Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 761Question →

A developer is implementing a secure audit logging system where an application running on Amazon EC2 instances encrypts log files locally before uploading them to Amazon S3. A separate analytics service running on AWS Fargate needs to decrypt and process these log files. The developer wants to use a customer managed key (CMK) in AWS KMS for envelope encryption and must ensure that all encryption and decryption operations are cryptographically bound to the encryption context `{"Project": "Audit"}`.

Which TWO actions must the developer perform to successfully implement this security architecture?

Select all that apply

Show answer & explanation

Answer: In the EC2 application code, call the `GenerateDataKey` API operation using the KMS key identifier and passing the encryption context `{"Project": "Audit"}` to retrieve both the plaintext data key and the encrypted data key.; In the ECS task role policy of the Fargate service, grant `kms:Decrypt` permission for the CMK, and include a condition block that checks the `kms:EncryptionContext:Project` key is equal to `"Audit"`.

Answer

In the EC2 application code, call the GenerateDataKey API operation using the KMS key identifier and passing the encryption context {"Project": "Audit"} to retrieve both the plaintext data key and the encrypted data key; and in the ECS task role policy of the Fargate service, grant kms:Decrypt permission for the CMK, and include a condition block that checks the kms:EncryptionContext:Project key is equal to "Audit".
The correct options describe the proper implementation of client-side envelope encryption and IAM policy configuration. To encrypt files of arbitrary size, the producer must generate a data key using the `GenerateDataKey` API, passing the required encryption context. This context is cryptographically bound to the data key. On the consuming side, the application running inside the Fargate container needs permissions to decrypt the data key. Since this is an application runtime activity, the permission must be granted to the Fargate Task Role (rather than the Task Execution Role). The security policy enforces the use of the correct encryption context by using a condition block checking for the `kms:EncryptionContext:Project` key.

Step-by-Step Solution

1
Generate the data key for envelope encryption
The EC2 application makes a call to `GenerateDataKey` passing the customer managed key identifier and `{"Project": "Audit"}` as the encryption context. This returns both the plaintext data key and the ciphertext data key.
Envelope encryption requires a local plaintext key to perform symmetric encryption on the file, and an encrypted copy of the key to store alongside the ciphertext.
2
Encrypt the log file locally and discard the plaintext key
The log file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory, and the encrypted data key is stored as metadata with the log file in S3.
Discarding the plaintext key from memory after use ensures that only the encrypted data key remains, protecting the data at rest.
3
Configure the Fargate task permissions and policy conditions
The Fargate service's ECS task role policy is configured to allow `kms:Decrypt` on the CMK, constrained by a policy condition requiring `kms:EncryptionContext:Project` to be `"Audit"`.
The consumer service needs the task role (not the task execution role) to decrypt the data key during application runtime, and the policy condition enforces cryptographic context binding.
4
Decrypt the log file on Fargate
The Fargate consumer downloads the log and the encrypted data key, then calls `Decrypt` on the data key passing the exact encryption context `{"Project": "Audit"}`. It receives the plaintext key and decrypts the log file.
KMS will reject the decryption request if the encryption context passed to the API does not match the context used during key generation.

Key Concept

AWS KMS envelope encryption workflows, encryption context binding, and proper IAM role configuration for containerized services.
Estimated Time:2m 30s
Question 762Question →

A company is using AWS CodePipeline to automate their deployment process. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database migrations against an Amazon RDS MySQL DB instance located in a private subnet. The migration script requires database credentials that must be rotated automatically every 14 days, as well as a non-sensitive database endpoint port number. During execution, the custom Lambda action fails. Which configuration should the developer implement to allow the Lambda function to securely run the migrations while optimizing for operational overhead, cost, and security?

Show answer & explanation

Answer: Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway. Retrieve the database credentials from AWS Secrets Manager and the database port from AWS Systems Manager Parameter Store. Attach a permissions policy to the Lambda execution role allowing secretsmanager:GetSecretValue and ssm:GetParameter, and ensure the role's trust policy allows the lambda.amazonaws.com service principal to assume the role.

Answer

Deploy the Lambda function within the private VPC subnets with a route to a NAT Gateway, retrieving the credentials from AWS Secrets Manager and the port from AWS Systems Manager Parameter Store, while attaching the appropriate permissions policy and a trust policy allowing lambda.amazonaws.com to assume the role.
The correct configuration deploys the Lambda function in private VPC subnets alongside a NAT Gateway to permit egress access to both the RDS database and AWS public service endpoints. By retrieving the database credentials from AWS Secrets Manager, the developer secures the credentials and can leverage automatic secret rotation. Using Systems Manager Parameter Store for the database port optimizes cost for non-sensitive configurations. Finally, creating a permissions policy for the AWS actions and maintaining a trust policy that allows the Lambda service principal to assume the role complies with the AWS IAM model.

Step-by-Step Solution

1
Determine the network topology for the database migration Lambda function.
The Lambda function must be placed in private VPC subnets with a route to a NAT Gateway to access the private RDS DB instance and reach public AWS endpoints for Secrets Manager and Parameter Store.
Since the RDS MySQL instance is in a private subnet, the Lambda function needs to be in the same VPC to communicate with it, and it needs a NAT Gateway to call AWS API endpoints.
2
Select the correct secrets and parameter storage services based on requirements.
Store database credentials in AWS Secrets Manager and the database port in Systems Manager Parameter Store.
AWS Secrets Manager is required because it natively supports automatic rotation every 14 days. Systems Manager Parameter Store is used for the non-sensitive port number to minimize costs.
3
Configure the Lambda execution role policies.
Attach a permissions policy allowing secretsmanager:GetSecretValue and ssm:GetParameter. Ensure the trust policy allows lambda.amazonaws.com to assume the role.
The permissions policy governs what resources the role can access, while the trust policy specifies that the Lambda service itself is permitted to assume the role during execution.

Key Concept

Integration of AWS CodePipeline custom actions with VPC network configurations, AWS Secrets Manager, Systems Manager Parameter Store, and IAM role trust/permissions separation.
Estimated Time:2m 0s
Question 763Question →

A developer is configuring security for an Amazon API Gateway REST API. The API needs to validate JSON Web Tokens (JWT) issued by an Amazon Cognito User Pool. Additionally, the backend Lambda function, which is integrated using a Lambda Proxy integration, must be able to read the user's group memberships to apply application-level authorization. Which two configuration steps should the developer perform to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an Amazon Cognito User Pool authorizer in API Gateway, pointing to the user pool, and set the Identity Source to read the Authorization header.; Configure the API Gateway resource methods to use the Cognito User Pool authorizer, and extract the group memberships from the request context authorizer claims in the Lambda function.

Answer

Create a Cognito User Pool authorizer configured to read the Authorization header, associate it with the API methods, and access the groups from the event request context authorizer claims in the Lambda function.
The correct options describe creating a Cognito User Pool authorizer and configuring it on the API methods, while retrieving the token claims directly from the request context authorizer claims. This provides a secure, native, and low-latency solution that leverages API Gateway's built-in validation capabilities. Under a Lambda Proxy integration, the validated token claims are automatically passed to the Lambda function's event payload.

Step-by-Step Solution

1
Create and configure a Cognito User Pool authorizer in Amazon API Gateway.
API Gateway is configured to automatically inspect the token source header (e.g., Authorization) and validate the JWT signature against the Cognito User Pool.
This establishes native token validation at the API Gateway layer without writing custom authorizer code.
2
Set the API methods to use the created Cognito User Pool authorizer.
The API resources are secured, and unauthenticated requests are blocked with a 401 Unauthorized status.
This applies the authorizer security to the specific methods that require authentication.
3
Access the user's groups in the backend Lambda function from the proxy event context.
The Lambda function code retrieves claims from the event structure at `event.requestContext.authorizer.claims['cognito:groups']`.
Since the API uses a Lambda Proxy integration, API Gateway automatically passes the validated token claims down to the backend integration.

Key Concept

API Gateway Cognito User Pool Authorizers and requestContext claims propagation with Lambda Proxy integration.
Question 764Question →

An organization is designing a B2B integration platform where partner companies consume API endpoints exposed via an Amazon API Gateway REST API. The partners authenticate using a third-party Identity Provider (IdP) and obtain a custom JWT containing a partnerId claim. The organization requires that partners can only access API paths matching /partners/{partnerId}/*. Which solution should a developer implement to meet these authorization requirements with the least administrative complexity?

Show answer & explanation

Answer: Implement an API Gateway Lambda authorizer. In the authorizer function, validate the custom JWT and verify the signature using the Identity Provider's public keys. Extract the partnerId claim and return an IAM policy to API Gateway that grants execute-api:Invoke permissions exclusively on the resource path corresponding to /partners/{partnerId}/*.

Answer

Implement an API Gateway Lambda authorizer to validate the JWT and dynamically generate an IAM policy that allows access only to /partners/{partnerId}/*.
The correct solution involves deploying a Lambda authorizer. The Lambda authorizer receives the token, validates its signature against the IdP's JWKS (JSON Web Key Set), extracts the partnerId claim, and dynamically constructs an IAM policy. This IAM policy grants execute-api:Invoke permission specifically on the ARN pattern arn:aws:execute-api:region:account-id:api-id/stage/GET/partners/{partnerId}/*, enforcing least-privilege access control at the API Gateway boundary.

Step-by-Step Solution

1
Determine if Cognito User Pool Authorizer can validate external JWTs directly.
It cannot, as Cognito User Pool authorizers are designed for Amazon Cognito User Pools.
Identifies that a Lambda authorizer or Cognito federation is required.
2
Analyze how to enforce path-based access control based on JWT claims dynamically.
A Lambda authorizer can extract the partnerId claim and return a dynamically generated IAM policy.
Enforces least privilege at the API Gateway layer before the backend is invoked.
3
Evaluate the configuration complexity of the proposed solutions.
Using a Lambda authorizer keeps the architecture simple by validating and authorizing in one step without Cognito Identity Pool federation.
Selects the solution with the least operational overhead.

Key Concept

API Gateway Lambda Authorizer with Dynamic Policy Generation
Estimated Time:2m 0s
Question 765Question →

A developer has configured an application running on an Amazon EC2 instance to decrypt database credentials using an AWS KMS customer managed key. The EC2 instance profile has an IAM policy attached that allows the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, the application receives an `AccessDeniedException` error when attempting to decrypt the credentials. Which configuration change is required to resolve this authorization error?

Show answer & explanation

Answer: Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

Answer

Modify the KMS key policy to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.
For AWS KMS customer managed keys, authorization is determined by both the key policy and IAM policies. If the key policy does not explicitly permit the caller or delegate authority to the root AWS account (which allows IAM policies to take effect), any IAM policies permitting KMS actions will have no effect, resulting in an AccessDeniedException. Granting the EC2 role access in the key policy resolves the issue.

Step-by-Step Solution

1
Determine the resource authorization hierarchy for AWS KMS.
Unlike other services, AWS KMS requires that the key policy itself explicitly grants access, either directly or by delegating control to the account's IAM policies.
If the key policy is not configured to trust the IAM role or the root account, all IAM permissions for that key will be ignored.
2
Verify if the key policy of the customer managed key contains an allow statement for the caller's IAM role.
The key policy does not delegate control or explicitly authorize the EC2 role.
This results in an AccessDeniedException despite the presence of the IAM policy.
3
Add the required permissions statement to the KMS key policy.
The key policy is updated to include the EC2 instance profile's IAM role ARN as a Principal with the `kms:Decrypt` action.
This satisfies the KMS authorization check and allows the application to decrypt the credentials.

Key Concept

AWS KMS Key Policy Authorization
Estimated Time:1m 30s
Question 766Question →

A developer is building a healthcare application that processes patient medical images. Each image file is approximately 25 MB25\text{ MB} in size. The developer needs to encrypt these images locally using client-side envelope encryption with an AWS KMS customer managed key before uploading them to an Amazon S3 bucket.

Which of the following steps must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.; Encrypt the medical image file locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To perform client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey operation to retrieve a plaintext data key and an encrypted data key, encrypt the file locally using the plaintext data key, and then delete the plaintext data key from memory.
The correct workflow for client-side envelope encryption requires generating a data key using the GenerateDataKey API operation. This provides a plaintext data key to perform the local symmetric encryption on the 25 MB25\text{ MB} image and an encrypted data key. Once the file is encrypted, the plaintext data key must be removed from memory to ensure security.

Step-by-Step Solution

1
Call the GenerateDataKey API operation.
AWS KMS returns a plaintext data key and an encrypted data key.
The plaintext data key is required to perform the local encryption, and the encrypted data key will be stored alongside the encrypted file.
2
Perform local encryption using a cryptographic library.
The medical image file is encrypted locally.
Since the file exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, the encryption must be handled locally on the application host.
3
Delete the plaintext data key from memory and package the encrypted key with the ciphertext.
The plaintext key is removed, and the encrypted data key is saved with the encrypted image.
Removing the plaintext data key from memory prevents security risks. Storing the encrypted data key alongside the ciphertext is necessary for future decryption.

Key Concept

AWS KMS client-side envelope encryption workflow for payloads exceeding the KMS API size limits.
Question 767Question →

An organization requires a new microservice backend to run on AWS Lambda within a custom VPC. The function must query an Amazon Aurora MySQL database residing in a private subnet. The function also needs to retrieve database credentials from AWS Secrets Manager without any traffic transiting the public internet.

Which configuration should a developer implement to meet these requirements securely?

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.

Answer

Associate the Lambda function with the private subnets. Provision an interface VPC endpoint for Secrets Manager in the VPC, and configure the security groups to allow inbound HTTPS traffic from the Lambda function's security group to the endpoint.
The correct solution involves associating the Lambda function with the private subnets where the database resides and provisioning an interface VPC endpoint for Secrets Manager. The security groups are then configured to allow inbound HTTPS traffic from the Lambda function to the endpoint. This satisfies all requirements: Lambda can query the Aurora database, and the credentials from Secrets Manager are retrieved securely over private IP addresses within the AWS network without transiting the public internet.

Step-by-Step Solution

1
Associate the Lambda function with the private subnets of the VPC.
The Lambda function receives elastic network interfaces (ENIs) inside the private subnets, enabling network connectivity to the Aurora database.
By default, Lambda functions run in a secure service VPC and cannot access resources in a customer's private subnets unless VPC association is configured.
2
Provision an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
Private IP addresses are allocated in the private subnets for the endpoint, resolving hostnames privately within the VPC.
An interface VPC endpoint is required to access AWS Secrets Manager without routing requests through a NAT Gateway or transiting the public internet.
3
Configure the security groups of the interface VPC endpoint to allow inbound HTTPS (port 443) traffic from the Lambda function's security group.
The firewall rules are updated to permit secure HTTPS connections from the Lambda function to the Secrets Manager endpoint.
Interface VPC endpoints use security groups to restrict network access, and they must explicitly permit incoming traffic from the clients.

Key Concept

VPC endpoints enable private connection between a VPC and supported AWS services without requiring internet gateways, NAT devices, or VPN connections. Security groups must be configured to allow communication between resources and interface endpoints.
Question 768Question →

A developer is setting up a basic release pipeline using AWS CodePipeline to compile a containerized application and deploy it to Amazon Elastic Container Service (Amazon ECS). The source code is stored in an AWS CodeCommit repository. Which of the following configurations are required to successfully set up this pipeline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Source action in AWS CodePipeline with AWS CodeCommit as the source provider.; Configure a Build action in AWS CodePipeline with AWS CodeBuild as the build provider.

Answer

To configure the release pipeline, the developer must add a Source action with AWS CodeCommit as the provider and a Build action with AWS CodeBuild as the provider.
The correct configurations are configuring a Source action with AWS CodeCommit as the source provider and configuring a Build action with AWS CodeBuild as the build provider. The Source action triggers the pipeline when changes are detected in the repository, and the Build action compiles the containerized application and packages it as a Docker image.

Step-by-Step Solution

1
Define the Source stage.
The pipeline is configured with a Source stage that references the AWS CodeCommit repository to pull the code on changes.
AWS CodePipeline requires a source repository to fetch the code before running subsequent compilation or build actions.
2
Define the Build stage.
The pipeline is configured with a Build stage that uses AWS CodeBuild to execute the compilation and Docker image build steps.
An AWS CodeBuild action is necessary to compile the containerized application code and package it as a Docker image.

Key Concept

AWS CodePipeline Stages and Actions
Question 769Question →

A developer is designing a serverless e-commerce application that runs on AWS Lambda and uses Amazon DynamoDB. The developer needs to implement a session state management solution to store user shopping carts externally, and a database caching solution to reduce read latency for popular products.

Which TWO architectural decisions should the developer make to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store user session states in Amazon DynamoDB with Time to Live (TTL) enabled to automatically delete expired shopping carts.; Enable Amazon DynamoDB Accelerator (DAX) to cache database reads for popular products.

Answer

The developer should store user session states in Amazon DynamoDB with Time to Live (TTL) enabled, and enable Amazon DynamoDB Accelerator (DAX) to cache database reads for popular products.
Storing user session states in Amazon DynamoDB with TTL enabled allows the application to offload session storage to a highly available, scalable database while letting AWS automatically clean up expired sessions. Enabling DynamoDB Accelerator (DAX) provides an in-memory caching tier directly in front of DynamoDB, reducing read latency for popular products to sub-milliseconds without modifying application logic.

Step-by-Step Solution

1
Identify the storage and lifecycle requirements for the user session states.
Amazon DynamoDB is suitable for key-value session storage, and enabling TTL allows automatic, cost-effective cleanup of expired session data.
Session data is transient and needs automatic deletion to avoid accumulating garbage data.
2
Identify the caching layer for database queries on popular products.
Amazon DynamoDB Accelerator (DAX) acts as an in-memory cache directly in front of Amazon DynamoDB.
DAX provides sub-millisecond response times for read-heavy workloads on DynamoDB tables without modifying application logic.

Key Concept

Selecting appropriate AWS services and features for application caching and session state management.
Estimated Time:1m 30s
Question 770Question →

A developer is building a serverless backend for a mobile application. The APIs are exposed via an Amazon API Gateway REST API. The application uses an Amazon Cognito User Pool for user authentication. The developer needs to secure the API Gateway methods so that only authenticated users can access them. Additionally, the backend Lambda function must access the authenticated user's custom attribute, `custom:department`, to perform fine-grained data authorization. The client application is configured to pass the user's ID token in the HTTP `Authorization` header.

Which two configuration steps must the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool authorizer that references the User Pool, and set the Token Source to `method.request.header.Authorization`.; Configure the API Gateway method to use Lambda proxy integration, and access the custom attributes in the backend Lambda function via the `event.requestContext.authorizer.claims` object.

Answer

Configure an API Gateway Cognito User Pool authorizer pointing to the User Pool with the appropriate token source, and configure the API Gateway method to use Lambda proxy integration to read the custom attribute claims under the request event context.
To secure the API Gateway REST API with Cognito User Pool users, the developer should configure a native API Gateway Cognito User Pool authorizer. This authorizer automatically validates the incoming JSON Web Token (JWT) signature and expiration. By specifying `method.request.header.Authorization` as the Token Source (or Identity Source), API Gateway expects the client to pass the token in that header. In addition, when the API Gateway method is configured with Lambda proxy integration, API Gateway automatically passes the validated token's claims (including custom user attributes) to the backend Lambda function. The function can access these claims directly in the event object under the `event.requestContext.authorizer.claims` path, which contains the `custom:department` claim.

Step-by-Step Solution

1
Configure an API Gateway Cognito User Pool authorizer.
API Gateway will natively validate incoming JSON Web Tokens (JWTs) from the specified User Pool using the `Authorization` header as the token source.
This eliminates the need to write custom validation logic in a Lambda authorizer, minimizing complexity and latency.
2
Configure the API Gateway method to use Lambda proxy integration.
The full request context, including authorization metadata, is automatically forwarded to the backend Lambda function.
Lambda proxy integration simplifies the interface, bypassing the need for manual integration mapping templates.
3
Access user attributes inside the Lambda function.
The backend code can directly read the claims from `event.requestContext.authorizer.claims['custom:department']`.
Cognito User Pool authorizers automatically populate user claims in the request context under the authorizer claims dictionary.

Key Concept

Securing API Gateway using Cognito User Pool Authorizers and passing identity context to a backend Lambda function using Lambda Proxy Integration.
Estimated Time:3m 0s
Question 771Question →

A developer is building a smart-home mobile application that connects to a backend hosted on Amazon API Gateway. Users authenticate with the application through an Amazon Cognito User Pool, which provides a JSON Web Token (JWT) upon login. The developer needs to secure the API Gateway REST API by verifying these JWTs before forwarding requests to the backend services.

Which of the following is the most operationally efficient method to authorize API requests using these JWTs?

Show answer & explanation

Answer: Configure a built-in Amazon Cognito User Pool authorizer on the Amazon API Gateway REST API.

Answer

Configure a built-in Amazon Cognito User Pool authorizer on the Amazon API Gateway REST API.
The correct option is to configure a built-in Amazon Cognito User Pool authorizer. API Gateway natively integrates with Cognito User Pools to validate JWT identity tokens without requiring custom code or additional Lambda invocations, making it the most operationally efficient choice.

Step-by-Step Solution

1
Identify the token type and authentication provider.
The tokens are JWTs generated by an Amazon Cognito User Pool.
Determining the identity source is the first step in selecting the appropriate authorizer.
2
Evaluate native API Gateway features for the identity provider.
API Gateway provides a native Amazon Cognito User Pool authorizer to validate these JWTs.
Using built-in features reduces operational complexity and costs.
3
Configure the API Gateway authorizer.
The authorizer validates the token header natively before forwarding requests, blocking unauthorized access at the edge.
This secures the API boundary with the least administrative overhead.

Key Concept

API Gateway built-in Cognito User Pool Authorizers
Question 772Question →

A developer is planning the deployment strategy for a critical, high-volume API hosted on AWS Elastic Beanstalk. The API is highly sensitive to performance fluctuations under load and must maintain 100%100\% of its provisioned capacity throughout the deployment process. Additionally, company compliance requires that the update must be deployed onto brand-new EC2 instances to ensure compliance with a fresh OS base image, and any deployment failure must support an immediate rollback to minimize service disruption. Which two AWS Elastic Beanstalk deployment strategies should the developer choose to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Immutable; Traffic Splitting

Answer

The correct strategies are Immutable and Traffic Splitting because both launch a separate, temporary Auto Scaling group to host the new version on brand-new instances while keeping the original instances fully operational, thereby maintaining 100%100\% capacity and allowing for immediate rollback if a failure occurs.
The correct strategies are the ones that deploy to a temporary Auto Scaling group rather than performing in-place updates. The Immutable strategy creates a parallel Auto Scaling group with the new version, maintaining 100%100\% capacity on the old instances, and swaps traffic once healthy. Similarly, the Traffic Splitting strategy launches a temporary Auto Scaling group and routes a set percentage of traffic to it to perform canary testing. Both options use brand-new EC2 instances and support fast, clean rollbacks by destroying the temporary resources.

Step-by-Step Solution

1
Analyze the capacity requirement
The requirement to maintain 100%100\% capacity eliminates the standard Rolling strategy, which takes batches of existing instances offline during the deployment, and the All at once strategy, which takes all instances offline.
Maintaining capacity ensures no performance degradation occurs under high-volume load.
2
Analyze the infrastructure requirement
The requirement to deploy the new application version onto brand-new EC2 instances eliminates the Rolling with additional batch strategy. While it launches an initial extra batch, subsequent batches are updated in-place on the existing EC2 instances.
Compliance policies often require fresh operating system baselines rather than patching running hosts.
3
Evaluate the remaining strategies against rollback requirements
Both Immutable and Traffic Splitting deployment strategies satisfy all conditions. They launch a temporary Auto Scaling group with the new application version, keeping the existing environment fully scaled, and allow an immediate rollback by terminating the new group if health checks fail.
Validating both strategies confirms they fulfill the capacity, new instance, and rapid rollback criteria.

Key Concept

AWS Elastic Beanstalk Deployment Policies and Strategies
Question 773Question →

A developer needs to deploy an update to a non-production web application running in an AWS Elastic Beanstalk environment. The update must be deployed as quickly as possible, and the developer can tolerate a brief period of downtime during the deployment. Additionally, no new EC2 instances should be provisioned to avoid temporary cost increases. Which deployment policy should the developer select?

Show answer & explanation

Answer: All at once

Answer

All at once
The 'All at once' deployment policy is the fastest way to deploy an update because it deploys the new application version to all instances at the same time. Since it uses the existing instances in-place without launching new ones, it incurs no additional costs. While it causes temporary downtime because all instances are out of service during the update, this is acceptable under the given constraints.

Step-by-Step Solution

1
Analyze the deployment constraints.
The requirements specify: maximum speed of deployment, acceptable downtime, and no additional EC2 instances (zero extra cost).
Understanding the constraints is necessary to choose the correct AWS Elastic Beanstalk deployment policy.
2
Evaluate the deployment policies against the constraints.
The 'All at once' policy stops all instances, deploys the new version, and starts them up. This is the fastest method, uses only existing instances (no extra cost), but causes downtime. Other methods like Rolling, Rolling with additional batch, or Immutable focus on avoiding downtime, which increases deployment duration and, in some cases, temporary resource costs.
Comparing available deployment policies identifies the policy that matches the constraints.

Key Concept

AWS Elastic Beanstalk deployment policies and their trade-offs between speed, cost, and availability.
Question 774Question →

A developer is configuring an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The application needs a database password at startup. The password is saved as a secret in AWS Secrets Manager. The developer wants the Amazon ECS container agent to automatically retrieve the secret value and inject it as an environment variable into the container. Which configuration is required to achieve this?

Show answer & explanation

Answer: Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.

Answer

Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.
The correct option is correct because the Amazon ECS container agent is responsible for calling AWS Secrets Manager to retrieve the secret value before starting the container. To do this, the agent uses the permissions defined in the ECS task execution role. The developer must then map the secret to an environment variable inside the container definition's secrets section.

Step-by-Step Solution

1
Identify the role responsible for tasks executed by the ECS container agent.
The ECS task execution role is responsible for actions the ECS agent performs, such as pulling container images and fetching secrets.
Since the container agent is retrieving the secret and injecting it during task startup (rather than the application code itself calling Secrets Manager), the execution role must have the permission.
2
Determine the proper task definition section for injecting secrets as environment variables.
The secrets section of the container definition is used to map a secret source (like Secrets Manager) to an environment variable.
The standard environment block is only for plaintext environment variables, whereas the secrets block allows referencing secret ARNs for automatic resolution.

Key Concept

ECS Task Role vs. ECS Task Execution Role for Secret Injection
Question 775Question →

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Auto Scaling group of Amazon EC2 instances, which are configured using AWS::CloudFormation::Init metadata and helper scripts to install packages and start the application. During a stack update, the update fails and rolls back because the new instances do not signal success to the stack within the specified timeout. Additionally, the developer suspects that team members might have made manual configuration changes directly on the production EC2 instances. Which two actions should the developer take to troubleshoot the deployment failure and address the configuration drift? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Run drift detection on the CloudFormation stack to identify any out-of-band modifications made to the stack resources.; Inspect the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances to determine why the helper scripts failed to execute or signal success.

Answer

Running drift detection on the CloudFormation stack and inspecting the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances.
To troubleshoot a rolling deployment failure where the EC2 instances fail to signal success, the developer must inspect the helper script logs. The /var/log/cfn-init.log file captures the output and status of the cfn-init metadata execution, while /var/log/cloud-init-output.log captures the standard output and error of the user data script execution. Additionally, running drift detection is the standard way to identify out-of-band resource modifications without manual inspection or disrupting the stack.

Step-by-Step Solution

1
Diagnose the rollback by connecting to the EC2 instances and reviewing logs.
Checking /var/log/cfn-init.log and /var/log/cloud-init-output.log reveals the specific step where the helper scripts failed or why cfn-signal was not invoked.
When a stack update rolls back due to a timeout, it means the stack did not receive a success signal from the instances within the WaitCondition timeout, and these log files contain the helper script execution history.
2
Audit the stack for drift by executing the drift detection tool on the CloudFormation stack.
A drift status report identifying which resources have been modified outside of CloudFormation, including the specific properties that differ from the template.
This determines if manual changes made by team members are causing configuration differences, which must be resolved to align the infrastructure with the template.

Key Concept

Troubleshooting CloudFormation helper scripts and managing stack drift.
Question 776Question →

A developer is preparing to deploy a Node.js web application to an AWS Elastic Beanstalk environment. The deployment has two new requirements: it must securely retrieve a database password that is configured to rotate automatically, and it must install a custom security daemon package on the underlying Amazon EC2 instances during environment provisioning.

Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager, and retrieve the secret programmatically in the application code.; Create a configuration file containing the package installation instructions and place it inside a directory named `.ebextensions` at the root of the application source bundle.

Answer

Store the database password in AWS Secrets Manager to be retrieved programmatically by the application, and place the configuration file inside the `.ebextensions` directory at the root of the application source bundle.
To securely manage a database password that needs automatic rotation, AWS Secrets Manager is the correct choice because it natively integrates with rotation schedules. To customize the EC2 instances (such as installing packages), configuration files must be stored in the `.ebextensions` folder located at the root of the application source bundle. Therefore, storing the password in Secrets Manager and placing the configuration file in `.ebextensions` at the root are the correct actions.

Step-by-Step Solution

1
Evaluate secret storage and rotation requirements.
Identify AWS Secrets Manager as the appropriate service because it natively supports automatic rotation, unlike Systems Manager Parameter Store.
Secrets Manager provides out-of-the-box secret rotation using AWS Lambda.
2
Evaluate how to customize EC2 instances with packages during deployment.
Determine that an Elastic Beanstalk configuration file (.config) must be placed in a directory named `.ebextensions`.
Elastic Beanstalk searches for configuration files specifically in this folder to apply customizations.
3
Verify directory location and naming constraints.
Confirm that the `.ebextensions` directory must be at the root level of the application source bundle with a leading period.
Incorrect naming (like `ebextensions`) or incorrect placement (like inside a `/src` directory) will cause Elastic Beanstalk to ignore the configurations.

Key Concept

AWS Elastic Beanstalk environment customization using `.ebextensions` and secure secret management with Secrets Manager vs Parameter Store.
Estimated Time:1m 30s
Question 777Question →

A developer is implementing user authentication for a web application. The application must allow users to register and sign in directly using their email addresses. Once signed in, the client application needs to invoke a secured REST API hosted on Amazon API Gateway. The developer wants to validate user sessions at the API Gateway layer while minimizing operational overhead and avoiding custom token-validation code.

Which configuration should the developer implement to meet these requirements?

Show answer & explanation

Answer: Use an Amazon Cognito User Pool to manage user registration and authentication. Configure a Cognito User Pool Authorizer on the API Gateway REST API and pass the ID token in the authorization header of the requests.

Answer

Use an Amazon Cognito User Pool to manage user registration and authentication, configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the ID token in the authorization header of the requests.
The correct configuration uses an Amazon Cognito User Pool because it manages the user directory, sign-up, and sign-in, returning standard JSON Web Tokens (JWTs). Configuring a built-in Cognito User Pool Authorizer on the API Gateway REST API allows API Gateway to natively inspect the authorization header and validate the Cognito ID token without custom-written validation logic.

Step-by-Step Solution

1
Select User Directory Service
Choose Amazon Cognito User Pool to handle registration, password management, and user sign-in directly.
Cognito User Pools provide a built-in user directory, whereas Cognito Identity Pools are used for federating identity to obtain temporary AWS credentials.
2
Configure API Gateway Authorizer
Create a built-in Cognito User Pool Authorizer on the REST API resources in API Gateway, pointing it to the created Cognito User Pool.
This offloads token verification (signature, expiration, claims) entirely to API Gateway without writing custom Lambda authorizer code.
3
Transmit Session Token from Client
Send the identity token (ID Token) received after successful Cognito authentication in the request's Authorization header.
The Cognito User Pool Authorizer extracts and validates this token from the configured header to allow or deny the API invocation.

Key Concept

API Gateway integration with Amazon Cognito User Pools for standard authentication flows
Estimated Time:1m 30s
Question 778Question →

A developer is designing a stateful web application that will be hosted on Amazon ECS across multiple Availability Zones. The application requires a shared, external session store to maintain user shopping carts. The session store must support sub-millisecond read/write latency, accommodate complex data structures such as lists and hashes for cart items, and automatically expire session records after 2 hours of inactivity to control costs. Additionally, the solution must survive cache node failures without losing user session data.

Which solution should the developer implement to meet these requirements?

Show answer & explanation

Answer: Use Amazon ElastiCache for Redis with Multi-AZ and automatic failover enabled, and configure the application to store shopping cart data in Redis hashes with a Time-To-Live (TTL) of 7200 seconds.

Answer

Use Amazon ElastiCache for Redis with Multi-AZ and automatic failover enabled, and configure the application to store shopping cart data in Redis hashes with a Time-To-Live (TTL) of 7200 seconds.
The correct solution uses Amazon ElastiCache for Redis because it supports sub-millisecond latencies, provides advanced data structures (like Redis hashes) to represent shopping cart items, and offers high availability through replication groups, Multi-AZ, and automatic failover. Setting a TTL of 7200 seconds ensures that keys expire automatically after 2 hours of inactivity.

Step-by-Step Solution

1
Analyze the requirements for latency and data structures.
The application requires sub-millisecond read/write latency and supports complex data structures (lists and hashes). Amazon ElastiCache (specifically Redis) is designed for in-memory, sub-millisecond lookups and supports advanced data structures natively.
Memcached only supports simple strings, whereas Redis supports hashes, lists, and sets, which are ideal for shopping carts.
2
Evaluate high availability and failover requirements.
The session store must survive cache node failures. Selecting an ElastiCache for Redis replication group with Multi-AZ and automatic failover ensures that a replica is promoted to primary with minimal downtime if the primary node fails.
Without Multi-AZ failover, a node failure would cause data loss and application disruption.
3
Address the session expiration requirement.
Configure a Time-To-Live (TTL) of 7200 seconds (2 hours) on the Redis keys when writing session data.
Redis handles key expiration automatically in the background, freeing up memory without requiring custom application clean-up workers.

Key Concept

Selecting ElastiCache for Redis for high-availability session state management with complex data structures and automatic key eviction (TTL).
Question 779Question →

A developer is configuring an AWS Lambda function to run inside a private subnet of a custom VPC. The function must retrieve configuration parameters from Systems Manager Parameter Store and send trace data to AWS X-Ray. Due to strict compliance guidelines, the VPC does not have a NAT Gateway or an Internet Gateway. Which two configurations must the developer implement to enable this connectivity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager (com.amazonaws.region.ssm) and associate it with the private subnets.; Create an interface VPC endpoint for AWS X-Ray (com.amazonaws.region.xray) and associate it with the private subnets.

Answer

Create interface VPC endpoints for Systems Manager (com.amazonaws.region.ssm) and AWS X-Ray (com.amazonaws.region.xray) and associate them with the private subnets.
Because the Lambda function is deployed inside a private subnet without internet egress (no NAT Gateway or Internet Gateway), it cannot resolve and reach the public API endpoints of Systems Manager and AWS X-Ray. Implementing interface VPC endpoints (AWS PrivateLink) creates private elastic network interfaces (ENIs) with private IP addresses directly inside the private subnet. This routes traffic privately to the specified AWS services without exposing data to the public internet.

Step-by-Step Solution

1
Identify the destination services needed by the Lambda function.
The function must reach AWS Systems Manager (SSM) Parameter Store and AWS X-Ray.
This establishes the specific AWS service endpoints that require network pathways.
2
Select the correct connectivity mechanism for a VPC without internet egress (no NAT Gateway or Internet Gateway).
Determine that interface VPC endpoints (AWS PrivateLink) are required for SSM and X-Ray since gateway endpoints are not supported for these services.
AWS PrivateLink provisions private ENIs inside the subnets to route traffic locally and securely over the AWS network.
3
Configure the interface endpoints for com.amazonaws.region.ssm and com.amazonaws.region.xray.
The Lambda function inside the private subnet can now resolve these service endpoints to private IP addresses and successfully connect.
This establishes the necessary network endpoints for secure internal service resolution.

Key Concept

AWS PrivateLink and Interface VPC Endpoints for private AWS service communication
Question 780Question →

A developer is implementing client-side envelope encryption to secure local data files of size 10 MB10\text{ MB}. The developer calls the AWS KMS `GenerateDataKey` API operation. What does this API operation return to the developer's application?

Show answer & explanation

Answer: Both the plaintext data key and the encrypted ciphertext data key

Answer

Both the plaintext data key and the encrypted ciphertext data key
The GenerateDataKey API operation returns both a plaintext copy of the data key (used to encrypt the file locally in memory) and a ciphertext copy of the data key (encrypted with the specified KMS key, which is saved alongside the encrypted data for later decryption).

Step-by-Step Solution

1
Determine the operational mechanism of envelope encryption for large files.
Envelope encryption requires generating a temporary symmetric data key that will be used to encrypt the payload locally.
Direct encryption using KMS keys is limited to payloads of 4 KB4\text{ KB} or less, meaning a 10 MB10\text{ MB} file must be encrypted using envelope encryption.
2
Analyze the output of the GenerateDataKey API operation.
The GenerateDataKey operation creates a unique data key, encrypts it under the customer managed key, and returns both the plaintext key and the encrypted ciphertext key.
The application needs the plaintext key to encrypt the file immediately, and the ciphertext key to save next to the encrypted file so it can be decrypted later.
3
Match the generated API outputs to the options provided.
The option stating that both the plaintext data key and the encrypted ciphertext data key are returned is correct.
It matches the exact response schema of the GenerateDataKey API call.

Key Concept

AWS KMS Envelope Encryption Workflow
Estimated Time:45s
PreviousPage 39 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin