Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 661Question →

A company is developing a mobile application. The mobile app needs to allow users to sign up and sign in using their email addresses, and it also needs to store custom user profile attributes in a managed user directory. Which Amazon Cognito component should the developer use to implement this user directory and handle user authentication?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
Amazon Cognito User Pools is the correct service because it functions as a user directory that manages user registration, authentication, and profile attributes. It provides built-in sign-up and sign-in pages and can scale to millions of users without requiring database management.

Step-by-Step Solution

1
Analyze the application requirements for user registration, login, and managing a user directory.
Identify that the system needs to perform authentication and directory management rather than direct AWS resource authorization.
This helps differentiate between Cognito User Pools and Cognito Identity Pools.
2
Compare Cognito User Pools and Cognito Identity Pools features.
Understand that User Pools handle authentication and act as the user directory, whereas Identity Pools provide temporary AWS credentials for authorization.
To select the specific Cognito component designed for managing user profiles and handling sign-up/sign-in flows.
3
Select the service that manages authentication and user directories.
Choose Amazon Cognito User Pools as the correct service.
It fulfills the requirement to manage user sign-up, sign-in, and profile attributes without managing a backend database.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and user directory) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).
Question 662Question →

A developer is deploying an updated version of a REST API to Amazon API Gateway. The developer must test the update by routing 15%15\% of production traffic to the new version. The remaining 85%85\% of traffic must continue to use the current version. The developer also needs the ability to instantly roll back the update if errors occur, or fully promote the update to production if it is successful. Which TWO configurations or actions must the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a canary release on the existing API Gateway stage and configure the canary traffic percentage to 15%15\%.; Delete the canary release from the stage to roll back, or promote the canary release to make the new version the active production version.

Answer

To meet the requirements, the developer must create a canary release on the API Gateway stage configured to receive 15% of the traffic, and then either delete the canary release to roll back or promote it to replace the production version if successful.
Creating a canary release on the existing stage and specifying 15%15\% traffic natively implements the requested traffic split. Once configured, any new deployment to that stage routes the specified portion of traffic to the new code. Deleting the canary from the stage immediately halts the canary traffic routing and serves 100%100\% of traffic from the production version, fulfilling the instant rollback requirement. Promoting the canary upgrades the stage's production settings to point to the new deployment.

Step-by-Step Solution

1
Set up traffic shifting in API Gateway.
By creating a canary release directly on the target deployment stage and configuring it to receive 15%15\% of traffic, API Gateway automatically splits incoming traffic between the current production release (85%85\%) and the newly deployed canary release (15%15\%).
This natively meets the requirement to route a specific percentage of traffic to the new version without using external routing mechanisms.
2
Manage the lifecycle of the canary deployment.
If errors are detected during testing, deleting the canary release immediately routes 100%100\% of traffic back to the production version. If successful, promoting the canary copies the configuration to the stage, making it the new production release.
This provides instant rollback and clean promotion capabilities directly inside the API Gateway stage settings.

Key Concept

Amazon API Gateway stages support native canary releases. Enabling a canary on a stage allows a developer to route a portion of the traffic to a new deployment, test its stability, and either promote it to production or delete the canary to roll back.
Estimated Time:2m 0s
Question 663Question →

A team is migrating an on-premises desktop application to a cloud-native model. The application requires users to authenticate against a central directory and then obtain temporary, limited-privilege AWS credentials to retrieve configuration objects directly from an Amazon DynamoDB table. Which configuration steps must the team implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a user pool in Amazon Cognito to manage the user directory and handle user authentication.; Configure an identity pool in Amazon Cognito, link it to the user pool, and define an authenticated IAM role that allows DynamoDB access.

Answer

Configure a user pool in Amazon Cognito to manage the user directory and handle user authentication, and configure an identity pool in Amazon Cognito, link it to the user pool, and define an authenticated IAM role that allows DynamoDB access.
To meet the requirements, the team must use a user pool in Amazon Cognito to handle user directory management and authentication. Then, they must link this user pool to an Amazon Cognito identity pool, which handles authorization by vending temporary AWS credentials to authenticated users via an IAM role.

Step-by-Step Solution

1
Identify the authentication requirement.
Use a Cognito user pool to act as a user directory and handle user authentication.
User pools are designed for identity management, user directory hosting, and authentication.
2
Identify the authorization requirement for direct AWS resource access.
Use a Cognito identity pool linked to the user pool to exchange identity tokens for temporary AWS credentials.
Identity pools authorize access to AWS resources by vending temporary credentials to authenticated users.
3
Configure the IAM role and trust policy for the identity pool.
Define an authenticated IAM role allowing DynamoDB access and trust the Cognito identity service principal.
This establishes the secure trust relationship needed for Cognito to assume the role on behalf of the user.

Key Concept

Separation of authentication (Cognito User Pools) and authorization (Cognito Identity Pools) for direct AWS resource access using IAM roles.
Question 664Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to securely download external libraries from a public repository on the internet and retrieve configuration parameters from AWS Systems Manager Parameter Store. Which of the following VPC configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet.; Create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) and associate it with the private subnets.

Answer

Configure a route in the private subnet's route table that directs outbound traffic (0.0.0.0/0) to a NAT Gateway located in a public subnet, and create an Interface VPC Endpoint (AWS PrivateLink) for Systems Manager (ssm) associated with the private subnets.
The correct configurations involve routing private subnet outbound internet traffic to a NAT Gateway in a public subnet, and establishing an Interface VPC Endpoint for Systems Manager. This allows the Lambda function to securely communicate with both the public internet and AWS Systems Manager privately.

Step-by-Step Solution

1
Analyze internet access requirements for Lambda in a private subnet.
To access the public internet (external registry), a Lambda function in a private subnet requires a route targeting a NAT Gateway located in a public subnet.
Resources in private subnets cannot associate with public IP addresses directly, so egress to the internet must be handled by a Network Translation (NAT) device.
2
Analyze private access to AWS Systems Manager.
Create an Interface VPC Endpoint (PrivateLink) for 'ssm' and map it to the private subnets.
This establishes a secure, private connection to Systems Manager within the VPC without routing traffic through the public internet.

Key Concept

VPC Egress and VPC Endpoints for Lambda
Question 665Question →

A company is deploying an application on Amazon EC2 instances located in a private subnet of a custom VPC. The application must securely retrieve database credentials from AWS Secrets Manager and also connect to a public API endpoint of an external partner over the internet.

Which of the following network configurations must the developer implement to meet these requirements while minimizing data transfer over the public internet? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet.; Deploy a NAT gateway in a public subnet and add a route in the private subnet's route table that points 0.0.0.0/0 to the NAT gateway.

Answer

The correct configurations are to create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnet, and deploy a NAT gateway in a public subnet with a route in the private subnet's route table pointing outbound internet-bound traffic (0.0.0.0/0) to the NAT gateway.
To satisfy both requirements under the constraint of minimizing public internet usage, the developer must: 1. Deploy an Interface VPC Endpoint (PrivateLink) for Secrets Manager so that credential requests remain entirely within the AWS network. 2. Use a NAT Gateway in a public subnet coupled with a route in the private route table to enable outbound internet access to the external payment API.

Step-by-Step Solution

1
Determine the required connectivity for AWS Secrets Manager.
Since the goal is to retrieve credentials securely while minimizing internet traffic, the application should connect to Secrets Manager privately. Secrets Manager supports Interface VPC Endpoints (AWS PrivateLink) for private network connectivity.
Using an interface endpoint prevents database credential retrieval traffic from traversing the public internet.
2
Determine the required connectivity for the external API.
The external API is a public internet endpoint. Instances in private subnets cannot access the public internet directly. A NAT gateway must be deployed in a public subnet, and a route to it (for 0.0.0.0/0) must be added to the private subnet's route table.
A NAT gateway allows private subnet resources to initiate outbound requests to public endpoints.

Key Concept

Configuring private subnets to securely access AWS services via VPC endpoints and external services via NAT Gateways.
Question 666Question →

A developer is creating a mobile game. The application needs to authenticate users using a custom username and password. Once authenticated, the game client must directly publish player analytics events to an Amazon Pinpoint project. Which of the following Amazon Cognito components should the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An Amazon Cognito User Pool to manage user sign-up, sign-in, and the player directory.; An Amazon Cognito Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon Pinpoint.

Answer

The developer should configure an Amazon Cognito User Pool to manage user sign-up, sign-in, and the player directory, and configure an Amazon Cognito Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon Pinpoint.
To manage player authentication and the user directory, an Amazon Cognito User Pool is required. To obtain temporary AWS credentials for the game client to access Amazon Pinpoint directly, an Amazon Cognito Identity Pool must be configured to exchange the user pool tokens for temporary IAM credentials.

Step-by-Step Solution

1
Determine the service needed for user authentication and user directory management.
An Amazon Cognito User Pool is selected to register and authenticate players.
User Pools provide identity provider features such as sign-up, sign-in, and directory storage.
2
Determine the service needed to provide the client with access to AWS resources directly.
An Amazon Cognito Identity Pool is selected to supply temporary credentials.
Identity Pools exchange the tokens from the User Pool for temporary IAM credentials that allow the client to access services like Amazon Pinpoint.

Key Concept

Understanding the division of responsibility between Amazon Cognito User Pools (authentication and user directory) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).
Question 667Question →

A developer is building an application that needs to encrypt files locally before uploading them to Amazon S3. Each file is approximately 150 MB150\text{ MB} in size. The encryption process must use client-side envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS, minimizing network overhead and API requests. Which two actions must the developer perform to complete this client-side encryption process?

Select all that apply

Show answer & explanation

Answer: Call the KMS GenerateDataKey API passing the Customer Managed Key ID to retrieve a plaintext data key and a ciphertext data key.; Encrypt the file locally using the plaintext data key, store the ciphertext data key alongside the encrypted file in Amazon S3, and delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the KMS GenerateDataKey API to obtain a plaintext and ciphertext data key, use the plaintext data key to encrypt the file locally, store the ciphertext data key alongside the encrypted file, and destroy the plaintext data key from memory.
The correct options describe the standard client-side envelope encryption workflow. The developer calls the GenerateDataKey API to obtain both a plaintext data key and a ciphertext data key. The plaintext key is used to encrypt the 150 MB150\text{ MB} file locally, after which the plaintext key is discarded from memory. The ciphertext data key is stored alongside the encrypted file in S3 so that it can be decrypted later by calling the KMS Decrypt API.

Step-by-Step Solution

1
Generate a unique data key using AWS KMS.
The application receives a plaintext data key and a ciphertext data key encrypted by the KMS Customer Managed Key.
This is the initial step of the envelope encryption pattern, allowing the local system to obtain the keying material needed for bulk encryption without sending the actual file payload to KMS.
2
Encrypt the file locally using the plaintext data key.
The 150 MB150\text{ MB} file is converted into ciphertext.
This allows the high-throughput encryption of large payloads to occur locally, avoiding KMS size limitations (such as the 4 KB4\text{ KB} limit on the Encrypt API) and reducing network overhead.
3
Upload the encrypted file and the ciphertext data key to Amazon S3, and clean up memory.
The encrypted payload and ciphertext key are stored in S3, and the plaintext data key is purged from application memory.
Ensures that the plaintext key is not exposed or stored persistently, while the ciphertext key remains available for future decryption operations.

Key Concept

AWS KMS Envelope Encryption Workflow for Large Payloads
Estimated Time:1m 30s
Question 668Question →

An application deployed on AWS Lambda in Account A (111122223333111122223333) needs to retrieve and decrypt S3 objects from an Amazon S3 bucket located in Account B (444455556666444455556666). The S3 bucket is configured with Server-Side Encryption (SSE-KMS) using a KMS customer managed key.

Which two AWS KMS configuration steps are required to enable the Lambda function to decrypt the objects? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In Account B, modify the KMS customer managed key's key policy to grant the Lambda execution role in Account A permission to perform the kms:Decrypt action.; In Account A, attach an IAM policy to the Lambda execution role that grants the kms:Decrypt permission on the ARN of the customer managed key in Account B.

Answer

The Lambda function execution role requires permissions in both accounts: a KMS key policy update in Account B to allow the role to perform the kms:Decrypt operation, and an IAM policy in Account A allowing the role to call the kms:Decrypt action on the key's ARN in Account B.
For cross-account access to KMS keys, permissions must be granted by both the resource owner (Account B) and the consumer (Account A). First, the KMS customer managed key's policy in Account B must be modified to trust and allow the Lambda execution role ARN from Account A to perform the decryption operation. Second, the Lambda execution role in Account A must have an IAM policy attached that permits it to perform the decryption action against the KMS key ARN in Account B.

Step-by-Step Solution

1
Examine the cross-account requirements for SSE-KMS decryption.
Identify that both S3 access and KMS key access are required, and that KMS cross-account access requires permissions in both the key policy (trusting account) and the IAM policy (trusted account).
KMS evaluates authorization in both the caller's account and the resource-owning account for cross-account requests.
2
Configure the key-owning account (Account B).
Modify the customer managed key's key policy in Account B to grant kms:Decrypt permissions to the specific Lambda execution role ARN in Account A.
This establishes trust from the resource owner to the external identity.
3
Configure the caller's account (Account A).
Attach an IAM policy to the Lambda execution role in Account A granting kms:Decrypt on the specific customer managed key ARN from Account B.
This grants the identity the authority to call KMS across accounts.

Key Concept

Cross-account KMS authorization requires permission grants in both the KMS key policy (resource-based) and the caller's IAM policy (identity-based), and AWS managed keys do not support cross-account sharing.
Question 669Question →

A developer is using AWS SAM to deploy a serverless application consisting of an API Gateway endpoint that triggers a Lambda function, which writes data to a DynamoDB table. The template is defined as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
ProcessTransactionFunction:
Type: 'AWS::Serverless::Function'
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostTransaction:
Type: Api
Properties:
Path: /transaction
Method: post
Role: !GetAtt LambdaExecutionRole.Arn

LambdaExecutionRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- apigateway.amazonaws.com
Action:
- 'sts:AssumeRole'
Policies:
- PolicyName: DynamoDBWritePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'dynamodb:PutItem'
Resource: !GetAtt TransactionTable.Arn

During the deployment process using the AWS SAM CLI, the deployment fails with a parser error indicating that the resource type `AWS::Serverless::Function` is invalid. Additionally, if the parsing error is resolved, the Lambda function will fail to execute due to execution role issues.

Which two modifications must the developer make to ensure the template parses successfully and the Lambda function can be successfully assumed and executed by the AWS Lambda service?

Select all that apply

Show answer & explanation

Answer: Add Transform: AWS::Serverless-2016-10-31 at the root level of the template.; Update the trust policy of LambdaExecutionRole to list lambda.amazonaws.com as the service principal.

Answer

To resolve the issues, the developer must add the Transform declaration to the root level of the template, and update the execution role trust policy to list the Lambda service principal.
Adding the Transform header enables the CloudFormation service to parse the AWS SAM syntax. Changing the service principal in the trust policy to lambda.amazonaws.com allows the Lambda service to assume the execution role and run the function.

Step-by-Step Solution

1
Analyze the template syntax error.
Identify that the parser failed on 'AWS::Serverless::Function' because the AWS SAM transform macro statement is missing.
Without the Transform declaration, CloudFormation does not recognize resources in the AWS::Serverless namespace.
2
Analyze the IAM Role trust policy configuration.
Identify that the trust policy lists 'apigateway.amazonaws.com' as the service principal in the Principal section.
The execution role must be assumed by the Lambda service, meaning the service principal must be lambda.amazonaws.com.
3
Determine the necessary changes.
Formulate the fixes: insert the Transform line and update the service principal in the trust policy.
These changes address both the parsing failure and the runtime execution permission failure.

Key Concept

AWS SAM templates require the Transform header to compile serverless resources, and Lambda execution roles require the correct trust policy configuration to allow the Lambda service to assume the role.
Question 670Question →

A developer is deploying a backend microservice on an AWS Lambda function that is configured to run inside the private subnets of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. Due to strict compliance guidelines, the VPC has no Internet Gateway or NAT Gateway attached, and all traffic must remain within the AWS network.

Which two configuration steps should the developer perform to establish private connectivity to these services while maintaining the principle of least privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure its security group to allow inbound HTTPS traffic from the security group associated with the Lambda function.

Answer

Create a Gateway VPC Endpoint for Amazon DynamoDB and associate it with the route tables of the private subnets, and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets with its security group configured to allow inbound HTTPS traffic from the security group associated with the Lambda function.
To connect to AWS services privately from a VPC without internet access, developers must use VPC endpoints. Amazon DynamoDB supports Gateway VPC Endpoints, which route traffic directly to the service using route table entries associated with the private subnets. AWS Secrets Manager requires an Interface VPC Endpoint, which deploys Elastic Network Interfaces (ENIs) into the subnets. To secure access to the Secrets Manager Interface Endpoint under the principle of least privilege, its security group must allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

Step-by-Step Solution

1
Determine the correct VPC endpoint type for Amazon DynamoDB.
Identify that DynamoDB supports Gateway VPC Endpoints.
Gateway endpoints provide private routing to DynamoDB via subnet route tables without incurring hourly charges or requiring security group modifications.
2
Determine the correct VPC endpoint type for AWS Secrets Manager.
Identify that Secrets Manager requires an Interface VPC Endpoint (AWS PrivateLink).
Secrets Manager does not support Gateway endpoints; it requires an Interface endpoint, which places an Elastic Network Interface (ENI) with a private IP in the subnets.
3
Configure the security group for the Secrets Manager Interface VPC Endpoint.
Allow inbound HTTPS (TCP port 443) traffic originating from the specific security group assigned to the Lambda function.
This implements the principle of least privilege, ensuring only the authorized Lambda function can reach the Secrets Manager interface.

Key Concept

VPC Endpoint Routing and Security Group Configuration for Private AWS Service Access
Estimated Time:2m 0s
Question 671Question →

A development team is deploying a worker application to an AWS Elastic Beanstalk Worker Tier environment. The application processes high-compute tasks received from an Amazon SQS queue, with each task taking approximately 4545 minutes (27002700 seconds) to complete. During testing, the team notices that tasks are frequently reprocessed by different worker instances before the original instance completes them, and the worker daemon logs indicate timeout failures before the application returns an HTTP status code. Which two configuration steps must the developer perform to resolve these issues and support this long-running processing requirement?

Select all that apply

Show answer & explanation

Answer: Create a configuration file inside the `.ebextensions` directory with a `.config` extension, and set the `InactivityTimeout` parameter to 30003000 in the `aws:elasticbeanstalk:sqsd` namespace.; Create a configuration file inside the `.ebextensions` directory with a `.config` extension, and set the `VisibilityTimeout` parameter to 30003000 in the `aws:elasticbeanstalk:sqsd` namespace.

Answer

Create a configuration file inside the `.ebextensions` directory with a `.config` extension, and set the `InactivityTimeout` parameter to 30003000 in the `aws:elasticbeanstalk:sqsd` namespace; and create a configuration file inside the `.ebextensions` directory with a `.config` extension, and set the `VisibilityTimeout` parameter to 30003000 in the `aws:elasticbeanstalk:sqsd` namespace.
In an Elastic Beanstalk worker tier environment, the local daemon (`sqsd`) retrieves messages from an SQS queue and posts them to the application. If processing takes 4545 minutes (27002700 seconds), the daemon must wait longer than the default 300300 seconds for the HTTP response. Increasing `InactivityTimeout` in the `aws:elasticbeanstalk:sqsd` namespace to 30003000 seconds prevents premature HTTP timeouts. Concurrently, increasing the `VisibilityTimeout` in the same namespace to 30003000 seconds keeps the message hidden from other instances while the worker processes it, preventing duplicate processing.

Step-by-Step Solution

1
Analyze the worker tier daemon mechanics
Identify that the Elastic Beanstalk worker daemon (`sqsd`) pulls messages from SQS and forwards them via HTTP POST to the local application. The default HTTP connection inactivity timeout is 300300 seconds.
Since tasks take 4545 minutes (27002700 seconds), the daemon's connection will time out unless `InactivityTimeout` is increased.
2
Analyze message visibility constraints
Identify that the SQS visibility timeout must exceed the task processing time (27002700 seconds) to prevent duplicate processing by other worker instances.
Setting the `VisibilityTimeout` option in the daemon configuration to 30003000 seconds prevents the message from returning to the queue during processing.
3
Verify configuration file structure and namespace rules
Confirm that Elastic Beanstalk looks for configurations in the `.ebextensions/` directory at the root of the source bundle. The configuration must target the `aws:elasticbeanstalk:sqsd` namespace.
Any deviation in folder naming (e.g. omitting the leading dot) or using incorrect namespaces will result in the parameters being ignored.

Key Concept

AWS Elastic Beanstalk Worker Tier Daemon Configuration
Question 672Question →

A developer is building a REST API in Amazon API Gateway. The API needs to validate JSON Web Tokens (JWTs) sent by clients who have authenticated using an Amazon Cognito User Pool. The developer wants to implement this security check with the least configuration effort and no additional custom code. Which authorization method is the most appropriate to meet these requirements?

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.

Answer

Configure an API Gateway Cognito User Pool authorizer by specifying the User Pool ID and client ID.
The correct option is configuring an API Gateway Cognito User Pool authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) generated by Cognito User Pools, eliminating the need to write, test, or pay for custom Lambda authorizer code.

Step-by-Step Solution

1
Identify the authorization requirements.
The API must validate JWTs generated specifically by an Amazon Cognito User Pool.
Knowing the token source helps determine if a native, built-in solution is available.
2
Evaluate native API Gateway features for Amazon Cognito.
Amazon API Gateway offers a built-in Cognito User Pool authorizer specifically designed to validate these JWT tokens without writing code.
This minimizes administrative overhead, custom code maintenance, and execution cost.
3
Select the option that requires the least configuration and coding effort.
Configuring the native Cognito User Pool authorizer meets all requirements with the lowest effort.
Other methods either require custom Lambda code or confuse User Pools with Identity Pools.

Key Concept

API Gateway Cognito User Pools Authorizer
Question 673Question →

A developer is building a web application that allows users to sign in using Amazon Cognito. The backend REST API is hosted on Amazon API Gateway. The developer needs to secure the API so that only authenticated users can access the resources. The solution must minimize code maintenance, overhead, and latency. Which configuration should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway methods and pass the Cognito identity token in the request header.
Configuring an Amazon Cognito User Pool authorizer allows API Gateway to automatically validate the incoming identity token without requiring custom Lambda code. This minimizes latency, development effort, and execution costs compared to custom authorizers.

Step-by-Step Solution

1
Analyze the requirements for securing the API Gateway REST API.
The requirement specifies validating user credentials from Amazon Cognito with minimal code maintenance, overhead, and latency.
This helps narrow down the choices between built-in API Gateway features and custom authorization code.
2
Compare built-in API Gateway features with custom-coded solutions.
Amazon API Gateway offers a built-in Amazon Cognito User Pool authorizer that validates JWT tokens natively without invoking any custom Lambda functions.
Using native features reduces both execution latency and the overhead of maintaining custom code.
3
Evaluate and eliminate incorrect authorization configurations.
Custom Lambda authorizers add custom code; Cognito Identity Pools (IAM auth) require request signing and are designed for AWS resource authorization; validating tokens inside a Lambda proxy integration mixes authentication with backend business logic and incurs extra runtime costs.
This identifies the built-in Cognito User Pool authorizer as the most efficient and standard solution.

Key Concept

API Gateway built-in Cognito User Pool Authorizers provide native, low-latency validation of JSON Web Tokens (JWT) without writing or managing custom backend code.
Estimated Time:1m 30s
Question 674Question →

A developer is writing a script to encrypt a small configuration string of size 500 B500\text{ B} before storing it in a database. The developer wants to use AWS KMS to perform the encryption directly on the AWS side, avoiding the complexity of local envelope encryption. Which AWS KMS API operation should the developer call to encrypt this data?

Show answer & explanation

Answer: Encrypt

Answer

The Encrypt operation should be called because it directly encrypts small payloads (up to 4 KB4\text{ KB}) using the KMS key on the AWS side.
The correct answer is the direct encryption operation because the payload is small (500 B500\text{ B}), which is below the 4 KB4\text{ KB} limit for direct KMS encryption, allowing the developer to encrypt it without the overhead of client-side envelope encryption.

Step-by-Step Solution

1
Determine the size of the payload to be encrypted.
The payload size is 500 B500\text{ B}, which is well under the maximum limit of 4 KB4\text{ KB} for direct KMS encryption.
AWS KMS direct encryption via the Encrypt API has a payload limit of 4 KB4\text{ KB}.
2
Identify the encryption approach requested.
Direct encryption on the AWS KMS side is required, avoiding local client-side envelope encryption.
Direct encryption means we do not need to generate a data key locally; we send the plaintext directly to KMS.
3
Select the API operation that matches these criteria.
The Encrypt API operation matches both the size limitation and the requirement for direct KMS-side encryption.
Calling Encrypt returns the encrypted ciphertext directly from AWS KMS.

Key Concept

Direct encryption using AWS KMS is limited to payloads of up to 4 KB4\text{ KB}, whereas larger payloads require client-side envelope encryption using generated data keys.
Question 675Question →

A telemetry data analysis company is building a REST API using Amazon API Gateway. The API will be consumed by two distinct groups:

1. Internal microservices running on Amazon EC2 instances that need to invoke the API securely using their IAM roles.
2. External customer applications that authenticate against an external identity provider and send a custom JSON Web Token (JWT) containing dynamic billing tier claims.

The developer needs to configure the security and authorization for this API in a way that minimizes custom code for standard authentication, supports fine-grained billing-tier checks, and ensures minimum latency.

Which two configuration steps should the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure AWS_IAM authorization on the API resources accessed by the internal microservices, and grant the EC2 instance profile roles the execute-api:Invoke permission.; Create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce authorization based on the dynamic billing tier claims.

Answer

Configure AWS_IAM authorization on the API resources accessed by the internal microservices with execute-api:Invoke permissions, and create an API Gateway Lambda authorizer of type REQUEST to validate the custom JWT and enforce billing tier claims.
The correct configuration requires utilizing AWS_IAM authorization for callers that possess IAM credentials (the internal microservices), and implementing a custom Lambda authorizer of type REQUEST to handle external clients sending custom JWTs with proprietary billing claims. This setup ensures that API Gateway offloads standard authentication natively and handles complex claims verification securely before hitting backend integrations.

Step-by-Step Solution

1
Evaluate the authentication requirements for the internal microservices.
Since internal microservices on Amazon EC2 have IAM roles, using AWS_IAM authorization is the native choice requiring no custom authentication code.
AWS_IAM authorization allows API Gateway to natively leverage IAM policies and signature verification, minimizing latency and code overhead.
2
Evaluate authorization mechanisms for custom third-party JWTs.
Built-in Cognito authorizers cannot process custom external tokens directly. A custom Lambda authorizer must be used.
Lambda authorizers execute custom validation logic, which is required to parse proprietary JWTs and evaluate claims such as billing tiers.
3
Select the correct Lambda authorizer structure.
A REQUEST-type Lambda authorizer receives headers, query strings, and stage variables to execute verification.
A REQUEST authorizer provides flexibility to validate the authorization header and use caching to optimize latency for subsequent API requests.

Key Concept

API Gateway Authorizers and IAM Access Control
Question 676Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline. During the pipeline execution, the pipeline fails at the transition to a deployment stage with an access denied error indicating that the pipeline cannot assume the service role. Which of the following is the most likely cause of this failure?

Show answer & explanation

Answer: The IAM service role assigned to the pipeline has a trust policy that does not list codepipeline.amazonaws.com as a trusted entity.

Answer

The IAM service role assigned to the pipeline must have a trust policy that explicitly lists codepipeline.amazonaws.com as a trusted entity.
The correct option is correct because AWS CodePipeline requires an IAM service role to execute pipeline actions on your behalf. The service role's trust policy must declare codepipeline.amazonaws.com as a trusted entity so that the pipeline service can assume the role and obtain temporary credentials.

Step-by-Step Solution

1
Analyze the error message regarding the pipeline's inability to assume the designated service role.
Identify that the issue is related to IAM role assumption permissions.
The error specifically mentions that CodePipeline is denied access when attempting to assume the service role.
2
Review the trust policy of the IAM service role assigned to AWS CodePipeline.
Determine if the service principal codepipeline.amazonaws.com is declared as a trusted entity.
Without the correct service principal in the trust policy, the AWS Security Token Service (STS) will block CodePipeline from assuming the role.
3
Verify that the permissions policy is separate from the trust policy.
Ensure permissions policies define resource access, whereas the trust policy dictates who can assume the role.
Misplacing trust declarations in the permissions policy is a common configuration mistake that results in access denied errors.

Key Concept

AWS CodePipeline Service Roles and IAM Trust Policies
Question 677Question →

A backend service must encrypt large archives of user data locally before uploading them to a third-party storage provider. The developer needs to implement envelope encryption using a customer managed key in AWS KMS. The service needs to obtain a data key that can be used to encrypt the archives immediately and then be discarded from memory.

Which AWS KMS API operation should the developer invoke to retrieve the required data key?

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey
The correct answer is the operation GenerateDataKey. In envelope encryption, the application needs to encrypt data locally. It calls the GenerateDataKey API, which returns a plaintext data key and an encrypted data key. The application uses the plaintext data key to encrypt the data, discards the plaintext key from memory, and stores the encrypted data key alongside the encrypted data.

Step-by-Step Solution

1
Determine the type of encryption required.
Envelope encryption is required because the application needs to encrypt large archives locally before upload.
Direct KMS encryption via the Encrypt API is limited to 4 KB4\text{ KB} payloads, so client-side envelope encryption must be used for larger files.
2
Identify the state of the data key needed.
The application needs the plaintext data key to perform the encryption immediately, and the encrypted data key to store alongside the ciphertext.
Encryption requires a plaintext key, but for security, the plaintext key is discarded after use and only the encrypted key is saved for future decryption.
3
Select the correct KMS API operation.
GenerateDataKey is selected.
GenerateDataKey returns both the plaintext and ciphertext versions of the data key, satisfying the requirement to encrypt immediately. GenerateDataKeyWithoutPlaintext only returns the ciphertext version.

Key Concept

KMS Envelope Encryption API operations
Estimated Time:1m 30s
Question 678Question →

A developer is securing a REST API in Amazon API Gateway. Users authenticate against an Amazon Cognito User Pool. The developer wants API Gateway to automatically validate the incoming JSON Web Tokens (JWT) before forwarding requests to the backend, with the least operational overhead.

Which two steps must the developer perform to configure this security setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a Cognito User Pool authorizer in API Gateway and configure it with the user pool details.; Configure the API Gateway method authorization to use the newly created Cognito User Pool authorizer.

Answer

Create a Cognito User Pool authorizer in API Gateway and configure the API Gateway method authorization to use it.
The correct options represent the standard path for native JWT validation with Cognito. Creating a Cognito User Pool authorizer leverages built-in functionality to automatically validate signatures, expiration, and audience of identity tokens. Configuring the API Gateway method to use this authorizer ensures the validation checks are applied to incoming requests.

Step-by-Step Solution

1
Identify the authentication source and authorization requirements.
The source is a Cognito User Pool, and token validation must happen at API Gateway with minimal custom code.
This determines that API Gateway's built-in Cognito User Pool authorizer is the optimal choice.
2
Configure the authorizer in the API Gateway console or via IaC.
A Cognito User Pool authorizer is created and pointed to the correct Cognito User Pool.
This establishes the validation connection between API Gateway and the user pool.
3
Enable authorization on the specific API resources and methods.
The method authorization settings are updated to point to the Cognito User Pool authorizer.
This enforces validation on incoming requests before they reach the backend Lambda functions.

Key Concept

API Gateway Cognito User Pool Authorizers
Question 679Question →

A developer needs to encrypt a database backup file of size 2 GB2\text{ GB} on an application server before uploading it to Amazon S3. The developer decides to use client-side envelope encryption with an AWS KMS customer managed key.

Which two actions must the developer perform to encrypt the file locally?

Select all that apply

Show answer & explanation

Answer: Call the GenerateDataKey API operation to receive both a plaintext data key and an encrypted data key.; Encrypt the file locally with the plaintext data key, and then securely discard the plaintext key from memory.

Answer

The developer must call the GenerateDataKey API to obtain the data keys, encrypt the file locally with the plaintext data key, and then securely remove the plaintext data key from memory.
To perform envelope encryption, the application calls the GenerateDataKey API, which returns a plaintext data key and an encrypted version of that same key. The developer uses the plaintext data key to encrypt the large file locally. Once encrypted, the plaintext data key is discarded from memory, and the encrypted data key is stored alongside the ciphertext file so it can be decrypted later.

Step-by-Step Solution

1
Generate data keys using KMS API
Obtained a plaintext data key and an encrypted data key
KMS cannot encrypt payloads larger than 4 KB4\text{ KB} directly, so a local data key is required for envelope encryption.
2
Encrypt the database backup file locally
The file is encrypted using the plaintext data key
This performs the actual cryptographic operation on the large file locally.
3
Discard the plaintext data key from memory
The plaintext data key is removed from the application's memory
To ensure security, the plaintext data key should not persist in memory after use.

Key Concept

AWS KMS Envelope Encryption Workflow
Question 680Question →

A developer is packaging a Node.js web application for deployment to AWS Elastic Beanstalk. The application requires the installation of an external system tool (git) and must define a custom environment variable named APP_STAGE set to production. The developer wants to manage these configurations as code within the application source bundle. Which two actions must the developer take to accomplish this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a directory named .ebextensions at the root of the application source bundle.; Create a configuration file ending with the .config extension inside the .ebextensions directory.

Answer

Create a directory named .ebextensions at the root of the application source bundle, and create a configuration file ending with the .config extension inside that directory.
To customize the AWS Elastic Beanstalk environment (such as installing packages or setting environment variables) using the application source bundle, the configuration files must be stored in a directory named '.ebextensions' located at the root of the application source bundle. These files must have a '.config' extension and contain valid YAML or JSON syntax.

Step-by-Step Solution

1
Determine the directory structure required for Elastic Beanstalk configuration files.
Identify that a directory named .ebextensions must be created at the root of the application source bundle.
Elastic Beanstalk looks for configuration files specifically in this location at the root level during deployment.
2
Determine the file naming convention and format for these configurations.
Identify that files must use a .config extension (e.g., setup.config) and contain YAML or JSON formatted configuration blocks such as packages and option_settings.
This is the required format and suffix for Elastic Beanstalk to recognize and parse configurations.

Key Concept

Configuring AWS Elastic Beanstalk environments using .ebextensions configuration files
PreviousPage 34 / 78Next