All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

An organization has a deployment pipeline configured in AWS CodePipeline in Account A. The pipeline needs to deploy a containerized application to Amazon ECS in Account B. The developer creates a cross-account deployment IAM role in Account B. Which configuration must be implemented to allow the pipeline in Account A to assume this role and perform the deployment?

Attach an IAM permissions policy to the role in Account B that grants the sts:AssumeRole action to the CodePipeline service role in Account A, while keeping the trust policy of the role restricted to local services in Account B.

Store the AWS access keys of an IAM user from Account B as a SecureString parameter in AWS Systems Manager Parameter Store in Account A, and configure CodePipeline to retrieve these credentials at runtime.

Configure the trust policy of the IAM role in Account B to allow the CodePipeline service role in Account A to perform the sts:AssumeRole action, and configure the deployment action in Account A to use this role ARN.

Configure the Amazon ECS Task Execution Role in Account B to trust the CodePipeline service role in Account A, enabling the container agent to pull the deployment artifacts directly.

Show answer & explanation

Answer: Configure the trust policy of the IAM role in Account B to allow the CodePipeline service role in Account A to perform the sts:AssumeRole action, and configure the deployment action in Account A to use this role ARN.

Answer

For cross-account deployments, the deployment action in Account A's pipeline must assume an IAM role in Account B. This is achieved by adding a trust policy to the role in Account B that allows the pipeline's service role in Account A to perform the sts:AssumeRole action. The deployment action in the pipeline is then configured to use the ARN of the role in Account B.

Step-by-Step Solution

Identify the mechanism AWS CodePipeline uses to interact with resources in a different AWS account.

Cross-account access in AWS requires role assumption (sts:AssumeRole) rather than static credentials.

Using IAM roles avoids the security risks associated with managing static access keys.

Determine where to configure the trust relationship and how the role is assumed.

The trust policy must be configured on the target role in Account B to trust the pipeline's role in Account A.

Trust policies specify which external entities are allowed to assume the role.

Specify the role in the pipeline action configuration.

The deployment action in Account A's pipeline is updated to reference the target role's ARN in Account B.

This tells CodePipeline which role to assume when executing that specific action.

Key Concept

AWS CodePipeline cross-account resource deployment using IAM roles and trust policies.

Question 702Question →

A company requires a developer to implement client-side encryption for sensitive application log files before uploading them to an Amazon S3 bucket. The log files range in size from $5\text{ MB}$ to $50\text{ MB}$ . The developer wants to minimize network overhead and ensure compliance by utilizing a customer managed key in AWS Key Management Service (AWS KMS) for envelope encryption. Which workflow should the developer implement to encrypt the log files?

Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.

Call the Encrypt API using the customer managed key, passing the raw log file payload in the request. Store the returned ciphertext file in the S3 bucket.

Call the GenerateDataKey API using the customer managed key to obtain a plaintext data key. Encrypt the log file locally using this key, and then store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to allow the decryption service to retrieve it.

Call the GenerateDataKey API by initializing an AWS SDK client that hardcodes the access keys of an IAM user who has permissions to use the customer managed key, encrypt the log file locally with the returned plaintext key, and upload the encrypted log file to S3.

Show answer & explanation

Answer: Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.

Answer

The correct workflow is to use envelope encryption. The developer calls the GenerateDataKey API, which utilizes the customer managed key to output a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the payload locally, after which it is deleted from memory. The encrypted data key is stored alongside the encrypted payload. This allows encryption of large objects without hitting the

4\text{ KB}

limit of KMS direct encryption operations and minimizes network overhead because the large payload is not sent to KMS.

Step-by-Step Solution

Invoke the GenerateDataKey API operation using the AWS SDK.

AWS KMS returns a plaintext data key and an encrypted data key (ciphertext).

This avoids sending the large payload to AWS KMS, overcoming the

4\text{ KB}

limitation of direct encryption API operations.

Encrypt the log file locally using the plaintext data key.

The log file is converted into ciphertext using a local symmetric encryption algorithm (such as AES-256).

Doing this locally minimizes network overhead and ensures the plaintext data never leaves the client environment.

Clean up memory and upload the artifacts to Amazon S3.

The plaintext data key is purged from memory. The encrypted log file and the encrypted data key are uploaded together to Amazon S3.

Removing the plaintext data key prevents unauthorized memory inspection, and keeping the encrypted data key with the file enables decryption later.

Key Concept

AWS KMS Envelope Encryption Workflow and Limits

Estimated Time:2m 0s

Question 703Question →

A developer has configured an AWS Lambda function to run inside private subnets of a VPC. The function needs to connect to an external, third-party payment gateway API on the public internet, but the connection attempts are failing due to timeouts. Which configuration change should the developer implement to allow the Lambda function to connect to the external API?

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound

0.0.0.0/0

traffic to the NAT Gateway.

Configure the private subnet's route table to route outbound

0.0.0.0/0

traffic directly to the VPC's Internet Gateway.

Update the trust policy of the Lambda function's IAM execution role to explicitly allow connections to the payment gateway API domain.

Store the payment gateway API URL in Systems Manager Parameter Store and enable automatic parameter rotation.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound $0.0.0.0/0$ traffic to the NAT Gateway.

Answer

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound traffic to the NAT Gateway.

The correct answer provides a valid network path for the Lambda function. Since the Lambda function is placed in a private subnet, it has no public IP address and cannot directly route traffic to an Internet Gateway. Deploying a NAT Gateway in a public subnet and routing the private subnet's outbound traffic to the NAT Gateway allows the Lambda function to reach public endpoints securely.

Step-by-Step Solution

Analyze the network requirements of the Lambda function.

The Lambda function is inside private subnets of a VPC and needs to access an endpoint on the public internet.

Since the Lambda is within a VPC private subnet, it lacks a path to the public internet by default.

Select the correct AWS VPC component to enable outbound-only internet connectivity.

A NAT Gateway must be deployed in a public subnet of the VPC.

A NAT Gateway translates private IP addresses to a public IP to facilitate outbound communication with the internet.

Update the routing configuration of the private subnet.

Add a route for

0.0.0.0/0

pointing to the NAT Gateway.

This ensures all internet-bound traffic from the Lambda function is correctly forwarded to the NAT Gateway.

Key Concept

Outbound internet connectivity for VPC-enabled Lambda functions requires a NAT Gateway and appropriate route table entries.

Estimated Time:1m 0s

Question 704Question →

A startup is deploying a secure REST API on Amazon API Gateway. External clients will authenticate using JSON Web Tokens (JWTs) issued by a third-party identity provider. The startup needs to implement an authorization solution at the API Gateway layer that validates the JWT, denies unauthorized access before invoking backend resources, and performs fine-grained authorization based on the user's subscription tier claim embedded in the JWT. The backend is an AWS Lambda function integrated using a Lambda custom integration (non-proxy). Which approach meets these requirements with the least operational complexity?

Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.

Configure an Amazon Cognito Identity Pool to authenticate the third-party tokens. In API Gateway, configure a Cognito User Pool authorizer to validate the incoming token, and rely on API Gateway to automatically forward the user claims in the integration request to the backend Lambda custom integration.

Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to append the subscription tier claim as a custom header in the API Gateway integration request. Configure the backend Lambda function to automatically retrieve this header from the handler's default event.headers payload.

Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to return an IAM policy that allows execute-api:Invoke on the backend Lambda function's ARN, and passes the subscription tier claim using the $stageVariables.subscriptionTier context variable.

Show answer & explanation

Answer: Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.

Answer

The correct approach involves using a Lambda custom authorizer because it allows validating JWTs from external identity providers. The authorizer returns an IAM policy allowing the execute-api:Invoke action on the API Gateway method ARN, along with a context map. Since the backend Lambda function is integrated using a Lambda custom integration (non-proxy), we must use an API Gateway mapping template to extract the subscription tier metadata from the authorizer context using the $context.authorizer.subscriptionTier variable and pass it to the backend Lambda function payload.

Step-by-Step Solution

Select the appropriate authorizer type for third-party identity providers.

Lambda custom authorizer is chosen because built-in Cognito User Pool authorizers are designed for Amazon Cognito User Pools, not arbitrary third-party JWTs.

API Gateway needs to validate external JWTs and deny access before invoking the backend integration.

Define the IAM policy and context returned by the custom authorizer.

The Lambda custom authorizer returns an IAM policy targeting the execute-api:Invoke action on the API Gateway method ARN, along with a context map payload containing the subscription tier claim.

The authorizer must authorize the API Gateway execution path and pass custom validation metadata downstream.

Map the authorizer context payload to the backend Lambda custom integration.

An API Gateway mapping template is created for the integration request, mapping $context.authorizer.subscriptionTier to a property in the request payload.

Under Lambda custom integration (non-proxy), the backend does not automatically receive the raw API Gateway request or authorizer context. Thus, explicit mapping is required.

Key Concept

API Gateway custom Lambda authorizers evaluate external tokens, return IAM policies targeting API Gateway execution ARNs, and provide context metadata that must be mapped to custom integrations.

Question 705Question →

A developer is configuring an AWS CloudFormation template to deploy an Amazon RDS DB instance. The database requires a master password that must be stored securely and rotated automatically every 30 days to comply with company security policies. Which configuration should the developer use to reference and manage the password?

Store the database password in Systems Manager Parameter Store as a SecureString parameter, and reference it using the ssm-secure dynamic reference in the template.

Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.

Store the database password in Systems Manager Parameter Store as a String parameter, and reference it using the ssm dynamic reference in the template.

Hardcode the password in the CloudFormation template, and then manually change it in the Amazon RDS console after deployment to trigger a stack drift detection and alignment.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.

Answer

Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.

The correct option stores the database password in AWS Secrets Manager, which natively supports automatic rotation, and references it using the secretsmanager dynamic reference in the template. This ensures that the secret is kept secure and is retrieved dynamically during deployment.

Step-by-Step Solution

Analyze the requirements: secure storage of a database password and support for automatic rotation.

Identify that AWS Secrets Manager is the appropriate service for credentials requiring automatic rotation, whereas Systems Manager Parameter Store does not support native rotation.

Choosing the correct AWS service ensures security compliance and automation features are utilized.

Determine how to reference the secret in the CloudFormation template.

Identify that the secretsmanager dynamic reference should be used.

Dynamic references retrieve sensitive information at deployment time without storing it in plaintext or parameters.

Key Concept

AWS CloudFormation Dynamic References and Secrets Management

Question 706Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline. The pipeline has three stages:
1. Source: An Amazon S3 source action.
2. BuildAndTest: A stage containing three actions: a CodeBuild build action with `runOrder: 1`, a CodeBuild linting action with `runOrder: 1`, and a CodeBuild unit test action with `runOrder: 2` that requires the output artifact of the build action.
3. Deploy: An AWS Elastic Beanstalk deploy action.

When a new code revision is uploaded to the Amazon S3 source bucket, in what chronological order does AWS CodePipeline process the actions and transitions for a successful execution? Arrange the steps from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: first, the source action retrieves the revision and uploads it to the artifact store; second, the build and lint actions run concurrently; third, the build action completes and uploads its output artifact; fourth, the unit test action runs using the build output; and finally, the pipeline transitions to the Deploy stage.

AWS CodePipeline processes executions stage-by-stage. Within a stage, actions with the same runOrder value (such as the build and lint actions, both with runOrder 1) are executed in parallel. Actions with a higher runOrder (such as the unit test action with runOrder 2) will wait to execute until all actions with lower runOrder values have successfully completed. Furthermore, any output artifacts required as inputs by subsequent actions must be uploaded before those actions can start. Finally, the pipeline only transitions to the next stage (Deploy) once all actions in the current stage (BuildAndTest) have completed successfully.

Step-by-Step Solution

Analyze stage boundaries and action execution sequence.

Identify that the Source stage must complete first, creating the initial source artifact.

AWS CodePipeline is artifact-driven; subsequent stages cannot start without the input artifact from the source stage.

Determine execution order of parallel actions in the BuildAndTest stage.

Identify that the build action and linting action run concurrently.

Actions within the same stage that share the same runOrder value (in this case, 1) are executed in parallel.

Identify the transition criteria between runOrder levels.

Recognize that the unit test action (runOrder 2) must wait for all runOrder 1 actions to finish and the build output artifact to be uploaded.

CodePipeline executes actions sequentially based on runOrder. An action with runOrder 2 starts only after all runOrder 1 actions complete and its required input artifacts are available.

Determine when the stage transitions to the next stage.

Confirm that the Deploy stage starts after the unit test action completes.

A pipeline transition to a subsequent stage occurs only when all actions in the preceding stage have executed successfully.

Key Concept

AWS CodePipeline execution order, action runOrder concurrency, and stage transition logic.

Question 707Question →

A developer is building a web application and wants to store user session data externally. The application requires a solution that natively supports automatically deleting expired session items after a specified period of time to keep costs low and limit storage growth, without requiring custom deletion code. Which AWS service and feature should the developer use to meet these requirements?

AWS Lambda execution context global variables

Amazon DynamoDB with Time-to-Live (TTL) enabled

Amazon Systems Manager Parameter Store with secure strings

Amazon DynamoDB with a nightly application cron script that executes a Scan operation to delete expired sessions

Show answer & explanation

Answer: Amazon DynamoDB with Time-to-Live (TTL) enabled

Answer

Amazon DynamoDB with Time-to-Live (TTL) enabled is the best solution for storing session state and automatically purging expired items without custom code.

Amazon DynamoDB is a fully managed NoSQL database service that provides single-digit millisecond latency at scale. It includes a native Time-to-Live (TTL) feature that allows developers to define a timestamp attribute on items. Once the current time passes the timestamp, DynamoDB automatically deletes the item within a few days without consuming provisioned throughput, eliminating the need to write custom cleanup code.

Step-by-Step Solution

Identify the data storage requirements.

The application needs external, high-speed, key-value session storage with automatic deletion of expired records.

This determines which database types and features are appropriate.

Evaluate the deletion requirement.

Amazon DynamoDB offers a native Time-to-Live (TTL) feature that automatically deletes expired items based on an epoch timestamp attribute without using provisioned read/write capacity.

This avoids the need to build and maintain custom cleanup scripts or cron jobs.

Compare against alternatives.

Other options such as Lambda context storage or Parameter Store do not support automatic expiration or high-throughput session state workflows, and manual DynamoDB Scan operations are inefficient.

This confirms that the native TTL feature in DynamoDB is the most cost-effective and scalable choice.

Key Concept

Storing session state externally in Amazon DynamoDB and leveraging its native Time-to-Live (TTL) feature to automate cleanup of expired records.

Alternative Method

For session data with sub-millisecond requirements that require advanced data structures, Amazon ElastiCache (Redis) can be used with a key expiration (TTL) set via the EXPIRE command.

Estimated Time:1m 0s

Question 708Question →

A developer is managing a production infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon ECS service. To prevent accidental replacement or deletion of the production database, the developer applies a stack policy to the stack. The policy contains a Deny statement for all update actions on the RDS DB instance resource, while allowing updates on all other resources.

The developer now needs to update the database engine version of the RDS DB instance. The developer attempts to perform a stack update with a template containing the new engine version, but the update fails due to the stack policy.

Which of the following is the correct method to update the database engine version while preserving the protective stack policy for future updates?

Manually update the database engine version using the Amazon RDS console, and then perform a CloudFormation drift detection operation to automatically synchronize the change and update the CloudFormation stack template.

Execute the continue-update-rollback command and specify the RDS DB instance resource to be skipped, which bypasses the stack policy validation and forces the update to apply.

Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.

Store the new engine version parameter in AWS Systems Manager Parameter Store as a SecureString, and reference it via a custom resource in the template to update the database engine version.

Show answer & explanation

Answer: Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.

Answer

The correct answer is to perform the stack update by using the AWS CLI update-stack command while passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter. When a stack policy is associated with a CloudFormation stack, all resources are protected by default unless explicitly allowed. To update a protected resource, the developer must temporarily override the stack policy during the update process. The --stack-policy-during-update-body parameter allows providing a temporary policy that permits the update. Once the update completes, CloudFormation automatically reverts to the original stack policy, maintaining the protection for subsequent updates.

Step-by-Step Solution

Define a temporary stack policy JSON document that explicitly allows updates (such as Update:Modify) to the target RDS DB instance resource.

A JSON stack policy document is created for temporary use during the update.

This policy is required to temporarily override the existing Deny rule on the database resource.

Run the aws cloudformation update-stack command with the --stack-policy-during-update-body flag, referencing the temporary stack policy.

CloudFormation executes the stack update and successfully applies the database engine version update.

Passing the temporary policy allows CloudFormation to bypass the permanent Deny rule for the duration of this single update transaction.

Verify that the update has completed and the stack status is UPDATE_COMPLETE.

The stack policy reverts to the original, permanent policy containing the Deny rule.

The temporary policy is only active during the update process, ensuring the database remains protected against accidental updates afterwards.

Key Concept

CloudFormation Stack Policies and temporary overrides during updates

Estimated Time:2m 30s

Question 709Question →

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The application experiences high-frequency read requests for a small subset of popular items, leading to DynamoDB throttling and ProvisionedThroughputExceededException errors. The developer needs to implement a caching solution that requires minimal application code changes, provides sub-millisecond response times, and automatically updates the cache when database items are updated. Which solution should the developer implement to meet these requirements?

Cache the queried items in AWS Systems Manager Parameter Store and configure a Time to Live (TTL) parameter for eviction.

Deploy an Amazon ElastiCache for Memcached cluster and implement write-through caching logic in the Lambda function code.

Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

Store the retrieved items in the AWS Lambda execution context's global variables to serve subsequent requests from memory.

Show answer & explanation

Answer: Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

Answer

Enable Amazon DynamoDB Accelerator (DAX) and configure the application to use the DAX client SDK.

The correct answer is to enable Amazon DynamoDB Accelerator (DAX) and use the DAX client SDK. DAX provides a fully managed, highly available in-memory cache specifically for DynamoDB. It is API-compatible with DynamoDB, which means developers only need to point their existing SDK client to the DAX endpoint rather than rewriting application logic. DAX transparently manages cache hits, misses, and updates, ensuring that write-through operations keep the cache current.

Step-by-Step Solution

Analyze the requirements for low-latency caching, automatic updates/invalidation, and minimal code changes.

Identify that the solution must integrate natively with DynamoDB without requiring complex cache-aside or write-through application logic.

This narrows down options to DynamoDB-native or API-compatible caching layers.

Evaluate Amazon DynamoDB Accelerator (DAX) against the requirements.

DAX provides sub-millisecond response times, is API-compatible (requiring only a change in the SDK client initialization), and handles cache invalidation and updates transparently.

To verify that DAX is the optimal fit for the scenario.

Compare against alternatives such as ElastiCache, Systems Manager Parameter Store, and Lambda execution context reuse.

Eliminate ElastiCache due to code complexity, Parameter Store due to rate limits and purpose misfit, and Lambda context reuse due to statelessness and synchronization issues.

To ensure distractors are systematically eliminated based on the scenario constraints.

Key Concept

DynamoDB Accelerator (DAX) is an in-memory, write-through cache that is API-compatible with DynamoDB, minimizing code changes while offloading read-heavy hot partitions.

Question 710Question →

A developer is updating a critical serverless backend API hosted on AWS Lambda by configuring traffic shifting using AWS SAM and AWS CodeDeploy. The deployment must adhere to the following requirements:

1. Traffic must be routed to the new version in a linear, step-by-step progression rather than a single large step-up after an initial canary window.
2. The entire deployment must complete, routing 100% of traffic to the new version, in less than 15 minutes.
3. The deployment must automatically roll back if a CloudWatch alarm is triggered.

Which CodeDeploy deployment configuration should the developer specify in the SAM template's DeploymentPreference section to satisfy these requirements?

Canary10Percent10Minutes

Linear10PercentEvery2Minutes

Linear10PercentEvery1Minute

AllAtOnce

Show answer & explanation

Answer: Linear10PercentEvery1Minute

Answer

Linear10PercentEvery1Minute

The configuration that increments traffic by 10% every minute is the only option that is linear (providing a step-by-step progression rather than a sudden shift) and completes the deployment within the 15-minute constraint, taking 9 minutes in total.

Step-by-Step Solution

Analyze the requirement for linear, step-by-step progression.

This rules out Canary deployment configurations (like Canary10Percent10Minutes) and AllAtOnce configurations, leaving only Linear options.

Linear configurations shift traffic incrementally over multiple steps, whereas Canary shifts a small percentage, waits, and then shifts the remainder all at once.

Calculate the total deployment duration for the remaining Linear options.

Linear10PercentEvery1Minute takes 9 minutes (9 intervals of 1 minute) to complete. Linear10PercentEvery2Minutes takes 18 minutes (9 intervals of 2 minutes) to complete.

The total duration of a Linear10PercentEveryXMinutes configuration is 9 * X minutes, since it starts at 10% and increments by 10% each interval until it reaches 100%.

Compare the durations against the maximum completion limit of 15 minutes.

Only Linear10PercentEvery1Minute (9 minutes) is under the 15-minute threshold.

Linear10PercentEvery2Minutes requires 18 minutes, which violates the SLA requirement of completing in less than 15 minutes.

Key Concept

AWS CodeDeploy built-in deployment configurations for AWS Lambda and SAM allow developers to choose between linear and canary traffic shifting. Calculating the total deployment duration (number of steps multiplied by the interval) is critical to meeting deployment time SLAs.

Estimated Time:2m 0s

Question 711Question →

A developer is configuring security for a REST API in Amazon API Gateway. The API has two separate endpoints with different access control requirements:

1. The first endpoint must authenticate users using JSON Web Tokens (JWTs) from a Cognito User Pool.
2. The second endpoint must restrict access to specific IAM users and roles within the AWS account.

Which two configuration actions must the developer take to implement these security controls? (Select TWO.)

Select all that apply

Create a Cognito User Pool authorizer in API Gateway and associate it with the first endpoint.

Set the authorization type for the second endpoint to AWS_IAM in API Gateway.

Create a Cognito Identity Pool authorizer in API Gateway and associate it with the first endpoint.

Set the authorization type for the second endpoint to CUSTOM and attach an IAM policy to the API Gateway stage.

Configure a Lambda proxy integration on the first endpoint to automatically validate Cognito User Pool tokens.

Show answer & explanation

Answer: Create a Cognito User Pool authorizer in API Gateway and associate it with the first endpoint.; Set the authorization type for the second endpoint to AWS_IAM in API Gateway.

Answer

To secure the API, the developer must create a Cognito User Pool authorizer in API Gateway for the first endpoint and set the authorization type for the second endpoint to AWS_IAM.

The correct options are configuring a Cognito User Pool authorizer for the first endpoint and setting the authorization type to AWS_IAM for the second endpoint. A Cognito User Pool authorizer allows API Gateway to authenticate API calls using tokens from Amazon Cognito User Pools without needing custom Lambda authorizer code. Setting the authorization type to AWS_IAM ensures that callers must sign their requests with AWS credentials, allowing the developer to control access via IAM policies.

Step-by-Step Solution

Identify the authentication mechanism for the first endpoint.

The requirement specifies using Cognito User Pool JWTs. The native way to handle this in API Gateway is by creating a Cognito User Pool Authorizer.

This allows API Gateway to validate the token signature and expiration automatically before invoking the backend integration.

Identify the authentication mechanism for the second endpoint.

The requirement specifies restricting access to specific IAM users and roles. The native way to handle this in API Gateway is to set authorization to AWS_IAM.

This requires callers to sign their requests using AWS Signature Version 4, which API Gateway authenticates against IAM policies.

Key Concept

API Gateway supports native integration with Cognito User Pools using Cognito Authorizers, and native IAM authorization using AWS_IAM to restrict access to IAM identities.

Question 712Question →

A developer is configuring a simple release pipeline in AWS CodePipeline. The pipeline has a source stage, a build stage using AWS CodeBuild, and a deployment stage using AWS CodeDeploy. The developer needs to pass the compiled build output from the build stage to the deployment stage.

How should the developer configure the pipeline to transfer these files between the stages?

Define an output artifact in the build stage action, and reference it as an input artifact in the deployment stage action.

Store the build output files in AWS Systems Manager Parameter Store during the build stage, and retrieve them during the deployment stage.

Write the build output files to a temporary directory and configure the IAM trust policy of the build role to allow the deployment role to assume it and pull the files.

Hardcode IAM user access keys in the build environment variables to write the build outputs directly to the deployment environment.

Show answer & explanation

Answer: Define an output artifact in the build stage action, and reference it as an input artifact in the deployment stage action.

Answer

Define an output artifact in the build stage action, and reference it as an input artifact in the deployment stage action.

AWS CodePipeline manages the flow of data between stages through input and output artifacts. When a stage like CodeBuild runs, it can package its output into a ZIP file and upload it to the pipeline's S3 artifact bucket as an output artifact. Subsequent stages, such as CodeDeploy, can then download this ZIP file by referencing it as an input artifact.

Step-by-Step Solution

Identify the standard mechanism in AWS CodePipeline for transferring files (like build outputs) between stages.

CodePipeline uses artifacts (input and output) backed by an Amazon S3 bucket to share files across pipeline actions.

This maintains statelessness and isolation between stage execution environments.

Configure the source or build stage to produce an output artifact.

The build stage (CodeBuild) writes the compiled output files to a zip file in the pipeline S3 bucket, registered as an output artifact.

This makes the build artifacts available to downstream stages.

Configure the deployment stage to consume the artifact.

The deployment stage (CodeDeploy) specifies the output artifact from the build stage as its input artifact.

This allows CodeDeploy to download the correct files from the pipeline S3 bucket to execute the deployment.

Key Concept

AWS CodePipeline uses input and output artifacts to share files between pipeline actions and stages.

Question 713Question →

An application running on Amazon ECS needs to decrypt sensitive customer configuration files that were previously encrypted using client-side envelope encryption with an AWS KMS customer managed key. The application has access to the encrypted files and the corresponding ciphertext data keys stored alongside them. Which TWO actions must the developer implement in the application code to retrieve the original configuration files?

Select all that apply

Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to obtain the plaintext data key.

Decrypt the configuration file locally using the plaintext data key and a symmetric decryption algorithm.

Call the Decrypt API operation of AWS KMS, passing the entire encrypted configuration file to AWS KMS.

Call the GenerateDataKey API operation of AWS KMS using the customer managed key to retrieve the plaintext decryption key.

Call the AWS Secrets Manager GetSecretValue API using the customer managed key identifier to fetch the stored plaintext data key.

Show answer & explanation

Answer: Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to obtain the plaintext data key.; Decrypt the configuration file locally using the plaintext data key and a symmetric decryption algorithm.

Answer

To retrieve the original configuration files, the developer must call the Decrypt API operation of AWS KMS to decrypt the ciphertext data key, and then decrypt the configuration file locally using the resulting plaintext data key.

The correct solution involves calling the AWS KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then using that key to decrypt the payload locally. This process separates key management from data processing, satisfying envelope encryption requirements.

Step-by-Step Solution

Retrieve the ciphertext data key that is stored alongside the encrypted configuration file.

The application has the encrypted data key ready for the API call.

The ciphertext data key must be decrypted by AWS KMS because only the KMS customer managed key can decrypt it.

Call the AWS KMS Decrypt API passing the ciphertext data key as a parameter.

AWS KMS returns the plaintext data key.

The application needs the plaintext data key in memory to perform the local decryption algorithm.

Perform local symmetric decryption of the configuration file using the plaintext data key.

The configuration file is returned to its original plaintext form.

Under client-side envelope encryption, actual data decryption is done by the client application to avoid sending large payloads over the network.

Key Concept

Client-side envelope decryption workflow using AWS KMS

Question 714Question →

An enterprise is deploying a REST API using Amazon API Gateway. The API will be accessed solely by internal server-to-server microservices running on Amazon EC2 instances within a private VPC. The security policy mandates that all communication must be encrypted, credentials must not be hardcoded in application code, and access must be restricted using IAM policies based on the principle of least privilege. Which configuration should a developer implement to secure the API Gateway with the least operational effort?

Enable AWS_IAM authorization on the API Gateway methods. Associate an IAM role with the EC2 instances that grants permissions for the `execute-api:Invoke` action, and configure the clients to sign their API requests using Signature Version 4.

Configure a Cognito User Pool Authorizer on the API Gateway methods. Use Amazon Cognito Identity Pools to exchange the EC2 instance role credentials for a JSON Web Token (JWT) to pass in the Authorization header.

Create a custom Lambda authorizer for the API Gateway methods. Write code within the Lambda authorizer to validate the Signature Version 4 signature of incoming requests against IAM policies before allowing access.

Set up the API Gateway integration as a Lambda proxy integration. Configure the backend Lambda function to inspect the raw request headers, extract the access key, and verify permissions against an IAM policy before returning a response.

Show answer & explanation

Answer: Enable AWS_IAM authorization on the API Gateway methods. Associate an IAM role with the EC2 instances that grants permissions for the `execute-api:Invoke` action, and configure the clients to sign their API requests using Signature Version 4.

Answer

Enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances granting the `execute-api:Invoke` action, and sign requests using Signature Version 4.

The correct option is to enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances, and configure the client to sign requests with Signature Version 4. This utilizes API Gateway's built-in capabilities to validate access using IAM roles without requiring custom authorization logic or external token providers, providing the least operational overhead.

Step-by-Step Solution

Select AWS_IAM as the authorization type on the target API Gateway resource methods.

API Gateway will now reject any requests to these methods that are not signed with valid AWS Signature Version 4 credentials.

This offloads authorization and credential validation entirely to AWS, eliminating the need to write custom verification logic.

Assign an IAM execution role (via an EC2 instance profile) to the EC2 instances running the microservices, and attach a policy permitting `execute-api:Invoke` on the API Gateway resource ARN.

The microservices can retrieve temporary security credentials from the EC2 instance metadata service.

This satisfies the requirement that credentials must not be hardcoded, adhering to IAM least-privilege principles.

Configure the microservice client applications to sign their outgoing HTTP requests to the API Gateway using AWS Signature Version 4 (SigV4) with the temporary credentials.

The requests are successfully authenticated and authorized by API Gateway.

SigV4 signing is required for any API Gateway method configured with AWS_IAM authorization.

Key Concept

AWS_IAM Authorization in API Gateway

Question 715Question →

An application deployed on AWS App Runner must retrieve and update user session data. Currently, the session data is stored in an Amazon DynamoDB table, but the application is suffering from high latency and scaling costs during peak traffic. The development team wants to optimize session state management to achieve sub-millisecond response times for read operations and reduce DynamoDB read throughput costs. The session data is updated frequently, and stale session states are unacceptable. Which two actions should the developer take to meet these requirements?

Select all that apply

Migrate the session storage to an Amazon ElastiCache for Redis cluster with Multi-AZ enabled.

Implement a write-through caching strategy in the application, updating the cache whenever session data is modified.

Leverage Amazon DynamoDB Accelerator (DAX) to cache session data and use Scan operations with filter expressions to retrieve active user sessions.

Store active session state payloads as secure strings in AWS Systems Manager Parameter Store and enable Parameter Store caching.

Publish session state updates to an Amazon SQS queue and use the visibility timeout to manage concurrent session access.

Show answer & explanation

Answer: Migrate the session storage to an Amazon ElastiCache for Redis cluster with Multi-AZ enabled.; Implement a write-through caching strategy in the application, updating the cache whenever session data is modified.

Answer

Migrating the session storage to Amazon ElastiCache for Redis and implementing a write-through caching strategy.

Migrating session storage to Amazon ElastiCache for Redis provides sub-millisecond latency for session state management. A write-through caching strategy ensures that the cache is updated synchronously when session data changes, preventing stale session reads in a highly dynamic environment.

Step-by-Step Solution

Analyze application requirements

Identified the need for sub-millisecond read latency, high-frequency updates, prevention of stale session reads, and reduction of DynamoDB costs.

Establishes the performance and consistency boundaries for the architectural selection.

Select the optimal cache storage engine

Selected Amazon ElastiCache for Redis with Multi-AZ enablement.

Redis provides the low-latency key-value data structures required for session state, while Multi-AZ ensures failover capability.

Select the caching strategy for real-time consistency

Selected a write-through caching pattern.

Write-through caching updates both the cache and backend database simultaneously when session writes occur, ensuring subsequent reads from the cache never return stale data.

Key Concept

Session state management and cache consistency strategies using Amazon ElastiCache

Question 716Question →

A developer is deploying an update to a Python application hosted on AWS Elastic Beanstalk using the Amazon Linux 2023 platform. The deployment requires running a database migration script that is packaged inside the application source code. This script must run after the application source archive is extracted to the staging directory, but before the application version is deployed and the web server is restarted. Which approach should the developer use to run the script at the correct stage?

Place the migration script in the .platform/hooks/predeploy/ directory of the application source bundle.

Place the migration script in the .ebextensions/ directory and configure it under the commands section of a configuration file.

Place the migration script inside a directory named ebextensions/ (without a leading dot) at the root of the source bundle.

Place the migration script in the root directory and specify its execution in the BeforeInstall hook of an appspec.yml file.

Show answer & explanation

Answer: Place the migration script in the .platform/hooks/predeploy/ directory of the application source bundle.

Answer

Place the migration script in the .platform/hooks/predeploy/ directory of the application source bundle.

The correct answer is to place the script in the .platform/hooks/predeploy/ directory. In modern Elastic Beanstalk platforms (Amazon Linux 2 and Amazon Linux 2023), developers can run custom scripts at specific lifecycle events using platform hooks. Scripts placed in the .platform/hooks/predeploy/ folder are executed after the application archive is extracted to the staging folder but before the application version is deployed and the web server is restarted. This is the correct phase for running database migrations or setting up environment-specific configuration files.

Step-by-Step Solution

Identify the target platform environment and configuration requirements.

The application runs on Amazon Linux 2023, which supports platform hooks and .ebextensions.

Platform hooks provide a structured way to run scripts at specific lifecycle events on modern Elastic Beanstalk platforms.

Evaluate the execution timing of different hooks.

The predeploy platform hook runs after the application source archive is extracted but before the application is deployed.

This matches the requirement to run the migration script on the extracted source files before the new version becomes active.

Package the script in the correct directory.

Creating the directory .platform/hooks/predeploy/ and putting the executable script in it ensures execution at the correct stage.

Elastic Beanstalk automatically executes any scripts located in this specific platform directory during deployment.

Key Concept

AWS Elastic Beanstalk Platform Hooks

Estimated Time:1m 30s

Question 717Question →

A developer is managing an AWS CloudFormation stack. The developer needs to update the stack template to add a new Amazon DynamoDB table, store a database password that requires automatic rotation, and store a non-sensitive configuration parameter. Which of the following actions should the developer take to accomplish this? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager.

Store the non-sensitive configuration parameter in AWS Systems Manager Parameter Store.

Store the non-sensitive configuration parameter in AWS Secrets Manager to reduce management overhead.

Create the DynamoDB table manually in the AWS Console before updating the CloudFormation stack.

Manually delete the resources directly in the console during a rollback state to force stack recovery.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager.; Store the non-sensitive configuration parameter in AWS Systems Manager Parameter Store.

Answer

The developer should store the database password in AWS Secrets Manager and store the non-sensitive configuration parameter in Systems Manager Parameter Store.

The correct options are storing the database password in AWS Secrets Manager and storing the non-sensitive configuration parameter in AWS Systems Manager Parameter Store. Secrets Manager provides built-in rotation capabilities, which meets the security requirement, while Parameter Store is a cost-effective solution for non-sensitive data.

Step-by-Step Solution

Evaluate the sensitivity and lifecycle requirements of the database password.

The password is a sensitive credential requiring automatic rotation, which points to AWS Secrets Manager.

AWS Secrets Manager provides built-in rotation integration for databases.

Evaluate the sensitivity of the configuration parameter.

The parameter is non-sensitive configuration data, which points to AWS Systems Manager Parameter Store.

Parameter Store is more cost-effective for storing non-sensitive configuration parameters.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store for storing CloudFormation parameters.

Question 718Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline in Account A ( $111122223333$ ) to automate deployments to Account B ( $444455556666$ ) using AWS CloudFormation. The pipeline fails during the Deploy stage with an access denied error when attempting to assume the deployment IAM role in Account B. Additionally, the CloudFormation template must retrieve a database password that requires automatic rotation every $30$ days. Which combination of actions should the developer take to resolve the deployment failure and meet the security requirements?

Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role of Account A to perform the sts:AssumeRole action. Store the database password in AWS Secrets Manager and configure automatic rotation.

Update the permissions policy of the deployment IAM role in Account B to allow the CodePipeline service principal to assume the role. Store the database password in Systems Manager Parameter Store and implement custom rotation logic.

Update the trust policy of the deployment IAM role in Account B to trust the global CodePipeline service principal (codepipeline.amazonaws.com). Store the database password in Systems Manager Parameter Store and enable the parameter rotation policy.

Update the permissions policy of the CodePipeline service role in Account A to allow trust from Account B. Store the database password in AWS Secrets Manager and configure automatic rotation.

Show answer & explanation

Answer: Update the trust policy of the deployment IAM role in Account B to allow the CodePipeline service role of Account A to perform the sts:AssumeRole action. Store the database password in AWS Secrets Manager and configure automatic rotation.

Answer

The correct action is to update the trust policy of the target IAM role in Account B to allow Account A's CodePipeline service role to perform the sts:AssumeRole action, and to store the credentials in AWS Secrets Manager which natively handles automatic rotation. This properly satisfies both cross-account trust requirements and credential lifecycle security rules.

Step-by-Step Solution

Configure cross-account IAM role assumption.

The Deploy action in Account A's CodePipeline can now assume the IAM role in Account B to create or update the CloudFormation stack.

To deploy resources across AWS accounts, the CodePipeline service role in the source account must be granted permission to assume a role in the destination account. The destination account's role must trust the source role via its trust policy.

Select the correct credential storage service.

AWS Secrets Manager is selected to store the database password.

AWS Secrets Manager provides native, out-of-the-box support for database credential rotation, whereas Systems Manager Parameter Store does not.

Key Concept

Cross-account pipeline deployments and secret rotation management.

Question 719Question →

A developer is configuring a CI/CD pipeline to deploy updates to an AWS Lambda function that is integrated with an Amazon API Gateway REST API. The developer needs to implement a deployment strategy that routes $10\%$ of the incoming API traffic to the new Lambda version for a $20$ -minute evaluation period. If any $5\text{xx}$ errors are detected during this period, the traffic must automatically and immediately roll back to the stable version. The deployment must not require changes to the API Gateway stage configuration.

Which two configurations should the developer implement to meet these requirements?

Select all that apply

Configure the API Gateway integration to target a Lambda function alias instead of a specific version ARN or the

LATEST

qualifier.

Configure an AWS CodeDeploy deployment group to use the deployment configuration named `CodeDeployDefault.LambdaCanary10Percent20Minutes` and associate it with a CloudWatch alarm monitoring API Gateway

5\text{xx}

errors.

Configure API Gateway stage canary settings, setting the canary traffic percentage to

10\%

and mapping the canary to the new Lambda version ARN.

Set the deployment configuration in AWS CodeDeploy to `CodeDeployDefault.LambdaLinear10PercentEvery2Minutes` and associate the deployment group with a CloudWatch alarm monitoring API Gateway

5\text{xx}

errors.

Publish the new Lambda version and update the API Gateway integration to point to the new version's ARN directly, relying on Lambda's built-in routing rules to shift

10\%

of the traffic.

Show answer & explanation

Answer: Configure the API Gateway integration to target a Lambda function alias instead of a specific version ARN or the $LATEST$ qualifier.; Configure an AWS CodeDeploy deployment group to use the deployment configuration named `CodeDeployDefault.LambdaCanary10Percent20Minutes` and associate it with a CloudWatch alarm monitoring API Gateway $5\text{xx}$ errors.

Answer

To meet the requirements, the developer must configure the API Gateway integration to target a Lambda function alias instead of a specific version ARN or the

LATEST

qualifier, and configure an AWS CodeDeploy deployment group to use the deployment configuration named `CodeDeployDefault.LambdaCanary10Percent20Minutes` and associate it with a CloudWatch alarm monitoring API Gateway

5\text{xx}

errors.

Targeting a Lambda function alias from API Gateway allows AWS CodeDeploy to shift traffic at the Lambda level by shifting the alias routing configuration between two versions. Selecting the `CodeDeployDefault.LambdaCanary10Percent20Minutes` deployment configuration routes exactly

10\%

of traffic to the new version for a

20

-minute window while monitoring the associated CloudWatch alarms. If the alarm for

5\text{xx}

errors fires, CodeDeploy automatically rolls back the alias configuration to route all traffic back to the stable version, achieving an automated rollback.

Step-by-Step Solution

Establish version-level addressing for the Lambda function.

Configure the API Gateway integration to point to a Lambda function alias (e.g., `prod`).

Lambda version routing requires an alias. Pointing directly to a version ARN prevents CodeDeploy from dynamically shifting weights because versions are immutable.

Select the deployment configuration that matches the traffic-shifting requirements.

Identify `CodeDeployDefault.LambdaCanary10Percent20Minutes` as the correct configuration.

The scenario requires routing a constant

10\%

of traffic to the new version for a

20

-minute evaluation period before shifting

100\%

of traffic, which matches the definition of this canary configuration.

Configure automated rollback triggers.

Associate the CodeDeploy deployment group with a CloudWatch alarm monitoring API Gateway

5\text{xx}

errors.

5\text{xx}

errors occur during the

20

-minute evaluation, the alarm triggers and CodeDeploy immediately rolls back the alias routing weights to point

100\%

of traffic back to the stable version.

Key Concept

Lambda Canary Deployments with AWS CodeDeploy

Estimated Time:2m 0s

Question 720Question →

A company is building an employee portal that allows users to access internal resources via an Amazon API Gateway REST API. The client application authenticates users directly using an Amazon Cognito User Pool. The developer needs to secure the API Gateway methods to ensure that only users authenticated by this Cognito User Pool can access the endpoints. The solution must minimize development effort and avoid unnecessary execution costs.

Which two of the following configuration steps must be performed in Amazon API Gateway to secure the API?

Select all that apply

Create a Cognito user pool authorizer in API Gateway by specifying the Amazon Cognito User Pool ARN and the token source header name.

Create a Cognito identity pool authorizer in API Gateway by specifying the Identity Pool ID and the token source header name.

Edit the Method Request settings for the API methods, select the Cognito authorizer as the Authorization type, and redeploy the API.

Create a custom Lambda authorizer that extracts the JSON Web Token (JWT) from the headers, verifies it using public keys, and returns an IAM policy.

Configure the integration request as a Lambda Proxy integration and implement code in the backend Lambda function to validate the JWT.

Show answer & explanation

Answer: Create a Cognito user pool authorizer in API Gateway by specifying the Amazon Cognito User Pool ARN and the token source header name.; Edit the Method Request settings for the API methods, select the Cognito authorizer as the Authorization type, and redeploy the API.

Answer

To secure the API natively using Cognito User Pools with the least overhead, the developer must create a Cognito user pool authorizer in API Gateway, link it to the Method Request settings for the API methods, and redeploy the API.

To secure the API with the minimum development and operational overhead, the developer should create a native Cognito User Pool authorizer by linking the Amazon Cognito User Pool ARN and the token source header name. The authorizer must then be assigned to the API's Method Request settings, followed by a redeployment of the API. This native validation does not require writing custom code and does not incur Lambda execution costs for the authorization layer.

Step-by-Step Solution

Create a Cognito user pool authorizer in the API Gateway configuration.

A native authorizer of type COGNITO is registered using the Cognito User Pool ARN and configured with a token header source (e.g., Authorization).

This establishes the validation connection between API Gateway and the Cognito User Pool so API Gateway can verify incoming JWT tokens.

Configure the API Gateway Method Request settings to use the Cognito authorizer.

The API Gateway method settings are updated to enforce authentication using the Cognito authorizer.

This binds the authorizer to specific endpoints and methods, preventing unauthenticated requests from passing through.

Deploy the API Gateway API to a stage.

The API configuration updates are applied to the active stage endpoint.

API Gateway requires an active deployment for configuration updates, including authorization settings, to become active for clients.

Key Concept

API Gateway integration with Amazon Cognito User Pools

PreviousPage 36 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Alternative Method

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution