Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 821Question →

A developer is writing a Python application to secure sensitive application configuration files locally before uploading them to Amazon S3. The compliance policy requires the developer to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. Which two actions must the developer perform to implement this encryption workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Call the KMS GenerateDataKey API, passing the KMS key ID, to retrieve both a plaintext data key and an encrypted data key.; Use the plaintext data key to encrypt the files locally using a symmetric encryption algorithm.

Answer

The developer must call the KMS GenerateDataKey API to obtain the plaintext and encrypted data keys, and use the plaintext data key to encrypt the files locally.
In client-side envelope encryption, the application calls the GenerateDataKey API to obtain both a plaintext data key and an encrypted version of that key. The application uses the plaintext key to encrypt the files locally, and then discards the plaintext key from memory. The encrypted data key is stored alongside the encrypted data.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The application receives a plaintext data key and an encrypted data key (ciphertext key) from the GenerateDataKey API call.
The plaintext key is required for local encryption, and the encrypted key is required for future decryption.
2
Encrypt the files locally.
The configuration files are encrypted using a symmetric encryption library (e.g., cryptography in Python) with the plaintext data key.
Envelope encryption requires the actual data to be encrypted client-side using the local plaintext data key.
3
Discard the plaintext key and store the encrypted key.
The plaintext data key is deleted from memory, and the encrypted data key is uploaded to Amazon S3 alongside the encrypted files.
Deleting the plaintext key ensures security, while storing the encrypted key allows authorization checks and decryption when retrieved.

Key Concept

AWS KMS Envelope Encryption Workflow
Question 822Question →

A development team needs to store a collection of third-party API keys that will be accessed by several serverless applications. These keys must be encrypted at rest, but they do not require automatic rotation or cross-account access. The team wants a solution that minimizes storage and retrieval costs.

Which AWS service or feature should the developer select to store these API keys?

Show answer & explanation

Answer: Systems Manager Parameter Store using SecureString parameters

Answer

Systems Manager Parameter Store using SecureString parameters
Systems Manager Parameter Store using SecureString parameters is the correct choice because it provides secure, encrypted storage for configuration data and secrets at no additional cost for standard parameters. Since the API keys do not require automatic rotation or cross-account access, using Parameter Store is the most cost-effective and operationally efficient solution.

Step-by-Step Solution

1
Analyze the requirements for storing the third-party API keys.
The API keys must be encrypted at rest, accessed by multiple serverless applications, do not require automatic rotation, and the solution must minimize storage and retrieval costs.
Understanding the technical constraints helps in selecting the most cost-effective and secure AWS service.
2
Compare AWS Systems Manager Parameter Store and AWS Secrets Manager against the requirements.
Parameter Store (SecureString) offers free/cost-effective secure storage without automatic rotation. Secrets Manager supports automatic rotation but introduces a monthly cost per secret.
Both services support encryption, but Parameter Store is the more cost-effective choice for secrets that do not require rotation.
3
Select the correct service and parameter type.
Systems Manager Parameter Store using SecureString parameters satisfies both the security and cost-efficiency requirements.
Using SecureString parameters ensures the API keys are encrypted at rest using KMS while remaining cost-effective.

Key Concept

Selecting between Parameter Store and Secrets Manager based on rotation requirements and cost efficiency.
Estimated Time:1m 0s
Question 823Question →

A developer is configuring authentication and authorization for a serverless web application. The application consists of a Single-Page Application (SPA) frontend and a REST API hosted on Amazon API Gateway. The developer wants to use Amazon Cognito to authenticate users directly through a sign-up and sign-in flow. Additionally, authenticated users in the "PremiumUsers" Cognito group must be allowed to directly download private reports from an Amazon S3 bucket, while standard authenticated users should only access the API. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to authenticate users and secure the API Gateway REST API using a Cognito Authorizer.; Configure an Amazon Cognito Identity Pool to federate the User Pool tokens and map the 'PremiumUsers' group to an IAM role with S3 read permissions.

Answer

The developer should configure an Amazon Cognito User Pool to authenticate users and secure the API Gateway using a Cognito Authorizer, and configure an Amazon Cognito Identity Pool to federate User Pool tokens and map the 'PremiumUsers' group to an IAM role with S3 read permissions.
To authenticate users and secure the REST API, a Cognito User Pool is configured along with a native API Gateway Cognito Authorizer. To authorize users to directly access S3 resources, a Cognito Identity Pool is set up to federate the User Pool tokens, allowing the application to map specific user groups (like 'PremiumUsers') to IAM roles with permission to retrieve objects from the S3 bucket.

Step-by-Step Solution

1
Configure a User Pool for user authentication.
Users can sign up, sign in, and obtain JSON Web Tokens (JWTs) representing their identity and group memberships.
Cognito User Pools serve as the identity directory for client application authentication.
2
Integrate the User Pool with API Gateway.
The API Gateway REST API is secured, permitting only requests with valid User Pool tokens.
A Cognito Authorizer automatically validates incoming ID or Access tokens from the User Pool.
3
Establish an Identity Pool linked to the User Pool and configure IAM role mapping.
Authenticated users receive temporary AWS credentials, with the 'PremiumUsers' group mapped to an IAM role granting S3 read access.
Cognito Identity Pools authorize users to access AWS resources directly by mapping their authenticated identity to specific IAM roles.

Key Concept

Amazon Cognito User Pools handle authentication (user directory, JWTs), while Identity Pools handle authorization (temporary AWS credentials via IAM roles). API Gateway can use a built-in Cognito Authorizer for User Pools.
Estimated Time:1m 30s
Question 824Question →

A developer is designing a microservice application deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservice requires access to two types of data: database credentials for an Amazon RDS for PostgreSQL instance that must be automatically rotated every 30 days, and non-sensitive API endpoints for external integration that vary by environment. Which combination of actions should the developer take to store and manage this data securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.; Store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.

Answer

Store the database credentials in AWS Secrets Manager with built-in automatic rotation, and store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.
Storing database credentials in AWS Secrets Manager takes advantage of native automatic rotation with Amazon RDS, removing the need to manage custom rotation code. Storing non-sensitive configuration parameters like API endpoints in AWS Systems Manager Parameter Store as String parameters is cost-effective because Parameter Store standard parameters are free, whereas Secrets Manager charges per secret.

Step-by-Step Solution

1
Evaluate the security and rotation requirements for the database credentials.
Identify that database credentials are highly sensitive and need to be rotated automatically every 30 days.
AWS Secrets Manager is the optimal service because it has built-in integration with Amazon RDS to rotate credentials automatically via a pre-configured Lambda function.
2
Evaluate the requirement for the non-sensitive API endpoints.
Identify that API endpoints are non-sensitive and vary by environment, meaning they do not require encryption or automatic rotation.
AWS Systems Manager Parameter Store String parameters are free of charge for standard use cases, making it the most cost-effective solution for non-sensitive configurations.
3
Identify the correct combination of options based on AWS best practices.
Select Secrets Manager for the database secret rotation and Parameter Store String parameters for the non-sensitive configuration data.
This combination fulfills all security requirements while optimizing costs.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation, and cost requirements.
Estimated Time:2m 0s
Question 825Question →

A developer creates a customer managed key in AWS KMS to encrypt sensitive configuration payloads. The developer then attaches an IAM policy to an IAM role associated with an Amazon EC2 instance. The IAM policy grants permission for the `kms:Decrypt` action on the key's Amazon Resource Name (ARN). However, when the application running on the EC2 instance attempts to call the Decrypt API, it receives an `AccessDeniedException`. Which of the following is the most likely cause of this authorization failure?

Show answer & explanation

Answer: The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.

Answer

The key policy for the customer managed key does not contain a statement that delegates permissions to the AWS account, which is required for IAM policies to grant access to the key.
For customer managed keys, AWS KMS evaluates both the key policy and the IAM policies. For an IAM policy to successfully grant access, the KMS key policy must contain a statement that delegates permission to the AWS account (specifically referencing the account's root principal ARN). If this delegation is missing, IAM policy permissions on the key are ignored, resulting in an AccessDeniedException.

Step-by-Step Solution

1
Analyze the IAM policy and the error.
The IAM policy grants the necessary `kms:Decrypt` permissions to the EC2 instance's IAM role, but the application still receives an `AccessDeniedException`.
AWS KMS evaluation logic requires checks on both the key policy and IAM policies.
2
Review the evaluation logic for AWS KMS customer managed keys.
Unlike other AWS services where IAM policies alone can grant access, KMS requires the key policy to explicitly delegate permission to the AWS account (via the root principal ARN) or directly to the IAM role.
If the key policy does not delegate permission to the AWS account, any permissions granted in IAM policies are ignored.
3
Identify the correct resolution.
Add a statement in the KMS key policy that allows the root principal of the AWS account to perform actions, thereby enabling IAM policies to govern access to the key.
This establishes the delegation chain from the key policy to IAM policies.

Key Concept

AWS KMS Key Policies and IAM Policy Integration
Question 826Question →

A developer needs to update an Amazon ECS service that runs behind an Application Load Balancer. To prevent any service degradation, the service must maintain 100% of its desired task capacity at all times during the update. Additionally, the service is allowed to provision up to double its desired capacity temporarily to perform the rolling update. Which configuration of deployment parameters should the developer apply to the ECS service?

Show answer & explanation

Answer: Set the minimum healthy percent to 100% and the maximum percent to 200%

Answer

Set the minimum healthy percent to 100% and the maximum percent to 200%
Setting the minimum healthy percent to 100% ensures that the desired capacity is maintained at all times, preventing any service degradation. Setting the maximum percent to 200% allows ECS to launch the new version of tasks up to double the desired count before stopping any of the existing tasks, enabling a smooth rolling update with zero downtime.

Step-by-Step Solution

1
Identify the minimum capacity requirement from the scenario.
The minimum healthy percent must be set to 100% to ensure that the service capacity never drops below 100% of the desired task count at any point.
To prevent service degradation, the application must maintain full capacity during the update.
2
Identify the maximum allowable capacity during the update.
The maximum percent must be set to 200% to allow the service to temporarily scale up to double its desired task count.
Provisioning up to double the capacity allows Amazon ECS to start new version tasks before draining and terminating the old version tasks.

Key Concept

Amazon ECS service rolling update parameters (minimum healthy percent and maximum percent)
Question 827Question →

A developer is designing an AWS CloudFormation template to deploy an application that connects to an Amazon RDS database. The developer needs to store the database credentials securely and prevent the database from being accidentally deleted if the CloudFormation stack is deleted or updated. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.; Configure the DeletionPolicy attribute with a value of Retain on the database resource in the template.

Answer

To securely manage the credentials and protect the database, the developer should store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and also configure the DeletionPolicy attribute with a value of Retain on the RDS database resource in the template.
Storing credentials in AWS Secrets Manager and referencing them using dynamic references keeps sensitive values encrypted and out of the template code. Setting the DeletionPolicy to Retain on the RDS resource prevents CloudFormation from deleting the database when the stack is deleted or the resource is updated out of the stack.

Step-by-Step Solution

1
Select a secure storage mechanism for the database credentials.
Determine that AWS Secrets Manager is the correct service for storing database credentials, and referencing it via CloudFormation dynamic references keeps them secure.
Hardcoding secrets or using unencrypted parameter types exposes sensitive information, violating security best practices.
2
Select a policy to prevent accidental resource deletion.
Determine that the DeletionPolicy attribute should be set to Retain on the RDS resource definition.
The Retain policy ensures that CloudFormation keeps the physical resource even if its stack is deleted or if the resource is removed during a stack update.
3
Eliminate incorrect options based on common AWS misconfigurations.
Discard options suggesting plaintext Parameter Store parameters, out-of-band console changes (which cause drift), or updating a stack that is currently in a rollback state.
These choices introduce security vulnerabilities, drift issues, or violate CloudFormation state machine rules.

Key Concept

AWS CloudFormation Resource Lifecycle and Credential Management
Question 828Question →

An application team wants to automate the deployment of an AWS Serverless Application Model (SAM) project. The workflow requires compiling code, performing security tests, getting manual sign-off from a release manager, and updating a staging stack. The team sets up AWS CodePipeline to coordinate these actions. Arrange the sequence of operations in the correct order that occurs during a single execution of this pipeline, from the detection of a commit to the completion of the stack deployment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: first, detecting the commit and archiving the source to the S3 artifact bucket; second, running CodeBuild to package the application and upload the output template; third, pausing for manual approval and notifying via SNS; fourth, creating the CloudFormation change set; and fifth, executing the change set to update the staging resources.
The correct execution flow starts with the source step where code is archived in S3. Next, CodeBuild generates the packaged template. Then, the execution pauses for manual approval. Finally, CloudFormation deploys the updates by first creating the change set and then executing it.

Step-by-Step Solution

1
Source detection and storage
The source code is retrieved and uploaded to the Amazon S3 artifact store.
AWS CodePipeline is an artifact-driven service; any pipeline execution must start by fetching the code from the source stage and making it available as an input artifact.
2
Package the application using AWS CodeBuild
A packaged CloudFormation template is written back to the Amazon S3 artifact bucket.
The build stage uses the source input artifact to compile code and package resources, producing a new output artifact for deployment.
3
Halt execution for manual approval
The execution stops, and an Amazon SNS message is published to alert the team.
Manual approval must be placed before deployment actions to prevent unverified artifacts from modifying target environments.
4
Create a CloudFormation change set
CloudFormation processes the packaged template artifact and generates a change set.
A two-step CloudFormation deployment requires creating a change set first to define the differences between the current and proposed stack state.
5
Execute the CloudFormation change set
The stack is updated, deploying the new resource configurations.
Once the change set is generated, it must be executed to apply the actual modifications to the staging environment.

Key Concept

AWS CodePipeline execution lifecycle, stage sequencing, and the separation of CloudFormation deployment steps into creating and executing change sets.
Question 829Question →

A web application is deployed as a Docker container on Amazon ECS using the AWS Fargate launch type. The application's Go code utilizes the AWS SDK to retrieve configuration files from an Amazon S3 bucket. Which IAM role must be configured with Amazon S3 read permissions to allow the application code to access the bucket?

Show answer & explanation

Answer: The ECS Task Role

Answer

The ECS Task Role
The ECS Task Role is the IAM role assumed by the container itself. AWS SDKs running inside the container retrieve credentials from this role automatically, allowing the application code to interact with AWS services like Amazon S3.

Step-by-Step Solution

1
Identify the entity requiring access to the Amazon S3 bucket.
The application code running inside the container requires access to read S3 objects.
This determines whether we need a role for the application code or a role for the ECS infrastructure agent.
2
Select the ECS task parameter designed for application-level AWS API permissions.
The ECS Task Role (taskRoleArn) provides temporary credentials directly to the containerized application.
The Task Execution Role is for ECS agent tasks (like image pulls and logging), whereas the Task Role is for application code tasks.

Key Concept

ECS Task Role vs Task Execution Role
Estimated Time:45s
Question 830Question →

A developer is building a high-throughput mobile gaming backend deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The application needs to manage real-time user session state and player matchmaking lobby tokens. Currently, session state is written to an Amazon DynamoDB table. During peak traffic periods, the application experiences database write throttling (`ProvisionedThroughputExceededException`), and players frequently lose connection and matchmaking state when EKS pods scale out or restart. The developer needs to implement a highly available caching and session management strategy that resolves the throttling and avoids data loss when EKS pods are rescheduled.

Which of the following actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Migrate the session state storage from Amazon DynamoDB to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled.; Redesign the DynamoDB table partition key schema to use a high-entropy key, such as a combination of user ID and game session UUID, and configure the table to use on-demand capacity mode.

Answer

Migrate the session state storage from Amazon DynamoDB to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled, and redesign the DynamoDB table partition key schema to use a high-entropy key, such as a combination of user ID and game session UUID, and configure the table to use on-demand capacity mode.
Migrating the session state storage from Amazon DynamoDB to an Amazon ElastiCache for Redis cluster with Multi-AZ replication enabled provides sub-millisecond, in-memory performance while ensuring that session states survive cache node failures. Redesigning the DynamoDB table partition key schema to use a high-entropy key, such as a combination of user ID and game session UUID, and configuring the table to use on-demand capacity mode eliminates hot partition issues and automatically scales table capacity to prevent write throttling during peak periods.

Step-by-Step Solution

1
Analyze the scaling and availability constraints of the session state storage.
Identified that the current architecture suffers from two main issues: write throttling on DynamoDB and data loss due to local state dependencies when ephemeral compute (EKS pods) scales or restarts.
Resolving this requires decoupled, external, high-performance storage that persists session state across pod recycles.
2
Evaluate in-memory caching solutions suitable for stateful data.
Determined that ElastiCache for Redis with Multi-AZ replication provides low-latency key-value operations, durability, and high availability, making it an ideal choice for session and matchmaking states.
Redis supports replication and automatic failover, preventing session loss if a cache node goes down.
3
Analyze how to optimize the write pattern to DynamoDB if it continues to be used for persistent backup.
Determined that using high-entropy partition keys distributes traffic evenly across partition ranges, and enabling on-demand capacity handles sudden workload spikes.
Low-entropy keys cause 'hot partitions' that result in write throttling, even if overall table capacity seems sufficient.

Key Concept

Session state caching requires an external, durable, and highly available key-value store (like ElastiCache for Redis) to ensure sessions persist across ephemeral container restarts, and database partitions must be designed with high-entropy keys to prevent write throttling.
Estimated Time:2m 30s
Question 831Question →

An enterprise retail application exposes catalog and inventory management endpoints via an Amazon API Gateway REST API. The system has two distinct integration requirements:

1. A customer-facing portal where users authenticate using external Google Workspace accounts.
2. An automated background synchronization service running on Amazon ECS Fargate that updates inventory levels.

The developer needs to secure both sets of endpoints using native AWS mechanisms to minimize custom code and maintenance.

Which TWO configuration steps should the developer perform to secure these endpoints?

Select all that apply

Show answer & explanation

Answer: Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, allowing the API to automatically validate the JSON Web Tokens (JWT) generated after Google Workspace federation.; Enable AWS_IAM authorization on the inventory synchronization endpoints, and configure the ECS Fargate tasks with an IAM Task Role that has permissions to execute the API using Signature Version 4 signing.

Answer

Configure the customer-facing endpoints to use an Amazon Cognito User Pool authorizer, and enable AWS_IAM authorization on the inventory synchronization endpoints while assigning an IAM Task Role to the ECS Fargate tasks.
For external user authentication, Amazon Cognito User Pools provide a native authorizer in API Gateway that validates OIDC-compliant JWT tokens (such as from Google Workspace) without requiring custom Lambda code. For AWS service-to-service communication, enabling AWS_IAM authorization allows API Gateway to natively verify Signature Version 4 (SigV4) signatures generated by Fargate tasks using their IAM Task Roles, enforcing least-privilege access.

Step-by-Step Solution

1
Determine authorization for external federated users.
Identify that Google Workspace acts as the identity provider (IdP). Amazon Cognito User Pools handle federation and issue JWTs. API Gateway natively validates these JWTs via a Cognito User Pools authorizer.
This offloads identity management and token verification to AWS native services, avoiding custom validation code.
2
Determine authorization for internal AWS compute resources.
Identify that Amazon ECS Fargate runs within AWS. Secure service-to-service authentication is natively supported using AWS_IAM authorization and Signature Version 4 (SigV4) signing via an IAM Task Role.
This follows the security principle of least privilege and avoids managing static keys or custom authorizer logic.

Key Concept

API Gateway natively supports Amazon Cognito User Pools authorizers for user-based JWT validation and AWS_IAM authorization for service-to-service SigV4 request verification.
Estimated Time:2m 0s
Question 832Question →

An application developer is implementing a Lambda function that validates user sessions. The function must query a Redis cluster running in the private subnets of a custom VPC. At the same time, the function needs to send validation logs to an external analytics provider's HTTPS endpoint on the public internet. How should the developer configure the VPC network paths to allow the Lambda function to access both the private Redis cluster and the public HTTPS endpoint?

Show answer & explanation

Answer: Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.

Answer

Place the Lambda function in the private subnets of the VPC. Create a NAT Gateway in a public subnet, and add a route in the private subnet route table that directs 0.0.0.0/00.0.0.0/0 traffic to the NAT Gateway. Ensure the Redis security group allows inbound traffic from the Lambda function's security group.
The correct answer provides the standard, secure pattern for accessing both private VPC resources and the public internet from an AWS Lambda function. By associating the Lambda function with the private subnets, it can reach the Redis cluster. By routing outbound internet traffic (0.0.0.0/00.0.0.0/0) from the private subnets through a NAT Gateway in a public subnet, the function can safely establish HTTPS connections to the public analytics API.

Step-by-Step Solution

1
Determine private connectivity requirements
To access the Redis cluster inside the private subnets, the Lambda function must be configured with VPC integration and attached to the same VPC and private subnets.
VPC integration allows the Lambda function to access resources in private subnets via Elastic Network Interfaces (ENIs) deployed in those subnets.
2
Determine public connectivity requirements
A NAT Gateway must be provisioned in a public subnet, and the route table for the private subnets must direct all internet-bound traffic (0.0.0.0/00.0.0.0/0) to this NAT Gateway.
Lambda functions with VPC integration lose access to the public internet by default because ENIs in private subnets do not have public IP addresses.
3
Configure security group rules
Allow inbound traffic on the Redis port from the Lambda function's security group.
VPC security groups act as stateful firewalls and must explicitly permit the inbound traffic to the Redis cluster.

Key Concept

A Lambda function configured to access resources within a private VPC subnet requires a NAT Gateway or VPC Endpoint to communicate with any endpoints on the public internet.
Question 833Question →

A developer is designing a security solution for a document archiving system. The application must encrypt PDF documents, each averaging 18 MB18\text{ MB} in size, before uploading them to an Amazon S3 bucket. A Customer Managed Key (CMK) in AWS KMS will be used to protect the data. A separate reader application running on Amazon ECS must download these documents from S3 and decrypt them. Which TWO actions must the developer perform to implement this workflow using the AWS SDK and AWS KMS under the principle of least privilege?

Select all that apply

Show answer & explanation

Answer: In the writer application, call the KMS GenerateDataKey API operation to retrieve both a plaintext data key and a ciphertext data key. Encrypt the PDF file locally using the plaintext data key, delete the plaintext key from memory, and upload the encrypted PDF along with the ciphertext data key to Amazon S3.; In the reader application's IAM policy, grant the kms:Decrypt permission on the KMS CMK. Download the encrypted PDF and the ciphertext data key from Amazon S3, call the KMS Decrypt API operation with the ciphertext data key to retrieve the plaintext data key, and decrypt the PDF locally.

Answer

The developer must configure the writer application to call the KMS GenerateDataKey API operation to retrieve the plaintext and ciphertext data keys, encrypt the file locally, and delete the plaintext key from memory. Additionally, the developer must grant the reader application's IAM role the kms:Decrypt permission to decrypt the ciphertext data key via the KMS Decrypt API operation to retrieve the plaintext data key.
To encrypt payloads larger than 4 KB4\text{ KB} like the 18 MB18\text{ MB} PDFs, client-side envelope encryption must be used. The writer calls GenerateDataKey on the Customer Managed Key (CMK), getting both plaintext and ciphertext versions of the data key. It encrypts the PDF locally with the plaintext data key and then discards it. The ciphertext data key is saved alongside the encrypted file in S3. The reader downloads the encrypted PDF and the ciphertext data key, calls Decrypt to retrieve the plaintext data key, and then decrypts the PDF locally. Under the principle of least privilege, the reader only needs kms:Decrypt permission.

Step-by-Step Solution

1
Evaluate the file size against AWS KMS limitations.
Since the average PDF file size is 18 MB18\text{ MB} and the direct KMS Encrypt API maximum limit is 4 KB4\text{ KB}, the developer must use client-side envelope encryption.
Direct KMS encryption cannot handle large payloads, necessitating the generation of local data keys.
2
Determine the proper writer application API calls and IAM permissions.
The writer application must call GenerateDataKey (which requires kms:GenerateDataKey permission) to get both plaintext and ciphertext data keys, encrypt the payload with the plaintext key, delete the plaintext key, and store the ciphertext key with the encrypted file.
This implements standard client-side envelope encryption and minimizes key exposure.
3
Determine the proper reader application API calls and IAM permissions.
The reader application must download the encrypted PDF and the ciphertext key, call the Decrypt API (requiring kms:Decrypt permission) to decrypt the ciphertext key, and then decrypt the PDF locally.
To decrypt, only the ciphertext data key needs to be decrypted via KMS. The main document decryption happens locally.

Key Concept

Client-side envelope encryption with AWS KMS
Estimated Time:2m 0s
Question 834Question →

A developer needs to encrypt a database password of size 2 KB2\text{ KB} directly using an AWS Key Management Service (AWS KMS) key. Which AWS KMS API operation should the developer call to encrypt this payload?

Show answer & explanation

Answer: Encrypt

Answer

Encrypt
The Encrypt API operation is designed to encrypt small payloads (up to 4 KiB4\text{ KiB}) directly using a specified customer managed key or AWS managed key. Since the database password size is 2 KB2\text{ KB}, it fits within this limit and can be encrypted directly in a single API call.

Step-by-Step Solution

1
Determine the size of the payload to be encrypted.
The payload is 2 KB2\text{ KB}, which is under the 4 KiB4\text{ KiB} limit for direct encryption in AWS KMS.
AWS KMS allows direct encryption of small payloads up to 4 KiB4\text{ KiB} without requiring client-side envelope encryption.
2
Select the correct AWS KMS API operation that accepts a small plaintext payload and returns the ciphertext.
The Encrypt API operation is selected.
Calling Encrypt directly sends the plaintext payload to AWS KMS to be encrypted by the designated KMS key, returning the ciphertext.

Key Concept

Direct encryption of small payloads using the AWS KMS Encrypt API
Estimated Time:45s
Question 835Question →

A developer is deploying a Go application to AWS Elastic Beanstalk running on Amazon Linux 2023. The deployment must satisfy two requirements: set custom environment properties that the application reads at runtime, and run a bash script to install a monitoring agent after the application files are extracted but before the application process is started. Which two steps should the developer take to configure the application source bundle? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create a configuration file with a .config extension inside a directory named .ebextensions at the root of the source bundle, defining the properties under the aws:elasticbeanstalk:application:environment namespace.; Place the bash script in the .platform/hooks/predeploy directory at the root of the source bundle and ensure the script has execute permissions.

Answer

To deploy the Go application with the given requirements, the developer must create a configuration file inside the .ebextensions directory at the root of the application source bundle to set the environment properties under the application environment namespace, and place the startup script inside the .platform/hooks/predeploy directory at the root of the source bundle.
To configure environment properties via configuration files, the properties must be defined in a .config file inside the .ebextensions directory at the root of the source bundle under the aws:elasticbeanstalk:application:environment namespace. To run scripts during deployment on Amazon Linux 2023, you must use platform hooks placed in the .platform/hooks/predeploy directory to execute after staging but before the application starts.

Step-by-Step Solution

1
Configure environment properties in the source bundle.
Create a directory named .ebextensions at the root of the project, add a file ending in .config, and define option_settings under the aws:elasticbeanstalk:application:environment namespace.
This is the default mechanism for declaring custom application properties/environment variables within the Elastic Beanstalk source bundle.
2
Configure the deployment script execution stage.
Create the path .platform/hooks/predeploy at the root of the project, place the script inside it, and make it executable.
On Amazon Linux 2023 platforms, platform hooks located in .platform/hooks/predeploy automatically execute after staging the application but before launching the web server/process.

Key Concept

Elastic Beanstalk environment configuration via .ebextensions and custom scripts using .platform hooks
Estimated Time:2m 0s
Question 836Question →

To support file uploads in a new collaborative web portal, users must be able to sign up, sign in, and directly upload files to a private Amazon S3 bucket. The application needs to authenticate users and then obtain temporary AWS credentials for the uploads. Which TWO Amazon Cognito components should the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: A User Pool to manage user registration, sign-in, and provide a user directory.; An Identity Pool to exchange authentication tokens for temporary AWS credentials to access Amazon S3.

Answer

The developer should implement a Cognito User Pool to manage user registration and sign-in, and a Cognito Identity Pool to exchange the authentication tokens for temporary AWS credentials to access Amazon S3.
To support the user registration, authentication, and S3 file uploads, both User Pools and Identity Pools are needed. A Cognito User Pool manages the user directory, sign-up, and sign-in processes (authentication). Once authenticated, a Cognito Identity Pool exchanges the resulting token for temporary AWS credentials (authorization) that the application's frontend can use to upload files directly to Amazon S3.

Step-by-Step Solution

1
Identify the authentication and directory management component.
Amazon Cognito User Pool.
User Pools serve as the user directory and handle user registration, sign-in, and identity tokens.
2
Identify the authorization component for accessing AWS resources.
Amazon Cognito Identity Pool.
Identity Pools exchange authentication tokens for temporary AWS credentials (via AWS STS) allowing client-side applications to access services like Amazon S3 directly.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and user directory) and Identity Pools (authorization and temporary AWS credentials for AWS resources).
Question 837Question →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline that deploys a serverless application using AWS CloudFormation. The pipeline needs to pass a database password to the CloudFormation deploy stage. The database password must be rotated automatically every 30 days to comply with company security policies. Additionally, the CloudFormation action in CodePipeline must assume a specific deployment IAM role in the production account to create and update resources. Which configuration should the developer implement to meet these requirements securely and with the least operational overhead?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.
The correct configuration uses AWS Secrets Manager for secret storage because it offers built-in automatic rotation. In addition, to allow AWS CodePipeline to assume the deployment IAM role, the trust policy of the deployment role must be updated to allow the CodePipeline service principal to assume it. This satisfies all requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the database password rotation requirement.
Determine that AWS Secrets Manager is the correct service because it natively supports automatic rotation, unlike Systems Manager Parameter Store.
Parameter Store lacks native, automated rotation, which would require custom Lambda scripts, adding operational overhead.
2
Determine the required trust relationship for the deployment role.
Identify that the CloudFormation deployment IAM role needs to trust the CodePipeline service principal (codepipeline.amazonaws.com).
The deployment role must allow CodePipeline to assume it via a trust policy, which is distinct from a permissions policy.
3
Combine both configurations.
Choose the configuration that stores the secret in Secrets Manager and correctly modifies the trust policy of the deployment role.
This ensures both security compliance for secret rotation and correct delegation of IAM permissions.

Key Concept

Integrating AWS CodePipeline with AWS Secrets Manager and cross-account or cross-action IAM roles.
Question 838Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application requires a database connection string that is stored as a secure string in Systems Manager Parameter Store. The developer wants the connection string to be automatically injected as a container environment variable at startup without modifying the application code to retrieve it. Which configuration will meet these requirements?

Show answer & explanation

Answer: Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.

Answer

Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.
Referencing the Systems Manager Parameter Store parameter ARN in the `secrets` section of the container definition tells the ECS agent to retrieve the parameter and inject it as an environment variable at container startup. Because this action is performed by the ECS container agent before the containerized application is running, the ECS Task Execution Role must contain the `ssm:GetParameters` permission.

Step-by-Step Solution

1
Identify the component responsible for retrieving the secret at container startup.
The Amazon ECS container agent is responsible for fetching the secret and injecting it as an environment variable before the application starts.
Since the application code itself is not retrieving the secret via the SDK, the ECS agent needs the direct permission.
2
Select the correct IAM role for the ECS container agent permissions.
The Task Execution Role must be used.
The Task Execution Role is utilized by the ECS agent to perform actions on behalf of the task (such as pulling container images, writing logs, and retrieving secrets), whereas the Task Role is for the application container itself.
3
Configure the task definition container definition.
Map the environment variable in the `secrets` array pointing to the SSM Parameter Store parameter ARN, and ensure the trust policy of the Task Execution Role allows the `ecs-tasks.amazonaws.com` service to assume it.
This binds the parameter to the environment variable securely and allows the ECS service to successfully assume the execution role.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role for secret management
Estimated Time:1m 30s
Question 839Question →

A developer is configuring a multi-stage release pipeline in AWS CodePipeline. The first stage contains a Source action that retrieves code from an AWS CodeCommit repository, and the developer has assigned the namespace `SourceVariables` to this action. In a downstream Deploy stage, the developer wants to reference the specific commit ID that triggered the pipeline execution to dynamic-tag the deployment resources. Which of the following is the correct method to pass this commit ID variable from the Source stage to the Deploy stage?

Show answer & explanation

Answer: Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.

Answer

Configure the Deploy action to reference the variable using the syntax `#{SourceVariables.CommitId}` in its configuration parameters.
AWS CodePipeline supports namespaces and variables to share execution-state data between different actions. By setting a namespace (like 'SourceVariables') on an action, any of its output variables, such as 'CommitId', can be referenced in downstream action configurations using the syntax '#{Namespace.VariableName}'. Therefore, configuring the Deploy action with '#{SourceVariables.CommitId}' is the correct method.

Step-by-Step Solution

1
Identify the requirement to pass runtime metadata (Commit ID) from an upstream Source stage to a downstream Deploy stage.
The developer needs to utilize AWS CodePipeline's native variable sharing capability.
Native variables are the most efficient way to share dynamic data between pipeline actions without external dependencies.
2
Locate the namespace configured on the upstream action.
The source action namespace is defined as 'SourceVariables'.
Variables are grouped under a namespace to avoid collision and to reference them uniquely.
3
Reference the variable in the downstream action configuration using the syntax: `#{Namespace.VariableName}`.
The dynamic reference is formatted as `#{SourceVariables.CommitId}`.
This is the syntax recognized by CodePipeline to resolve variables at runtime.

Key Concept

AWS CodePipeline Action Variables and Namespaces
Question 840Question →

An operations team writes a CloudFormation template containing an AWS::Serverless::Function resource. When they attempt to deploy this template using the AWS CLI, CloudFormation returns an error stating that the resource type is invalid or unsupported. What is the root cause of this deployment failure?

Show answer & explanation

Answer: The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.

Answer

The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.
The correct answer is correct because AWS CloudFormation requires the Transform declaration (specifically Transform: AWS::Serverless-2016-10-31) at the root of the template. Without this declaration, CloudFormation does not recognize or parse custom resource types like AWS::Serverless::Function, resulting in an invalid resource type error.

Step-by-Step Solution

1
Identify the resource types declared in the template.
The template contains the resource type AWS::Serverless::Function.
AWS::Serverless::Function is a custom resource type defined by the AWS Serverless Application Model (SAM).
2
Determine how CloudFormation processes SAM resource types.
CloudFormation requires the Transform: AWS::Serverless-2016-10-31 declaration to translate these resource types.
Without the Transform declaration, CloudFormation treats the template as standard CloudFormation and does not recognize the AWS::Serverless namespace.
3
Diagnose the error message indicating the resource type is invalid.
The lack of the Transform header causes CloudFormation to reject AWS::Serverless::Function.
Adding the Transform declaration resolves this issue by invoking the SAM translator before processing the resources.

Key Concept

AWS SAM templates require a Transform declaration (Transform: AWS::Serverless-2016-10-31) at the root level so that CloudFormation can translate serverless resources into standard CloudFormation resources.
PreviousPage 42 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin