All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS database and an Amazon ECS service. The database credentials must be rotated automatically every 30 days. To troubleshoot an urgent connectivity issue, a system administrator manually modified the database security group rules and the database master password directly in the AWS Management Console. When the developer subsequently attempts to update the stack to deploy a new ECS task definition, the stack update fails.

Which two actions should the developer take to resolve the update failure and align the infrastructure with AWS security best practices? (Select TWO.)

Select all that apply

Run drift detection on the stack to identify the out-of-band changes, and update the CloudFormation template to match the current database security group configuration.

Store the database credentials in AWS Secrets Manager, and reference them in the CloudFormation template using dynamic references to support automatic rotation.

Store the database credentials in Systems Manager Parameter Store as String parameters, and enable the native Parameter Store rotation schedule.

Revert the manual security group modifications using the AWS Management Console, and use the `cfn-init` helper script within the ECS container definition to dynamically retrieve the new credentials during container startup.

Manually change the stack status to `ROLLBACK_COMPLETE` in the CloudFormation console to bypass the failed update, then proceed with the task definition deployment.

Show answer & explanation

Answer: Run drift detection on the stack to identify the out-of-band changes, and update the CloudFormation template to match the current database security group configuration.; Store the database credentials in AWS Secrets Manager, and reference them in the CloudFormation template using dynamic references to support automatic rotation.

Answer

Run drift detection on the stack to identify the out-of-band changes, update the CloudFormation template to match the current database security group configuration, store the database credentials in AWS Secrets Manager, and reference them in the template using dynamic references.

To resolve the CloudFormation update failure due to manual out-of-band modifications, the developer should run drift detection to identify the changes and update the template configuration to match the current physical state. To securely manage the database password and satisfy the rotation requirement, the developer should store the credentials in AWS Secrets Manager, which natively supports automatic rotation, and reference them in the CloudFormation template using dynamic references.

Step-by-Step Solution

Detect drift to identify out-of-band changes.

The differences between the expected template configuration and the actual physical resource configuration of the security groups are identified.

This determines exactly what has changed manually so the template can be synchronized without overwriting intended configuration changes.

Update the template to match the drifted state.

The template definition of the security groups is updated to match the manually modified rules.

Aligning the template with the drifted state ensures subsequent CloudFormation updates do not fail due to configuration mismatch or attempt to overwrite the database's network access settings.

Migrate credentials to AWS Secrets Manager and configure dynamic references.

The database credentials are secured in Secrets Manager with automatic rotation enabled, and the template references them dynamically.

Secrets Manager provides secure storage and automatic rotation of credentials, which are referenced at runtime without hardcoding in the CloudFormation template or application configuration.

Key Concept

Handling resource drift and managing secrets securely in AWS CloudFormation.

Question 882Question →

A developer is selecting deployment strategies for a production web application. The application has two strict requirements: there must be zero downtime during the deployment process, and the application must be able to roll back to the previous version immediately if a failure is detected. Which of the following deployment strategies satisfy both of these requirements? (Select TWO.)

Select all that apply

Blue/Green deployment

Canary deployment

All-at-once deployment

Rolling deployment

In-place deployment

Show answer & explanation

Answer: Blue/Green deployment; Canary deployment

Answer

Blue/Green deployment and Canary deployment satisfy the requirements because they both allow traffic to be shifted between environments or versions with zero downtime, and can immediately route traffic back to the stable version if a failure occurs.

The correct strategies are Blue/Green deployment and Canary deployment. In a Blue/Green deployment, a separate environment is created, and traffic is cut over, allowing an immediate rollback by shifting traffic back if an error occurs. In a Canary deployment, traffic is shifted incrementally, and if alarms fire, traffic is immediately routed back to the old version. Both methods guarantee zero downtime and immediate rollback.

Step-by-Step Solution

Identify the downtime requirements of the candidate deployment strategies.

Blue/Green and Canary strategies support zero downtime by keeping both versions of the application active. All-at-once and standard In-place strategies incur downtime.

To filter out strategies that cause application offline states.

Analyze the rollback capabilities of the remaining strategies.

Blue/Green and Canary strategies can roll back immediately by shifting traffic back to the original version. Rolling and All-at-once strategies require a redeployment of the previous version to roll back.

To identify which strategies meet the immediate rollback constraint.

Key Concept

Downtime and rollback trade-offs of AWS deployment strategies.

Estimated Time:45s

Question 883Question →

A developer is implementing a secure corporate portal that exposes sensitive administrative endpoints through an Amazon API Gateway REST API. The portal's frontend application authenticates users against an Amazon Cognito User Pool. The developer wants to restrict access to these REST API endpoints to authenticated users only. To comply with security best practices and keep development and operational overhead to a minimum, the developer wants to avoid writing and maintaining custom code for token verification. Which approach should the developer use to authorize these API requests?

Enable Lambda Proxy integration for the backend Lambda function, extract the authorization header inside the function code, and manually verify the token using the Amazon Cognito SDK.

Create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from the Amazon Cognito User Pool to manually validate the signature of the incoming bearer token.

Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.

Configure an Amazon Cognito Identity Pool to authenticate users directly, and use temporary AWS credentials in the request headers to authenticate against an API Gateway Cognito Authorizer.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.

Answer

Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.

Configuring an Amazon Cognito User Pool authorizer is a native, built-in feature of Amazon API Gateway. It validates JSON Web Tokens (JWT) sent in the request header directly against the configured Cognito User Pool without executing custom Lambda code. This approach eliminates custom code development, reduces operational overhead, and minimizes execution costs.

Step-by-Step Solution

Identify the authentication source and authorization requirements.

Users authenticate against an Amazon Cognito User Pool, and the API Gateway REST API must allow access only to these authenticated users.

Establishing the source of the identity tokens helps determine which built-in integrations are available.

Evaluate the constraints regarding development and operational overhead.

Custom code for token verification must be avoided.

This eliminates custom Lambda authorizers or validation within the backend Lambda function, favoring native API Gateway integrations.

Select the built-in, code-free API Gateway security mechanism.

Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API resources.

This native feature validates the JWT signature and expiration directly at the API Gateway layer without requiring custom code or extra Lambda execution.

Key Concept

Natively securing Amazon API Gateway REST APIs using Cognito User Pool Authorizers to validate JSON Web Tokens (JWT) without custom code execution.

Question 884Question →

A developer is deploying a serverless application using AWS SAM. During the deployment process, AWS CloudFormation returns a validation error stating that the resource type 'AWS::Serverless::Function' could not be found or is invalid. Which of the following is the most likely cause of this error?

The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

The Lambda function's execution role has a misconfigured trust policy that prevents AWS CloudFormation from assuming the role.

The Lambda function is configured with a timeout value that exceeds the maximum limit allowed for serverless function resources.

The template specifies a Lambda proxy integration when it should be configured as a Lambda custom integration.

Show answer & explanation

Answer: The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

Answer

The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

The correct answer is correct because AWS SAM is an extension of AWS CloudFormation. In order for CloudFormation to recognize and parse SAM-specific resource types like AWS::Serverless::Function, the template must include the 'Transform: AWS::Serverless-2016-10-31' declaration. This declaration tells CloudFormation to run the macro that translates the SAM template into standard CloudFormation resources.

Step-by-Step Solution

Analyze the CloudFormation error message.

The error indicates that the resource type 'AWS::Serverless::Function' is unrecognized or invalid.

This error occurs because CloudFormation does not natively support the AWS::Serverless namespace without a translator.

Identify the mechanism that enables CloudFormation to parse SAM resources.

The template must contain the 'Transform: AWS::Serverless-2016-10-31' declaration.

The Transform declaration instructs CloudFormation to invoke the SAM transform macro, which translates SAM-specific resources into standard CloudFormation resources during deployment.

Key Concept

AWS SAM templates must include the Transform declaration to translate serverless resources into standard CloudFormation resources.

Question 885Question →

A developer is running a local Node.js application that uses the AWS SDK to read from an Amazon S3 bucket. During local testing, the application fails to connect to AWS and throws a credential loading error. Which two actions should the developer take to resolve this issue securely? (Select TWO.)

Select all that apply

Configure the AWS Access Key ID and Secret Access Key in the shared AWS credentials file located at the default user profile path on the local machine.

Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session where the application is executed.

Hardcode the AWS Access Key ID and Secret Access Key directly into the AWS SDK client constructor in the application code.

Modify the IAM Role trust policy of the target S3 bucket to allow direct access from the public IP address of the local developer's workstation.

Store the credentials in an unencrypted plaintext parameter within AWS Systems Manager Parameter Store and retrieve them at application startup.

Show answer & explanation

Answer: Configure the AWS Access Key ID and Secret Access Key in the shared AWS credentials file located at the default user profile path on the local machine.; Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session where the application is executed.

Answer

Configure the credentials in the shared AWS credentials file on the local machine, or set the access keys as environment variables in the local shell session.

The correct options are configuring the credentials in the shared AWS credentials file or setting the credentials as environment variables. The AWS SDK default credential provider chain automatically searches for environment variables first, followed by the shared credentials file. Both options are standard, secure ways to provide credentials to local applications without modifying the code.

Step-by-Step Solution

Identify that the AWS SDK requires valid credentials (access key ID and secret access key) to authenticate local API requests.

The application fails because no credentials are provided to the default credential provider chain.

By default, the SDK checks environment variables and local configuration files to locate credentials.

Apply a secure local credentials configuration method by either writing the credentials to the default shared AWS credentials file or exporting them as environment variables.

The SDK successfully loads the credentials automatically without hardcoding them in the source code.

Environment variables and the credentials file are high-priority locations checked by the default credential provider chain.

Key Concept

AWS SDK Default Credential Provider Chain and Local Authentication

Question 886Question →

A company's CI/CD pipeline uses AWS CodeBuild to compile a web application. The build process requires the main application source code from a primary AWS CodeCommit repository, as well as a common stylesheet template from a secondary AWS CodeCommit repository. The developer configures the CodeBuild project with multiple input sources, setting the secondary source identifier to CommonStyles. During the build, the buildspec must copy the stylesheet from the secondary source directory to the main application's public assets folder. How should the developer reference the file path of the secondary source inside the buildspec.yml file to perform this copy operation?

Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.

Reference the directory path using a relative path from the primary source directory, such as `../CommonStyles`.

Reference the directory path as a subdirectory of the primary working directory, such as `$CODEBUILD_SRC_DIR/CommonStyles`.

Store the repository URL in AWS Systems Manager Parameter Store and resolve it using the `parameters` section of the buildspec.

Show answer & explanation

Answer: Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.

Answer

Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.

When configured with multiple input sources, AWS CodeBuild downloads the primary source to the default build directory referenced by `

CODEBUILD_SRC_DIR`. For each secondary source, CodeBuild creates a separate directory and generates a dedicated environment variable named `

CODEBUILD_SRC_DIR_source_identifier` where `source_identifier` is the unique identifier specified in the project configuration. Therefore, referencing `$CODEBUILD_SRC_DIR_CommonStyles` provides the correct path to the secondary source repository's files.

Step-by-Step Solution

Identify how AWS CodeBuild handles multiple input sources during a build execution.

The primary source is downloaded to the directory referenced by `$CODEBUILD_SRC_DIR`, while secondary sources are downloaded to separate locations.

Understanding the isolation of source directories prevents incorrect assumptions about directory nesting or relative paths.

Determine how CodeBuild exposes the paths of secondary sources to the build environment.

CodeBuild dynamically generates environment variables for each secondary source matching the pattern `$CODEBUILD_SRC_DIR_source_identifier`.

This allows buildspec shell commands to programmatically locate and reference files across different repositories.

Select the specific environment variable matching the configured source identifier CommonStyles.

The correct environment variable is `$CODEBUILD_SRC_DIR_CommonStyles`.

This environment variable contains the absolute path to the directory containing the common stylesheet template.

Key Concept

AWS CodeBuild Multiple Source Inputs

Question 887Question →

An asynchronous processing system utilizes an AWS Lambda function to retrieve messages from an Amazon SQS queue and perform updates on an Amazon Aurora PostgreSQL database. The database is hosted in private subnets within a custom VPC. To connect to the database, the Lambda function is associated with the same private subnets. However, the Lambda function fails to retrieve any messages from the queue and times out during execution. How should the network and endpoint configuration be adjusted to allow the function to securely poll the SQS queue?

Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.

Reconfigure the Lambda function to reside in the public subnets of the VPC so that it can route traffic directly to the public SQS endpoint using the Internet Gateway.

Migrate the SQS connection metadata into AWS Secrets Manager with active secret rotation enabled, allowing the function to dynamically fetch the endpoint credentials.

Update the trust relationship policy of the Lambda execution role to include the Amazon SQS service principal, enabling the queue to push messages to the function.

Show answer & explanation

Answer: Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.

Answer

Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.

Establishing an Interface VPC endpoint for Amazon SQS inside the private VPC subnets allows the Lambda function to securely and privately access SQS over the AWS internal network. Activating private DNS hostnames ensures that the standard SQS DNS hostname automatically resolves to the private IP addresses of the endpoint network interfaces.

Step-by-Step Solution

Analyze the network configuration of the Lambda function.

The Lambda function is placed in a private VPC subnet to access the private Aurora database.

By placing Lambda in a VPC subnet, it loses its default internet connectivity and can only access resources inside the VPC or via VPC gateways/endpoints.

Identify the destination endpoint requirements.

The Lambda function needs to communicate with Amazon SQS, which is a public AWS service.

Since the function is in a private subnet with no path to the public internet, it cannot resolve or reach the public SQS endpoint directly.

Determine the secure, private solution for AWS service integration.

Create an Interface VPC endpoint (powered by AWS PrivateLink) for SQS in the VPC and enable Private DNS.

This places elastic network interfaces (ENIs) inside the private subnets, allowing the Lambda function to route SQS API calls entirely within the AWS network.

Key Concept

VPC Endpoint Connectivity for Serverless Resources

Estimated Time:1m 30s

Question 888Question →

A developer is setting up a release pipeline in AWS CodePipeline that consists of a Source stage, a Build stage using AWS CodeBuild, and a Deploy stage. The developer needs to pass the build output files from the Build stage to the Deploy stage. Which configuration must the developer specify in the pipeline definition to transfer these files?

Configure the build action to upload the zip archive to a custom Amazon S3 bucket, and modify the Deploy stage's IAM role trust policy to trust the CodeBuild service role directly.

Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.

Save the binary payload of the build output directly inside AWS Systems Manager Parameter Store as a SecureString parameter, then configure the deploy action to retrieve it.

Define the artifact paths within a custom buildspec.yml file located in a /config subdirectory of the source repository, and reference the paths as environment variables in the deploy stage.

Show answer & explanation

Answer: Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.

Answer

Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.

In AWS CodePipeline, files are passed between stages using input and output artifacts. The developer defines an output artifact for the CodeBuild action and references it as an input artifact in the deployment action. CodePipeline automatically manages the storage of these files in an Amazon S3 artifact bucket associated with the pipeline.

Step-by-Step Solution

Identify the AWS CodePipeline mechanism for passing files between stages.

CodePipeline uses InputArtifacts and OutputArtifacts to move files between actions.

This is the native, secure, and automated way to manage flow of files in CodePipeline.

Assign the output artifact name in the Build stage.

The Build stage action produces an output artifact named (e.g.) BuildArtifact.

This registers the build output in CodePipeline's artifact store.

Reference the same artifact name as the input artifact in the Deploy stage.

The Deploy stage action consumes BuildArtifact as its input.

This tells CodePipeline to feed the build output files into the deployment step.

Key Concept

CodePipeline Artifacts

Estimated Time:1m 30s

Question 889Question →

An application deployed on Amazon EC2 instances must connect to an external database. The developer needs to store the database endpoint URL, which is non-sensitive, and the database credentials, which must be rotated automatically every 30 days. Which combination of actions should the developer take to configure these parameters in a secure and cost-effective manner? (Select TWO.)

Select all that apply

Store the non-sensitive database endpoint URL as a Parameter Store parameter.

Store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Store the database credentials as a String parameter in Systems Manager Parameter Store and create a custom AWS Lambda function for rotation.

Store both the database endpoint URL and the database credentials in AWS Secrets Manager as a single secret.

Hardcode the database credentials directly in the application configuration files.

Show answer & explanation

Answer: Store the non-sensitive database endpoint URL as a Parameter Store parameter.; Store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Answer

Store the non-sensitive database endpoint URL as a Parameter Store parameter, and store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Storing the non-sensitive database endpoint in Systems Manager Parameter Store provides a low-cost, fully-managed configuration store. Storing the sensitive database credentials in AWS Secrets Manager provides native automated credentials rotation, which meets security requirements with minimal operational overhead.

Step-by-Step Solution

Identify parameter sensitivity and rotation requirements.

The database endpoint URL is non-sensitive and does not require rotation. The database credentials are sensitive and require regular rotation.

Correct classification helps in choosing the most cost-effective and secure service.

Select the appropriate AWS service for each parameter class.

Use Systems Manager Parameter Store for the endpoint URL, and use AWS Secrets Manager for the database credentials.

Parameter Store offers cost-effective storage for configuration parameters, whereas Secrets Manager provides out-of-the-box automatic rotation for sensitive credentials.

Key Concept

Selecting between Systems Manager Parameter Store and AWS Secrets Manager based on credential sensitivity and automatic rotation requirements.

Question 890Question →

A developer is configuring a web application running on Amazon EC2 instances in an Auto Scaling group. The application must retrieve a database password to connect to an Amazon Aurora PostgreSQL DB cluster. The database password must be rotated every 30 days. Both the EC2 instances and the database cluster are deployed in private subnets within a VPC that has no internet connectivity. Which combination of steps should the developer take to meet these requirements securely with the minimum operational overhead?

Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.

Store the database password in Systems Manager Parameter Store as a SecureString parameter. Write a custom AWS Lambda function to rotate the password in the database and update the parameter. Configure an Amazon EventBridge rule to trigger the Lambda function every 30 days, and configure the EC2 instances to retrieve the parameter by hardcoding database read-only IAM access keys in the application source code.

Store the database password in Systems Manager Parameter Store as a SecureString parameter. Configure the application to retrieve the password by reading a plaintext configuration file stored in a public Amazon S3 bucket. Configure a scheduled Amazon EventBridge rule to update the S3 file every 30 days.

Store the database password in Systems Manager Parameter Store as a SecureString parameter. Write a custom AWS Lambda function to rotate the password in the database and update the parameter. Configure the Lambda function to run inside the VPC and access Systems Manager using a NAT Gateway, and associate an IAM instance profile with the EC2 instances to retrieve the parameter.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.

Answer

The correct solution uses AWS Secrets Manager, which natively supports automated rotation of RDS database credentials using pre-built Lambda templates. Since the database and EC2 instances reside in a private VPC without internet access, deploying the Lambda rotation function inside the VPC allows it to reach the database. Creating an interface VPC endpoint for Secrets Manager allows the EC2 instances and the Lambda rotation function to securely interact with Secrets Manager privately. Access is granted to the EC2 instances via an IAM instance profile, ensuring no credentials are hardcoded.

Step-by-Step Solution

Store the secret in AWS Secrets Manager.

The database password is encrypted and stored securely.

AWS Secrets Manager is designed for storing secrets (like passwords and API keys) and supports native automatic rotation.

Enable automatic rotation using the standard RDS template and deploy the rotation Lambda function within the VPC private subnets.

Secrets Manager automatically manages password updates in both the database and the secret storage every 30 days.

Since the database has no public internet access, the Lambda function must run inside the VPC to connect to the database cluster and update the password.

Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.

The EC2 instances and the Lambda rotation function can securely connect to Secrets Manager without internet access.

An interface VPC endpoint allows secure, private traffic routing to AWS services within a isolated VPC.

Attach an IAM role containing Secrets Manager read access to the EC2 instance profile.

The application retrieves the credential dynamically at runtime.

This avoids hardcoding credentials and uses temporary security credentials instead.

Key Concept

AWS Secrets Manager vs. Systems Manager Parameter Store and Private VPC Networking Integration

Question 891Question →

A developer is designing a secure integration for an enterprise application. While human users authenticate interactively via an Amazon Cognito User Pool, an external partner’s automated service must programmatically invoke a specific Amazon API Gateway REST API. The partner's service needs to perform machine-to-machine (M2M) communication without any user interaction. Which configuration meets these requirements with the least operational overhead?

Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.

Create a custom API Gateway Lambda authorizer. Instruct the partner service to send its client credentials in the Authorization header. In the authorizer Lambda function, call the Cognito InitiateAuth API to validate the credentials on each request.

Set up an Amazon Cognito Identity Pool using developer-authenticated identities. Write a backend authentication service to verify the partner service, exchange credentials for temporary IAM credentials, and secure the API Gateway REST API using IAM authorization.

Configure a user pool client with the Authorization Code grant flow. Instruct the partner service to authenticate and obtain an ID token, then implement custom token validation logic in the backend Lambda function to verify the token signature on each request.

Show answer & explanation

Answer: Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.

Answer

Configuring a Cognito resource server and using the Client Credentials grant flow allows machine-to-machine clients to obtain OAuth 2.0 access tokens. API Gateway Cognito authorizers can natively validate these access tokens and restrict access based on the configured custom scopes. This requires no custom validation code or external identity pools.

Step-by-Step Solution

Analyze the client interaction requirements.

The requirement calls for machine-to-machine (M2M) communication without user interaction.

This rules out interactive authorization flows like Authorization Code or Implicit, pointing towards the OAuth 2.0 Client Credentials grant flow.

Select the appropriate Amazon Cognito feature set.

Amazon Cognito User Pools support OAuth 2.0 resource servers, custom scopes, and client clients with the Client Credentials grant.

Using a User Pool is more lightweight than building a custom credential exchange service with Cognito Identity Pools.

Determine the API Gateway integration strategy.

API Gateway's built-in Cognito authorizer can validate access tokens containing custom scopes natively.

Using a native authorizer avoids writing custom Lambda code to verify JWT signatures, reducing operational overhead and request latency.

Key Concept

Amazon Cognito User Pool Resource Servers and Client Credentials Flow

Question 892Question →

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate in Account A ( $111111111111$ ). The application must assume an IAM role named `CrossAccountDynamoDBAccess` in Account B ( $222222222222$ ) to perform read operations on a DynamoDB table.

The task definition in Account A is configured with an ECS Task Role named `TaskRole` and an ECS Task Execution Role named `TaskExecutionRole`. The developer configures the trust policy for the `CrossAccountDynamoDBAccess` role in Account B as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the container starts, the application throws an `AccessDenied` error when calling the AWS Security Token Service (STS) `AssumeRole` API.

How should the developer modify the configuration to resolve this issue and grant the application access using the principle of least privilege?

Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskRole"`. Additionally, attach a policy to `TaskRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.

Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskExecutionRole"`. Additionally, attach a policy to `TaskExecutionRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.

Configure the application code to initialize the AWS SDK client using hardcoded AWS access keys of an IAM user created in Account A. Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as the ARN of that IAM user.

Modify the trust policy of `TaskRole` in Account A to specify the principal as `"AWS": "arn:aws:iam::222222222222:role/CrossAccountDynamoDBAccess"`. Attach a policy to `CrossAccountDynamoDBAccess` in Account B that allows `sts:AssumeRole` on `TaskRole`.

Show answer & explanation

Answer: Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskRole"`. Additionally, attach a policy to `TaskRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.

Answer

Update the trust policy of the cross-account role in Account B to trust the ARN of the ECS Task Role, and attach an IAM policy to the ECS Task Role in Account A allowing it to assume the cross-account role.

The correct solution involves modifying the trust policy of the cross-account role in Account B to trust the specific IAM role associated with the running application container (the Task Role in Account A). Additionally, the Task Role in Account A must be granted permission to call the Security Token Service (STS) AssumeRole API on the role in Account B. This allows the application to assume the role using temporary credentials retrieved via the ECS Task Role, complying with the principle of least privilege.

Step-by-Step Solution

Identify the role that executes the application code in ECS.

The containerized application runs using the permissions of the ECS Task Role (`TaskRole`), not the ECS Task Execution Role (`TaskExecutionRole`).

The Task Execution Role is for container agent operations (like pulling images and shipping logs), whereas the Task Role provides AWS API credentials directly to the containerized application.

Determine the required trust policy for the cross-account role in Account B.

The trust policy of `CrossAccountDynamoDBAccess` must trust the caller's identity: `arn:aws:iam::111111111111:role/TaskRole`.

The current trust policy incorrectly trusts the service principal `ecs-tasks.amazonaws.com`, which allows ECS to assume the TaskRole but does not allow the TaskRole to assume the cross-account role.

Define the required permissions policy in the source account (Account A).

Attach an IAM policy to `TaskRole` in Account A allowing `sts:AssumeRole` on `arn:aws:iam::222222222222:role/CrossAccountDynamoDBAccess`.

For cross-account role assumption to succeed, the source identity must be explicitly granted permission to perform the `sts:AssumeRole` action on the target role.

Key Concept

IAM Cross-Account Role Assumption with Amazon ECS Task Roles

Question 893Question →

A developer is using AWS Serverless Application Model (SAM) to deploy updates to a critical Lambda function. The deployment must satisfy the following constraints:
- Traffic must be shifted from the old version to the new version gradually, in increments of 10% every 2 minutes.
- The deployment must automatically roll back if the execution error rate or latency metrics exceed predefined thresholds.
- Integration test suites must run before traffic starts shifting, and a cleanup script must run after all traffic has shifted to the new version.

Which TWO configurations must the developer specify in the AWS SAM template to satisfy these requirements?

Select all that apply

Configure the AutoPublishAlias property under the Serverless Function resource to define the alias that will receive the shifted traffic.

Under DeploymentPreference, set the Type to Linear10PercentEvery2Minutes, list the rollback alarms under Alarms, and define the PreTraffic and PostTraffic lifecycle hooks.

Under DeploymentPreference, set the Type to Canary10PercentEvery2Minutes and define the hooks under BeforeAllowTraffic and AfterAllowTraffic.

Define a custom CodeDeploy deployment configuration named CodeDeployDefault.LambdaLinear10PercentEvery2Minutes in the Resources section of the template.

Under DeploymentPreference, set the Type to AllAtOnce and configure a custom AWS CodePipeline action to rollback the stack if the CloudWatch alarms transition to the ALARM state.

Show answer & explanation

Answer: Configure the AutoPublishAlias property under the Serverless Function resource to define the alias that will receive the shifted traffic.; Under DeploymentPreference, set the Type to Linear10PercentEvery2Minutes, list the rollback alarms under Alarms, and define the PreTraffic and PostTraffic lifecycle hooks.

Answer

The developer must specify the AutoPublishAlias property under the Serverless Function resource to define the alias for traffic routing, and configure the DeploymentPreference section with Type: Linear10PercentEvery2Minutes along with the rollback alarms and the PreTraffic and PostTraffic hooks.

To perform gradual traffic shifting with AWS SAM, the function must have AutoPublishAlias enabled. In addition, the deployment strategy must be specified via DeploymentPreference with Type: Linear10PercentEvery2Minutes to shift traffic by 10% every 2 minutes. The template must also reference CloudWatch alarms for automated rollback and specify PreTraffic and PostTraffic hooks to execute validation tests and cleanup operations.

Step-by-Step Solution

Enable traffic shifting support by defining an alias configuration.

Define the AutoPublishAlias property under the AWS::Serverless::Function resource.

AWS SAM cannot perform gradual deployment unless a function alias is defined to shift traffic between the old and new versions.

Select the correct linear deployment type configuration.

Set the Type under DeploymentPreference to Linear10PercentEvery2Minutes.

This built-in configuration matches the requirement of shifting 10% of the traffic every 2 minutes.

Link safety controls and lifecycle hooks for validation.

Reference the CloudWatch alarms under Alarms and the Lambda validation functions under the PreTraffic and PostTraffic hook properties.

Alarms trigger automatic rollback during the deployment, and hooks run integration tests before traffic shifting starts and cleanup after traffic shifting completes.

Key Concept

Configuring AWS SAM safe deployments (DeploymentPreference) using built-in CodeDeploy types, aliases, alarms, and lifecycle hooks.

Estimated Time:2m 30s

Question 894Question →

A developer is configuring an AWS Lambda function to run inside private subnets of a custom VPC. The Lambda function needs to read data from an Amazon Aurora PostgreSQL database located in another private subnet of the same VPC. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager. To meet security requirements, all traffic must remain within the AWS network. Which two configurations must the developer implement to allow the Lambda function to connect to both the database and AWS Secrets Manager? (Select TWO.)

Select all that apply

Configure the security groups to allow outbound traffic from the Lambda function to the database, and inbound traffic to the database from the Lambda function.

Deploy a NAT Gateway in the private subnet, and update the private subnet's route table to route traffic destined for AWS Secrets Manager through the NAT Gateway.

Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure the Lambda function's security group to allow outbound traffic to the endpoint.

Create a Gateway VPC Endpoint for AWS Secrets Manager, and associate it with the route table of the private subnets.

Add a statement to the AWS Secrets Manager resource-based policy to trust the VPC's CIDR block and allow the Lambda service role to assume a trust role for cross-network access.

Show answer & explanation

Answer: Configure the security groups to allow outbound traffic from the Lambda function to the database, and inbound traffic to the database from the Lambda function.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure the Lambda function's security group to allow outbound traffic to the endpoint.

Answer

Configure the security groups to allow outbound traffic from the Lambda function to the database (and inbound traffic to the database from the Lambda function) and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, configuring the Lambda function's security group to allow outbound traffic to the endpoint.

To secure communications between resources, security groups must explicitly allow traffic between the Lambda function and the database. Additionally, because the Lambda function resides in a private VPC subnet and must reach AWS Secrets Manager without using the public internet, an Interface VPC Endpoint must be provisioned. This places an Elastic Network Interface in the private subnet to facilitate private communication with Secrets Manager.

Step-by-Step Solution

Configure the security groups for the local database connection.

The Lambda function is allowed to initiate outbound connections to the database, and the database accepts inbound connections from the Lambda function on the PostgreSQL port.

Security groups act as stateful firewalls at the resource interface level to allow communication within the VPC.

Determine the endpoint type required to access AWS Secrets Manager privately.

Identify that an Interface VPC Endpoint (AWS PrivateLink) is needed for AWS Secrets Manager, as Gateway Endpoints are not supported for this service.

Interface VPC Endpoints allow resources inside private subnets to communicate securely with AWS services without leaving the Amazon network.

Establish the Interface VPC Endpoint and configure its security group.

The endpoint is created in the private subnets, and its security group is updated to allow inbound HTTPS traffic from the Lambda function's security group.

Interface endpoints use Elastic Network Interfaces (ENIs) which require security group configurations to permit incoming traffic from client resources.

Key Concept

AWS VPC private connectivity using Security Groups and Interface VPC Endpoints.

Question 895Question →

A developer is setting up an AWS CodeBuild project to compile a simple web application. The developer needs to define the build commands and pull database connection configurations securely during the build execution.

Which TWO configurations are required to support this setup? (Select TWO.)

Select all that apply

Place the buildspec.yml file at the root of the source directory to define the build phases.

Reference sensitive database configurations from AWS Systems Manager Parameter Store or AWS Secrets Manager in the env section of the buildspec file.

Save the buildspec.yml file within a custom .codebuild/ subfolder at the top level of the repository without specifying a custom path in the project configuration.

Store non-sensitive configuration parameters in AWS Secrets Manager rather than AWS Systems Manager Parameter Store to optimize cost.

Edit the IAM permission policy attached to the CodeBuild service role to allow the CodeBuild service to assume the role.

Show answer & explanation

Answer: Place the buildspec.yml file at the root of the source directory to define the build phases.; Reference sensitive database configurations from AWS Systems Manager Parameter Store or AWS Secrets Manager in the env section of the buildspec file.

Answer

Placing the buildspec.yml file at the root of the source directory and referencing database configurations from Parameter Store or Secrets Manager in the env section of the buildspec file.

The correct options are placing the buildspec.yml file at the root of the source directory, which CodeBuild automatically locates, and referencing sensitive database configurations from Parameter Store or Secrets Manager in the env section of the buildspec to securely retrieve secrets.

Step-by-Step Solution

Determine the default buildspec file placement.

CodeBuild expects the buildspec.yml file at the root of the source repository unless a custom path is specified in the build project settings.

This allows the build runner to find and execute the build steps automatically.

Determine the secure configuration retrieval method.

Map database configurations dynamically inside the env parameter block of the buildspec using Parameter Store or Secrets Manager.

This avoids hardcoding sensitive information in the source code.

Key Concept

AWS CodeBuild buildspec configuration and secret retrieval

Question 896Question →

A developer is building a web application and needs to implement user sign-up, sign-in, and password recovery features to manage the application's user directory. The application does not require users to access any AWS resources directly. Which Amazon Cognito feature should the developer use to meet these requirements?

Amazon Cognito User Pools

Amazon Cognito Identity Pools

Amazon API Gateway Lambda Authorizer

AWS IAM User Groups

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools

Amazon Cognito User Pools is the correct component because it functions as a user directory that provides sign-up, sign-in, and self-service password recovery workflows out-of-the-box, which matches the application's requirement to manage end-user authentication without needing access to AWS resources.

Step-by-Step Solution

Identify the primary requirement: managing a user directory with sign-up, sign-in, and password recovery capabilities for an application's end-users.

Requires an authentication directory service rather than an authorization service for AWS resources.

The scenario specifies managing sign-up, sign-in, and password recovery without needing direct access to AWS resources.

Compare the core functions of Cognito User Pools and Cognito Identity Pools.

User Pools provide identity provider and user directory services. Identity Pools provide temporary AWS credentials for accessing AWS resources.

This avoids the common misconception of confusing User Pools (authentication/directory) with Identity Pools (authorization/credentials).

Key Concept

Amazon Cognito User Pools provide authentication, user directories, and profile management for application users, whereas Identity Pools provide authorization to AWS resources via temporary credentials.

Estimated Time:45s

Question 897Question →

A developer is deploying a containerized microservice to Amazon ECS that requires access to a customer managed key in AWS KMS for encrypting and decrypting application data. The security team prohibits direct, permanent IAM policy attachments to the ECS task role for KMS access. Instead, they require that permissions to use the KMS key be granted dynamically and programmatically to specific tasks at startup, and revoked when the tasks terminate. Which approach should the developer use to meet these security requirements?

Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.

Retrieve the customer managed key's plaintext private key from AWS Secrets Manager dynamically during task initialization.

Call the GenerateDataKey API operation to obtain a plaintext data key, and pass this data key as a plain environment variable in the ECS task definition.

Modify the ECS task execution role's trust policy to allow kms.amazonaws.com to assume the role to perform cryptographic operations.

Show answer & explanation

Answer: Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.

Answer

Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.

Calling the CreateGrant API operation allows the microservice to dynamically grant the required cryptographic permissions on the customer managed key to the ECS task role at startup. The grant can then be retired programmatically using the RetireGrant operation when the task terminates, fulfilling the security requirement without permanent IAM policy attachments.

Step-by-Step Solution

Analyze the requirement for dynamic, programmatically managed, and temporary KMS permissions that avoid permanent IAM policies.

Identify that AWS KMS Grants allow programmatic, temporary delegation of key usage permissions to a principal.

Grants are designed precisely for scenarios where permissions must be given dynamically (e.g., at task startup) and revoked (retired) when no longer needed.

Evaluate the viability of using KMS Grants.

A grant can be created via the AWS SDK calling CreateGrant with the ECS task role as the grantee, specifying operations like Decrypt and Encrypt. When the task shuts down, the grant can be retired using the RetireGrant API call.

This avoids attaching permanent policy statements to the ECS task IAM role while ensuring the task has permissions only during its lifetime.

Key Concept

AWS KMS Grants provide a flexible, programmatic mechanism to delegate temporary access to KMS keys without changing IAM policies.

Question 898Question →

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires two configurations:
1. A database connection password that must be rotated automatically every 30 days.
2. A database connection port number, which is a non-sensitive configuration parameter.

To optimize operational efficiency, security, and cost, how should the developer store and reference these configurations in the CloudFormation template?

Store both the database password and the port number in AWS Secrets Manager, and reference both in the template using Secrets Manager dynamic references.

Store the database password in Systems Manager Parameter Store as a SecureString parameter with automatic rotation enabled, and store the port number in AWS Secrets Manager.

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.

Store the database password as a standard CloudFormation Parameter with NoEcho set to true, and manually update the stack parameters whenever the password is rotated.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.

Answer

The correct approach is to store the sensitive database password in AWS Secrets Manager because it supports native automatic rotation every 30 days. To optimize costs, the non-sensitive port number should be stored in Systems Manager Parameter Store as it is free for standard parameters. Both can be securely referenced in the CloudFormation template using dynamic references without exposing plaintext values.

Step-by-Step Solution

Analyze the security and rotation requirements for the database password.

Identify that AWS Secrets Manager is required because it natively supports automatic rotation (every 30 days) and secure storage of sensitive credentials.

To meet the security and compliance requirement of automated rotation.

Analyze the requirements for the database port number.

Identify that the port number is non-sensitive and does not require rotation or high-cost storage, making AWS Systems Manager Parameter Store the most cost-effective service.

To optimize costs and distinguish between sensitive and non-sensitive configurations.

Determine how to reference both configurations in the CloudFormation template securely.

Use CloudFormation dynamic references to retrieve the values at runtime without hardcoding them in the template.

To maintain infrastructure-as-code best practices and avoid credential exposure in version control.

Key Concept

AWS CloudFormation Dynamic References

Question 899Question →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application needs to read and write items in an Amazon DynamoDB table. According to security best practices, which two steps should the developer take to configure the required permissions? (Select two.)

Select all that apply

Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role.

Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Role.

Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Execution Role.

Modify the trust policy of the IAM role to trust the DynamoDB service principal (dynamodb.amazonaws.com).

Generate AWS access keys for an IAM user with DynamoDB permissions and package them as environment variables inside the Docker container image.

Show answer & explanation

Answer: Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role.; Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Role.

Answer

Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal to assume the role, and attach the permissions policy to the ECS Task Role.

To secure an ECS task, the developer must use an ECS Task Role for application permissions (like DynamoDB access) and configure the trust policy to allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume that role.

Step-by-Step Solution

Identify the entity that needs to make AWS API calls and the entity that needs permission to assume the role.

The application code running inside the ECS container needs to access DynamoDB. The ECS task service itself needs to assume the role to pass temporary credentials to the container.

This determines the trust policy requirements and the correct IAM role type to use.

Configure the trust relationship for the IAM role.

A trust policy is created allowing ecs-tasks.amazonaws.com to assume the role.

ECS tasks must be authorized to obtain temporary security credentials from AWS STS.

Associate the DynamoDB permissions with the application role.

The permissions policy is attached to the ECS Task Role.

The Task Role supplies credentials to the containerized application, allowing it to authenticate and authorize against the DynamoDB table.

Key Concept

IAM Task Roles for ECS tasks separation and configuration

Question 900Question →

A developer is building a mobile application that allows users to register, log in, and upload photos directly to a private Amazon S3 bucket. The developer wants to use Amazon Cognito for user management and secure access. Which TWO options represent the correct configuration of Amazon Cognito services required to meet these objectives?

Select all that apply

Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuance

Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 access

Amazon Cognito User Pools to directly map users to IAM roles and issue temporary S3 credentials

Amazon API Gateway Lambda Authorizer to validate user credentials and return temporary IAM credentials to the client

Static IAM user access keys hardcoded in the application client to perform the S3 photo upload

Show answer & explanation

Answer: Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuance; Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 access

Answer

Amazon Cognito User Pools are used to manage user authentication and token issuance, while Amazon Cognito Identity Pools are used to exchange these tokens for temporary AWS credentials to access AWS resources such as Amazon S3.

The correct options are the ones implementing Cognito User Pools for user authentication and directory management, and Cognito Identity Pools for exchanging the resulting tokens into temporary AWS credentials for S3 access.

Step-by-Step Solution

Identify the authentication requirement.

The application needs user registration, sign-in, and token management, which is handled by Amazon Cognito User Pools.

User Pools act as the user directory and provide identity management.

Identify the authorization requirement for AWS resources.

The application needs to grant authenticated users access to Amazon S3 to upload files.

Accessing AWS resources directly from client apps requires temporary credentials.

Determine the resource that yields temporary AWS credentials.

Amazon Cognito Identity Pools (Federated Identities) can take the token from the User Pool and exchange it for temporary AWS credentials via an IAM role.

Identity Pools are designed to authorize access to AWS resources.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication/user directory) and Identity Pools (authorization/temporary credentials).

Estimated Time:1m 0s

PreviousPage 45 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept