All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

An application needs to decrypt a large dataset ( $5\text{ GB}$ ) that was previously encrypted client-side using envelope encryption with an AWS KMS Customer Managed Key (CMK). The encrypted dataset consists of the ciphertext data and the encrypted data key, both of which are stored in an Amazon S3 bucket. The application's IAM role has been granted `kms:Decrypt` permissions.

Which of the following steps must the developer implement in the application code to successfully decrypt the dataset? (Select TWO.)

Select all that apply

Call the AWS KMS `Decrypt` API operation, passing the encrypted data key to retrieve the plaintext data key.

Decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

Call the AWS KMS `Decrypt` API operation, passing the entire ciphertext dataset to retrieve the decrypted plaintext data directly.

Call the AWS KMS `GenerateDataKey` API operation, passing the KMS key identifier to generate a new plaintext key for decrypting the data.

Call the AWS KMS `ReEncrypt` API operation, passing the encrypted data key and the ciphertext dataset to decrypt it in a single request.

Show answer & explanation

Answer: Call the AWS KMS `Decrypt` API operation, passing the encrypted data key to retrieve the plaintext data key.; Decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

Answer

To decrypt a large dataset encrypted client-side with envelope encryption, the application must call the KMS Decrypt API operation, passing the encrypted data key to obtain the plaintext data key, and then decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

In client-side envelope encryption, the Customer Managed Key (CMK) in AWS KMS is only used to decrypt the encrypted data key. The application must first send the encrypted data key to KMS via the `Decrypt` API to retrieve the plaintext data key. Once retrieved, the actual decryption of the large dataset (in this case,

5\text{ GB}

) is performed locally on the client side using a symmetric decryption algorithm (like AES) with the plaintext data key. This avoids sending large files over the network to KMS and bypasses KMS API payload limits.

Step-by-Step Solution

Retrieve the encrypted data key and the ciphertext dataset from the S3 bucket.

The application has the encrypted data key and the encrypted dataset ready in memory or buffer.

Before performing any cryptographic operations, both the encrypted key and ciphertext must be accessed.

Call the AWS KMS `Decrypt` API, providing the encrypted data key as the CiphertextBlob parameter.

AWS KMS decrypts the data key using the designated Customer Managed Key (CMK) and returns the plaintext data key.

The Customer Managed Key (CMK) is kept securely within KMS HSMs; only KMS can decrypt the encrypted data key.

Use the returned plaintext data key with a local cryptographic library (such as AES-GCM) to decrypt the ciphertext dataset.

The

5\text{ GB}

ciphertext is decrypted locally into its original plaintext state.

KMS cannot decrypt large data directly due to the

4\text{ KB}

payload limit, so decryption of the dataset must occur client-side.

Securely wipe the plaintext data key from the application's memory.

The plaintext data key is erased.

This minimizes the risk of the plaintext data key being exposed in memory dumps or logs.

Key Concept

Client-side envelope encryption relies on using a local plaintext data key (retrieved by decrypting the encrypted data key via KMS) to perform symmetric decryption on the actual dataset locally, rather than sending the large dataset to KMS.

Estimated Time:3m 0s

Question 622Question →

A developer is implementing a new backend service and needs to add sign-up, sign-in, and profile management capabilities for end users. The developer wants to use a fully managed solution that provides a secure, customizable user directory out of the box. Which Amazon Cognito component should the developer use to meet these requirements?

Amazon Cognito User Pools

Amazon Cognito Identity Pools

Amazon API Gateway Lambda Authorizers

AWS Identity and Access Management (IAM) Roles

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools

Amazon Cognito User Pools are the correct choice because they act as a user directory that manages sign-up, sign-in, and user profile management, which matches the developer's requirements.

Step-by-Step Solution

Identify the primary requirement

The requirement is to implement user sign-up, sign-in, and profile management (a user directory) using Amazon Cognito.

This establishes the scope of authentication vs. authorization.

Compare Cognito User Pools and Identity Pools

User Pools provide user directory and authentication, while Identity Pools provide temporary AWS credentials for accessing AWS resources.

To choose the correct component for a user directory, we must distinguish between authentication (User Pools) and authorization (Identity Pools).

Select the correct component matching the requirement

Amazon Cognito User Pools is the appropriate component.

It matches the sign-up, sign-in, and user directory requirements directly.

Key Concept

Amazon Cognito User Pools provide user directory services, sign-up, and sign-in functionality for application users.

Estimated Time:45s

Question 623Question →

An organization is deploying a secure microservice where an AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. To meet strict security standards, no traffic is allowed to traverse the public internet. The developer has created a gateway VPC endpoint for DynamoDB and an interface VPC endpoint for Secrets Manager in the same private subnet. While DynamoDB queries succeed, the Lambda function times out when attempting to retrieve credentials from Secrets Manager. Which action must the developer take to allow the Lambda function to successfully retrieve the secrets?

Move the Lambda function to a public subnet within the VPC and assign a public IP address to its execution configuration to allow direct routing to the public Secrets Manager endpoint.

Update the trust policy of the Lambda execution role to trust the interface VPC endpoint service principal, allowing the network interface to assume the role's permissions.

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store and provision a gateway VPC endpoint for Parameter Store.

Show answer & explanation

Answer: Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Answer

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

The correct option correctly configures the security group associated with the Secrets Manager interface VPC endpoint. Interface endpoints (PrivateLink) create network interfaces inside the VPC with private IP addresses. For the Lambda function to reach these network interfaces over HTTPS, the security group of the interface endpoint must allow inbound traffic on TCP port 443 from the security group of the Lambda function.

Step-by-Step Solution

Analyze the network path and failure point.

The Lambda function times out when attempting to connect to Secrets Manager. Because there is no NAT Gateway or internet path, traffic must route through the interface VPC endpoint.

Since the DynamoDB query succeeds via the gateway endpoint, the Lambda function's internal VPC subnet configuration and basic execution routing are functional, indicating a specific block on the Secrets Manager interface endpoint path.

Identify the network requirements for interface VPC endpoints.

Interface endpoints (AWS PrivateLink) deploy ENIs inside the VPC. Clients connect to these ENIs using HTTPS on TCP port 443.

Unlike gateway endpoints, interface endpoints act as local network interfaces in the subnet and are subject to security group evaluation.

Configure the endpoint security group rules.

Add an inbound rule to the security group associated with the Secrets Manager interface VPC endpoint allowing TCP port 443 traffic from the Lambda function's security group.

This permits the Lambda function's network interface to successfully initiate and complete the TLS handshake with the Secrets Manager endpoint ENIs.

Key Concept

Security group configuration for interface VPC endpoints

Question 624Question →

An application runs on an Amazon EC2 instance located within a private subnet of a Virtual Private Cloud (VPC). The application must access AWS Systems Manager Parameter Store to retrieve configuration parameters. The security policy dictates that this traffic must not traverse the public internet. Which VPC configuration should be implemented to satisfy this requirement?

Create an interface VPC endpoint for Systems Manager within the VPC.

Configure a NAT Gateway in a public subnet and route all internet-bound traffic from the private subnet through it.

Update the IAM role trust policy on the EC2 instance to trust the Systems Manager service principal.

Migrate the parameters to AWS Secrets Manager and enable automatic credential rotation.

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager within the VPC.

Answer

Create an interface VPC endpoint for Systems Manager within the VPC.

Creating an interface VPC endpoint for Systems Manager within the VPC is the correct solution. Interface VPC endpoints use AWS PrivateLink, which places elastic network interfaces (ENIs) with private IP addresses in the subnets. Traffic to Systems Manager is routed privately within the AWS network, satisfying the requirement to avoid the public internet.

Step-by-Step Solution

Identify the environment and target service requirements.

An application on an EC2 instance in a private subnet needs to access AWS Systems Manager Parameter Store.

This establishes the source and destination for the network traffic.

Apply the security constraint regarding internet traversal.

The traffic must remain entirely within the AWS network and cannot route through the public internet.

This eliminates options that route traffic through internet gateways or NAT gateways to public service endpoints.

Select the VPC private connectivity option for AWS services.

An interface VPC endpoint (powered by AWS PrivateLink) is configured for Systems Manager, providing private IP addresses within the VPC.

Interface VPC endpoints allow private subnets to communicate with AWS services securely without using public endpoints.

Key Concept

AWS PrivateLink and Interface VPC Endpoints allow private resources inside a VPC to securely connect to supported AWS services without internet traversal.

Question 625Question →

A developer is packaging a Node.js web application for deployment to an AWS Elastic Beanstalk environment running on an Amazon Linux $2023$ platform. The developer needs to run a custom shell script that modifies application files after the application source bundle has been unpacked, but before the application version is started and traffic is routed to it. Which approach should the developer use to ensure the script executes at the correct stage of the deployment lifecycle?

Place the script inside the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has executable permissions.

Place the script inside the `.ebextensions/` folder and execute it using the `commands` key in a configuration file.

Place the script inside the `ebextensions/` folder of the source bundle and configure it to run using the `container_commands` key in a configuration file.

Place the script inside the `.platform/confighooks/predeploy/` directory of the application source bundle.

Show answer & explanation

Answer: Place the script inside the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has executable permissions.

Answer

Place the script inside the `.platform/hooks/predeploy/` directory of the application source bundle and ensure it has executable permissions.

The correct option is to place the script inside the `.platform/hooks/predeploy/` directory. On Amazon Linux 2 and Amazon Linux 2023 platforms, Elastic Beanstalk runs scripts placed in this folder after the application source archive is unpacked into the staging folder but before the application process is started. This matches the developer's requirement to modify unpacked files prior to execution.

Step-by-Step Solution

Analyze the target operating system platform and version.

The platform is Amazon Linux 2023, which supports `.platform/` hooks for customizing deployments.

AWS Elastic Beanstalk platforms based on Amazon Linux 2 and Amazon Linux 2023 use the `.platform/` directory structure for lifecycle hooks, replacing the older behavior of running raw scripts directly from `.ebextensions/`.

Determine the exact lifecycle stage required for the script execution.

The script must execute after unpacking the source code but before the application runs.

This corresponds to the 'predeploy' phase in Elastic Beanstalk deployment lifecycle stages.

Identify the correct directory path and file requirements within the application bundle.

The path is `.platform/hooks/predeploy/`, and files inside must be executable.

Scripts in `.platform/hooks/predeploy/` run automatically at the predeploy phase. Omission of the leading dot in configuration directories or using configuration hooks (`confighooks`) designed for configuration updates will prevent execution during a standard code deployment.

Key Concept

AWS Elastic Beanstalk Platform Hooks (.platform/hooks)

Question 626Question →

A serverless application needs to retrieve credentials from AWS Secrets Manager and query an Amazon RDS database located in a private VPC subnet. What network configuration should be implemented to allow the Lambda function to securely retrieve the credentials and access the database without exposing any traffic to the public internet?

Run the Lambda function in the private VPC subnets without any VPC endpoints or NAT gateways, as Lambda functions automatically bypass VPC routing to connect to public AWS service endpoints.

Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation to allow the private Lambda function to retrieve them over standard HTTP.

Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Modify the Lambda function's IAM role trust policy to allow public internet gateway access for database credentials validation.

Show answer & explanation

Answer: Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Answer

The correct configuration is to attach the Lambda function to the private subnets, set up an interface VPC endpoint for Secrets Manager to allow private API calls, and configure the RDS database's security group to allow inbound traffic from the Lambda function's security group. This achieves fully private, secure access for both credentials retrieval and database queries.

Step-by-Step Solution

Configure the Lambda function to run inside the private subnets of the VPC.

The Lambda function gains private network access to VPC resources, including the RDS database in the same VPC.

This establishes private network routing to the database.

Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC.

A private network interface is placed in the subnets, routing traffic to Secrets Manager privately.

This allows the Lambda function to retrieve secrets without traversing the public internet.

Modify the RDS database's security group inbound rules to allow traffic on the database port from the Lambda function's security group.

The RDS database will accept connection requests initiated by the Lambda function.

This ensures secure access to the database using the principle of least privilege.

Key Concept

VPC endpoints and security groups for private AWS service and database connectivity from Lambda functions.

Question 627Question →

A developer is configuring a deployment pipeline for a containerized application running on Amazon ECS (Fargate). The ECS service has a desired task count of $10$ . The deployment must comply with the following operational constraints:

- At least $8$ tasks must remain healthy and actively serve traffic at all times during the deployment to prevent service degradation.
- Due to strict account resource quotas in the target AWS Region, no more than $12$ tasks for this service can run concurrently at any point during the deployment.
- The system must automatically roll back to the previous stable version if the new container version fails to launch or fails to pass its container health checks.

Which deployment strategy and configuration should the developer implement to satisfy these requirements?

An ECS rolling update with the minimum healthy percent set to

80

%, the maximum percent set to

120

%, and the ECS deployment circuit breaker enabled with rollback.

An ECS rolling update with the minimum healthy percent set to

100

%, the maximum percent set to

150

%, and the ECS deployment circuit breaker enabled with rollback.

An AWS CodeDeploy blue/green deployment using the CodeDeployDefault.ECSAllAtOnce configuration, with automated rollbacks configured via CloudWatch alarms.

An AWS CodeDeploy blue/green deployment using a custom canary configuration (ECSCanary10Percent5Minutes) to limit task provisioning, with automated rollbacks configured via CloudWatch alarms.

Show answer & explanation

Answer: An ECS rolling update with the minimum healthy percent set to $80$ %, the maximum percent set to $120$ %, and the ECS deployment circuit breaker enabled with rollback.

Answer

An ECS rolling update with the minimum healthy percent set to

80

%, the maximum percent set to

120

%, and the ECS deployment circuit breaker enabled with rollback.

The correct option is the ECS rolling update with the minimum healthy percent set to

80

% and the maximum percent set to

120

%. This configuration ensures that at least

8

tasks (

80

% of

10

) are always healthy and serving traffic, and restricts the ECS scheduler from running more than

12

tasks (

120

% of

10

) concurrently, satisfying the regional quota limit. Enabling the ECS deployment circuit breaker with rollback allows ECS to automatically roll back to the last stable deployment revision if the new tasks fail to reach a steady state, meeting all requirements natively.

Step-by-Step Solution

Calculate the minimum healthy task count and maximum task limit based on the percentage parameters.

A minimum healthy percent of

80

% requires at least

8

tasks to remain healthy (

10 \times 0.8 = 8

). A maximum percent of

120

% limits the total concurrent tasks to

12

(

10 \times 1.2 = 12

To verify compliance with the resource quotas and availability constraints specified in the scenario.

Evaluate AWS CodeDeploy blue/green deployment capabilities for ECS under task capacity limitations.

All CodeDeploy blue/green deployments for ECS require provisioning a full replacement task set (

10

tasks) before any traffic is shifted, requiring a total of

20

tasks (

200

% capacity).

To determine if CodeDeploy can satisfy the constraint of having at most

12

concurrent tasks.

Verify the configuration needed for automated rollback in the chosen deployment model.

The native ECS deployment circuit breaker automatically monitors task launch and health check failures, triggering an automated rollback to the last stable task definition revision if the deployment fails.

To meet the requirement for automated rollback on container launch or health check failure without manual intervention.

Key Concept

ECS Rolling Updates vs CodeDeploy Blue/Green task provisioning constraints and native deployment circuit breaker rollbacks.

Estimated Time:3m 0s

Question 628Question →

An enterprise archiving application is designed to write raw sensor datasets (each averaging $500\text{ KB}$ in size) to a self-managed object store. The compliance team mandates client-side encryption before transmission. To minimize AWS KMS API requests and network latency, the development team plans to use local envelope encryption. Which sequence of AWS SDK operations represents the correct and most cost-effective implementation of this encryption workflow?

Request a data key by calling `GenerateDataKey`. Use the returned plaintext data key to encrypt the dataset locally, immediately wipe the plaintext key from application memory, and store the dataset along with the returned ciphertext data key.

Encrypt the dataset directly by calling `Encrypt` with the customer managed key, and then upload the resulting ciphertext to the object store.

Request only the encrypted key structure by calling `GenerateDataKeyWithoutPlaintext`. Use this returned ciphertext data key to perform the local encryption of the dataset.

Request a data key by calling `GenerateDataKey` to get a plaintext key. Use it to encrypt the dataset locally, then call `Encrypt` to encrypt that plaintext key, storing the resulting ciphertext key alongside the data.

Show answer & explanation

Answer: Request a data key by calling `GenerateDataKey`. Use the returned plaintext data key to encrypt the dataset locally, immediately wipe the plaintext key from application memory, and store the dataset along with the returned ciphertext data key.

Answer

Request a data key by calling `GenerateDataKey`, use the returned plaintext data key to encrypt the dataset locally, wipe the plaintext key from memory, and store the dataset alongside the returned ciphertext data key.

The correct workflow for client-side envelope encryption involves requesting a data key using `GenerateDataKey`. This operation returns both the plaintext key (for immediate encryption) and the encrypted ciphertext key (for storage). The plaintext key should be cleared from memory as soon as encryption completes.

Step-by-Step Solution

Analyze the file size constraint and encryption method.

The files average

500\text{ KB}

, which exceeds the

4\text{ KB}

payload limit of direct KMS `Encrypt` operations, confirming that envelope encryption is required.

Determines whether direct encryption or envelope encryption must be used.

Determine the correct API call to retrieve the necessary keys for envelope encryption.

Calling `GenerateDataKey` returns both a plaintext key (required to perform the encryption algorithm locally) and a ciphertext key (stored for later decryption).

Identifies the correct AWS KMS API operation that yields the cryptographic keys needed for client-side envelope encryption.

Review the workflow steps for security and cost efficiency.

Wiping the plaintext data key from memory immediately after encryption secures the system, and storing the returned ciphertext key directly avoids extra API calls (such as a redundant `Encrypt` call).

Ensures the application adheres to security best practices and minimizes AWS KMS cost and latency.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:1m 30s

Question 629Question →

A developer is implementing authentication and authorization for a new Single Page Application (SPA) written in React. The SPA needs to securely invoke a REST API hosted on Amazon API Gateway and also upload user-generated profile images directly to a private Amazon S3 bucket. The solution must support user sign-up and sign-in, minimize custom backend code, and follow security best practices. Which architecture should the developer implement to meet these requirements?

Implement an Amazon Cognito User Pool for user sign-up and sign-in using the Authorization Code Flow with PKCE. Secure the API Gateway REST API using a built-in Cognito User Pool authorizer. Set up an Amazon Cognito Identity Pool linked to the User Pool to exchange the ID token for temporary AWS credentials, and attach an IAM role to the Identity Pool that allows S3 uploads to a path restricted by the user's Cognito identity ID.

Implement an Amazon Cognito Identity Pool to handle user sign-up, sign-in, and user directory management. Use the resulting temporary credentials to sign requests to the API Gateway REST API using AWS Signature Version 4, and use the same credentials to upload images to the S3 bucket.

Implement an Amazon Cognito User Pool for user sign-up and sign-in. Create a custom Lambda authorizer on API Gateway that validates the Cognito JSON Web Token (JWT) and calls the STS AssumeRole API to generate temporary credentials, which are returned to the SPA for direct S3 uploads.

Implement an Amazon Cognito User Pool for user sign-up and sign-in. Configure a Cognito User Pool authorizer on API Gateway. Create an IAM role with S3 write permissions, and modify the IAM role's trust policy to allow the Cognito User Pool service principal (cognito-idp.amazonaws.com) to directly assume the role on behalf of the web client.

Show answer & explanation

Answer: Implement an Amazon Cognito User Pool for user sign-up and sign-in using the Authorization Code Flow with PKCE. Secure the API Gateway REST API using a built-in Cognito User Pool authorizer. Set up an Amazon Cognito Identity Pool linked to the User Pool to exchange the ID token for temporary AWS credentials, and attach an IAM role to the Identity Pool that allows S3 uploads to a path restricted by the user's Cognito identity ID.

Answer

Implement a Cognito User Pool for user sign-up and sign-in using the Authorization Code Flow with PKCE, secure the API Gateway REST API with a built-in Cognito User Pool authorizer, set up a Cognito Identity Pool to exchange tokens for temporary AWS credentials, and attach an IAM role to allow direct S3 uploads to a user-specific folder.

The correct architecture uses a Cognito User Pool for user authentication and directory management, which integrates natively with API Gateway using a built-in Cognito User Pool authorizer. To allow the frontend application to upload files directly to S3, a Cognito Identity Pool is required to exchange the authentication tokens for temporary AWS credentials with restricted permissions.

Step-by-Step Solution

Authenticate users using Amazon Cognito User Pools.

Users can register and log in, receiving Identity, Access, and Refresh tokens on the client SPA.

User Pools act as the user directory and handle authentication flows (specifically the Authorization Code Flow with PKCE for SPAs).

Configure the API Gateway REST API with a built-in Amazon Cognito User Pool authorizer.

Incoming API requests are automatically validated using the Cognito ID token, denying unauthorized access before reaching the backend Lambda functions.

The built-in Cognito authorizer requires no custom code, reducing maintenance overhead and latency.

Set up an Amazon Cognito Identity Pool linked to the User Pool.

The SPA exchanges the Cognito ID token for temporary, limited-privilege AWS credentials.

Identity Pools translate authentication tokens into AWS STS credentials for direct access to AWS resources like S3.

Attach an IAM role to the Identity Pool with a policy that limits S3 access.

Users can upload files directly to their own folders within the S3 bucket using a policy containing the '${cognito-identity.amazonaws.com:sub}' variable.

Using IAM policies with Cognito variables ensures secure, isolated user paths without needing an intermediary backend upload service.

Key Concept

Distinguishing and integrating Cognito User Pools (authentication) and Cognito Identity Pools (authorization/AWS credentials) for a Single Page Application.

Estimated Time:2m 30s

Question 630Question →

A developer is building a secure enterprise document management portal. User authentication is managed by a third-party Identity Provider (IdP). The client applications send a JSON Web Token (JWT) issued by the IdP in the `Authorization` header of every request to an Amazon API Gateway REST API. The developer must secure the `/documents/delete` resource so that only users who have a custom claim `user_role` set to `Administrator` in the JWT are permitted to invoke the backend service. This validation must be enforced at the API Gateway boundary to prevent unauthorized requests from invoking the backend integration. Which solution should the developer implement to meet these requirements with the least operational overhead?

Create an API Gateway Lambda Request Authorizer. In the Lambda function, verify the signature of the incoming JWT using the Identity Provider's JSON Web Key Set (JWKS), extract the custom `user_role` claim, and return an IAM policy that allows the `execute-api:Invoke` action on the target resource if the claim value is `Administrator`.

Set up an Amazon Cognito User Pool federated with the third-party IdP, and configure an API Gateway Cognito User Pools Authorizer. In the method request settings for the `/documents/delete` resource, add custom OAuth Scopes to validate that the custom `user_role` attribute in the user's identity token matches `Administrator`.

Set up an Amazon Cognito Identity Pool to exchange the third-party JWT for temporary AWS credentials. Enable IAM authorization on the `/documents/delete` resource, and write a custom API Gateway Resource Policy that denies requests if the `$context.authorizer.claims.user_role` context variable does not match `Administrator`.

Set up a Lambda Proxy Integration for the `/documents/delete` resource. In the backend Lambda function, extract the custom `user_role` claim from the request payload, and return an API Gateway Resource Policy dynamically to deny the request if the claim value is not `Administrator`.

Show answer & explanation

Answer: Create an API Gateway Lambda Request Authorizer. In the Lambda function, verify the signature of the incoming JWT using the Identity Provider's JSON Web Key Set (JWKS), extract the custom `user_role` claim, and return an IAM policy that allows the `execute-api:Invoke` action on the target resource if the claim value is `Administrator`.

Answer

Create an API Gateway Lambda Request Authorizer to decode and validate the token, extract the custom claim, and generate an IAM policy that grants access if the claim matches the required role.

Implementing an API Gateway Lambda Request Authorizer allows the developer to run custom code at the API Gateway boundary. The Lambda function can fetch the IdP's JSON Web Key Set (JWKS), verify the JWT signature, read the custom `user_role` claim, and generate an IAM policy that allows or denies access using the `execute-api:Invoke` action.

Step-by-Step Solution

Analyze client authentication token properties.

The client passes a standard JWT issued by a third-party IdP containing custom claims.

Understanding the token type and claims is essential for choosing the correct authorizer type.

Evaluate API Gateway native authorizer capabilities.

Built-in Cognito User Pool Authorizers cannot perform custom authorization logic (such as validating custom claims like `user_role` at the API Gateway level) and do not support OIDC scopes on ID tokens.

Enforcing custom claim checks at the API Gateway boundary prevents unauthorized backend execution.

Select the appropriate authorization mechanism.

A custom Lambda Authorizer must be implemented to validate the JWT signature against the IdP's JWKS and programmatically inspect the custom claim.

Only Lambda Authorizers allow running custom code at the API Gateway boundary to generate dynamic IAM policies based on arbitrary JWT claims.

Return an IAM policy from the Lambda Authorizer.

The Lambda Authorizer returns an IAM policy allowing or denying the `execute-api:Invoke` action on the resource.

API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Key Concept

API Gateway custom Lambda Authorizers allow developers to perform custom JWT verification and inspect arbitrary token claims at the API Gateway boundary to return an IAM policy.

Estimated Time:3m 0s

Question 631Question →

A developer is configuring a deployment strategy for a web application running on AWS Elastic Beanstalk. The application must maintain full capacity ( $100\%$ ) throughout the deployment process to handle steady traffic, and the developer wants to avoid performing any DNS routing changes or CNAME swaps. Which two deployment policies satisfy these requirements? (Select TWO.)

Select all that apply

Rolling with additional batch

Immutable

Rolling

All at once

Blue/Green deployment via CNAME swap

Show answer & explanation

Answer: Rolling with additional batch; Immutable

Answer

Rolling with additional batch and Immutable are the correct deployment policies.

The correct options are 'Rolling with additional batch' and 'Immutable'. 'Rolling with additional batch' maintains full capacity by launching a new batch of instances before taking existing ones out of service. 'Immutable' maintains full capacity by deploying a temporary Auto Scaling group next to the original one and only cleaning up the old instances once the new ones pass health checks. Neither policy requires DNS or CNAME swaps.

Step-by-Step Solution

Analyze capacity requirements during deployment.

The application requires maintaining full capacity (

100\%

) at all times, meaning the deployment must not take any active instances out of service without first replacing their capacity.

This rules out the standard Rolling policy, which takes batches offline, and the All at once policy, which takes all instances offline.

Analyze DNS and routing requirements.

The developer wants to avoid DNS changes or CNAME swaps.

This rules out Blue/Green deployment, which relies on swapping the URLs of two separate environments (a DNS-level change).

Evaluate the remaining Elastic Beanstalk deployment policies.

Rolling with additional batch launches new instances first to maintain capacity, and Immutable creates a temporary parallel Auto Scaling group to test the new version before replacing the old one. Neither requires DNS changes.

Both of these options satisfy both the full capacity and no-DNS-swap constraints.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, downtime, and DNS routing.

Question 632Question →

A developer needs to encrypt local application backup files before uploading them to Amazon S3 using client-side envelope encryption with an AWS KMS customer managed key. Which TWO actions must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation to retrieve both a plaintext and a ciphertext version of the data key.

Encrypt the files locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the KMS Encrypt API operation directly for each file to encrypt the payload on the server side.

Call the GenerateDataKeyWithoutPlaintext API operation and use the returned ciphertext data key to encrypt the files.

Store the plaintext data key in AWS Systems Manager Parameter Store to use during future decryption processes.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to retrieve both a plaintext and a ciphertext version of the data key.; Encrypt the files locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To perform local envelope encryption, the developer must call the GenerateDataKey API to obtain a plaintext and ciphertext data key, encrypt the files locally using the plaintext key, and then delete the plaintext key from memory.

In client-side envelope encryption, the client must obtain a data key from KMS by calling the GenerateDataKey API. The API returns both a plaintext data key and a ciphertext data key. The developer uses the plaintext data key to encrypt the files locally and then immediately deletes the plaintext key from memory to prevent unauthorized access. The ciphertext data key is stored next to the encrypted file so it can be decrypted later when needed.

Step-by-Step Solution

Request a data key from AWS KMS

Obtained a plaintext data key and a ciphertext data key by invoking the GenerateDataKey API with the customer managed key.

The plaintext key is necessary for local encryption, while the ciphertext key is stored alongside the data for subsequent decryption.

Encrypt the file locally

Encrypted the backup files using the plaintext data key with a local cryptographic library.

This performs client-side encryption without sending the file payload to AWS KMS.

Clean up the memory

Deleted the plaintext data key from memory and retained the ciphertext data key.

Ensures the plaintext key does not persist in memory, which would compromise the security of the encrypted files.

Key Concept

AWS KMS Client-Side Envelope Encryption Workflow

Question 633Question →

A developer is securing a feedback collection REST API hosted on Amazon API Gateway. The requirement is to allow access only to authenticated corporate users who reside in an Amazon Cognito User Pool. Which two steps should the developer perform to implement this authentication mechanism? (Select TWO).

Select all that apply

Create an Amazon API Gateway authorizer of type Cognito and select the Cognito User Pool.

Configure the API Gateway resource methods to use the Cognito authorizer.

Configure an Amazon Cognito Identity Pool to authenticate requests and associate it directly with the API Gateway resource.

Write a custom AWS Lambda authorizer that manually decodes and validates the Cognito JSON Web Tokens (JWT).

Configure the API Gateway resource with a Lambda proxy integration to handle user pool authentication inside the backend integration code.

Show answer & explanation

Answer: Create an Amazon API Gateway authorizer of type Cognito and select the Cognito User Pool.; Configure the API Gateway resource methods to use the Cognito authorizer.

Answer

To secure the API using an Amazon Cognito User Pool, the developer must create a Cognito authorizer in API Gateway pointing to the User Pool, and then configure the API methods to use this authorizer.

To secure the API using an Amazon Cognito User Pool natively, the developer must first create an API Gateway authorizer of type Cognito, linking it directly to the User Pool. The developer then configures the relevant API resource methods to use this Cognito authorizer. This allows API Gateway to automatically authenticate incoming requests by validating the JWT passed in the Authorization header.

Step-by-Step Solution

Create a Cognito authorizer in Amazon API Gateway.

An authorizer configured to validate JSON Web Tokens (JWTs) issued by the specified Amazon Cognito User Pool is established.

This sets up the connection between API Gateway and the user directory where corporate users are managed.

Configure the HTTP method (e.g., GET, POST) on the API Gateway resource to use the newly created Cognito authorizer.

The API method is secured, requiring a valid Authorization header containing a JWT.

This enforces the authorizer check at the API Gateway edge before any request is forwarded to backend integrations.

Key Concept

API Gateway Cognito Authorizers

Estimated Time:1m 30s

Question 634Question →

A developer is deploying a containerized API on AWS Fargate within a private subnet of a custom VPC. The API needs to read and write data to an Amazon Aurora PostgreSQL database located in a different private subnet within the same VPC. Additionally, the API must fetch sensitive API keys from AWS Secrets Manager. There is no route to the internet or any NAT Gateway configured in the VPC. Which set of configurations is required to establish these connections securely?

Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Deploy a NAT Gateway in the Fargate task's private subnet, add a route in its route table pointing 0.0.0.0/0 to the NAT Gateway, and configure the Aurora security group to allow inbound traffic from the NAT Gateway's private IP address.

Modify the IAM trust policy of the ECS task execution role to trust secretsmanager.amazonaws.com and add a policy allowing secretsmanager:GetSecretValue, then configure the Aurora routing table to propagate routes from the Fargate subnet.

Migrate the API keys from AWS Secrets Manager to Systems Manager Parameter Store, as Parameter Store is natively accessible within private subnets without requiring VPC endpoints or NAT gateways, and open port 5432 on the Aurora subnet's Network Access Control List (NACL) for inbound and outbound traffic.

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Answer

The correct option establishes a private, secure path to Secrets Manager via AWS PrivateLink within the VPC, and allows the Fargate task to securely communicate with the Aurora database in another private subnet of the same VPC using security groups.

Step-by-Step Solution

Analyze destination endpoints.

Amazon Aurora PostgreSQL is hosted within the VPC, while AWS Secrets Manager is a public AWS service endpoint outside the VPC.

This determines which connections require VPC-native routing and which require external access or endpoints.

Configure the database connection.

The Aurora security group is modified to allow inbound traffic on port 5432 originating from the security group of the Fargate task.

Since both resources reside in different private subnets of the same VPC, local routing is automatic, and security groups are used to restrict access.

Configure access to AWS Secrets Manager without internet access.

An interface VPC endpoint (PrivateLink) for Secrets Manager is created in the VPC subnets, and its security group is set to allow inbound HTTPS traffic (port 443) from the Fargate task's security group.

Since there is no internet route or NAT Gateway, a VPC endpoint is required to establish private connectivity to Secrets Manager.

Key Concept

VPC Security Groups and Private VPC Endpoints

Estimated Time:2m 0s

Question 635Question →

A company is developing a serverless web application where users authenticate via a third-party SAML Identity Provider (IdP) integrated with an Amazon Cognito User Pool. Upon successful login, the frontend application receives Cognito JSON Web Tokens (JWTs). The frontend needs to call a backend REST API hosted on Amazon API Gateway, which triggers an AWS Lambda function. The Lambda function must retrieve the user's custom database tenant ID (mapped from the SAML assertion to a Cognito custom attribute) to perform tenant-isolated database queries. The solution must minimize code complexity and avoid custom token verification logic in the Lambda function.

Which combination of steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Configure a built-in Cognito User Pool Authorizer on the API Gateway REST API methods and pass the Cognito ID token in the Authorization header of the request.

Access the user's custom attribute in the backend Lambda function using the event.requestContext.authorizer.claims['custom:tenant_id'] context path.

Configure a custom Lambda Authorizer in API Gateway that validates the token signature and calls the Cognito IDP AdminGetUser API to fetch user attributes.

Establish an Amazon Cognito Identity Pool to map the SAML federated users to IAM roles, and configure API Gateway to use IAM Authorization.

Configure an IAM role with a trust policy that allows Amazon Cognito User Pools to assume the role, then pass this role ARN in the API request header.

Show answer & explanation

Answer: Configure a built-in Cognito User Pool Authorizer on the API Gateway REST API methods and pass the Cognito ID token in the Authorization header of the request.; Access the user's custom attribute in the backend Lambda function using the event.requestContext.authorizer.claims['custom:tenant_id'] context path.

Answer

Configure a built-in Cognito User Pool Authorizer on the API Gateway methods to validate the ID token, and retrieve the custom mapped attribute inside the Lambda function using the requestContext authorizer claims context.

The correct approach involves using the built-in Cognito User Pool Authorizer on API Gateway. This validates incoming ID tokens and passes the claims directly to the Lambda function. Inside the Lambda function, the mapped custom attribute can be extracted from the requestContext authorizer claims without calling Cognito APIs or writing custom validation logic.

Step-by-Step Solution

Integrate the SAML IdP with Amazon Cognito User Pools, mapping the SAML assertion fields to Cognito custom attributes (such as custom:tenant_id).

Upon user authentication, Cognito issues an ID token containing the user claims and custom attributes.

This establishes user identity and maps the required business context into the standard token format.

Create and configure a built-in Cognito User Pool Authorizer in API Gateway, linking it to the Cognito User Pool, and apply it to the API Gateway methods.

API Gateway automatically intercepts requests, validates the token signature, checks expiration, and retrieves user claims.

This offloads token validation complexity from the application code.

In the backend Lambda function code, read the custom attributes from the incoming event structure context.

The Lambda function receives the claims directly under the requestContext object, permitting the function to isolate data access using the tenant ID without performing any cryptographic operations or SDK calls.

This matches the requirement to minimize code complexity and avoid custom verification logic.

Key Concept

API Gateway Cognito Authorizers parse and validate Cognito JSON Web Tokens (JWTs) automatically, exposing the decoded claims directly to integrated backend Lambda functions via the request context.

Estimated Time:2m 0s

Question 636Question →

A team is deploying a serverless data ingestion application. An AWS Lambda function needs to read and write data to an Amazon ElastiCache for Redis cluster located in the private subnets of a VPC. The Lambda function also must perform outbound HTTPS requests to an external validation API on the public internet. Which TWO network and security configurations must the developer implement to establish this connectivity? (Select TWO.)

Select all that apply

Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.

Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.

Attach the Lambda function to the public subnets of the VPC to allow direct outbound communication to the external API via an Internet Gateway.

Modify the trust policy of the Lambda execution role to allow the Systems Manager Parameter Store service principal to access VPC resources.

Configure the ElastiCache connection endpoint as a Parameter Store SecureString parameter and configure Parameter Store to automatically rotate the parameter daily.

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.; Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.

Answer

To establish the required connectivity, the developer must place the Lambda function in the VPC's private subnets and use a NAT Gateway in a public subnet for public internet access, while also adjusting the ElastiCache security group to allow inbound traffic on port 6379 from the Lambda function's security group.

Configuring the Lambda function inside private subnets with a NAT Gateway in a public subnet allows the function to access both private resources (ElastiCache) and the public internet (external API). Modifying the ElastiCache security group to accept inbound traffic from the Lambda security group is required to allow connection requests.

Step-by-Step Solution

Place the Lambda function inside the private subnets of the VPC to grant it network path access to the ElastiCache cluster.

The Lambda function is associated with ENIs in the private subnets, enabling it to reach local VPC resources.

VPC-enabled Lambda functions require association with subnets inside the VPC to interact with private endpoints like ElastiCache.

Set up a NAT Gateway in a public subnet of the VPC and update the private subnets' route table to forward 0.0.0.0/0 traffic to the NAT Gateway.

The Lambda function in the private subnets can now establish outbound HTTPS connections to the external validation API.

Lambda functions in private subnets cannot access the public internet directly through an Internet Gateway and must use a NAT Gateway.

Modify the ElastiCache security group to allow inbound Redis traffic (TCP 6379) from the security group assigned to the Lambda function.

Network communication on port 6379 is allowed through the stateful firewall rules of both security groups.

Security groups act as firewalls at the instance/resource level, and inbound access must be explicitly allowed for connection requests to succeed.

Key Concept

VPC Security for Lambda and ElastiCache connectivity, including security group rules and private-to-public routing.

Estimated Time:2m 0s

Question 637Question →

A development team is deploying a web application to an AWS Elastic Beanstalk environment running on an Amazon Linux 2023 platform. The application requires two configuration changes: First, a custom shell script must execute after the application source code has been extracted to the staging directory but before it is moved to the final path. Second, a custom system daemon (systemd service) must be configured to start automatically when each EC2 instance boots. Which combination of files and directory structures must the developer include in the application source bundle to satisfy these requirements? (Select TWO.)

Select all that apply

A shell script inside the `.platform/hooks/predeploy/` directory to run the custom script.

A configuration file ending in `.config` inside the `.ebextensions/` directory containing a `services` block to enable and start the system daemon.

A shell script inside the `.ebextensions/hooks/` directory to run the custom script.

An `appspec.yml` file at the root of the source bundle containing the script path under the `ApplicationStart` hook.

A shell script inside the `.ebextensions/predeploy/` directory to execute during the predeploy stage.

Show answer & explanation

Answer: A shell script inside the `.platform/hooks/predeploy/` directory to run the custom script.; A configuration file ending in `.config` inside the `.ebextensions/` directory containing a `services` block to enable and start the system daemon.

Answer

The correct options are placing the custom shell script under the `.platform/hooks/predeploy/` directory and placing a `.config` configuration file under the `.ebextensions/` directory containing a `services` block.

To execute custom scripts during specific deployment phases on Amazon Linux 2023, scripts must be placed in `.platform/hooks/predeploy/`. To manage system services, a `.config` file within the `.ebextensions/` folder containing a `services` section must be used.

Step-by-Step Solution

Determine the directory structure required for custom hook scripts on Amazon Linux 2023 platforms.

Identify that platform hooks must reside in `.platform/hooks/` and that the `predeploy` phase runs after extraction but before the app goes live.

Elastic Beanstalk AL2023 platforms look for hooks in `.platform/hooks/` rather than `.ebextensions/`.

Determine how to manage system-level configuration such as starting daemons or services on boot.

Identify that the `.ebextensions/` directory contains `.config` files, which support a `services` section to configure system daemon startup.

The `.ebextensions/` files are processed during deployment to declare system configuration resources.

Key Concept

AWS Elastic Beanstalk configuration files and platform hooks directory layout

Estimated Time:2m 0s

Question 638Question →

A developer is implementing client-side decryption for a serverless application. The application retrieves encrypted log archives (each averaging $150\text{ MB}$ in size) from an Amazon S3 bucket. The logs were encrypted using envelope encryption with an AWS KMS customer managed key. The encrypted data key is stored as metadata alongside each S3 object.

Which two actions must the developer perform to decrypt the log archives? (Select TWO.)

Select all that apply

Call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key.

Decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

Send the encrypted log archive directly to the KMS Decrypt API to be decrypted by AWS KMS.

Call the KMS GetKeyPolicy API to retrieve the private key of the customer managed key to perform local decryption.

Retrieve the plaintext decryption key from the AWS Systems Manager Parameter Store using the GetParameter API.

Show answer & explanation

Answer: Call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key.; Decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

Answer

To decrypt the log archives, the developer must call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key, and then decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

The correct options identify the proper steps for client-side envelope decryption: first, the client must call the KMS Decrypt API to decrypt the encrypted data key (which is small enough to fit within the

4\text{ KB}

KMS limit); second, the client must perform the decryption of the actual

150\text{ MB}

log file locally using the resulting plaintext data key and a symmetric decryption algorithm. This avoids transmitting large data payloads over the network to KMS.

Step-by-Step Solution

Extract the encrypted data key from the S3 object metadata.

The encrypted data key is loaded into the Lambda function's memory.

The encrypted data key must be decrypted before it can be used to decrypt the actual log archive.

Invoke the AWS KMS Decrypt API operation, passing the encrypted data key.

AWS KMS returns the plaintext data key.

Only AWS KMS can decrypt the data key because the customer managed key remains secured within the KMS hardware security modules.

Decrypt the

150\text{ MB}

log archive locally using the plaintext data key and a symmetric algorithm like AES.

The log archive is successfully decrypted.

Direct decryption via AWS KMS is limited to payloads of

4\text{ KB}

or less, requiring large files to be decrypted locally using envelope encryption.

Key Concept

Envelope encryption is a method where data is encrypted with a unique data key, and the data key itself is encrypted under a root key (an AWS KMS customer managed key). To decrypt the data, the encrypted data key must first be sent to KMS to be decrypted. The resulting plaintext data key is then used locally by the application to decrypt the large payload, avoiding the transmission of large files over the network to KMS.

Estimated Time:1m 30s

Question 639Question →

A developer is building a high-throughput microservice deployed on AWS Fargate that processes sensitive financial transactions. The system must encrypt each transaction payload client-side before storing it in an Amazon DynamoDB table. To meet strict security compliance, the team has established the following requirements:

1. Access to the AWS Key Management Service (AWS KMS) customer managed key (CMK) must be managed centrally using IAM policies, avoiding direct updates to the KMS key policy whenever a new microservice is deployed.
2. The microservice's IAM execution role (`TxServiceRole`) must be granted the absolute minimum permissions required to perform local client-side envelope encryption.

Which two configuration steps must the developer perform to satisfy these requirements? (Select TWO.)

Select all that apply

Include a statement in the KMS key policy of the customer managed key that grants the AWS account root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform all KMS actions (`kms:*`).

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKey` action on the ARN of the customer managed key.

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:Encrypt` and `kms:Decrypt` actions on the ARN of the customer managed key.

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKeyWithoutPlaintext` action on the ARN of the customer managed key.

Configure the microservice to store the generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to reuse across transaction sessions.

Show answer & explanation

Answer: Include a statement in the KMS key policy of the customer managed key that grants the AWS account root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform all KMS actions (`kms:*`).; Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKey` action on the ARN of the customer managed key.

Answer

To configure client-side envelope encryption with IAM-based access management, the KMS key policy must delegate permission control to IAM by granting the account root user permissions to perform all KMS actions. Additionally, the microservice execution role must be granted permissions in IAM to run the `kms:GenerateDataKey` action on the key.

The correct configuration requires delegating control of the KMS Customer Managed Key (CMK) to IAM, and granting the microservice the minimal API action required for envelope encryption. Delegating control to IAM is achieved by adding a policy statement to the key policy that grants `kms:*` to the account's root user. The microservice requires the `kms:GenerateDataKey` action to retrieve both the plaintext and encrypted versions of the data key needed to perform envelope encryption client-side.

Step-by-Step Solution

Configure the KMS key policy to delegate authorization to IAM.

Include a statement in the KMS key policy that grants the root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform `kms:*` operations.

This is a prerequisite for managing KMS key access centrally via IAM policies. Without this statement, IAM policies granting access to the key will be ignored.

Determine the necessary KMS API action for envelope encryption.

Identify that the application needs to run `GenerateDataKey` to retrieve both the plaintext and ciphertext versions of the data key.

Envelope encryption requires the plaintext key to encrypt the payload locally and the ciphertext key to store with the encrypted payload for later decryption.

Attach the minimum required IAM permissions to the microservice role.

An IAM policy allowing `kms:GenerateDataKey` on the key ARN is attached to the role.

This implements the principle of least privilege, giving the microservice only the permission it needs to generate keys for client-side encryption without granting administrative or direct encryption capabilities.

Key Concept

KMS Key Policies and Envelope Encryption Integration

Question 640Question →

A developer is building a web application and needs to implement user registration, sign-in, and password recovery features. The developer wants to manage a secure user directory without provisioning or managing server infrastructure. Which Amazon Cognito component should the developer use to meet these requirements?

Amazon Cognito User Pools

Amazon Cognito Identity Pools

AWS IAM Trust Policies

Amazon API Gateway Lambda Authorizers

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools

Amazon Cognito User Pools act as a user directory and provide built-in sign-up, sign-in, and self-service password recovery workflows, which perfectly align with the developer's requirements.

Step-by-Step Solution

Identify the primary requirement of the application, which is to implement user registration, sign-in, password recovery, and to maintain a secure user directory.

The core requirement is user authentication and user directory management.

This determines whether a user directory service (authentication) or a credential vending service (authorization) is needed.

Compare Amazon Cognito User Pools and Identity Pools to determine which service meets the user directory requirement.

Amazon Cognito User Pools provide a user directory and handle user registration/sign-in, whereas Identity Pools provide temporary AWS credentials.

Choosing the correct pool type is essential to avoid unnecessary custom integration work.

Key Concept

Amazon Cognito User Pools are user directories that provide sign-up and sign-in options for web and mobile app users.

PreviousPage 32 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept