All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.

In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Configure an API Gateway Cognito Identity Pool Authorizer and associate it with the API methods.

Create an API Gateway Lambda Custom Authorizer to validate the JWT and return an IAM policy allowing the request.

Configure a Lambda Custom Integration (non-proxy) and parse the Authorization header inside the Lambda function using a mapping template.

Show answer & explanation

Answer: Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.; In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Answer

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.

To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Step-by-Step Solution

Select the built-in Cognito User Pool Authorizer in API Gateway.

API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.

This avoids writing custom validation code and utilizes AWS managed capabilities.

Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.

Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.

This secures the endpoints before requests reach the backend Lambda function.

Access the user claims within the Lambda handler using the integration event object.

The Lambda function receives the username and email in the event object without performing additional decoding or verification.

API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Key Concept

API Gateway Cognito User Pools Integration

Question 62Question →

A developer is designing a secure REST API using Amazon API Gateway that will be consumed by external client applications. The clients authenticate against a third-party Identity Provider (IdP) that is not compatible with Amazon Cognito, receiving a custom JSON Web Token (JWT) that includes specific scopes in the payload. The REST API must authorize access to resources based on these scopes and forward the verified user identity metadata to a backend Lambda function using a Lambda proxy integration. The developer wants to implement a solution that minimizes both authorization latency and cost. Which configuration should the developer implement to meet these requirements?

Configure the API Gateway integration to use a Lambda custom integration with a request mapping template that forwards the custom JWT. Perform the JWT validation and policy evaluation directly inside the backend Lambda function, caching the validation results in an Amazon ElastiCache cluster to minimize authorization latency on subsequent requests.

Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Configure a Cognito User Pool authorizer in API Gateway, and link it to an Amazon Cognito Identity Pool that federates with the third-party Identity Provider. Retrieve the custom scopes and user identity metadata from the requestContext.authorizer.claims object in the backend Lambda function, and configure API Gateway caching on the client's IAM role.

Configure a Cognito User Pool authorizer in API Gateway to validate the custom JWT. Set the authorizer's Identity Source to the Authorization header, and configure a custom Lambda integration mapping template to extract the third-party JWT and exchange it for an IAM policy before executing the backend Lambda function.

Show answer & explanation

Answer: Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Answer

The correct solution uses an API Gateway Lambda authorizer to validate the third-party JWT. Because the token is not issued by Amazon Cognito, a built-in Cognito authorizer cannot be used. By setting an Identity Source (such as the Authorization header), API Gateway caches the generated IAM policy, preventing downstream invocations of the authorizer Lambda function on subsequent calls with the same token. Additionally, return values in the context object from the authorizer are forwarded to the backend Lambda function under requestContext.authorizer, satisfying the requirement to pass user metadata securely while keeping backend processing optimized.

Step-by-Step Solution

Create and deploy a Lambda authorizer function that receives the third-party JWT, validates its cryptographic signature against the IdP's public keys, and inspects the payload claims for valid scopes.

The Lambda function is ready to return an IAM policy document and a custom context object containing user metadata.

API Gateway requires a custom Lambda authorizer to inspect and validate third-party tokens since built-in Cognito authorizers only validate Cognito-issued tokens.

Configure the API Gateway REST API to use the Lambda authorizer, set the authorization caching TTL, and specify the Identity Source (such as method.request.header.Authorization).

API Gateway caches the policy document returned by the authorizer for matching tokens, avoiding repeated invocations of the authorizer function.

Caching reduces API latency and reduces the cost of running the authorizer Lambda function on every API request.

Map the required user identity claims to the context object returned by the Lambda authorizer, and use Lambda Proxy Integration for the backend integration.

The backend Lambda function receives the mapped metadata in the requestContext.authorizer object of the incoming event.

Using the context object allows passing validated client metadata to the backend Lambda function securely without requiring the backend function to parse or re-validate the token.

Key Concept

Using API Gateway Lambda authorizers to validate third-party JSON Web Tokens (JWTs) and caching the authorization policy response to minimize backend invocations.

Estimated Time:2m 0s

Question 63Question →

A developer manages a production application stack deployed via AWS CloudFormation. The stack consists of an Amazon RDS DB instance and an Auto Scaling group of Amazon EC2 instances. During a recent deployment, a stack update failed while attempting to modify the DB instance parameters, and the subsequent automatic rollback also failed, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to update the launch template of the Auto Scaling group to apply a critical security patch immediately without deleting the existing stack or losing DB instance data. How can the developer successfully apply the launch template update to the stack?

Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.

Initiate a new stack update using the `update-stack` command with the `--force` flag to bypass the failed rollback state and overwrite the Auto Scaling group configurations.

Execute the `rollback-stack` command to manually force the stack to return to the last known stable state of `CREATE_COMPLETE`, and then run the update command for the Auto Scaling group.

Perform drift detection on the stack to identify the mismatched RDS configuration, then execute the `resolve-drift` command to automatically align the stack state and reset the status to `UPDATE_ROLLBACK_COMPLETE`.

Show answer & explanation

Answer: Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.

Answer

The correct answer is to run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. When a CloudFormation stack update fails and the rollback also fails, the stack enters the `UPDATE_ROLLBACK_FAILED` state. To perform further updates, the developer must get the stack into a stable state. By continuing the update rollback and skipping the failing DB instance resource, CloudFormation can successfully roll back the rest of the stack, transitioning it to the `UPDATE_ROLLBACK_COMPLETE` state. Once in this stable state, the developer can initiate the stack update for the Auto Scaling group.

Step-by-Step Solution

Identify the resource causing the rollback failure (the Amazon RDS DB instance) and execute the `continue-update-rollback` command (or use the console equivalent).

The stack bypasses the failed rollback of the DB instance and rolls back the other resources successfully.

This is necessary because a stack in the `UPDATE_ROLLBACK_FAILED` state cannot be updated directly; it must first reach a stable state.

Wait for the stack status to transition from `UPDATE_ROLLBACK_FAILED` to `UPDATE_ROLLBACK_COMPLETE`.

The stack enters a stable, updatable state.

CloudFormation only allows stack updates when the stack is in a stable status such as `UPDATE_ROLLBACK_COMPLETE` or `CREATE_COMPLETE`.

Perform the stack update using the template containing the modified launch template configuration for the Auto Scaling group.

The Auto Scaling group is updated successfully with the critical security patch.

This applies the required changes to the Auto Scaling group now that the stack is in an updatable state.

Key Concept

Handling CloudFormation stack updates and failures by using the ContinueUpdateRollback action to skip failing resources and return the stack to a stable state.

Question 64Question →

An enterprise application utilizes a release pipeline in AWS CodePipeline to automate deployments. The pipeline has a source stage in a development AWS account and must deploy a containerized application to an Amazon ECS cluster located in a separate production AWS account. During execution, the Deploy stage fails when trying to invoke the deployment action in the production account, returning an access denied error when attempting to assume the target role.

Which configuration is necessary to successfully authorize this cross-account deployment?

Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.

Add a permissions policy statement to the target IAM role in the production account allowing the sts:AssumeRole action for the development pipeline's IAM role, without modifying its trust policy.

Create a secure string parameter in AWS Systems Manager Parameter Store containing the production account's credentials, enable automatic rotation, and inject them into the deployment stage.

Update the Amazon ECS Task Execution Role in the production account to grant the pipeline's service role direct permissions to deploy the container image.

Show answer & explanation

Answer: Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.

Answer

Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.

For AWS CodePipeline to perform deployments in a separate AWS account, it must assume an IAM role inside that target account. For the role assumption to succeed, the trust policy (assume role policy) of the target IAM role must be configured to trust the pipeline's IAM role in the source account, granting it the sts:AssumeRole permission.

Step-by-Step Solution

Identify the authentication failure context.

The failure occurs during a cross-account deployment stage when the source account's CodePipeline attempts to assume the target IAM role in the production account.

AWS CodePipeline requires cross-account role delegation using AWS Security Token Service (STS) to deploy across accounts.

Determine where the delegation of trust is configured.

The trust must be established on the target resource (the production IAM role) to allow assumption by the source entity.

An IAM role's trust policy dictates which external AWS accounts or IAM principals are permitted to assume it.

Modify the target role's trust policy.

Add the ARN of the development pipeline's IAM role (or the development account root) to the principal element of the production role's trust policy with the sts:AssumeRole action.

This establishes a secure cryptographic trust chain between the two AWS accounts.

Key Concept

Cross-Account Access in AWS CodePipeline via STS AssumeRole

Question 65Question →

A developer is configuring an AWS Step Functions state machine to orchestrate a serverless workflow. The state machine needs to invoke an AWS Lambda function and publish execution status updates to an Amazon SNS topic. During testing, the state machine execution fails with an IAM authorization error. Which of the following configurations are required to resolve this issue and grant the state machine the necessary permissions? (Select TWO.)

Select all that apply

Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.

Configure the Step Functions execution role's trust policy to trust the `lambda.amazonaws.com` and `sns.amazonaws.com` service principals.

Attach an IAM role to the Lambda function and the SNS topic, and configure their trust policies to allow the `states.amazonaws.com` service principal to assume them.

Embed temporary AWS access credentials inside the Step Functions state machine definition parameters to authenticate the Lambda and SNS API requests.

Show answer & explanation

Answer: Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.

Answer

To resolve the authorization issue, you must configure a trust policy on the Step Functions execution role allowing the `states.amazonaws.com` service principal to perform `sts:AssumeRole`, and attach a permissions policy to that execution role that allows the `lambda:InvokeFunction` and `sns:Publish` actions on the target resource ARNs.

AWS Step Functions must assume an IAM role to perform tasks like invoking Lambda functions or publishing messages to SNS. For the service to assume this role, the trust policy must explicitly allow the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action. Additionally, the role itself must be granted permissions via an attached permissions policy to perform `lambda:InvokeFunction` and `sns:Publish` on the specific resources.

Step-by-Step Solution

Determine the executing principal that requires access.

The executing principal is the AWS Step Functions service (`states.amazonaws.com`).

Step Functions requires an IAM execution role to make API calls to other AWS resources on behalf of the user.

Establish the trust relationship for the execution role.

Add a trust policy to the role allowing `states.amazonaws.com` to call `sts:AssumeRole`.

Without this trust policy, the Step Functions service cannot assume the role to retrieve temporary security credentials.

Define the resource permissions for the execution role.

Attach an identity-based permissions policy granting `lambda:InvokeFunction` and `sns:Publish` on the respective ARNs.

Once the role is assumed, Step Functions must have the explicit authorization to perform the required actions on the target resources.

Key Concept

Configuring IAM execution roles requires establishing a trust policy that permits the calling service principal to assume the role, combined with a permissions policy that grants the role access to perform actions on specific resources.

Question 66Question →

A developer is building a classroom management application that tracks student assignment submissions. The application stores submission records in an Amazon DynamoDB table. The base table has a partition key of `ClassId` and a sort key of `StudentId_AssignmentId`. The developer needs to retrieve all submissions for a specific class that were submitted after a certain date, sorted by submission date, while minimizing Read Capacity Unit (RCU) consumption.

Which TWO actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Create a local secondary index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key.

Use the Query operation on the local secondary index (LSI) with a key condition expression for ClassId and SubmissionTimestamp.

Use the Scan operation on the base table with a filter expression on the SubmissionTimestamp attribute.

Use the Query operation on the base table and apply a filter expression on SubmissionTimestamp.

Increase the provisioned read capacity units (RCUs) of the base table to prevent read throughput exceptions during the retrieval process.

Show answer & explanation

Answer: Create a local secondary index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key.; Use the Query operation on the local secondary index (LSI) with a key condition expression for ClassId and SubmissionTimestamp.

Answer

To retrieve submissions efficiently while minimizing RCU consumption, the developer should create a local secondary index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key, and then use the Query operation on this index with a key condition expression specifying both ClassId and SubmissionTimestamp.

Creating a local secondary index (LSI) sharing the same partition key (ClassId) but using SubmissionTimestamp as the sort key allows the application to perform a Query operation. By querying the LSI with a key condition expression for the class and the timestamp range, DynamoDB only reads the matching items, minimizing the Read Capacity Units (RCUs) consumed and returning the results pre-sorted by the sort key.

Step-by-Step Solution

Analyze the access pattern and base table schema.

The base table partition key is ClassId and the sort key is StudentId_AssignmentId. Querying by ClassId alone requires reading all student assignments for that class, which is inefficient when only filtering by date.

To minimize RCU consumption, we must ensure we only read the records that match our filter criteria.

Identify the indexing strategy to support the date query.

Since we need to query within a specific ClassId (the partition key), we can create a Local Secondary Index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key.

An LSI allows us to use the same partition key as the base table but sort and query by a different attribute.

Select the appropriate DynamoDB operation to retrieve the data.

Perform a Query operation on the LSI using a key condition expression specifying ClassId and a comparison operator on SubmissionTimestamp.

Query operations on indexes with key condition expressions only read and consume RCUs for the items that meet the criteria, unlike Scan operations or post-query filters.

Key Concept

Optimizing DynamoDB retrieval using Local Secondary Indexes (LSI) and Query operations instead of Scan or filter expressions on non-key attributes.

Estimated Time:1m 30s

Question 67Question →

A developer is configuring a backend microservice running on AWS Lambda within a custom VPC. The Lambda function must connect to a private Amazon Aurora PostgreSQL database in the same VPC and retrieve secure configurations from AWS Systems Manager Parameter Store. The company's security policy strictly prohibits internet gateways and NAT gateways. The developer sets up an Interface VPC Endpoint for Systems Manager. Which two configurations must the developer implement to secure this traffic and establish connectivity? (Select TWO.)

Select all that apply

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function.

Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

Add a route in the private subnet route table pointing destination

0.0.0.0/0

to the Systems Manager VPC Endpoint network interface.

Configure the private subnet's Network Access Control List (NACL) to allow inbound traffic from the database, relying on the stateful nature of NACLs to permit return traffic.

Modify the Lambda execution role's trust policy to allow the Systems Manager service endpoint (ssm.amazonaws.com) to assume the role.

Show answer & explanation

Answer: Configure the database's security group to allow inbound TCP traffic on port $5432$ from the security group assigned to the Lambda function.; Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port $443$ ) traffic from the security group assigned to the Lambda function.

Answer

Configure the database's security group to allow inbound TCP traffic on port

5432

from the security group assigned to the Lambda function, and configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port

443

) traffic from the security group assigned to the Lambda function.

The database security group must allow inbound PostgreSQL traffic (port

5432

) from the Lambda function's security group. Interface VPC endpoints use security groups to control incoming traffic; therefore, the Systems Manager endpoint's security group must permit inbound HTTPS (port

443

) traffic from the Lambda function's security group. Since security groups are stateful, configuring these inbound rules automatically allows the corresponding outbound/return traffic.

Step-by-Step Solution

Analyze database connectivity requirements.

Identify that the Lambda function must connect to Aurora PostgreSQL on port

5432

To authorize this traffic, the database's security group must permit inbound traffic from the source (the Lambda function's security group).

Analyze Systems Manager Parameter Store connectivity requirements.

Identify that the Lambda function must connect to Systems Manager via an Interface VPC Endpoint using HTTPS on port

443

To authorize this traffic, the endpoint's security group must allow inbound traffic from the Lambda function's security group.

Evaluate security group statefulness.

Recognize that because security groups are stateful, return traffic is automatically allowed once the inbound/outbound connection is established.

This eliminates the need to configure ephemeral port rules on the security groups.

Key Concept

VPC security controls (Security Groups, NACLs, and Interface VPC Endpoints) for private AWS service integrations.

Estimated Time:2m 30s

Question 68Question →

A company is developing a fitness tracking mobile application. The application needs to access a REST API hosted on Amazon API Gateway to retrieve user workout histories. The development team wants to implement an authorization mechanism that allows users to authenticate using their existing email and password credentials, validates their JSON Web Tokens (JWTs) directly at the API Gateway level without invoking a custom Lambda function, and extracts user identity claims for backend processing. Which configuration should the developer implement to meet these requirements with the lowest latency and operational overhead?

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Configure an Amazon Cognito Identity Pools authorizer directly on the API Gateway REST API.

Implement a custom Lambda authorizer that fetches public keys from the Cognito User Pool to validate the JWT.

Configure API Gateway with Lambda Proxy integration to inspect and validate the JWT inside the backend integration function.

Show answer & explanation

Answer: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Answer

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

The correct configuration is to use the built-in Amazon Cognito User Pools authorizer. This option integrates directly with the user pool to authenticate and validate the signature of incoming JWT tokens without invoking custom Lambda code. Once validated, user claims are automatically populated into the request context and sent to the backend integration, providing a highly optimized, low-overhead solution.

Step-by-Step Solution

Analyze the requirements for user authentication, token validation, and latency control.

The solution requires user directory authentication (username/password), token validation at the API Gateway edge without executing custom code, and access to identity claims in backend integrations.

This establishes that the solution must use a native API Gateway mechanism rather than custom authorizer code.

Select the appropriate Amazon Cognito feature for user directories.

Cognito User Pools provides the directory and authentication flow, returning JWT tokens containing claims.

Cognito Identity Pools provides temporary AWS credentials instead of user authentication directory features.

Configure the native API Gateway authorizer that integrates directly with the Cognito User Pool.

Configuring a Cognito User Pools authorizer on the API Gateway REST API allows native verification of the JWT signature and expiration, and automatically passes the claims via the integration request context.

This provides the lowest latency and requires no custom code maintenance, satisfying all requirements.

Key Concept

API Gateway Cognito User Pools Authorizer

Question 69Question →

A developer is deploying a microservice on Amazon ECS using AWS Fargate that connects to an Amazon Aurora PostgreSQL database. The application must retrieve a database endpoint (non-sensitive configuration) and a database password (sensitive credential). The database password must be automatically rotated every 30 days. The microservice handles a very high volume of requests, so the developer must design a solution that prevents database connection failures after rotation, avoids API throttling errors, and minimizes costs. Which approach should the developer take to retrieve and manage these configurations?

Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Store both the database endpoint and the password as standard parameters in Systems Manager Parameter Store. Enable parameter policies to automatically rotate the password parameter every 30 days, and retrieve both values inside the microservice code on every request using the AWS SDK.

Store both the database endpoint and the database password in AWS Secrets Manager. Initialize the Secrets Manager SDK client in the microservice code by passing hardcoded IAM access keys and secret keys of a dedicated IAM user to bypass IAM role credential retrieval latency.

Store the database endpoint in Systems Manager Parameter Store and the database password in AWS Secrets Manager. Reference both the parameter and the secret in the ECS task definition as environment variables, allowing the containerized application to read them directly from the local environment.

Show answer & explanation

Answer: Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Answer

The correct strategy combines Systems Manager Parameter Store for non-sensitive configurations and AWS Secrets Manager for sensitive credentials that need automatic rotation. Under high-throughput environments, fetching credentials on every request will cause API throttling. Caching values locally with a Time-to-Live (TTL) ensures low latency and avoids API rate limiting, while the TTL expiration guarantees that the microservice eventually fetches the new password after an automatic rotation, avoiding database connection issues.

Step-by-Step Solution

Determine the appropriate storage service for each configuration type.

The database endpoint is non-sensitive configuration data, which is most cost-effective to store in Systems Manager Parameter Store. The database password is a sensitive credential requiring automatic rotation, making AWS Secrets Manager the correct choice.

Parameter Store does not charge for standard parameters, while Secrets Manager charges $0.40 per secret per month but supports automatic rotation natively.

Configure the rotation mechanism for the database password.

Enable automatic rotation in Secrets Manager, which uses an AWS Lambda function to update the database password in both Secrets Manager and the Aurora database.

This ensures the credentials remain secure without manual intervention.

Implement a caching strategy inside the microservice application code.

Use the AWS SDK to retrieve the parameters, and cache the values in memory with a reasonable Time-to-Live (TTL). When the TTL expires, the microservice makes a fresh call to the AWS APIs to refresh the cache.

Caching avoids API throttling (ProvisionedThroughputExceededException) and minimizes retrieval latency. The TTL ensures that warm containers periodically refresh their cached credentials, preventing connection failures after a rotation occurs.

Key Concept

Selecting and integrating AWS Secrets Manager and Systems Manager Parameter Store with caching to support credentials rotation in high-throughput applications.

Question 70Question →

A developer is planning the deployment strategy for a critical web application hosted on AWS Elastic Beanstalk. The application is highly sensitive to performance degradation, so the deployment process must maintain $100\%$ of the existing instance capacity at all times. Additionally, if the new version fails post-deployment tests, the developer must be able to roll back to the previous version almost instantly. Which two Elastic Beanstalk deployment strategies or methods will satisfy these requirements? (Select two.)

Select all that apply

Immutable deployment

Blue/Green deployment via environment URL swap

Rolling deployment

Rolling with additional batch deployment

All-at-once deployment

Show answer & explanation

Answer: Immutable deployment; Blue/Green deployment via environment URL swap

Answer

Immutable deployment and Blue/Green deployment via environment URL swap

Immutable deployments and Blue/Green deployments via environment URL swapping both maintain

100\%

of the existing application capacity during deployment. They also provide a rapid rollback path: immutable deployments roll back by terminating the new Auto Scaling group, while Blue/Green deployments roll back by swapping the CNAME records back.

Step-by-Step Solution

Analyze the capacity requirement.

The application must maintain

100\%

of its existing capacity during the deployment. This eliminates strategies that take instances offline without replacing them first, such as rolling and all-at-once.

To prevent performance degradation during the deployment window.

Evaluate the rollback requirements.

The deployment must support a rapid, near-instant rollback in case of failure. This rules out rolling with additional batch, which requires a new rolling deployment of the older version to revert.

To minimize the duration of any potential outage or failure.

Identify the compliant strategies.

Immutable deployments maintain capacity by launching a parallel Auto Scaling group and roll back instantly by terminating it. Blue/Green deployments maintain capacity in a separate environment and roll back instantly by swapping the CNAMEs back.

Both strategies meet the full capacity and near-instant rollback constraints.

Key Concept

Evaluating Elastic Beanstalk deployment policies based on capacity and rollback speed trade-offs.

Estimated Time:1m 30s

Question 71Question →

A developer is deploying a containerized API to AWS App Runner. The application needs to retrieve credentials for a backend Amazon Aurora MySQL database, which must be rotated automatically every 45 days. Additionally, the application requires access to 50 non-sensitive configuration parameters, such as service endpoints and logging levels, which are updated frequently. The developer wants to implement a secure, cost-effective architecture.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.

Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Store both the database credentials and the non-sensitive configuration parameters in AWS Secrets Manager to simplify client-side SDK integration.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, and write a custom EventBridge rule to trigger rotation.

Configure the App Runner service environment variables to host the database credentials directly to minimize API call latency.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.; Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Answer

The correct combination is to store the database credentials in AWS Secrets Manager with built-in Lambda automatic rotation, and store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as standard parameters.

The correct solution uses AWS Secrets Manager for the database credentials because Secrets Manager natively supports automatic rotation using built-in Lambda templates. It uses AWS Systems Manager Parameter Store (standard parameters) for the non-sensitive parameters because standard parameters are free, ensuring the overall architecture is cost-effective.

Step-by-Step Solution

Analyze credential security and rotation requirements.

Identify that the Aurora database credentials require security and automated rotation every 45 days. AWS Secrets Manager is the optimal service here because it offers out-of-the-box rotation support using Lambda templates specifically integrated with RDS/Aurora.

Ensures credentials are secure and rotated without custom scripting overhead.

Analyze non-sensitive configuration requirements and cost constraints.

Identify that logging levels and service endpoints are non-sensitive and numerous (50 parameters). Storing them in AWS Systems Manager Parameter Store as standard parameters is free, satisfying the cost-efficiency constraint.

Minimizes unnecessary Secrets Manager charges for non-sensitive data.

Key Concept

Secrets Manager vs Systems Manager Parameter Store

Estimated Time:2m 0s

Question 72Question →

A developer is designing a microservice that processes sensitive transaction payloads of approximately $1.5\text{ MB}$ each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

Call the Encrypt API operation directly, passing the payload and the customer managed key identifier, then store the resulting ciphertext in the database.

Store the transaction payloads directly in AWS Systems Manager Parameter Store as SecureString parameters, configuring Parameter Store to use the KMS customer managed key for encryption.

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain an encrypted data key. Decrypt the key locally using a client-side cryptographic library, use it to encrypt the payload, and discard the key.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Answer

For data larger than

4\text{ KB}

, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the

1.5\text{ MB}

payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Step-by-Step Solution

Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.

The transaction payload is

1.5\text{ MB}

, which exceeds the

4\text{ KB}

limit of the direct KMS Encrypt API.

KMS direct encryption cannot process payloads larger than

4\text{ KB}

, requiring the use of envelope encryption.

Evaluate the options for envelope encryption using AWS KMS APIs.

Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.

GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.

Complete the envelope encryption workflow locally on the client.

The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.

This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Key Concept

KMS Envelope Encryption and API Limits

Question 73Question →

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline is hosted in Account A and is designed to deploy a serverless application to Account B using AWS CloudFormation. The pipeline uses an Amazon S3 bucket in Account A to store pipeline artifacts. The deployment action in the Deploy stage fails with an error indicating that the CloudFormation role in Account B cannot access the deployment artifacts in the S3 bucket in Account A. The S3 bucket is currently encrypted using the default AWS managed key (aws/s3). Which configuration change is required to resolve this issue and allow successful deployment?

Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.

Modify the trust policy of the CloudFormation execution role in Account B to directly allow the AWS CodePipeline service principal (codepipeline.amazonaws.com) to assume the role, and attach an inline policy to the role allowing S3 read actions on the Account A bucket.

Configure the pipeline to store the build artifacts and deployment templates in AWS Systems Manager Parameter Store as SecureString parameters, and configure the CloudFormation action in Account B to retrieve them.

Move the buildspec.yml file in the source repository from the root directory to the subdirectory containing the CloudFormation templates, and specify this new path in the CodePipeline deploy action settings.

Show answer & explanation

Answer: Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.

Answer

For cross-account deployments in AWS CodePipeline, the deployment action in the target account must access the artifact S3 bucket in the source account. When using KMS encryption for the S3 bucket, you cannot use the default AWS-managed key (aws/s3) because its key policy cannot be modified to grant access to external accounts. A Customer Managed Key (CMK) must be created in the source account, and its key policy, along with the S3 bucket policy, must grant permissions to the target account's deployment role. The target role must also have permission to decrypt using that KMS key.

Step-by-Step Solution

Identify the cause of the cross-account S3 access failure.

The S3 bucket uses the default AWS-managed key (aws/s3) for encryption, which cannot be shared across different AWS accounts.

AWS-managed KMS keys do not allow modifications to their key policies to trust other AWS accounts.

Create and configure a Customer Managed Key (CMK) in AWS KMS.

A CMK is created in Account A with a key policy that allows the CloudFormation execution role in Account B to perform kms:Decrypt actions.

A Customer Managed Key allows policy customization, making it possible to grant cross-account decryption capabilities.

Update the S3 bucket policy and associate the CMK with the S3 bucket.

The S3 bucket in Account A is configured to use the new CMK, and its bucket policy is updated to allow S3 read actions (s3:GetObject, s3:GetBucketLocation) from the CloudFormation role in Account B.

Both the KMS key policy and the S3 bucket policy must allow cross-account access for the target role to successfully retrieve the artifacts.

Key Concept

Cross-account AWS CodePipeline S3 artifact access using KMS Customer Managed Keys (CMK)

Question 74Question →

A developer is designing a secure serverless backend where a single-page application (SPA) needs to access a REST API hosted on Amazon API Gateway. Users authenticate using Amazon Cognito User Pools. The developer needs to implement authorization such that standard users can only invoke the GET methods on /items resources, while administrative users (members of the 'Admins' Cognito group) can invoke any method on /items and /admin resources. Which two configuration steps should the developer perform to implement this authorization model?

Select all that apply

Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.

Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Configure a Cognito User Pool Authorizer on the API Gateway resources. In the API Gateway console, use the OAuth Scopes configuration to map the Cognito user groups directly to the corresponding HTTP methods and resource paths of the REST API.

Configure an Amazon Cognito Identity Pool as the API Gateway Authorizer. Send the Cognito ID token in the authorization header, and configure API Gateway to automatically map the token's claims to IAM policy permissions on the backend integration.

Enable AWS_IAM authorization on the API Gateway. Configure the API to use a Lambda Proxy integration, and write logic inside the backend Lambda integration function to query the Amazon Cognito User Pool to retrieve user groups and return a 403 Forbidden status code if unauthorized.

Show answer & explanation

Answer: Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.; Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Answer

To implement group-based authorization on API Gateway with Cognito User Pools, the developer can either use AWS_IAM authorization with Cognito Identity Pools and group-to-role mapping, or implement a Lambda Authorizer that inspects the 'cognito:groups' claim in the JWT and dynamically generates an IAM policy.

The correct options represent the two main architectures for implementing group-based access control in API Gateway. Using AWS_IAM authorization with Cognito Identity Pools maps User Pool groups to distinct IAM roles, letting API Gateway natively enforce authorization via SigV4 signed requests. Using a Lambda Authorizer allows developers to decode the JWT, inspect the 'cognito:groups' claim, and dynamically return an IAM policy allowing or denying access to specific routes.

Step-by-Step Solution

Identify the authorization requirements.

The system needs to restrict API access based on Cognito groups, which requires mapping groups to specific API paths and methods.

This establishes the scope and logic needed for the authorization policy.

Evaluate the AWS_IAM and Cognito Identity Pool approach.

By mapping user groups to different IAM roles via Cognito Identity Pools, the client can sign requests with SigV4, allowing API Gateway to evaluate permissions natively via IAM policies.

This offloads authorization logic to native AWS features, minimizing custom development.

Evaluate the custom Lambda Authorizer approach.

A Lambda Authorizer can verify the Cognito JWT signature, parse the 'cognito:groups' claim, and dynamically generate an IAM policy based on group membership.

This is standard when the client uses bearer tokens and avoids SigV4 request signing.

Key Concept

Fine-grained API Gateway authorization using Cognito groups, IAM policies, and Lambda Authorizers

Question 75Question →

A developer is preparing a source bundle to deploy a web application to AWS Elastic Beanstalk. The developer wants to include configuration files that install additional software packages and define system environment variables. In which directory must these configuration files be placed to ensure Elastic Beanstalk processes them during deployment?

A folder named ebextensions without a leading dot at the root level of the application source bundle

A folder named .elasticbeanstalk at the root level of the application source bundle

A folder named .ebextensions at the root level of the application source bundle

A folder named .ebextensions nested inside the primary source code directory, such as src/

Show answer & explanation

Answer: A folder named .ebextensions at the root level of the application source bundle

Answer

A folder named .ebextensions at the root level of the application source bundle

The correct answer specifies placing files in a directory named .ebextensions at the root level of the application source bundle. AWS Elastic Beanstalk automatically looks for configuration files with a .config extension inside this directory during deployment to customize the environment's resource configuration.

Step-by-Step Solution

Identify the mechanism Elastic Beanstalk uses for custom configuration files.

Elastic Beanstalk relies on YAML or JSON configuration files (ending in .config) to configure the environment.

This allows developers to define packages, services, files, and commands to run on the EC2 instances.

Determine the required naming convention and location for these files.

The configuration files must be stored within a directory named .ebextensions, which must be located at the root of the application source bundle.

Elastic Beanstalk only parses configuration files that are situated in this specific root folder.

Key Concept

AWS Elastic Beanstalk Custom Configurations (.ebextensions)

Question 76Question →

A developer is designing a security architecture for a native mobile application. The application must support user authentication using a corporate SAML 2.0 Identity Provider (IdP). Once authenticated, the application needs to:

1. Upload documents directly to a tenant-specific folder in an Amazon S3 bucket, where the folder name corresponds to the user's Cognito identity ID.
2. Invoke an Amazon API Gateway REST API, where access must be restricted based on the user's group membership (such as 'Finance' or 'Engineering') mapped from the corporate IdP. The authorization decision must be evaluated at the API Gateway layer without invoking a custom AWS Lambda function for token validation, to minimize latency and operational overhead.

Which architectural design meets these requirements while adhering to the principle of least privilege?

Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the trust policies of the assumed IAM roles to trust the API Gateway service principal.

Configure an Amazon Cognito Identity Pool to federate directly with the SAML IdP. Configure the mobile client to retrieve temporary AWS credentials from the Identity Pool and use them to obtain a JSON Web Token (JWT) directly from the Identity Pool. Secure the API Gateway REST API using a Cognito User Pool Authorizer to validate this JWT.

Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.

Configure an Amazon Cognito User Pool federated with the SAML IdP. Secure the API Gateway REST API using a custom Lambda Authorizer. Configure the Lambda Authorizer to receive the Cognito ID token, call the Cognito IDP GetUser API on every request to verify the token signature, and extract the group attributes to generate the IAM policy.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.

The correct solution leverages Cognito User Pools for federating the SAML IdP and mapping group claims, and uses Cognito Identity Pools to assign distinct IAM roles based on those groups. By securing API Gateway with AWS_IAM, the mobile client signs requests using SigV4 credentials, allowing API Gateway to perform native IAM evaluation without invoking a custom Lambda function. This approach satisfies both the S3 upload requirement and the low-latency API authorization requirement while adhering to least-privilege principles.

Step-by-Step Solution

Authenticate users via the Amazon Cognito User Pool federated with the corporate SAML IdP.

The user is authenticated and the mobile client receives a Cognito User Pool ID token containing SAML group attributes mapped to Cognito groups.

Allows integration with the corporate identity store while standardizing identity tokens.

Exchange the ID token for temporary AWS credentials using the Cognito Identity Pool.

The Identity Pool evaluates the user's group to the corresponding IAM role (such as Finance or Engineering) based on token claims and returns temporary credentials.

Enables fine-grained AWS role mapping and authorizes direct S3 bucket folder uploads using the identity ID context.

Secure the API Gateway REST API with AWS_IAM authorization and configure the client to sign API requests.

API Gateway natively evaluates the permissions policy attached to the caller's assumed IAM role without calling custom authorization code.

Provides low-latency, zero-custom-code authorization at the gateway layer.

Key Concept

Integrating Amazon Cognito User Pools, Cognito Identity Pools, and AWS IAM to achieve secure role-based access control and fine-grained authorization for S3 and API Gateway.

Estimated Time:3m 0s

Question 77Question →

A developer is designing a cross-platform client application that requires user sign-up, sign-in, and group-based access control. The backend services are hosted on Amazon ECS tasks running behind an Application Load Balancer (ALB). The developer wants to authenticate users and offload the verification of authentication tokens from the ECS tasks to the ALB. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership.

Configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.

Configure an Amazon Cognito Identity Pool to authenticate the users and generate temporary AWS credentials to authorize the Application Load Balancer listener.

Deploy an AWS Lambda function as a custom authorizer on the Application Load Balancer to decode and validate the Cognito user tokens manually.

Modify the IAM trust policy of the Amazon ECS Task Execution Role to allow the Cognito User Pool service principal to assume the role.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership.; Configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.

Answer

Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership, and configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.

To authenticate application users and offload token verification from Amazon ECS tasks to the Application Load Balancer, the developer must set up an Amazon Cognito User Pool for managing identities and configure the ALB listener rule to authenticate requests using Cognito. The ALB handles the authentication flow with the User Pool natively and forwards the user information in headers, securing the backend application without custom authentication logic.

Step-by-Step Solution

Set up the user directory and authentication flow.

An Amazon Cognito User Pool is created to handle user sign-up, sign-in, and manage user groups.

Cognito User Pools serve as the identity provider for authentication.

Configure the ALB listener to intercept and validate user traffic.

The Application Load Balancer listener rule is configured with an authenticate-cognito action pointing to the Cognito User Pool.

This offloads token verification from the ECS backend tasks to the load balancer, which then forwards user identity claims to the target ECS containers.

Key Concept

Offloading user authentication and validation to an Application Load Balancer using Amazon Cognito User Pools.

Question 78Question →

An application running on Amazon ECS container instances in Account A needs to decrypt sensitive data files stored in an Amazon S3 bucket. The files are encrypted using an AWS KMS Customer Managed Key (CMK) located in Account B. The developer needs to configure the permissions to allow the application to decrypt these files.

Which of the following actions must be taken to grant the application the required permissions? (Choose two.)

Select all that apply

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.

In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account A, attach an IAM policy to the ECS task execution role that allows the kms:Decrypt action on the KMS key ARN in Account B.

In Account B, update the S3 bucket policy to grant kms:Decrypt permissions to the application's IAM task role in Account A.

In Account A, retrieve the KMS Customer Managed Key plaintext key material and store it as a SecureString in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.; In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Answer

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A; and in Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Cross-account access to KMS keys requires validation at both the resource level and the identity level. First, the key policy of the Customer Managed Key in Account B must be configured to trust the external account or role. Second, the IAM policy in the application's account (Account A) must grant the application's IAM role permission to call the KMS API. Because the application logic runs within ECS containers, these permissions must be applied to the ECS Task Role.

Step-by-Step Solution

Differentiate between the ECS task role and the ECS task execution role.

Identify that the application container uses the ECS Task Role for application-level AWS API calls (such as KMS decryption), whereas the Task Execution Role is for container agent operations.

This prevents assigning permissions to the wrong IAM role.

Configure the key-level permissions in the KMS key owner's account (Account B).

Update the KMS key policy in Account B to delegate decrypt permissions to the IAM task role ARN from Account A.

AWS KMS requires the key policy to explicitly allow cross-account access, as identity-based IAM policies in the external account are not sufficient on their own.

Configure the identity-level permissions in the application's account (Account A).

Attach an IAM policy to the ECS Task Role in Account A allowing the kms:Decrypt action on the target KMS key ARN.

For cross-account access, permissions must be allowed on both the resource policy (key policy) and the identity policy (IAM policy).

Key Concept

Cross-Account KMS Key Access and ECS Task Roles

Estimated Time:2m 0s

Question 79Question →

A developer is deploying an AWS Lambda function that must connect to an Amazon ElastiCache (Redis OSS) cluster. The ElastiCache cluster is running in the private subnets of a custom VPC. The Lambda function does not need access to the public internet or external APIs. Which of the following configuration steps must the developer perform to establish secure network connectivity between the Lambda function and the ElastiCache cluster? (Select TWO.)

Select all that apply

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.

Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Provision a NAT Gateway in the private subnet and update the subnet route tables to route ElastiCache traffic through it.

Modify the Lambda function's IAM execution role trust policy to allow the ElastiCache service to assume the role.

Store the ElastiCache security group ID in AWS Secrets Manager to automatically authorize traffic and bypass security group checks.

Show answer & explanation

Answer: Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.; Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Answer

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group, and configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

To allow the Lambda function to reach the ElastiCache cluster, the Lambda function must first be attached to the same VPC. This is done by configuring VPC access on the Lambda function, which deploys ENIs in the specified private subnets. Second, since security groups are stateful and deny all inbound traffic by default, the ElastiCache security group must be updated to allow inbound TCP traffic on the Redis port from the security group associated with the Lambda function.

Step-by-Step Solution

Enable VPC access for the Lambda function.

The Lambda function is assigned Elastic Network Interfaces (ENIs) in the specified private subnets, enabling it to reach resources inside the VPC.

By default, Lambda functions run in an AWS-managed network that cannot directly communicate with private subnets inside a custom VPC.

Configure the database security group.

The stateful firewall allows incoming network connections from the Lambda function's security group on the specific Redis database port.

Security groups deny all inbound traffic by default, so you must explicitly authorize access from the client's security group.

Key Concept

To enable secure communication between an AWS Lambda function and an internal VPC resource (like ElastiCache), the Lambda function must be associated with the private subnets of the VPC, and the destination security group must explicitly allow inbound traffic from the Lambda function's security group. Internal VPC communication uses local routes and does not require a NAT Gateway.

Question 80Question →

A developer is building a multi-region active-active web application deployed across `us-east-1` and `us-west-2` using AWS Lambda. The application must securely retrieve a database credential that requires automatic rotation every $30$ days, as well as a region-specific database connection endpoint URL that is non-sensitive. The solution must minimize cross-region latency for credential retrieval and optimize cost. Which combination of services and configuration should the developer use to meet these requirements?

Store the database credential as a SecureString parameter in AWS Systems Manager Parameter Store in `us-east-1` with cross-region replication enabled. Store the connection endpoint URL in AWS Secrets Manager as a secret replicated to `us-west-2`.

Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.

Store both the database credential and the connection endpoint URL in a single secret in AWS Secrets Manager in `us-east-1`, replicate it to `us-west-2`, and hardcode AWS IAM access keys in the Lambda function code to decrypt and retrieve the secret across regions.

Store the database credential in AWS Secrets Manager in `us-east-1` and write a custom Lambda function to copy the secret value to `us-west-2` after each rotation. Store the connection endpoint URL as a SecureString parameter in AWS Systems Manager Parameter Store in `us-east-1` and access it across regions.

Show answer & explanation

Answer: Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.

Answer

Storing the database credential in AWS Secrets Manager meets the requirement for automatic rotation, and replication to the secondary region ensures low-latency local access. Utilizing Systems Manager Parameter Store for the connection endpoint is cost-effective, and storing it as a regional parameter in each region eliminates cross-region latency.

Step-by-Step Solution

Analyze credential requirements

Database credentials require security, automatic rotation, and cross-region availability with minimum latency.

AWS Secrets Manager is designed for managing sensitive secrets, supporting automated rotation and built-in cross-region replication.

Analyze non-sensitive configuration requirements

The connection endpoint is region-specific, non-sensitive, and needs to be retrieved cost-effectively.

AWS Systems Manager Parameter Store is ideal and cost-effective for storing non-sensitive config parameters, and storing them as regional parameters avoids cross-region latency.

Assess IAM and replication configurations

Identify the solution that avoids custom replication code and hardcoded credentials.

Native Secrets Manager replication handles cross-region secret syncing automatically, and using Lambda execution roles avoids hardcoding credentials.

Key Concept

Selecting the correct secret and parameter management service based on sensitivity, replication, rotation, and cost constraints.

Estimated Time:2m 0s

PreviousPage 4 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept