All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is configuring a release pipeline in AWS CodePipeline. The developer wants to pause the pipeline before the deployment stage to allow a team lead to review the changes, and wants the team lead to receive an email notification when the pipeline is paused. Which configuration should the developer use to meet these requirements?

Add a Manual Approval action to the pipeline before the deployment stage, and configure it with an Amazon Simple Notification Service (Amazon SNS) topic ARN.

Add a Manual Approval action to the pipeline before the deployment stage, and configure it to store approval decision tokens in an AWS Systems Manager Parameter Store parameter.

Modify the CodePipeline service role's IAM trust policy to allow the team lead's IAM user to assume the role and execute the deployment stage.

Configure the deployment stage with an AWS CodeDeploy action, and use the ApplicationStart lifecycle hook to send notifications and pause the deployment.

Show answer & explanation

Answer: Add a Manual Approval action to the pipeline before the deployment stage, and configure it with an Amazon Simple Notification Service (Amazon SNS) topic ARN.

Answer

Add a Manual Approval action to the pipeline before the deployment stage, and configure it with an Amazon Simple Notification Service (Amazon SNS) topic ARN.

The correct option adds a Manual Approval action directly into the pipeline stage before the deployment stage. By associating the action with an Amazon SNS topic ARN, CodePipeline automatically sends a notification to the subscribed email address of the team lead when the action runs, pausing the pipeline until the approval is granted or rejected.

Step-by-Step Solution

Identify the requirement to pause the pipeline and notify a reviewer.

The developer needs a mechanism to halt pipeline execution and send an email notification.

AWS CodePipeline provides a native action category called 'Approval' to pause the pipeline.

Select the correct action type and configuration details.

A Manual Approval action is added to a pipeline stage. It can be configured with an Amazon SNS topic.

The SNS topic publishes messages to its subscribers (such as email endpoints) to alert reviewers that an approval is pending.

Key Concept

AWS CodePipeline Manual Approval Actions

Estimated Time:45s

Question 782Question →

A developer is configuring a cross-account continuous delivery pipeline using AWS CodePipeline. The pipeline is created in a Tooling account ( $111111111111$ ) and must deploy a serverless application to a Production account ( $222222222222$ ) using AWS CloudFormation. The pipeline's deploy action is configured to assume an IAM role (`ProdDeployRole`) in the Production account. During execution, the pipeline fails at the CloudFormation deploy stage with an error stating that the pipeline service role is not authorized to perform `sts:AssumeRole` on `ProdDeployRole`.

Which action should the developer take to resolve this issue?

Attach an identity-based permission policy to the target deployment role in the Production account that allows the Tooling account's CodePipeline service role to perform STS assume role actions, without modifying the trust policy.

Store the deployment configuration parameters in AWS Systems Manager Parameter Store as a Standard parameter in the Tooling account, and configure the CloudFormation deployment action in CodePipeline to reference the parameter directly across accounts.

Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.

Move the CloudFormation configuration template and the build specification file from the root directory of the source repository to a subdirectory named after the deployment stage so CodePipeline can locate them during execution.

Show answer & explanation

Answer: Configure the trust policy of the target deployment role in the Production account to trust the CodePipeline service role ARN from the Tooling account, and grant the CodePipeline service role in the Tooling account permissions to perform assume role actions on the target role.

Answer

For cross-account deployments in AWS CodePipeline, a role must be assumed in the destination account. This requires two configurations: the trust policy of the target role in the destination account must trust the pipeline's service role, and the pipeline's service role must have the permission to assume the target role. This establishes the necessary cross-account delegation.

Step-by-Step Solution

Inspect the trust relationship of the deployment role (ProdDeployRole) in the destination Production account.

Identify that the trust policy must explicitly allow the 'sts:AssumeRole' action for the IAM service role ARN of AWS CodePipeline in the source Tooling account.

Without this trust relationship, IAM prevents external entities (like the Tooling account service role) from assuming the role.

Examine the identity-based permission policy attached to the CodePipeline service role in the Tooling account.

Ensure there is a policy that allows the 'sts:AssumeRole' action on the target role ARN in the Production account.

The initiating service role must have explicit permission to perform the assume role operation on the external resource.

Verify that both policies are correctly applied and reference the correct ARNs.

The pipeline execution succeeds at the deploy stage, assuming the target role to deploy the resources.

Both trust and permission policies must align to allow cross-account access delegation.

Key Concept

Cross-account resource deployment using AWS CodePipeline and IAM assume role configurations.

Question 783Question →

An application hosted on Amazon EC2 instances requires access to a database password that must be rotated every 30 days, as well as a non-sensitive external API endpoint URL that does not change. Which TWO of the following configurations should the developer use to manage these values securely and cost-effectively? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and configure automatic rotation.

Store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

Store the database password in Systems Manager Parameter Store, as Parameter Store natively supports automatic rotation of database credentials.

Hardcode the database password directly within the application's SDK client initialization code.

Store the API endpoint URL in AWS Secrets Manager to utilize Secrets Manager's automatic rotation feature for static endpoints.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation.; Store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

The correct options are to store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter. This ensures sensitive passwords are encrypted and rotated automatically, while non-sensitive parameters are stored cost-effectively in Parameter Store without incurring extra charges.

Step-by-Step Solution

Analyze the requirements for the database password.

The database password is a sensitive credential and requires rotation every 30 days.

AWS Secrets Manager is the optimal service because it securely stores secrets and provides built-in rotation integration.

Analyze the requirements for the API endpoint URL.

The API endpoint URL is non-sensitive and static (does not change or rotate).

Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration parameters.

Key Concept

Distinction between AWS Secrets Manager and Systems Manager Parameter Store

Estimated Time:1m 0s

Question 784Question →

A developer is maintaining a testing environment deployed via an AWS CloudFormation stack. To resolve a connectivity issue, the developer manually modifies the inbound port rules of an Amazon EC2 security group directly through the Amazon VPC Console. The developer now wants to identify the discrepancies between the live resource configurations and the definition in the original CloudFormation template. Which CloudFormation feature or action should the developer use to identify these configuration discrepancies?

Edit the resource configurations directly using the AWS CLI to force synchronization with the template.

Store the security group configurations in Systems Manager Parameter Store to automatically track updates.

Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.

Re-run the stack update and select the option to automatically roll back any out-of-band changes.

Show answer & explanation

Answer: Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.

Answer

Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.

Running drift detection allows CloudFormation to compare the current status of the stack resources with the expected status defined in the stack template. It flags any resources that have been modified outside of CloudFormation management, providing a clear list of discrepancies.

Step-by-Step Solution

Identify that the developer made manual, out-of-band changes to a resource managed by a CloudFormation stack.

The resource is now in a state of configuration drift relative to the CloudFormation template.

Before performing any updates, the developer needs a way to compare the live infrastructure configuration with the template definition.

Evaluate the native features of AWS CloudFormation that support checking template compliance against actual resource state.

CloudFormation Drift Detection is the specific feature designed to detect discrepancies between the expected state (template) and the actual state.

This avoids having to manually audit each resource or risk stack update failures due to out-of-band configuration mismatches.

Key Concept

AWS CloudFormation Drift Detection

Question 785Question →

A developer is maintaining an application that runs on a fleet of Amazon EC2 instances and frequently retrieves configuration parameters from AWS Systems Manager Parameter Store. Due to a recent surge in traffic, the application is receiving HTTP 400 (ThrottlingException) errors when calling the Parameter Store API. Which of the following is the most cost-effective way to resolve this throttling issue with minimal latency?

Migrate the configuration parameters from AWS Systems Manager Parameter Store to AWS Secrets Manager.

Store the configuration parameters in an Amazon DynamoDB table and retrieve them using a Scan operation.

Cache the configuration parameters locally in the application memory with a defined Time to Live (TTL).

Publish the configuration parameters to an Amazon Kinesis data stream using a single static partition key.

Show answer & explanation

Answer: Cache the configuration parameters locally in the application memory with a defined Time to Live (TTL).

Answer

Cache the configuration parameters locally in the application memory with a defined Time to Live (TTL).

Caching the configuration parameters locally in the application's memory with a Time to Live (TTL) prevents redundant API requests to Systems Manager Parameter Store. This resolves the throttling errors while reducing retrieval latency to sub-milliseconds without incurring additional AWS service charges.

Step-by-Step Solution

Analyze the cause of the throttling error.

The application frequently reads the same configuration values from Parameter Store, exceeding API request limits.

Understanding why the ThrottlingException occurs helps identify that reducing external API calls is the primary goal.

Determine the optimal caching location.

In-memory local caching within the application provides sub-millisecond retrieval latency.

Local caching avoids network overhead and does not require provisioning additional AWS infrastructure.

Apply a Time to Live (TTL) policy.

The configuration parameters are stored in memory and only refreshed from Parameter Store after the TTL expires.

TTL ensures the application eventually receives updates to configuration values while drastically reducing API calls.

Key Concept

Caching Systems Manager Parameter Store values locally to prevent API throttling and improve retrieval latency.

Question 786Question →

A developer is building a document archiving application where PDF files of approximately $5\text{ MB}$ each must be encrypted on the client side before they are uploaded to an Amazon S3 bucket. The encryption must be performed using an AWS KMS customer managed key. Which two steps must the developer perform to implement this encryption process? (Select two.)

Select all that apply

Call the GenerateDataKey API operation using the customer managed key identifier to receive a plaintext data key and an encrypted data key.

Encrypt the PDF file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted PDF along with the encrypted data key to Amazon S3.

Call the Encrypt API operation directly, passing the entire

5\text{ MB}

PDF file as the plaintext payload to be encrypted by the customer managed key.

Call the GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key, and use the encrypted data key directly to perform symmetric encryption on the PDF file.

Call the GetPublicKey API operation to download the private key material of the customer managed key to perform local symmetric encryption.

Show answer & explanation

Answer: Call the GenerateDataKey API operation using the customer managed key identifier to receive a plaintext data key and an encrypted data key.; Encrypt the PDF file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted PDF along with the encrypted data key to Amazon S3.

Answer

The developer must call the GenerateDataKey API operation to retrieve both the plaintext and encrypted data keys, encrypt the PDF locally with the plaintext data key, delete the plaintext data key from memory, and then upload the encrypted PDF and the encrypted data key to Amazon S3.

For files larger than

4\text{ KB}

, direct encryption via AWS KMS is not possible due to size limitations. Instead, client-side envelope encryption must be used. Under this model, the developer calls the GenerateDataKey API operation to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the

5\text{ MB}

file locally, after which the plaintext key is deleted from memory to maintain security. Finally, the encrypted PDF and the encrypted data key are uploaded together to Amazon S3 so that the file can be decrypted in the future using the Decrypt API on the encrypted data key.

Step-by-Step Solution

Request a data key from KMS by calling GenerateDataKey.

The application receives a plaintext data key and an encrypted data key.

Because files larger than

4\text{ KB}

cannot be directly encrypted using the KMS Encrypt API, client-side envelope encryption is required.

Encrypt the

5\text{ MB}

PDF locally using a symmetric encryption algorithm (such as AES-256) with the plaintext data key.

The PDF file is converted into ciphertext.

The plaintext data key is needed by the local encryption library to encrypt the raw file payload.

Erase the plaintext data key from memory, and upload the ciphertext PDF and the encrypted data key to Amazon S3.

The encrypted file and its metadata (the encrypted data key) are securely stored in S3, and no plaintext key remains in the application's memory.

Removing the plaintext data key minimizes the window of exposure, and storing the encrypted data key with the ciphertext is necessary for later decryption.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 787Question →

A developer is designing service-to-service communication between a microservice running on Amazon ECS in AWS Account A and a private REST API hosted on Amazon API Gateway in AWS Account B. The API Gateway endpoint must restrict access to only allow requests originating from the ECS microservice in Account A. The security architecture must adhere to the principle of least privilege and minimize custom code development. Which of the following configurations should the developer implement to meet these requirements?

Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).

Create a custom Lambda authorizer in Account B. Configure the ECS task in Account A to obtain temporary security credentials from AWS Security Token Service (STS) in Account B, and pass the credentials in the Authorization header to the custom authorizer for manual signature verification.

Configure a Cognito User Pool authorizer on the API Gateway in Account B. Configure the ECS task in Account A to authenticate directly with an Amazon Cognito identity pool in Account B to obtain an ID token, and pass this token in the Authorization header.

Configure the API Gateway method to use Lambda Proxy integration with no authorizer. In the backend Lambda function, extract the caller's ECS task execution IAM role from the request context headers and return a 403 Forbidden response if the role does not match.

Show answer & explanation

Answer: Configure the API Gateway method to use AWS_IAM authorization. Apply a resource policy to the API Gateway REST API in Account B that grants execute-api:Invoke permission to the specific ECS task IAM role in Account A. Configure the ECS microservice code to sign HTTP requests with Signature Version 4 (SigV4).

Answer

The correct configuration provides the most secure and operationally efficient mechanism by using API Gateway's native AWS_IAM authorization. By configuring an API Gateway resource policy, the developer can explicitly grant access to the IAM role associated with the ECS task in the external account. Since the client request must be signed, Signature Version 4 (SigV4) protocol ensures authentication and integrity of the request payload without requiring custom token management or custom Lambda authorizer code.

Step-by-Step Solution

Enable AWS_IAM authorization on the API Gateway REST API resource methods in Account B.

This enforces IAM-based authentication and authorization at the API Gateway level before any backend services are invoked.

To natively authenticate requests using IAM identity credentials without writing custom authorization code.

Configure the API Gateway resource policy in Account B to allow the execute-api:Invoke action, specifying the ARN of the ECS task IAM role from Account A as the Principal.

This establishes cross-account permission, allowing the specific ECS container identity to access the private API Gateway REST API.

To adhere to the principle of least privilege by restricting access to only the specific identity requiring it.

Implement Signature Version 4 (SigV4) signing in the ECS microservice application code for outgoing HTTP requests to API Gateway.

Requests are securely signed with temporary AWS credentials from the ECS task IAM role, enabling API Gateway to verify the sender's identity.

To satisfy API Gateway's requirement for SigV4-signed requests when using AWS_IAM authorization.

Key Concept

Cross-account service-to-service authentication using API Gateway AWS_IAM authorization and Resource Policies.

Estimated Time:1m 30s

Question 788Question →

A developer is implementing a custom build and test action in AWS CodePipeline to integrate a proprietary security scanning tool. The scanning tool runs on an on-premises worker. The developer needs to configure the custom action and set up the worker to retrieve artifacts, perform the scan, and report the results back to the pipeline. What is the correct sequence of steps to configure this custom action workflow and execute it successfully?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with registering the custom action type, configuring it within the pipeline, polling for jobs from the custom worker, acknowledging the job to retrieve credentials and artifact locations, and finally reporting the success result after executing the scan.

The correct sequence begins with registering the custom action type in the AWS account, followed by defining it within the pipeline structure. During execution, the custom worker polls for the job, acknowledges the job to receive the required S3 locations and temporary credentials, performs the tasks, and reports the success result back to CodePipeline.

Step-by-Step Solution

The custom action type is created and available for use in the AWS region.

Before a pipeline can reference a custom action, its schema and configuration requirements must be registered using the CLI or CloudFormation.

Add the custom action to the pipeline.

The pipeline configuration is updated to include the custom action in a stage.

The custom action must be declared in a stage so that CodePipeline knows when to execute it during the release process.

Poll for jobs from the custom worker.

The worker detects a scheduled custom action execution.

Unlike built-in actions, custom actions require an external worker to pull work requests from the CodePipeline service using PollForJobs.

Acknowledge the job.

The worker obtains job details, temporary security credentials, and artifact S3 locations.

The worker must notify CodePipeline that it is starting the job. The AcknowledgeJob API response provides the credentials and artifact paths.

Execute the task and report success.

The pipeline stage transitions to succeeded after the worker sends the PutJobSuccessResult.

The worker processes the input artifacts, uploads output artifacts to the artifact store, and updates CodePipeline with the final success status.

Key Concept

AWS CodePipeline Custom Actions and Worker Lifecycle APIs

Question 789Question →

A developer is building a serverless order processing system using AWS Lambda and Amazon DynamoDB. The system must encrypt order payloads (each approximately $15\text{ KB}$ ) prior to saving them to DynamoDB. The developer implements envelope encryption using an AWS KMS customer managed key.

During order creation, the Lambda function calls the `GenerateDataKey` API operation, providing an `EncryptionContext` containing `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`. The application encrypts the order payload using the returned plaintext data key, discards the plaintext key, and saves the ciphertext order payload and the encrypted data key in DynamoDB.

When retrieving and decrypting the order, which approach must the Lambda function use to successfully obtain the plaintext order payload?

Call the KMS `Decrypt` API operation passing the ciphertext order payload and the `EncryptionContext` map directly to retrieve the decrypted order payload.

Call the Systems Manager Parameter Store `GetParameter` API operation, passing the OrderID to retrieve the cached plaintext data key associated with the encryption context.

Call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

Call the KMS `Decrypt` API operation passing only the encrypted data key. The encryption context is metadata stored within the encrypted data key and is validated automatically by AWS KMS without requiring client input.

Show answer & explanation

Answer: Call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

Answer

The Lambda function must call the KMS `Decrypt` API operation passing the encrypted data key and the exact same `EncryptionContext` map, then use the returned plaintext data key to decrypt the order payload locally.

The correct answer correctly identifies the envelope decryption process: calling the KMS `Decrypt` API with the encrypted data key and the exact same `EncryptionContext` map. The encryption context is cryptographically bound to the ciphertext, so supplying the exact matching key-value pairs is necessary for AWS KMS to successfully authenticate and decrypt the data key. Once the plaintext data key is returned, the client performs the actual payload decryption locally.

Step-by-Step Solution

Retrieve the encrypted data key and the ciphertext order payload from DynamoDB.

The Lambda function has the encrypted data key and the encrypted payload.

These components are required for the decryption process.

Call the AWS KMS `Decrypt` API, passing the encrypted data key and the exact encryption context `{"OrderID": "ord-8831", "CustomerID": "cust-4402"}`.

AWS KMS decrypts the data key and returns the plaintext data key.

Since the encryption context was provided during key generation, the same context is required to decrypt the key.

Use the plaintext data key to decrypt the

15\text{ KB}

order payload locally using symmetric decryption.

The plaintext order payload is obtained.

Envelope encryption requires the actual data decryption to happen on the client side using the decrypted data key.

Key Concept

AWS KMS Envelope Decryption with Encryption Context

Estimated Time:2m 0s

Question 790Question →

An e-commerce company runs a production web application on AWS Elastic Beanstalk. The application is deployed across $10$ Amazon EC2 instances inside an Auto Scaling group behind an Application Load Balancer. A developer needs to configure a deployment strategy for a minor application update. The deployment must satisfy the following constraints:

* The environment must maintain exactly $100\%$ of its capacity ( $10$ instances) to handle traffic at all times during the update.
* The temporary cost overhead during the deployment process must be kept to a minimum.
* The update must be performed within the existing environment without creating a new environment or swapping CNAMEs.

Which Elastic Beanstalk deployment policy should the developer select?

All at once

Rolling

Rolling with additional batch

Immutable

Show answer & explanation

Answer: Rolling with additional batch

Answer

Rolling with additional batch

The deployment policy that meets all criteria is the one that adds an additional batch of instances before taking any offline, thereby maintaining the full environment capacity of ten instances during deployment. Since only one batch is provisioned at a time, the temporary cost overhead is minimized. Furthermore, the deployment is executed entirely within the existing environment.

Step-by-Step Solution

Evaluate the capacity constraint.

Since the application must maintain

100\%

capacity (

10

instances) during the update, the policies 'All at once' and 'Rolling' are ruled out because they take instances out of service.

Eliminating options that reduce capacity helps narrow down choices to policies that add temporary instances.

Evaluate the cost overhead constraint.

Between 'Immutable' and 'Rolling with additional batch', the 'Rolling with additional batch' policy is more cost-efficient because it only launches a small, configurable batch of extra instances (e.g.,

1

2

), whereas 'Immutable' launches a duplicate set of

10

instances (doubling the cost).

Comparing temporary cost resource provisioning determines the most cost-effective solution.

Evaluate the environment constraint.

The 'Rolling with additional batch' policy performs the update in-place within the existing Auto Scaling group and environment, avoiding CNAME swapping.

Ensures alignment with all environmental limits.

Key Concept

AWS Elastic Beanstalk deployment policies and their tradeoffs regarding capacity, deployment speed, rollback, and cost.

Estimated Time:1m 30s

Question 791Question →

A developer is setting up an automated release pipeline in AWS CodePipeline to handle application updates. Arrange the pipeline stages in the correct execution sequence, from the initial trigger to the final production release.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stages is: first, the Source stage retrieves the source code; second, the Build stage compiles and tests the code; third, the Approval stage pauses the pipeline for verification; and finally, the Deploy stage deploys the artifacts to the target environment.

The correct sequence begins with the Source stage to retrieve raw source files, followed by the Build stage to compile and test the application, then the Approval stage to hold deployment for verification, and finally the Deploy stage to update the live environment.

Step-by-Step Solution

Identify the pipeline trigger and source retrieval.

The pipeline execution begins with the Source stage pulling code from the repository.

AWS CodePipeline must first fetch code to generate the primary input artifact.

Identify the compilation and test phase.

The Build stage runs to compile code and generate target artifacts.

Source code must be processed and verified before it can be validated or deployed.

Identify the manual gatekeeper phase.

The Approval stage pauses the pipeline execution.

An approval step is used to block automatic progression to deployment until verified.

Identify the final software release phase.

The Deploy stage deploys the compiled artifacts to the target environment.

The deploy stage runs as the final step in this delivery cycle to update the live application.

Key Concept

AWS CodePipeline execution flow and stage sequencing.

Question 792Question →

A developer is writing a local utility to back up database exports to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS KMS customer managed key to secure the files before they are uploaded. Which of the following actions must the developer perform to encrypt the files locally using client-side envelope encryption? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key.

Encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext data key from memory.

Send the database export files directly to the AWS KMS Encrypt API operation to perform the encryption.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation to obtain the plaintext key needed to encrypt the files.

Retrieve a plaintext data key dynamically from the AWS Systems Manager Parameter Store as a SecureString parameter to encrypt the local files.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key.; Encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext data key from memory.

Answer

The developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key, encrypt the database exports locally using the plaintext data key, and then securely discard the plaintext key from memory.

In client-side envelope encryption, the developer must first call the GenerateDataKey API operation using an AWS KMS customer managed key (CMK). This operation returns both a plaintext data key (used to encrypt the file locally) and an encrypted copy of the data key (stored alongside the encrypted data). Once the files are encrypted locally, the plaintext data key must be securely deleted from memory to maintain security.

Step-by-Step Solution

Request a data key from AWS KMS.

The GenerateDataKey API operation returns a plaintext data key and an encrypted version of that key.

This starts the client-side envelope encryption process by providing the key material required for local encryption.

Encrypt the files locally.

The local database exports are encrypted using the plaintext data key.

This performs the actual cryptographic operation on the client side, keeping the data secure before transport.

Clean up the plaintext key material.

The plaintext data key is discarded from memory.

To prevent unauthorized access to the encryption key, the plaintext key must not be persisted or left in memory.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 793Question →

A developer is setting up an AWS CodePipeline to deploy a serverless application. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database schema migrations. The Lambda action requires access to database credentials, and the pipeline itself must have permission to invoke the Lambda function. Which two of the following configuration steps should the developer perform to meet these requirements securely? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and retrieve them programmatically within the Lambda function.

Configure the trust policy of the IAM role associated with AWS CodePipeline to allow the codepipeline.amazonaws.com service principal to assume the role.

Store the database credentials as a standard String parameter in Systems Manager Parameter Store.

Attach an IAM policy to the CodePipeline service role that contains a trust relationship statement allowing the CodePipeline service principal to perform the sts:AssumeRole action.

Configure a resource-based policy on the database credentials in AWS Secrets Manager that trusts the CodePipeline service principal directly to retrieve the secret.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them programmatically within the Lambda function.; Configure the trust policy of the IAM role associated with AWS CodePipeline to allow the codepipeline.amazonaws.com service principal to assume the role.

Answer

The correct steps are to store the database credentials in AWS Secrets Manager and to configure the trust policy of the IAM role associated with AWS CodePipeline to allow the CodePipeline service principal to assume the role.

Storing database credentials in AWS Secrets Manager is the correct practice because Secrets Manager encrypts the credentials at rest and supports automatic rotation. Additionally, the AWS CodePipeline service role requires a trust policy (also known as an assume role policy) that allows the CodePipeline service principal to assume the role in order to perform pipeline actions.

Step-by-Step Solution

Identify the correct storage service for database credentials.

AWS Secrets Manager is chosen for credential storage.

Secrets Manager encrypts credentials at rest and supports automatic rotation, meeting security requirements.

Configure permissions for CodePipeline execution.

The trust policy of the CodePipeline service role is configured to allow the codepipeline.amazonaws.com service principal to assume the role.

This trust relationship is necessary for CodePipeline to assume the role and execute the deployment steps.

Key Concept

AWS CodePipeline Custom Actions and IAM Roles

Question 794Question →

A developer is deploying a web application with a database backend using an AWS CloudFormation stack. The developer wants to ensure that the database credentials are managed securely and that the stack resources do not become inconsistent due to manual configurations. Which of the following actions should the developer take to achieve this? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.

Update the database and application configurations by modifying the CloudFormation template and performing a stack update rather than making manual changes.

Store the database credentials as plaintext parameters in Systems Manager Parameter Store to avoid the cost of Secrets Manager.

Modify resource configurations directly in the AWS Management Console and execute drift detection to automatically synchronize the CloudFormation template.

Hardcode the database credentials in the application source code and pass the developer's AWS access keys directly to the instance configuration.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.; Update the database and application configurations by modifying the CloudFormation template and performing a stack update rather than making manual changes.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and update stack configurations by modifying the CloudFormation template and performing a stack update.

The correct options are to store database credentials in AWS Secrets Manager and reference them using dynamic references, and to perform configuration updates via CloudFormation template updates rather than manual console changes. This ensures credential security and maintains the stack integrity as the source of truth.

Step-by-Step Solution

Identify the secure storage mechanism for credentials.

AWS Secrets Manager is chosen to store database credentials securely.

Storing credentials in Secrets Manager with dynamic references prevents plaintext exposure in templates.

Determine the correct method for modifying stack resources.

Modify the CloudFormation template and perform a stack update instead of making manual changes.

This prevents configuration drift and ensures the template remains the single source of truth.

Key Concept

CloudFormation configuration drift management and secure parameter reference.

Question 795Question →

A developer is configuring a task definition to run a microservice on Amazon ECS using the AWS Fargate launch type. The microservice application code needs to send messages to an Amazon SQS queue. How should the developer grant the application code the required SQS permissions?

Assign the permissions to the IAM role specified in the executionRoleArn parameter of the task definition.

Embed an IAM user's access key credentials directly in the application code configuration inside the container.

Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.

Modify the SQS queue's resource-based policy to trust the Amazon Resource Name (ARN) of the ECS cluster.

Show answer & explanation

Answer: Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.

Answer

Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.

The correct option is the one specifying the use of the taskRoleArn parameter. When deploying containers on Amazon ECS, the Task Role (taskRoleArn) grants the containerized application permissions to make API requests to other AWS services like Amazon SQS. The AWS SDK inside the container automatically retrieves temporary credentials associated with this role.

Step-by-Step Solution

Identify the resource requiring credentials.

The application code running inside the ECS container needs to interact with Amazon SQS.

This determines whether the task agent permissions or the application permissions are needed.

Distinguish between ECS Task Role and ECS Task Execution Role.

The Task Role (taskRoleArn) is designed for the application inside the container, whereas the Task Execution Role (executionRoleArn) is for the ECS agent itself.

Choosing the correct role ensures the application can retrieve temporary credentials for SQS.

Select the appropriate parameter in the task definition.

Apply the IAM policy with SQS write permissions to the IAM role specified by taskRoleArn.

This secures the containerized application without exposing static credentials or misconfiguring agent roles.

Key Concept

ECS Task Role vs. ECS Task Execution Role

Estimated Time:45s

Question 796Question →

An application uses Amazon DynamoDB to store active user session data. During peak traffic hours, the application experiences latency spikes when retrieving session states. Which of the following are recommended best practices to optimize performance and prevent session state retrieval bottlenecks? (Select TWO)

Select all that apply

Enable DynamoDB Accelerator (DAX) to cache session data and provide microsecond read latency.

Design partition keys with high entropy, such as a unique session ID, to distribute read and write operations evenly across partitions.

Store user session data in Systems Manager Parameter Store and enable automatic rotation of session parameters.

Perform a Scan operation with a filter expression on a custom session attribute to locate active session records.

Scale up the table's overall provisioned read capacity units (RCUs) immediately upon encountering a ProvisionedThroughputExceededException.

Show answer & explanation

Answer: Enable DynamoDB Accelerator (DAX) to cache session data and provide microsecond read latency.; Design partition keys with high entropy, such as a unique session ID, to distribute read and write operations evenly across partitions.

Answer

Enable DynamoDB Accelerator (DAX) to cache session data and design partition keys with high entropy, such as a unique session ID, to distribute operations evenly.

Enabling DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency to microseconds. Additionally, designing high-entropy partition keys ensures even request distribution, which prevents hot partitions and scaling bottlenecks.

Step-by-Step Solution

Analyze the workload requirements for user session data stored in Amazon DynamoDB, identifying that the latency spikes occur during read retrieval operations.

Identify that read-heavy workloads with strict latency requirements can benefit from caching.

This establishes that adding a dedicated caching layer like DynamoDB Accelerator (DAX) is the appropriate performance optimization.

Evaluate partition key design to ensure write and read distributions are uniform.

Select high-entropy attributes (such as unique session IDs) as partition keys.

Uniform key distribution prevents hot partitions, which cause ProvisionedThroughputExceededException and latency spikes even when overall capacity seems sufficient.

Review and eliminate anti-patterns like using Scan operations or storing session data in SSM Parameter Store.

Avoid full table scans and configuration store misuse.

Scans consume excessive read capacity units, and Parameter Store is not designed for fast, high-volume session data storage.

Key Concept

Caching DynamoDB read requests using DAX and avoiding hot partitions with high-entropy keys.

Question 797Question →

A developer at a financial technology company is designing a REST API using Amazon API Gateway. The API must validate custom bearer tokens generated by a legacy, proprietary on-premises authorization server. The validation process requires invoking a custom decryption library and checking a local revocation list. Once authorized, the backend Lambda function needs to receive the user's subscription tier, which is extracted during token validation, to return the appropriate level of data. Which two actions must the developer take to implement this security and integration flow? (Select TWO.)

Select all that apply

Implement an API Gateway Lambda authorizer that validates the custom bearer token and returns an IAM policy along with a context map containing the subscription tier.

Use Lambda proxy integration for the backend integration, and retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

Configure an Amazon Cognito User Pool authorizer and configure it to perform active verification against the on-premises revocation list.

Configure an Amazon Cognito Identity Pool to validate the legacy bearer tokens and pass the subscription tier as a session tag during the STS assume role call.

Configure a Lambda custom integration and write a custom mapping template that reads the bearer token from the header, runs a helper utility inside the template to validate the token, and injects the subscription tier into the payload.

Show answer & explanation

Answer: Implement an API Gateway Lambda authorizer that validates the custom bearer token and returns an IAM policy along with a context map containing the subscription tier.; Use Lambda proxy integration for the backend integration, and retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

Answer

Implement an API Gateway Lambda authorizer to validate the token and return the subscription tier in the context map, and use Lambda proxy integration to retrieve the subscription tier in the backend Lambda function from the event.requestContext.authorizer object.

To authenticate legacy proprietary tokens requiring custom decryption and revocation checks, the developer must implement a Lambda authorizer. The Lambda authorizer validates the token and returns a JSON payload containing an IAM policy and a context map containing the user's subscription tier. When using Lambda proxy integration, API Gateway maps the context variables to the requestContext object, making them accessible in the backend Lambda function via the event structure under the authorizer property.

Step-by-Step Solution

Select the correct authorizer type.

Since the validation requires custom validation logic (decryption libraries and revocation checks), standard Cognito User Pool authorizers are not suitable. A Lambda authorizer must be configured.

Lambda authorizers execute a custom Lambda function to perform bearer token validation.

Pass context information from the authorizer.

The Lambda authorizer returns an IAM policy along with a key-value 'context' block containing the subscription tier.

The authorizer can inject string, number, or boolean values into the request context for downstream consumption.

Retrieve context in the backend integration.

By using Lambda proxy integration, the backend Lambda function receives the API Gateway request context containing the authorizer's context map directly in the event parameter under event.requestContext.authorizer.

This allows the backend function to dynamically adapt its behavior based on the subscription tier without re-validating the token.

Key Concept

Custom Lambda authorizers are used for validating non-Cognito tokens and passing custom context to backend integrations via the request context.

Estimated Time:2m 0s

Question 798Question →

A developer is implementing client-side envelope encryption to secure proprietary application log files, each approximately $8\text{ MB}$ in size, before archiving them to an Amazon S3 bucket. The developer wants to minimize both network latency and KMS API costs while ensuring the application principal adheres to the principle of least privilege. Which two actions must the developer perform to successfully implement the encryption phase of this workflow?

Select all that apply

Grant the application's IAM role permissions for the `kms:GenerateDataKey` action, but do not grant permissions for the `kms:Encrypt` action.

Call the `GenerateDataKey` API operation, encrypt the log file client-side using the returned plaintext data key, and then save both the encrypted log file and the encrypted data key to Amazon S3.

Call the `GenerateDataKeyWithoutPlaintext` API operation to retrieve the encrypted data key, use it directly to encrypt the log file, and discard the key.

Grant the application's IAM role permissions for the `kms:Encrypt` action, and call the `Encrypt` API operation for each log file to secure the payload before uploading to S3.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter, using the log file's S3 object key as the parameter name.

Show answer & explanation

Answer: Grant the application's IAM role permissions for the `kms:GenerateDataKey` action, but do not grant permissions for the `kms:Encrypt` action.; Call the `GenerateDataKey` API operation, encrypt the log file client-side using the returned plaintext data key, and then save both the encrypted log file and the encrypted data key to Amazon S3.

Answer

Grant the application's IAM role permissions for the `kms:GenerateDataKey` action (excluding `kms:Encrypt`) and call the `GenerateDataKey` API operation, using the returned plaintext data key to encrypt the log file locally before saving the encrypted log and the encrypted data key to Amazon S3.

The correct configuration requires calling the `GenerateDataKey` API operation, which returns both the plaintext data key (used for local symmetric encryption of the

8\text{ MB}

file) and the ciphertext data key (stored with the encrypted file in S3). Because the encryption is performed locally by the application rather than by the KMS service, the application's IAM role only requires `kms:GenerateDataKey` permission and does not need `kms:Encrypt` permission.

Step-by-Step Solution

Determine key size and encryption method.

Since the log files are

8\text{ MB}

(which exceeds the KMS direct encryption limit of

4\text{ KB}

), client-side envelope encryption must be used.

KMS direct encryption API is restricted to small payloads; envelope encryption resolves this by performing encryption locally using a data key.

Configure IAM permissions for the application role.

Grant `kms:GenerateDataKey` permission. Do not grant `kms:Encrypt`.

Least privilege requires only the permissions necessary to generate the data key. The encryption is done locally, so KMS `Encrypt` is not utilized.

Request a data key from AWS KMS.

The application calls the `GenerateDataKey` API and receives a plaintext data key and a ciphertext data key.

The plaintext key is required for local encryption, and the ciphertext key is stored for future decryption.

Perform local encryption and storage.

Encrypt the log file using the plaintext data key, securely wipe the plaintext key from memory, and upload both the encrypted log file and the ciphertext data key to S3.

This completes the envelope encryption workflow, ensuring plaintext keys are not exposed or persisted.

Key Concept

AWS KMS client-side envelope encryption workflow and IAM privilege separation

Question 799Question →

A software engineer is setting up a new build configuration in AWS CodeBuild for a web application. The engineer wants CodeBuild to automatically find the build commands and phases without specifying a custom path in the build project settings.

Where should the build specification file be placed by default, and what must it be named?

In the root of the source directory, named buildspec.yml

In a subdirectory named build/ at the root of the source directory, named buildspec.yml

In AWS Systems Manager Parameter Store as a parameter named buildspec.yml, referenced by the build project configuration

In the root of the source directory, named trust-policy.json, containing an IAM policy that delegates build permissions

Show answer & explanation

Answer: In the root of the source directory, named buildspec.yml

Answer

In the root of the source directory, named buildspec.yml

The correct answer is the option stating that the file must be placed in the root of the source directory and named buildspec.yml. AWS CodeBuild expects the build specification file to be in the root directory and named buildspec.yml by default, unless a custom file name or location is overridden in the build project settings.

Step-by-Step Solution

Identify the default build specification file naming convention for AWS CodeBuild.

The file must be named buildspec.yml.

AWS CodeBuild looks specifically for a file named buildspec.yml by default.

Determine the default directory location for this file within the source repository.

The file must be placed in the root of the source directory.

CodeBuild fails to locate the build phases if the file is placed in a subdirectory unless a custom path is configured.

Key Concept

AWS CodeBuild default buildspec location and naming convention

Estimated Time:45s

Question 800Question →

A developer is implementing a database maintenance task using an AWS Lambda function. The function is configured to run within a private subnet of a custom VPC in order to access an Amazon RDS DB instance. The database credentials must be retrieved securely from AWS Secrets Manager. During testing, the Lambda function successfully queries the database but fails when trying to retrieve credentials from the Secrets Manager endpoint. Which action should the developer take to resolve this connection failure?

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Associate the Lambda function with the VPC's public subnets to allow direct outbound access to the public Secrets Manager endpoint without requiring a NAT Gateway or VPC endpoints.

Update the Lambda function's execution role to include an IAM trust policy that explicitly grants assume role permissions to the VPC's security groups.

Move the database credentials from Secrets Manager to Systems Manager Parameter Store, which is natively reachable from private VPC subnets without VPC endpoints or internet connectivity.

Show answer & explanation

Answer: Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Answer

Create an interface VPC endpoint for Secrets Manager, and configure the Lambda function's security group to allow outbound HTTPS traffic to the endpoint's security group.

Creating an interface VPC endpoint for Secrets Manager allows resources in private subnets to securely connect to the service via PrivateLink, avoiding the public internet. The security group of the Lambda function must allow outbound HTTPS traffic to the endpoint's IP addresses to establish this connection.

Step-by-Step Solution

Analyze the network path requirements.

The Lambda function is running in a private VPC subnet and needs to access AWS Secrets Manager, which is a public service.

Since the VPC lacks a NAT Gateway or internet path, the function cannot reach public endpoints.

Select the correct VPC security integration pattern.

Create an interface VPC endpoint (powered by AWS PrivateLink) for Secrets Manager inside the VPC.

This provides a private network path from the VPC subnets to the AWS service using private IP addresses.

Configure the security groups.

Allow outbound traffic from the Lambda function's security group to the VPC endpoint on HTTPS port 443.

Security groups are stateful and must allow outbound connections to initiate the handshake.

Key Concept

VPC Endpoint integration for accessing public AWS services privately from within private subnets.

PreviousPage 40 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept