching to control costs.
Question 608Question →

A backend system executes inside private subnets of a VPC to process financial transactions. This workload requires outbound connections to both an internal database within the VPC and a public third-party banking API. The database traffic is successful, but all connection attempts to the public API timeout. Which network configuration will enable the workload to connect to the external API?

Show answer & explanation

Answer: Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.

Answer

Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.
Providing a NAT Gateway in a public subnet and configuring the private subnet's route table to target it for all external traffic (0.0.0.0/0) allows resources within the private subnet to securely initiate outbound connections to the internet, resolving the timeout issue to the public banking API.

Step-by-Step Solution

1
Identify the destination type for the failing connections.
The failing traffic is destined for a public third-party banking API, which resides on the public internet.
Traffic to public internet endpoints from a private subnet requires a NAT mechanism since the private subnet lacks public IP addresses and direct internet routes.
2
Determine the appropriate NAT deployment architecture.
A NAT Gateway must be placed in a public subnet (a subnet with a route to an Internet Gateway).
NAT Gateways translate private source IPs to a public IP and route the traffic to the Internet Gateway.
3
Configure the private subnet routing.
Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.
This directs all non-VPC bound traffic (internet traffic) through the NAT Gateway for translation and outbound delivery.

Key Concept

Outbound internet connectivity from private VPC subnets using a NAT Gateway
Question 609Question →

A developer is preparing a Node.js web application for deployment on AWS Elastic Beanstalk. The application requires a public environment variable named `APP_COLOR` to be accessible across all instances. Additionally, the application must retrieve a highly sensitive database password that is rotated on a weekly basis. Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure the `APP_COLOR` variable under the Environment properties section of the Elastic Beanstalk environment configuration.; Store the database password in AWS Secrets Manager and retrieve it programmatically using the AWS SDK during application startup.

Answer

Configure the public variable in the Elastic Beanstalk Environment properties, and store the sensitive database password in AWS Secrets Manager, retrieving it programmatically at runtime.
The correct options are to configure the environment properties directly in Elastic Beanstalk for non-sensitive values and to retrieve sensitive credentials programmatically from AWS Secrets Manager. Environment properties in Elastic Beanstalk are ideal for simple public configuration variables such as application color, as they are passed directly to the environment. AWS Secrets Manager is the designated service for storing sensitive secrets that require automatic rotation, such as database passwords, and can be queried securely via the AWS SDK at runtime.

Step-by-Step Solution

1
Identify the storage method for non-sensitive public configuration
Environment properties are suitable for public values like APP_COLOR.
Environment properties allow configuration without hardcoding or using external secret stores.
2
Identify the storage method for sensitive credentials with automatic rotation requirements
AWS Secrets Manager is selected because it manages secrets and supports automatic weekly rotation.
Systems Manager Parameter Store does not support native automatic rotation for secrets.
3
Validate directory structure and configuration file placement constraints in Elastic Beanstalk
The configuration folder must be named .ebextensions with a leading dot, not ebextensions.
Failing to use the leading dot causes Elastic Beanstalk to ignore configuration files.

Key Concept

Configuring AWS Elastic Beanstalk applications with environment properties and managing secrets securely.
Question 610Question →

A developer is implementing a secure authentication and authorization mechanism for a web-based client portal. The portal consists of a React single-page application (SPA) and an Amazon API Gateway REST API backed by AWS Lambda. The developer must allow users to sign in, retrieve their profile details, and enforce group-based access control (e.g., Administrators vs. Standard Users) on the API Gateway endpoints. The architecture must minimize latency, avoid unnecessary external API calls during request processing, and leverage built-in AWS integrations where possible.

Which TWO actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a Cognito User Pool to manage user identities, and associate a Cognito User Pools authorizer with the API Gateway REST API.; Configure the API Gateway integration to forward token claims, and inspect the cognito:groups claim within the Lambda request context to determine user permissions.

Answer

To implement the authentication and authorization flow, configure a Cognito User Pool with a Cognito User Pools authorizer on the API Gateway REST API. Then, check user groups in the backend Lambda function by inspecting the cognito:groups claim inside the request context.
The correct approach is to use a Cognito User Pool combined with a Cognito User Pools authorizer on API Gateway, and to inspect the cognito:groups claim inside the backend Lambda function. The Cognito User Pool serves as the user directory and generates JWT tokens. API Gateway's built-in Cognito authorizer natively validates these tokens, reducing latency. After validation, API Gateway forwards the token claims (including the user's groups in the cognito:groups claim) directly to the Lambda request context, enabling authorization checks without any additional Cognito API calls.

Step-by-Step Solution

1
Select Cognito User Pools for authentication.
Cognito User Pools authenticate users, issue JWTs (ID and access tokens), and support social or enterprise identity providers.
The scenario requires user sign-in and identity management, which is the primary function of Cognito User Pools.
2
Integrate API Gateway with the Cognito User Pool.
API Gateway automatically validates the signature and expiration of incoming tokens using a native Cognito User Pools authorizer.
This offloads token verification logic from custom backend code, reducing latency and operational overhead.
3
Inspect token claims in the Lambda function for authorization.
The Lambda function receives claims (including the cognito:groups list) under the event.requestContext.authorizer.claims structure.
Accessing claims via the request context avoids executing slow and costly SDK calls to Cognito APIs to verify group membership.

Key Concept

Using Cognito User Pools with native API Gateway authorizers to authenticate users and forwarding claims to AWS Lambda for group-based authorization.
Estimated Time:2m 0s
Question 611Question →

An engineering team is troubleshooting a newly deployed backend application hosted in a private subnet of a custom VPC. The application needs to retrieve objects from an Amazon S3 bucket and send messages to an Amazon SQS queue. The VPC has no Internet Gateway or NAT Gateway. The developer creates an Amazon S3 Gateway Endpoint and an Amazon SQS Interface Endpoint. However, the application is still experiencing connection timeouts when trying to access these services. Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the route table associated with the private subnet contains an entry that directs traffic for S3 to the Gateway Endpoint.; Ensure the security group associated with the SQS Interface Endpoint allows inbound HTTPS (TCP port 443443) traffic from the application's security group.

Answer

Verify that the route table associated with the private subnet contains an entry directing S3 traffic to the Gateway Endpoint, and ensure that the security group of the SQS Interface Endpoint allows inbound HTTPS traffic from the application's security group.
For the Gateway Endpoint to route traffic to Amazon S3 from the private subnet, the subnet's route table must contain an entry directing S3 traffic to the S3 Gateway Endpoint. For the Interface Endpoint (PrivateLink) to route SQS traffic, the application connects to the endpoint's Elastic Network Interface (ENI) private IPs, which requires the security group attached to the SQS Interface Endpoint to allow inbound HTTPS (TCP port 443443) traffic from the application's security group.

Step-by-Step Solution

1
Evaluate Gateway Endpoint configuration requirements.
Confirm that Gateway Endpoints (like Amazon S3) require route table entries in the private subnet's route table pointing to the gateway endpoint (`vpce-xxx`) to correctly route traffic.
Without route table updates, traffic destined for S3 will attempt to use the default route, which fails since there is no internet gateway or NAT gateway.
2
Evaluate Interface Endpoint configuration requirements.
Confirm that Interface Endpoints (like Amazon SQS) provision ENIs in the private subnet and rely on security groups to allow inbound HTTPS (TCP port 443443) traffic from the client.
Because Interface Endpoints use private IP addresses within the VPC, the security group of the endpoint must allow inbound traffic from the application's security group.
3
Rule out non-network configurations.
Identify that IAM execution roles, trust policies, and AWS Secrets Manager configurations do not resolve TCP connection timeouts.
Connection timeouts represent network layer blocks or routing failures, not IAM permission denials or credential management issues.

Key Concept

Configuring VPC endpoints (Gateway and Interface) and their respective route tables and security groups to allow secure, private access to AWS services.
Estimated Time:2m 30s
Question 612Question →

A developer needs to secure a database connection string containing credentials. The string is 2 KB2\text{ KB} in size, and the developer wants to perform direct server-side encryption using an AWS KMS customer managed key without generating and managing local data keys. Which AWS KMS API operation should the developer call to encrypt this payload directly?

Show answer & explanation

Answer: Encrypt

Answer

The correct answer is the Encrypt API operation, which allows direct encryption of small payloads up to 4 KB4\text{ KB}.
The Encrypt API operation in AWS KMS is designed to directly encrypt small payloads up to 4 KB4\text{ KB} using a specified KMS key. Since the database connection string is only 2 KB2\text{ KB} in size, the developer can send the plaintext directly to AWS KMS for encryption without the overhead of generating, managing, and storing local data keys.

Step-by-Step Solution

1
Analyze the payload size and the requirement to avoid local data key management.
The database connection string is 2 KB2\text{ KB} in size, and direct encryption is preferred over envelope encryption.
This determines if direct encryption is possible and matches the developer's preference.
2
Check the maximum payload limit for the AWS KMS Encrypt API.
The Encrypt API supports direct encryption of data payloads up to 4 KB4\text{ KB}.
To verify that the 2 KB2\text{ KB} payload is within the direct encryption threshold.
3
Identify the KMS API operation that performs direct encryption on the payload.
The Encrypt operation takes the plaintext payload and returns the ciphertext directly.
To select the operation that meets all requirements without introducing envelope encryption complexity.

Key Concept

AWS KMS Direct Encryption Limits
Estimated Time:45s
Question 613Question →

A developer is managing an application deployed via AWS CloudFormation. The application's database credentials are stored in AWS Secrets Manager and referenced in the CloudFormation template using the dynamic reference `{{resolve:secretsmanager:ProductionDBSecret:SecretString:Password}}` within the `UserData` property of an `AWS::EC2::LaunchTemplate` resource.

The database administrator rotates the database password in AWS Secrets Manager. Subsequently, the developer initiates a stack update to increase the `MaxSize` property of the `AWS::AutoScaling::AutoScalingGroup` resource that uses this launch template. The stack update completes successfully, but the newly launched EC2 instances fail to connect to the database, while existing instances continue to function until their cached credentials expire.

What is the cause of this issue, and how should the developer resolve it?

Show answer & explanation

Answer: The Launch Template resource was not modified during the stack update, so CloudFormation did not re-resolve the dynamic reference to fetch the new password. The developer must update the template by appending the new secret's version ID or version stage to the dynamic reference to force a Launch Template update.

Answer

The Launch Template resource was not modified during the stack update, so CloudFormation did not re-resolve the dynamic reference. The developer must update the template by appending the new secret's version ID or version stage to the dynamic reference to force a Launch Template update.
CloudFormation resolves dynamic references only during stack creation or when the specific resource containing the dynamic reference is updated. Since the stack update only modified the `MaxSize` property of the `AWS::AutoScaling::AutoScalingGroup` resource, the `AWS::EC2::LaunchTemplate` resource was not modified, and CloudFormation did not re-resolve the Secrets Manager dynamic reference. Consequently, the launch template continued to use the old resolved password value. To resolve this, the template must be updated to force an update of the launch template resource. Appending the new secret's version ID or version stage (such as the specific version UUID) to the dynamic reference changes the template definition of the launch template, forcing CloudFormation to update the launch template and retrieve the new secret value.

Step-by-Step Solution

1
Analyze why the new EC2 instances are failing to connect.
The new instances are launched using the launch template that still contains the old database password because the dynamic reference was not re-resolved.
CloudFormation only resolves dynamic references when the resource defining them is created or updated. The stack update only changed the Auto Scaling group's MaxSize, leaving the Launch Template untouched.
2
Determine the correct method to force CloudFormation to resolve the updated secret.
The Launch Template resource must be modified in the template so that CloudFormation initiates an update for it.
By changing the resource's definition, CloudFormation is triggered to update the Launch Template and fetch the updated value of the dynamic reference.
3
Apply the change using the Secrets Manager dynamic reference version ID/stage suffix.
Update the dynamic reference to specify the new version ID (e.g., `{{resolve:secretsmanager:ProductionDBSecret:SecretString:Password::version-id}}`).
This updates the launch template resource in the CloudFormation template, prompting CloudFormation to re-resolve the reference during the stack update.

Key Concept

CloudFormation dynamic references are only resolved during resource creation or updates. Changing properties of other resources (like Auto Scaling group size) does not trigger re-resolution of dynamic references in unchanged resources.

Alternative Method

Another way to force the launch template to update and re-resolve the dynamic reference is to update a non-disruptive parameter or property on the launch template itself, such as adding or changing a metadata property or changing the launch template version in the Auto Scaling group template definition.
Estimated Time:3m 0s
Question 614Question →

A developer is designing a secure integration between an external third-party server-to-server daemon application and a private API hosted on Amazon API Gateway. The external application must programmatically access API endpoints to retrieve financial reports without user intervention. The solution must support custom OAuth 2.0 scopes, such as `reports:read`, to authorize access. Which architecture should the developer implement to meet these requirements with the least operational complexity?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with a resource server defining the `reports:read` scope. Create an app client, enable the Client Credentials grant, and assign the custom scope. On API Gateway, configure a Cognito Authorizer and specify the `reports:read` scope in the API method's authorization settings.

Answer

Configure an Amazon Cognito User Pool with a resource server defining the reports:read scope, enable the Client Credentials grant on the app client, and use API Gateway's built-in Cognito Authorizer.
The correct solution uses Amazon Cognito User Pools, which natively support the OAuth 2.0 Client Credentials grant flow for server-to-server (daemon) authentication. By configuring a Resource Server in the User Pool, the developer can define custom scopes like `reports:read`. The built-in API Gateway Cognito Authorizer can validate the incoming Access Token (JWT) and enforce authorization based on the configured custom scopes directly on the API method, requiring no custom Lambda authorizer code or IAM role assumption.

Step-by-Step Solution

1
Set up a resource server in the User Pool.
Defines the custom oauth scope `reports:read` under a custom identifier.
This establishes the scope structure that API Gateway will use to validate client access.
2
Configure the app client with Client Credentials flow.
Allows the external daemon to request tokens using its client ID and client secret, bypassing user interactive login.
Machine-to-machine authentication requires the client credentials grant type.
3
Integrate with API Gateway Cognito Authorizer.
Validates the incoming JWT access token and verifies the presence of the `reports:read` scope.
Provides declarative authorization without writing custom Lambda authorizer code.

Key Concept

Machine-to-machine authentication using Amazon Cognito User Pools and Client Credentials flow with API Gateway Integration
Estimated Time:2m 0s
Question 615Question →

A developer is implementing client-side decryption for a microservice that retrieves encrypted configuration files (each under 1010 KB in size) from an external datastore. The files were encrypted using envelope encryption with an AWS KMS customer managed key. The datastore contains the ciphertext payload and the encrypted data key (ciphertext data key). Which two steps must the developer's application perform to decrypt the payload?

Select all that apply

Show answer & explanation

Answer: Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to retrieve the plaintext data key.; Decrypt the ciphertext payload locally using the retrieved plaintext data key and the appropriate decryption algorithm.

Answer

To decrypt the payload, the application must call the KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then decrypt the ciphertext payload locally using that plaintext data key.
To decrypt a payload that was encrypted using envelope encryption, the client application first extracts the encrypted data key (ciphertext data key) that is stored alongside the payload. The application then sends this ciphertext data key to AWS KMS by calling the Decrypt API operation. AWS KMS decrypts the data key using the specified customer managed key and returns the plaintext data key to the application. Finally, the application uses this plaintext data key to decrypt the ciphertext payload locally. This ensures that the heavy decryption workload is done client-side and the sensitive raw payload is never sent over the network to AWS KMS.

Step-by-Step Solution

1
Isolate the ciphertext data key.
The ciphertext data key is separated from the encrypted configuration payload.
AWS KMS envelope encryption requires decrypting the data key before the data itself can be decrypted.
2
Decrypt the data key via AWS KMS.
AWS KMS decrypts the ciphertext data key and returns the plaintext data key.
The client application does not have access to the backing customer managed key and must delegate decryption of the data key to AWS KMS.
3
Decrypt the payload locally.
The configuration payload is decrypted back to plaintext.
Performing decryption locally avoids the network overhead of sending the payload to AWS KMS and bypasses the payload size limits of the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption Decryption Workflow
Question 616Question →

A logistics company is exposing a shipment tracking API via an Amazon API Gateway REST API. The developer needs to secure the API to authenticate and authorize two categories of consumers:

1. Internal warehouse applications running on Amazon EC2 instances within the company's AWS account. These applications must be granted access using their IAM roles under the principle of least privilege.
2. Mobile client applications used by delivery drivers. These drivers authenticate against an external identity provider (IdP). The authorization process must validate custom claims in their security tokens to restrict access to specific geographical regions.

Which two configurations should the developer implement to secure the API Gateway endpoints for these consumers? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and attach an IAM policy to the EC2 instances' instance profile role that allows the execute-api:Invoke action on the specific API resource ARN.; Configure a Lambda Request Authorizer for the delivery driver methods. In the authorizer Lambda function, validate the token from the external IdP, extract the custom geographic claim, and generate an IAM policy that allows access to the requested API resource.

Answer

Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and configure a Lambda Request Authorizer for the delivery driver methods to validate the external IdP token and return an IAM policy.
The correct configurations involve using AWS_IAM authorization for the warehouse applications, combined with a Lambda Request Authorizer for the delivery drivers. AWS_IAM authorization natively validates requests signed using SigV4 from EC2 instance profiles. A Lambda Request Authorizer allows running custom authorization logic against an external identity provider's tokens and returning an IAM policy dynamically based on custom claims.

Step-by-Step Solution

1
Identify the authentication mechanism for internal AWS resources.
AWS_IAM authorization is identified as the native, secure mechanism.
Since the warehouse applications run on EC2 instances inside AWS, utilizing instance profiles and IAM roles with SigV4 signing avoids hardcoding credentials and provides fine-grained access control.
2
Determine the resource policy assignment for EC2.
Attach an IAM policy allowing execute-api:Invoke on the API's ARN to the EC2 instances' role.
The client role needs permission to call the API Gateway endpoint when AWS_IAM authorization is enabled.
3
Identify the authorization mechanism for external IdP users requiring custom claim validation.
A Lambda Request Authorizer is selected.
Because the identity provider is external and custom claims (geographical region) must be verified to grant access, a custom Lambda authorizer must validate the token and dynamically generate an IAM policy.
4
Verify that API Gateway client certificates and Cognito User Pools do not fit the direct requirements.
Reject Cognito User Pools and client certificates configurations.
Client certificates authenticate API Gateway to the backend, not the client to API Gateway. Cognito User Pools Authorizers cannot natively validate external IdP tokens with complex custom validation logic without a user directory interface.

Key Concept

API Gateway Security and Authorization mechanisms, specifically matching IAM authorization for AWS services and Lambda Authorizers for external custom token validation.
Estimated Time:3m 0s
Question 617Question →

An internal employee portal has a frontend application that retrieves account data by calling a REST API hosted on Amazon API Gateway. The employees are authenticated using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints so that only authenticated users can access the resources. The developer needs to validate the JSON Web Tokens (JWT) at the API Gateway level with the least operational overhead.

Which configuration should the developer implement to meet these requirements?

Show answer & explanation

Answer: Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.

Answer

Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.
The correct option is to create a Cognito User Pools authorizer in API Gateway and configure the API method to use it. This utilizes API Gateway's native capability to validate JWT tokens generated by Amazon Cognito User Pools without writing any custom code, satisfying the requirement for the least operational overhead.

Step-by-Step Solution

1
Identify the authentication source and the validation requirement.
The authentication source is an Amazon Cognito User Pool which generates JSON Web Tokens (JWTs). Validation must occur at the API Gateway layer.
Understanding the source and location of authentication determines the available integration types.
2
Evaluate the requirement for least operational overhead and least custom code.
API Gateway offers a built-in authorizer specifically designed for Cognito User Pools that handles JWT validation natively.
Choosing the native authorizer eliminates the need to write and maintain custom validation functions.
3
Configure the API Gateway method.
Create the Cognito User Pools authorizer in API Gateway and associate it with the HTTP methods of the API.
This secures the API endpoints by ensuring that only valid Cognito JWTs are allowed to pass through to the backend.

Key Concept

API Gateway Cognito User Pools Authorizer
Question 618Question →

A developer is implementing a new mobile application that accesses a REST API hosted on Amazon API Gateway with an AWS Lambda proxy integration. Users will authenticate against an Amazon Cognito User Pool. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, and the backend Lambda function must be able to retrieve the user's email address and custom attributes to perform application-level authorization.

Which configuration should the developer implement to meet these requirements with the least operational overhead?

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool authorizer on the API methods, passing the ID token in the Authorization header. In the Lambda function, retrieve the user attributes from the request context claims.

Answer

Configure an API Gateway Cognito User Pool authorizer on the API methods, passing the ID token in the Authorization header. In the Lambda function, retrieve the user attributes from the request context claims.
The correct configuration uses the native Cognito User Pool authorizer in API Gateway. When integrated with a Lambda proxy, API Gateway validates the ID token and makes all claims (such as email and custom attributes) available to the backend Lambda function under the request context claims. This requires no custom code, minimizing operational overhead.

Step-by-Step Solution

1
Configure the API Gateway method to use a Cognito User Pool authorizer.
API Gateway is configured to authenticate incoming API requests by validating the signature and expiration of the JWT ID token supplied in the Authorization header.
This offloads token validation from the backend application code to the API Gateway edge.
2
Ensure the client application sends the ID token obtained from Cognito authentication in the Authorization header.
The client successfully passes the authenticated user's identity to API Gateway.
The Cognito User Pool authorizer requires the identity token to verify the user and extract claims.
3
Access the user attributes within the Lambda function using the event's request context.
The Lambda function retrieves the email and custom attributes from event.requestContext.authorizer.claims.
API Gateway automatically injects the claims of the validated token into the Lambda integration context, avoiding additional SDK calls.

Key Concept

API Gateway Cognito User Pool Authorizer integration with Lambda proxy
Estimated Time:1m 30s
Question 619Question →

A developer needs to configure autoscaling thresholds and environment properties for a web application deployed via AWS Elastic Beanstalk. To ensure consistency across development, staging, and production environments, the developer wants these configurations to be version-controlled in the Git repository alongside the application source code. Which of the following approaches should the developer use to satisfy these requirements?

Show answer & explanation

Answer: Place a YAML configuration file ending with a `.config` extension inside a folder named `.ebextensions` at the root of the application source bundle.

Answer

Place a YAML configuration file ending with a `.config` extension inside a folder named `.ebextensions` at the root of the application source bundle.
Placing configuration files with a `.config` extension inside the `.ebextensions` folder at the root of the application source bundle is the standard way to package environment configurations with the application code. This ensures they are version-controlled in the repository and automatically applied to the Elastic Beanstalk environment during deployment.

Step-by-Step Solution

1
Determine the mechanism for packaging configurations with Elastic Beanstalk source code.
Identify that Elastic Beanstalk uses configuration files inside the source bundle to customize the environment.
This ensures the configuration is tracked in Git alongside the code.
2
Identify the correct directory name and file extension required by Elastic Beanstalk.
The directory must be named `.ebextensions` (with a leading dot) at the root of the project, and files must end with `.config`.
Elastic Beanstalk specifically scans this folder path and suffix during application deployment.

Key Concept

AWS Elastic Beanstalk Configuration Files (.ebextensions)
Question 620Question →

A developer is building a multi-tenant web application where users authenticate using an Amazon Cognito User Pool. The application must allow authenticated users to perform the following tasks:

* Call a private backend REST API deployed on Amazon API Gateway.
* Directly query tenant-specific items in an Amazon DynamoDB table using temporary AWS credentials.

The user's tenant ID is stored as a custom attribute (`custom:tenant_id`) in the Cognito User Pool. The developer wants to implement a secure, low-overhead solution that minimizes the number of IAM roles and avoids custom Lambda authorizers or validation code.

Which TWO configurations should the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API, and set the API methods to require this authorizer, validating the tokens passed in the request header.; Create an Amazon Cognito Identity Pool, link it to the User Pool, and enable the 'Attributes for access control' feature mapping the `custom:tenant_id` claim to a principal tag. Reference `${aws:PrincipalTag/tenant_id}` in the IAM policy condition for the authenticated role.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API to validate tokens, and create an Amazon Cognito Identity Pool linked to the User Pool that maps the custom tenant ID claim to a principal tag using attributes for access control.
To secure the REST API with minimum overhead, using a built-in Cognito User Pool authorizer is the best option because API Gateway handles the token validation natively. To query DynamoDB directly from the client with temporary AWS credentials, the application must use a Cognito Identity Pool linked to the User Pool. To enforce tenant isolation with low overhead (minimizing IAM roles), the developer should configure 'Attributes for access control' in the Identity Pool. This maps the custom user attribute (`custom:tenant_id`) to a principal tag, allowing the IAM policy for the authenticated role to dynamically restrict access using `${aws:PrincipalTag/tenant_id}`.

Step-by-Step Solution

1
Select the correct mechanism for securing the REST API using Amazon Cognito User Pools.
Identify that API Gateway features a native Cognito User Pool authorizer which can authenticate API requests without custom validation code.
This meets the requirement of securing the API with low operational overhead and no custom code.
2
Determine how to obtain temporary AWS credentials for DynamoDB queries.
Recognize that Cognito Identity Pools are required to exchange Cognito User Pool tokens for temporary AWS credentials.
Cognito User Pools cannot directly issue temporary AWS credentials.
3
Evaluate how to implement tenant-level isolation in the IAM role policy dynamically without role overhead.
Use the 'Attributes for access control' feature in Cognito Identity Pools to map the `custom:tenant_id` claim to a principal tag, and write a policy using `${aws:PrincipalTag/tenant_id}`.
This allows a single IAM role to enforce tenant isolation dynamically (ABAC), minimizing the number of IAM roles.
4
Verify trust policy configuration.
Ensure the trust policy allows the Cognito Identity service (`cognito-identity.amazonaws.com`) to assume the role via web identity.
This allows Cognito Identity Pools to hand out credentials for the role.

Key Concept

Integration of Amazon Cognito User Pools and Identity Pools for unified authentication (API Gateway) and fine-grained authorization (temporary credentials for DynamoDB via ABAC).
PreviousPage 31 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin