All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer needs to update a web application running on AWS Elastic Beanstalk. The deployment must meet the following constraints:
- The application must have zero downtime during the update.
- The deployment must maintain 100% of the active instance capacity at all times.
- The update must be performed within the existing Elastic Beanstalk environment.

Which of the following Elastic Beanstalk deployment policies satisfy these constraints? (Select TWO.)

Select all that apply

Rolling with additional batch

Immutable

Rolling

All-at-once

Blue/Green

Show answer & explanation

Answer: Rolling with additional batch; Immutable

Answer

The Rolling with additional batch and Immutable deployment policies meet all the constraints.

The Rolling with additional batch policy launches a new batch of instances first to maintain the original capacity before rolling out the update to existing instances. The Immutable policy launches a temporary Auto Scaling group to deploy the new version alongside the existing group. Both methods ensure 100% of active instance capacity is maintained, have zero downtime, and operate within the existing environment.

Step-by-Step Solution

Evaluate the requirement for zero downtime and 100% capacity maintenance within a single Elastic Beanstalk environment.

The policies that do not temporarily reduce capacity (like Rolling) or take the entire environment offline (like All-at-once) must be selected.

This filters out All-at-once and Rolling.

Evaluate the requirement to perform the update within the existing Elastic Beanstalk environment.

The Blue/Green deployment method is ruled out because it requires launching a separate, new environment and swapping URLs.

This filters out Blue/Green.

Identify the remaining valid Elastic Beanstalk deployment policies.

Rolling with additional batch and Immutable deployment policies both maintain 100% capacity, ensure zero downtime, and run within the existing environment.

These policies fulfill all stated requirements.

Key Concept

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, downtime, and cost.

Question 722Question →

A developer is designing a serverless backend using AWS Lambda that connects to an Amazon RDS for PostgreSQL database. The application security policy requires that database passwords be rotated automatically every 30 days. Additionally, the Lambda function needs to retrieve non-sensitive configuration parameters, such as logging levels and external API endpoints. Which combination of actions should the developer take to implement these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.

Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters and configure built-in automatic rotation.

Hardcode the database credentials directly within the Lambda function's handler initialization code to avoid API latency.

Store the non-sensitive configuration parameters in AWS Secrets Manager to centralize all secrets and configurations.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.; Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Answer

Storing the database credentials in AWS Secrets Manager with built-in automatic rotation enabled, and storing the non-sensitive configurations in AWS Systems Manager Parameter Store as Standard parameters.

AWS Secrets Manager is designed for managing secrets such as database credentials and supports automated rotation out of the box, specifically with integrations for Amazon RDS. AWS Systems Manager Parameter Store is ideal for general, non-sensitive configuration parameters because Standard parameters are free, making it the most cost-effective choice for configurations that do not require rotation or encryption.

Step-by-Step Solution

Identify the storage and rotation requirements for the database credentials.

Database credentials are sensitive and require automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in rotation integration with Amazon RDS.

Parameter Store does not natively support automatic rotation, so using Parameter Store would require writing custom rotation logic.

Identify the storage and cost requirements for non-sensitive configurations.

Non-sensitive configurations (like logging levels) do not require rotation or encryption. Storing them in Parameter Store as Standard parameters is free and meets the cost-effectiveness requirement.

Storing non-sensitive config in Secrets Manager would incur unnecessary monthly costs per secret.

Key Concept

Distinguishing between AWS Secrets Manager and AWS Systems Manager Parameter Store features and cost profiles.

Question 723Question →

A developer is designing a secure mobile banking application. The application uses Amazon API Gateway for its backend REST APIs and stores user documents in an Amazon S3 bucket. The security requirements are:

1. Access to the API Gateway APIs must be restricted to authenticated users. The API Gateway must natively validate the users' JSON Web Tokens (JWTs) without invoking a custom function.
2. Users must be able to upload documents directly to their own folder within the S3 bucket using temporary AWS credentials, ensuring least-privilege access.

Which two configurations should the developer implement to meet these requirements?

Select all that apply

Configure an API Gateway Lambda Custom Authorizer to validate the JWT, then invoke AssumeRole against AWS STS to return temporary AWS credentials directly in the authorization context to S3.

Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.

Configure a Cognito Identity Pool as the primary API Gateway Authorizer, and use the Identity Pool client credentials to authenticate REST API calls via Lambda Proxy integration.

Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.

Create a Cognito User Pool and write an IAM policy that allows the User Pool client credentials to authenticate S3 API calls using KMS envelope encryption.

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.; Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.

Answer

To meet the requirements, the developer should configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate user tokens, and associate the Cognito User Pool with a Cognito Identity Pool to issue temporary AWS IAM credentials with policies that grant restricted folder access to the S3 bucket.

The correct configurations involve using a Cognito User Pool Authorizer to validate JWT tokens natively at the API Gateway level, and utilizing a Cognito Identity Pool in conjunction with the User Pool to provide authenticated users with temporary AWS IAM credentials. This enables secure, direct document uploads to specific S3 folders using IAM policies containing user identity variables.

Step-by-Step Solution

Configure the native authentication mechanism at API Gateway.

Create and deploy a Cognito User Pool Authorizer on the REST API methods. This offloads the token signature and expiration verification directly to API Gateway.

This meets the requirement of natively validating JWTs without writing and invoking custom Lambda functions.

Establish federated identity for AWS resource authorization.

Create an Amazon Cognito Identity Pool and configure the Cognito User Pool as an authentication provider.

This allows the client application to exchange the ID token received during user login for temporary AWS IAM credentials.

Enforce least-privilege direct access on the S3 bucket.

Attach an IAM policy to the Identity Pool's authenticated role that grants s3:PutObject permissions to paths matching the user's specific identity ID using the policy variable ${cognito-identity.amazonaws.com:sub}.

This allows authenticated mobile users to upload files directly to their personal folders on S3 without passing through backend servers, complying with the principle of least privilege.

Key Concept

Combining Cognito User Pools for native API Gateway authorization and Cognito Identity Pools for exchanging authentication tokens for temporary AWS credentials to access S3 directly under least privilege.

Estimated Time:2m 0s

Question 724Question →

A developer needs to encrypt a configuration file containing sensitive database credentials. The file size is $2\text{ KB}$ , and the developer decides to use direct encryption with an AWS Key Management Service (AWS KMS) customer managed key before uploading the file to Amazon S3. Which of the following actions must be taken to successfully encrypt this file? (Select TWO.)

Select all that apply

Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.

Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.

Call the `GenerateDataKey` API operation to perform client-side envelope encryption, as direct encryption is not supported for files smaller than

64\text{ KB}

Call the `GenerateDataKeyWithoutPlaintext` API operation to generate a plaintext data key for local file encryption.

Store the configuration file in AWS Systems Manager Parameter Store as a `SecureString` to automatically trigger direct KMS encryption on the file object.

Show answer & explanation

Answer: Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.; Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.

Answer

The configuration file can be encrypted by calling the KMS `Encrypt` API operation directly, and the application's IAM role must have the `kms:Encrypt` permission allowed in the customer managed key's key policy.

Direct encryption using the KMS `Encrypt` API operation is suitable for data payloads up to

4\text{ KB}

. To perform this action, the caller's IAM role must be granted permissions in the customer managed key's key policy.

Step-by-Step Solution

Determine the size of the payload to be encrypted.

The file size is

2\text{ KB}

, which is under the

4\text{ KB}

limit for direct KMS encryption.

Knowing the payload size helps determine whether direct encryption or envelope encryption is appropriate.

Verify key policy permissions.

Ensure the KMS key policy allows the IAM role to call `kms:Encrypt`.

KMS key policies must explicitly grant usage permissions even if the IAM policy allows it.

Perform the encryption using the SDK.

Call the `Encrypt` API with the plaintext payload and the key ID.

This generates the ciphertext directly without generating local data keys.

Key Concept

Direct encryption with AWS KMS using the Encrypt API operation is suitable for small payloads up to

4\text{ KB}

, provided that appropriate key policy permissions are configured.

Estimated Time:1m 30s

Question 725Question →

A developer is configuring a standard release pipeline in AWS CodePipeline to automate deployment. The pipeline must pull source code from an AWS CodeCommit repository, run tests and compile the code using AWS CodeBuild, require a manual sign-off from the quality assurance team, and finally deploy the application to AWS Elastic Beanstalk.

Arrange the actions in the correct sequence of execution from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of actions in the pipeline is: Source action (AWS CodeCommit), Build action (AWS CodeBuild), Manual approval action, and Deploy action (AWS Elastic Beanstalk).

AWS CodePipeline processes stages sequentially. The pipeline must first fetch the source code, compile and test it in the build phase, pause for manual verification, and finally deploy the verified package.

Step-by-Step Solution

Retrieve the source code from AWS CodeCommit.

The latest revision of the source code is retrieved and package artifacts are created.

Subsequent stages require the source code to perform builds and deployments.

Trigger the AWS CodeBuild environment to compile the application and run unit tests.

The application code is verified and a deployment package is generated.

Building the application generates the necessary artifacts that need to be reviewed and deployed.

Halt the pipeline for a Manual Approval action.

The pipeline execution pauses, and a notification is sent to the QA team for review.

This guarantees that the built artifacts are verified and approved before they reach the production environment.

Deploy the application using the AWS Elastic Beanstalk deployment action.

The verified application version is deployed to the Elastic Beanstalk environment.

Deploying is the final step in the pipeline after the application has been built and approved.

Key Concept

AWS CodePipeline action execution order

Question 726Question →

An application currently stores session data in the memory of individual web servers, which prevents the application tier from scaling horizontally. A developer needs to refactor the application to store session states externally with sub-millisecond to single-digit millisecond latency. Which TWO solutions should the developer use to achieve this? (Select TWO.)

Select all that apply

Amazon ElastiCache for Redis

Amazon DynamoDB

AWS Secrets Manager

AWS Lambda execution context temporary storage (/tmp)

Amazon DynamoDB using Scan operations to retrieve session data on every page request

Show answer & explanation

Answer: Amazon ElastiCache for Redis; Amazon DynamoDB

Answer

Amazon ElastiCache for Redis and Amazon DynamoDB

Amazon ElastiCache for Redis and Amazon DynamoDB are correct because they are managed, external services that offer the low-latency (sub-millisecond to single-digit millisecond) and high-throughput capabilities required for distributed session state storage.

Step-by-Step Solution

Identify the requirement for horizontal scalability and low latency for storing session states externally.

The solution must support high-throughput, low-latency reads and writes, and be accessible globally by all application servers.

Storing sessions locally prevents horizontal scaling because user requests must be pinned to a specific server (session stickiness).

Evaluate the AWS services designed for low-latency, scalable key-value storage.

Amazon ElastiCache for Redis (in-memory data store) and Amazon DynamoDB (NoSQL database) both provide fast, scalable, and external state management.

These services decouple session state from the compute tier, enabling stateless application servers to scale out.

Key Concept

Decoupling session state to external stores like ElastiCache or DynamoDB to enable stateless, horizontally scalable application tiers.

Question 727Question →

An application's secure ingestion service receives files and needs to prepare them for later encryption by a separate worker service running in a restricted environment. The ingestion service must generate an encrypted data key and store it alongside each file's metadata in a database. To minimize the attack surface, the security architecture requires that the ingestion service must never have access to the plaintext version of the data key. Which AWS KMS API operation should the developer call in the ingestion service to meet these requirements?

GenerateDataKeyWithoutPlaintext

GenerateDataKey

Encrypt

GetParameter

Show answer & explanation

Answer: GenerateDataKeyWithoutPlaintext

Answer

GenerateDataKeyWithoutPlaintext

The GenerateDataKeyWithoutPlaintext operation generates a unique symmetric data key under a specified KMS key and returns only the encrypted ciphertext representation of that data key. This prevents the ingestion service from exposing or holding the plaintext data key in memory, satisfying the security policy.

Step-by-Step Solution

Analyze the security constraints and envelope encryption requirements.

The ingestion service needs an encrypted data key to store but must not access the plaintext data key.

This determines the specific KMS API call needed to omit the plaintext data key from the response.

Identify the KMS API operation that generates data keys without returning the plaintext component.

GenerateDataKeyWithoutPlaintext is identified as the operation that returns only the ciphertext data key.

Unlike GenerateDataKey, which returns both plaintext and ciphertext, GenerateDataKeyWithoutPlaintext satisfies the zero-plaintext exposure constraint.

Key Concept

AWS KMS Envelope Encryption API operations

Question 728Question →

A developer is building a client-facing web application and needs to restrict access to a REST API hosted on Amazon API Gateway. The application's users will sign in using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints by validating the identity tokens issued to users upon login, with the least amount of development effort and custom code. Which authorization method should the developer configure on the API Gateway resources?

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Create a custom Lambda authorizer to parse and validate the JSON Web Token (JWT) issued by the User Pool.

Configure an Amazon Cognito Identity Pool authorizer to directly authenticate the API Gateway request.

Configure a Lambda proxy integration to manually inspect the user credentials in the incoming request body.

Show answer & explanation

Answer: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Answer

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Using the built-in Amazon Cognito User Pools authorizer is the most efficient method because Amazon API Gateway natively validates tokens issued by Amazon Cognito. This eliminates the need to develop, test, and maintain custom Lambda authorizer code, which minimizes development effort and operational overhead.

Step-by-Step Solution

Identify the authentication provider and the development constraints.

The application uses Amazon Cognito User Pools for user sign-in and token issuance, and requires token validation with the least development effort.

This establishes that we need a solution that integrates natively with Cognito User Pools tokens without custom code.

Evaluate API Gateway security integration types.

Amazon API Gateway offers a built-in Cognito User Pools authorizer that automatically validates the signature and expiration of Cognito JSON Web Tokens (JWTs).

Choosing a native authorizer avoids the need to write and maintain custom validation logic inside a Lambda function.

Key Concept

Built-in Cognito User Pools Authorizer in Amazon API Gateway

Question 729Question →

A developer is preparing a Java application package for deployment to an AWS Elastic Beanstalk environment. The application requires a custom system-level utility, `htop`, to be installed on the underlying Amazon EC2 instances. Additionally, the application requires an environment variable named `DB_HOST` to be accessible at runtime. Which two actions should the developer take to satisfy these requirements?

Select all that apply

Create a configuration file ending with `.config` inside a directory named `.ebextensions` at the root of the application source bundle, and use the `packages` section to define the `htop` installation.

Configure the `DB_HOST` environment variable in the Environment Properties section of the Elastic Beanstalk environment configuration.

Create a configuration file ending with `.config` inside a directory named `ebextensions` (without a leading dot) at the root of the application source bundle.

Define the `DB_HOST` environment variable inside a `buildspec.yml` file placed at the root of the application source bundle.

Place the `.ebextensions` directory inside the application's source code subfolder, such as `src/main/resources`, to compile it into the application's JAR/WAR archive.

Show answer & explanation

Answer: Create a configuration file ending with `.config` inside a directory named `.ebextensions` at the root of the application source bundle, and use the `packages` section to define the `htop` installation.; Configure the `DB_HOST` environment variable in the Environment Properties section of the Elastic Beanstalk environment configuration.

Answer

Create a configuration file ending with `.config` in a folder named `.ebextensions` at the root of the application source bundle to install the package, and configure the environment variable in the Environment Properties section under the Elastic Beanstalk environment configuration.

The correct solution involves leveraging `.ebextensions` at the root of the source bundle to configure package dependencies and using the Environment Properties configuration setting to handle variable values, satisfying both host-level and application-level requirements.

Step-by-Step Solution

Determine how to run custom package installations on the host instance during Elastic Beanstalk deployment.

Identify that the `.ebextensions` directory must be located at the root of the source bundle and contain a `.config` file with a `packages` block.

This directory is read by the Elastic Beanstalk platform agent to apply customizations before the application starts.

Determine how to provide configuration settings to the application environment at runtime.

Identify that Elastic Beanstalk supports Environment Properties for injecting variables into the execution context.

Setting these properties ensures they are parsed by the OS and available to the Java application code via system environment checks.

Key Concept

AWS Elastic Beanstalk instance customization via `.ebextensions` configuration files and runtime environment variable configuration.

Question 730Question →

A developer is configuring a deployment pipeline in AWS CodePipeline to deploy a serverless application across two AWS accounts. The pipeline resides in Account A, and the application must be deployed to Account B using an AWS CloudFormation action in the deploy stage. The pipeline execution fails at the deploy stage with an access denied error when attempting to assume the deployment IAM role created in Account B.

How should the developer configure the IAM policies to successfully allow the pipeline in Account A to assume the deployment role in Account B?

Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.

Attach an identity-based IAM policy to the CodePipeline service role in Account A that allows the sts:AssumeRole action on the deployment role in Account B, as cross-account permissions do not require trust policies when initiated from a managed pipeline service role.

Create an IAM user in Account B, generate long-lived access keys, and store them as a secure parameter in AWS Systems Manager Parameter Store with automatic rotation configured, then reference the parameter in the pipeline configuration.

Add an aws sts assume-role command to the buildspec.yml file in the source repository to authenticate as Account B, and configure the CloudFormation deployment action to execute using the resulting temporary credentials.

Show answer & explanation

Answer: Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.

Answer

The correct option correctly establishes two-way trust for cross-account role assumption. The trust policy of the target role in Account B must trust the CodePipeline service role in Account A, and the CodePipeline service role must have an identity-based policy allowing it to assume the target role in Account B.

Step-by-Step Solution

Configure the trust policy in the target account (Account B)

The deployment IAM role in Account B is updated to list the AWS CodePipeline service role ARN from Account A as a trusted principal that can perform sts:AssumeRole.

Establishing trust in the target account's role is mandatory for any cross-account access to succeed.

Configure the permissions policy in the source account (Account A)

An identity-based policy is attached to the CodePipeline service role in Account A allowing the sts:AssumeRole action on Account B's deployment role ARN.

The source principal must have explicit permission to assume the external role.

Reference the target role in the pipeline configuration

The pipeline deploy stage action configuration is updated with the roleArn parameter pointing to the target deployment role in Account B.

This instructs CodePipeline to assume the cross-account role when executing the CloudFormation action.

Key Concept

Cross-account role assumption in AWS CodePipeline

Question 731Question →

A developer is writing a backend application hosted on AWS Lambda that needs to decrypt a sensitive database connection string. The connection string was previously encrypted directly using an AWS KMS customer managed key (CMK). The Lambda function's IAM execution role has been granted permissions to use the key. Which AWS KMS API action must the developer invoke within the application code to retrieve the plaintext connection string?

Decrypt

GenerateDataKey

GetSecretValue

ReEncrypt

Show answer & explanation

Answer: Decrypt

Answer

Decrypt

The Decrypt API operation is the correct action to call because it decrypts ciphertext that was encrypted directly using an AWS KMS key, returning the decrypted plaintext to the application.

Step-by-Step Solution

Identify the source of encryption and the desired output.

The database connection string was encrypted directly using an AWS KMS customer managed key, and the application needs to retrieve the plaintext string.

This establishes that we are dealing with direct decryption of KMS ciphertext rather than local envelope encryption or retrieving a secret from a secret store.

Select the correct AWS KMS API operation for direct decryption.

The Decrypt operation is selected.

The Decrypt API operation takes ciphertext encrypted under a KMS key and returns the decrypted plaintext, which matches the application's requirement.

Key Concept

Direct decryption using AWS KMS API

Question 732Question →

A developer is configuring an AWS CodeBuild project that must run within a private subnet of a VPC to perform integration tests against a private Amazon RDS PostgreSQL database. The build process needs to retrieve an encrypted database password from AWS Systems Manager Parameter Store and pull a base image from a private Amazon ECR repository located in a shared-services AWS account. During the build execution, the build fails in the early phases with connection timeouts and permission errors. Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Ensure the CodeBuild project is associated with private subnets that route outbound traffic through a NAT Gateway, or configure Interface VPC endpoints within the VPC for Systems Manager and Amazon ECR.

Grant the CodeBuild service role the ssm:GetParameters and kms:Decrypt permissions for the parameter and its custom KMS key, and retrieve the password using the env: parameter-store block in the buildspec.

Attach an IAM policy to the CodeBuild service role that grants the ecr:GetAuthorizationToken permission restricted to the specific Amazon ECR repository ARN in the shared-services account.

Retrieve the database password by listing it under the env: variables block in the buildspec, and grant the CodeBuild service role the ssm:GetParameter permission.

Place the buildspec.yml file within a .aws/ subdirectory at the root of the repository, and configure the project to use a custom service role that assumes the Parameter Store administrator role.

Show answer & explanation

Answer: Ensure the CodeBuild project is associated with private subnets that route outbound traffic through a NAT Gateway, or configure Interface VPC endpoints within the VPC for Systems Manager and Amazon ECR.; Grant the CodeBuild service role the ssm:GetParameters and kms:Decrypt permissions for the parameter and its custom KMS key, and retrieve the password using the env: parameter-store block in the buildspec.

Answer

Configure private subnets with a NAT Gateway or VPC endpoints to establish connectivity, and retrieve the SecureString parameter via the env: parameter-store block while granting the service role both ssm:GetParameters and kms:Decrypt permissions.

For CodeBuild to communicate with AWS services when running inside a VPC, it requires route paths either via a NAT Gateway inside private subnets or Interface VPC endpoints. For SecureString parameters, the parameters must be retrieved using the env: parameter-store block, and the service role must be granted ssm:GetParameters and kms:Decrypt permissions.

Step-by-Step Solution

Diagnose the network timeout error during the early build phases.

Identify that CodeBuild containers launched inside a VPC do not have route paths to external AWS service public endpoints (like Systems Manager or Amazon ECR) by default.

Establishing outbound paths via a NAT Gateway or using local Interface VPC Endpoints inside the VPC is required for VPC-enabled CodeBuild projects to access external resources.

Address the Systems Manager Parameter Store access configuration.

Map the parameter inside the env: parameter-store section of the buildspec file rather than env: variables.

Only env: parameter-store triggers CodeBuild to retrieve and decrypt SecureString values from Systems Manager Parameter Store during the build lifecycle.

Grant the necessary IAM permissions to the CodeBuild service role.

Ensure the role has ssm:GetParameters and kms:Decrypt permissions for the custom KMS customer managed key (CMK) used to encrypt the password.

AWS-managed default KMS keys cannot be shared across accounts if cross-account access is needed, and accessing custom keys requires explicit ssm and kms permissions.

Key Concept

Configuring AWS CodeBuild VPC connectivity, ECR access, and IAM service role permissions to decrypt SecureString parameters in a buildspec.

Estimated Time:3m 0s

Question 733Question →

A developer is deploying a microservice on Amazon ECS that processes sensitive configurations. A configuration file of size $150\text{ KB}$ is encrypted client-side using envelope encryption with an AWS KMS customer managed key (CMK). During deployment, the application container fails to start because it cannot decrypt the configuration file.

The current configuration is as follows:
- The `kms:Decrypt` permission is granted to the ECS task execution role.
- The application code attempts to decrypt the entire configuration file by calling the `kms:Decrypt` API directly with the encrypted file content.

Which combination of actions will resolve the decryption failure and allow the application to start up successfully?

Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass the entire encrypted configuration file to the `kms:Decrypt` API, and ensure that the payload size does not exceed the

40\text{ MB}

payload limit of the API.

Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Update the application code to call the `kms:Decrypt` API with the encrypted data key to retrieve the plaintext data key, and then decrypt the configuration file locally using the plaintext data key.

Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Configure the application to use the Systems Manager Parameter Store to retrieve the plaintext KMS customer managed key at runtime, and decrypt the configuration file locally.

Show answer & explanation

Answer: Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

Answer

Associate the kms:Decrypt permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the kms:Decrypt API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

The correct answer correctly identifies that application code running inside an ECS container must use the ECS Task Role for runtime authorization to call KMS APIs. Additionally, in envelope encryption, the actual payload is encrypted locally with a data key, and only the encrypted data key is sent to AWS KMS for decryption. This bypasses the

4\text{ KB}

payload size limit of the `kms:Decrypt` API.

Step-by-Step Solution

Identify the correct IAM role for containerized application execution.

Determine that the ECS Task Role must be configured with `kms:Decrypt` permissions rather than the ECS Task Execution Role.

The ECS Task Execution Role is used by the ECS agent, not the application itself. The ECS Task Role is required for the application container to access AWS services at runtime.

Identify the limitations of the KMS Decrypt API.

Determine that the configuration file size of

150\text{ KB}

exceeds the

4\text{ KB}

size limit of the `kms:Decrypt` API.

Direct decryption using KMS is limited to small payloads under

4\text{ KB}

, necessitating envelope encryption.

Apply the correct envelope decryption workflow.

Update the code to send only the encrypted data key to KMS, receive the plaintext data key, and decrypt the file locally.

This is the standard envelope encryption pattern, which avoids sending large payloads over the network and bypasses API limits.

Key Concept

AWS KMS Envelope Decryption and ECS IAM Roles

Estimated Time:2m 0s

Question 734Question →

A developer is planning to update a non-critical internal application deployed on AWS Elastic Beanstalk. The update will be performed during off-peak hours over the weekend. To stay within budget, the deployment must not provision any additional EC2 instances. The company accepts that the application will be temporarily offline during the deployment process.

Which deployment strategy meets these requirements?

Rolling with additional batch

Immutable

All at once

Traffic splitting

Show answer & explanation

Answer: All at once

Answer

All at once

The 'All at once' strategy is the only Elastic Beanstalk deployment policy that does not provision any additional EC2 instances during the update. It applies the deployment package to all existing instances at the same time. While this causes a short period of downtime (unavailability) during which the application is offline, this aligns with the company's acceptance of weekend downtime and satisfies the strict budget constraint of zero additional instances.

Step-by-Step Solution

Analyze the scenario constraints.

The deployment must not provision any additional EC2 instances (minimal cost) and can tolerate downtime (offline during the weekend).

This establishes the boundaries for acceptable deployment strategies.

Evaluate the resource provisioning behavior of each strategy.

Rolling with additional batch, Immutable, and Traffic splitting all require provisioning new instances during the deployment. Only the All at once strategy deploys directly to existing instances without launching new ones.

This filters out strategies that violate the zero-additional-instance cost constraint.

Select the strategy that allows downtime and uses only existing instances.

The All at once strategy is selected as it updates all instances simultaneously, causing downtime but requiring no additional resource costs.

This matches all criteria described in the scenario.

Key Concept

AWS Elastic Beanstalk deployment strategy tradeoffs regarding cost and capacity.

Estimated Time:45s

Question 735Question →

A developer is building a serverless web application where users authenticate using an Amazon Cognito User Pool. The backend REST API is hosted on Amazon API Gateway with an AWS Lambda integration. The developer wants to restrict access to the `/premium-features` endpoint so that only users who belong to the 'PremiumGroup' in the User Pool can access it. Which approach implements this access control with the least latency and administrative effort?

Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.

Create a custom API Gateway Lambda Authorizer that intercepts the ID token, calls the Amazon Cognito service provider API to retrieve the user's group membership, and dynamically generates an IAM policy.

Configure an Amazon Cognito Identity Pool to exchange the ID token for temporary AWS credentials mapped to the PremiumGroup role. Configure the API Gateway method to use AWS_IAM authorization, and pass the raw ID token in the Authorization header.

Configure the API Gateway method to use a Cognito User Pool Authorizer. Update the API Gateway execution role's IAM trust policy to explicitly allow the role associated with the PremiumGroup to invoke the Lambda function.

Show answer & explanation

Answer: Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.

Answer

The correct solution uses an Amazon Cognito User Pool Authorizer on API Gateway. When a user authenticates, Cognito issues a JWT (ID or Access token) containing claims about the user, including group membership in the cognito:groups claim. API Gateway automatically validates the token and passes these claims to the backend Lambda integration in the event object. The Lambda function can then inspect the cognito:groups claim to enforce group-based authorization. This approach requires no external database queries or additional API calls, minimizing execution latency.

Step-by-Step Solution

Integrate API Gateway with the Cognito User Pool.

API Gateway automatically validates the incoming JSON Web Token (JWT) sent by the client.

This offloads token validation from the application code and utilizes built-in AWS functionality.

Verify group membership inside the backend Lambda integration.

The Lambda function receives the decoded JWT claims in the request context (under the authorizer object) and inspects the cognito:groups claim.

Since the group information is already present in the JWT, checking it in the Lambda function avoids making external network calls to Cognito, keeping latency low.

Key Concept

API Gateway Cognito User Pool Authorizer integration and JWT claims evaluation

Estimated Time:1m 30s

Question 736Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application code needs to read objects from an Amazon S3 bucket.

Which of the following IAM configurations is required to allow the application code to access the S3 bucket?

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Execution Role (executionRoleArn) in the ECS task definition.

Hardcode AWS access keys and secret access keys with S3 read permissions directly in the application code inside the Docker container.

Configure an IAM role with Amazon S3 read permissions, but set the trust policy principal to allow the Amazon EC2 service (ec2.amazonaws.com) to assume the role.

Show answer & explanation

Answer: Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Answer

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Configuring an IAM role with Amazon S3 read permissions and assigning it as the Task Role (taskRoleArn) in the ECS task definition is correct. The Task Role is designed to grant application code running inside the ECS container permissions to call AWS APIs.

Step-by-Step Solution

Identify which role is responsible for providing IAM permissions to application code running inside the container.

The Task Role (taskRoleArn) is identified as the role providing permissions directly to the application.

Differentiating between Task Role (application level) and Task Execution Role (ECS agent level) is critical for configuring correct permissions.

Formulate the IAM role policy for S3 access.

An IAM policy allowing S3 Read actions is created and attached to the Task Role.

This grants the application code the exact permissions needed to read objects from the S3 bucket.

Verify the trust policy of the IAM role.

The trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.

This ensures that Amazon ECS can successfully assign the role to the container at launch.

Key Concept

Distinction between ECS Task Role and Task Execution Role

Question 737Question →

A developer is building a serverless integration service. An AWS Lambda function is configured to run inside a custom VPC to process sensitive data. The function must poll messages from an Amazon SQS queue, store the processed data in an Amazon Aurora PostgreSQL database located in a private database subnet, and send a confirmation payload to an external HTTP webhook API on the public internet.

Which two configurations are required to ensure the Lambda function has the necessary network paths and security settings?

Select all that apply

Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing

0.0.0.0/0

to a NAT Gateway located in a public subnet.

Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port

5432

from the Security Group associated with the Lambda function.

Configure the Lambda function to run in public subnets with an assigned public IP address to allow direct outbound access to the external webhook.

Create a Gateway VPC Endpoint for Amazon SQS and associate it with the route tables of the private subnets to allow private polling of SQS messages.

Modify the IAM trust policy of the Lambda function's execution role to allow the Amazon SQS service to assume the role and push messages directly to the function's execution context.

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing $0.0.0.0/0$ to a NAT Gateway located in a public subnet.; Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port $5432$ from the Security Group associated with the Lambda function.

Answer

Configure the Lambda function to run in private subnets with a route to a NAT Gateway, and configure the database's Security Group to allow inbound traffic from the Lambda function's Security Group.

To allow the Lambda function to connect to the private database, the database security group must authorize inbound traffic on port

5432

from the Lambda function's security group. To allow the function to reach the external HTTP webhook on the public internet, the Lambda function must run in private subnets with a route directing outbound traffic to a NAT Gateway in a public subnet.

Step-by-Step Solution

Analyze database connectivity requirements

The Lambda function needs to connect to Aurora PostgreSQL on port

5432

. The database's security group must authorize inbound traffic on port

5432

originating from the security group assigned to the Lambda function.

Security groups act as firewalls at the instance/resource level and must be configured for stateful communication.

Analyze internet connectivity requirements

The Lambda function needs to call an external webhook. A VPC-enabled Lambda function must be placed in private subnets with a route directing

0.0.0.0/0

to a NAT Gateway.

VPC-enabled Lambda functions do not receive public IP addresses and cannot connect directly to the internet from a public subnet.

Evaluate SQS connectivity requirements

SQS traffic can flow either via the NAT Gateway or through an Interface VPC Endpoint. SQS does not support Gateway VPC Endpoints.

Only Amazon S3 and DynamoDB support Gateway VPC Endpoints; all other supported services use Interface VPC Endpoints.

Key Concept

VPC networking configurations for AWS Lambda, including NAT Gateway routing, security groups, and VPC endpoint types.

Question 738Question →

A developer is configuring a deployment strategy for a multi-instance AWS Elastic Beanstalk environment. The deployment must satisfy the following constraints:

* The application must maintain 100% of its capacity at all times during the deployment.
* There must be zero downtime.
* The update must be deployed to the entire fleet without splitting production traffic or performing canary testing.

Which of the following Elastic Beanstalk deployment strategies will satisfy these requirements? (Select TWO.)

Select all that apply

Immutable

Rolling with additional batch

Rolling

All-at-once

Traffic splitting

Show answer & explanation

Answer: Immutable; Rolling with additional batch

Answer

The Immutable and Rolling with additional batch deployment strategies are correct because they both maintain 100% capacity throughout the deployment and ensure zero downtime without splitting production traffic.

The Immutable strategy creates a full set of new instances in a separate Auto Scaling group, ensuring full capacity is maintained on the old group until cutover. The Rolling with additional batch strategy launches a temporary batch of new instances before starting the deployment to maintain 100% capacity during the rolling process. Neither strategy splits live production traffic for evaluation purposes.

Step-by-Step Solution

Analyze the constraint of maintaining 100% capacity during deployment.

This eliminates the standard Rolling strategy (which reduces capacity during updates) and the All-at-once strategy (which causes downtime).

We must identify strategies that launch temporary additional instances to offset the ones being upgraded.

Analyze the constraint of zero downtime.

This confirms that All-at-once is incorrect as it takes all instances offline at the same time.

Downtime must be avoided completely.

Analyze the constraint of not splitting production traffic or performing canary testing.

This eliminates the Traffic splitting strategy, which is designed to route a small percentage of production traffic to the new version for verification.

Traffic splitting acts as a canary deployment and violates the requirement.

Key Concept

AWS Elastic Beanstalk deployment strategies and their capacity, downtime, and traffic-routing trade-offs.

Estimated Time:1m 0s

Question 739Question →

A developer is securing a REST API hosted on Amazon API Gateway for a serverless application. External third-party partner systems must programmatically access this API using a machine-to-machine authentication flow. The partner systems do not have AWS accounts and support only the OAuth 2.0 Client Credentials grant flow. The developer wants to enforce authorization at the API Gateway layer with minimal custom code and low maintenance overhead. Which configuration should the developer implement?

Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.

Configure a Cognito Identity Pool to authenticate the partner systems using anonymous guest access. Grant the partner systems temporary AWS credentials to sign their requests using AWS Signature Version 4 (SigV4), and enable IAM authorization on the API Gateway methods.

Configure a Cognito User Pool with a resource server and client credentials. In API Gateway, create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from Cognito, decodes and validates the signature of the incoming JWT access token, and returns an IAM policy. Configure the API method to use this Lambda authorizer.

Enable Lambda Proxy integration on API Gateway to forward the requests to a backend Lambda function. Within the backend Lambda function code, parse the Authorization header, extract the access token, and perform custom validation against client client_id and client_secret pairs stored in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.

Answer

The correct configuration leverages Amazon Cognito User Pools with a Resource Server to support the OAuth 2.0 Client Credentials flow. External partner systems can obtain an access token and pass it to API Gateway. The built-in Cognito User Pool authorizer natively validates these access tokens and checks for the required custom scopes. This requires zero custom code and operates at the API Gateway layer, minimizing maintenance overhead and execution cost.

Step-by-Step Solution

Set up the Cognito User Pool acting as an OAuth 2.0 authorization server.

A Resource Server is defined in the Cognito User Pool with custom scopes representing API permissions. An App Client is created with the client credentials flow enabled.

This allows third-party clients to request OAuth 2.0 access tokens by authenticating directly with the Cognito token endpoint using client credentials, without needing AWS accounts or user logins.

Configure the Cognito Authorizer on Amazon API Gateway.

API Gateway is configured with a built-in Cognito User Pool authorizer pointing to the user pool.

This enables API Gateway to automatically fetch the JSON Web Key Set (JWKS) from Cognito, verify the token signatures, and extract the claims at the gateway level.

Apply the authorizer and custom scopes to the API methods.

The target API methods are associated with the Cognito Authorizer and the required custom scopes from the resource server.

This enforces that only requests presenting valid access tokens with the required scopes are authorized, filtering out unauthorized requests before they reach the backend integrations.

Key Concept

Using built-in Cognito User Pool authorizers with OAuth 2.0 Client Credentials flow for machine-to-machine API authorization.

Question 740Question →

A developer is migrating a containerized web application from Amazon EC2 instances to Amazon ECS. The deployment process is managed by AWS CodeDeploy using a Blue/Green deployment configuration. Before production traffic is shifted to the replacement task set, the deployment must execute a database migration script. This script retrieves a database password that must be automatically rotated every 30 days.

The developer writes the following `appspec.yaml` file for the Amazon ECS service:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:111122223333:task-definition/my-app:1"
LoadBalancerInfo: ContainerName: "web"
ContainerPort: 80
Hooks:
- AfterInstall:
- location: "scripts/migrate.sh"
timeout: 600

Which set of actions must the developer perform to ensure the database migration runs successfully and complies with the rotation requirement?

Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.

Keep the `appspec.yaml` hooks structure as is to run the migration script directly, but update the Amazon ECS task execution role's trust policy to trust `codedeploy.amazonaws.com`. Store the password in AWS Systems Manager Parameter Store as a SecureString with native automatic rotation enabled.

Change the hook in the `appspec.yaml` from `AfterInstall` to `ValidateService` to run the migration script, and keep the shell script location path. Store the database password in AWS Systems Manager Parameter Store, and configure an Amazon EventBridge rule to trigger a custom rotation Lambda function.

Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook to reference the Lambda function's ARN. Store the database password in AWS Systems Manager Parameter Store, and configure the Lambda function's trust policy to trust `codedeploy.amazonaws.com` so CodeDeploy can assume the function role directly.

Show answer & explanation

Answer: Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.

Answer

Package the database migration script into an AWS Lambda function, update the `AfterInstall` hook to reference its ARN, store the password in AWS Secrets Manager with automatic rotation, and allow the Lambda execution role to retrieve the secret.

The correct answer correctly identifies that Amazon ECS AppSpec files require lifecycle hooks to point to AWS Lambda functions rather than local shell scripts. It also correctly chooses AWS Secrets Manager over Systems Manager Parameter Store because Secrets Manager features native, built-in support for rotating credentials automatically.

Step-by-Step Solution

Analyze the AppSpec file hooks syntax for Amazon ECS.

Identify that the `location` parameter and shell script execution are only supported for EC2/On-Premises deployments. ECS deployments require hooks to point directly to AWS Lambda functions.

To ensure CodeDeploy can execute the database migration hook on the ECS compute platform.

Evaluate the database password rotation requirement.

Determine that AWS Secrets Manager provides built-in, out-of-the-box automatic rotation for database secrets, whereas AWS Systems Manager Parameter Store does not support native rotation.

To meet the compliance requirement of rotating the database password every 30 days with minimal administrative overhead.

Configure the Lambda function's IAM permissions.

Create an IAM execution role for the Lambda function and attach a policy allowing the `secretsmanager:GetSecretValue` action.

To allow the migration Lambda function to securely retrieve the database credentials during execution.

Key Concept

AWS CodeDeploy AppSpec configuration for Amazon ECS and Secrets Management integration

Estimated Time:3m 0s

PreviousPage 37 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept