All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A smart agriculture company is developing a system where IoT field sensors and farm managers access backend microservices through an Amazon API Gateway REST API. The field sensors must securely publish telemetry data at regular intervals using IAM roles, while the farm managers must log in using an email and password to view and control irrigation systems through a web interface. The developer needs to secure both endpoints with the least administrative overhead. Which TWO actions should the developer take to configure the API Gateway security? (Select TWO.)

Select all that apply

Configure the telemetry endpoint to use AWS_IAM authorization, requiring the sensors to sign their HTTPS requests using Signature Version 4 (SigV4).

Configure the management endpoint to use an Amazon Cognito User Pools authorizer to authenticate and validate the JSON Web Tokens (JWTs) of the farm managers.

Configure the management endpoint to use an Amazon Cognito Identity Pools authorizer to directly authenticate the credentials of the farm managers.

Create a custom Lambda authorizer for the management endpoint to decode, verify, and validate the Cognito User Pool JWTs manually.

Enable API Gateway Lambda proxy integration on the telemetry endpoint to automatically authenticate the sensor IAM roles.

Show answer & explanation

Answer: Configure the telemetry endpoint to use AWS_IAM authorization, requiring the sensors to sign their HTTPS requests using Signature Version 4 (SigV4).; Configure the management endpoint to use an Amazon Cognito User Pools authorizer to authenticate and validate the JSON Web Tokens (JWTs) of the farm managers.

Answer

To secure the REST API with the least administrative overhead, configure the telemetry endpoint to use AWS_IAM authorization, allowing sensors to sign their requests using Signature Version 4, and configure the management endpoint to use a Cognito User Pools authorizer to validate the JWTs of authenticated farm managers.

For IoT sensors configured with IAM roles, API Gateway's native AWS_IAM authorization validates calls signed with Signature Version 4 (SigV4) securely. For farm managers authenticating with a username and password, Cognito User Pools manage the user identities and generate JWTs, which API Gateway's native Cognito User Pools authorizer validates automatically without code.

Step-by-Step Solution

Determine the auth mechanism for IoT sensors.

Since sensors utilize IAM roles, they can authenticate via AWS Signature Version 4 (SigV4). Thus, the telemetry endpoint should use AWS_IAM authorization.

This natively supports IAM-based authorization without custom authentication logic.

Determine the auth mechanism for web users.

Since users authenticate with username/password, an Amazon Cognito User Pool is suitable. To authenticate API Gateway requests, the API should use a Cognito User Pools authorizer.

The Cognito User Pools authorizer natively validates JSON Web Tokens (JWTs) directly at the API Gateway level.

Minimize administrative overhead.

Avoid custom Lambda authorizers or external token parsing since native integration mechanisms exist.

Native integrations reduce maintenance, billing costs, and code complexity.

Key Concept

API Gateway authorization types (IAM authorization vs Cognito User Pools authorizers vs custom Lambda authorizers)

Estimated Time:2m 0s

Question 902Question →

An operations engineer is establishing a continuous deployment workflow for a critical microservice. The pipeline is designed to fetch code from a repository, package the application using AWS CodeBuild, create an AWS CloudFormation change set, require manual intervention for approval, and finally execute the change set.

In what chronological order do these events occur during a successful pipeline execution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The pipeline execution begins with the Source action detecting a commit and uploading the source ZIP file to S3. Next, the Build action downloads this source archive, runs the buildspec, and uploads the compiled package back to S3. Following the build, the first deployment action uses AWS CloudFormation to create a change set. The pipeline then pauses at the Manual Approval action to await user consent. Once approved, the final deployment action executes the CloudFormation change set to update the infrastructure.

The correct chronological sequence starts with the source action retrieving the codebase, followed by CodeBuild compiling and packaging the app. Once packaged, CloudFormation creates a change set so that the proposed infrastructure changes are calculated. The pipeline then pauses at the manual approval stage for verification. Finally, after approval, CloudFormation executes the change set to deploy the resources.

Step-by-Step Solution

Trigger pipeline and output source artifact

The Source stage runs, fetching code from the repository and storing it in the Amazon S3 artifact bucket.

AWS CodePipeline requires a source action to pull the source code and produce an input artifact for subsequent stages.

Compile and package the application

AWS CodeBuild runs the build stage, compiling code and outputting a packaged application template artifact to S3.

The build stage consumes the source artifact and produces the deployment package required by the deployment actions.

Generate the infrastructure change proposal

AWS CloudFormation creates a change set showing what resources will be created, modified, or deleted.

Creating a change set allows developers to review the proposed modifications before they are applied to the live environment.

Pause pipeline for manual approval

The pipeline halts transition to the next action, publishes a notification to an SNS topic, and waits for an approval decision.

This manual approval action is configured between the change set creation and execution to enforce gates and human validation.

Apply the infrastructure changes

AWS CloudFormation executes the previously created change set, deploying the updates to the stack.

After the manual approval action is approved, the execution resumes and applies the change set.

Key Concept

AWS CodePipeline execution flow, artifact transition, and integration of CloudFormation change sets with manual approvals.

Question 903Question →

A developer needs to deploy a new version of an application to an AWS Elastic Beanstalk environment. The application is for internal testing and can tolerate a brief period of service unavailability. The developer wants the deployment to be completed as quickly as possible without launching any new instances to keep costs at zero. Which deployment strategy meets these requirements?

All-at-once

Immutable

Rolling with additional batch

Rolling

Show answer & explanation

Answer: All-at-once

Answer

All-at-once

The All-at-once deployment strategy is correct because it applies the update to all instances in the environment simultaneously. This results in service downtime during the deployment, but it requires no additional resource provisioning (keeping cost at zero) and completes the deployment in the shortest time possible.

Step-by-Step Solution

Analyze the requirements from the deployment scenario.

The key constraints are: 1. Service unavailability (downtime) is acceptable. 2. The deployment must complete as quickly as possible. 3. Zero additional costs or new instances should be launched.

Identifying constraints helps filter out strategies that launch temporary instances or focus on zero-downtime at the expense of speed or cost.

Evaluate each deployment strategy against the constraints.

All-at-once causes downtime but requires zero new instances and is the fastest. Immutable and Rolling with additional batch launch new instances. Rolling takes longer and reduces serving capacity without using new instances.

Comparing strategies allows us to match the one that satisfies all constraints simultaneously.

Key Concept

Selecting the appropriate AWS Elastic Beanstalk deployment strategy based on cost, speed, and downtime constraints.

Estimated Time:1m 0s

Question 904Question →

A developer is troubleshooting a local Python application that uses the Boto3 SDK to retrieve configuration parameters from AWS Systems Manager Parameter Store. The developer previously configured the local machine using the AWS CLI and confirmed that the shared credentials file (~/.aws/credentials) contains valid credentials under the default profile. However, when executing the script in a terminal session, the application returns a signature mismatch error (SignatureDoesNotMatch).

Which of the following is the most likely cause of this error?

The Boto3 SDK requires access keys to be explicitly passed as arguments in the client initialization constructor when running outside of EC2.

The developer must use Secrets Manager instead of Parameter Store because local applications cannot authenticate to Parameter Store without using automatic credential rotation.

The terminal session has invalid or expired credentials set in the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, which override the shared credentials file.

The local machine is missing an IAM trust policy that explicitly grants permission for the local operating system to assume the user's IAM role.

Show answer & explanation

Answer: The terminal session has invalid or expired credentials set in the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables, which override the shared credentials file.

Answer

The terminal session contains active environment variables for AWS credentials that are invalid or expired, overriding the valid credentials configured in the shared credentials file.

The correct answer is correct because the AWS SDK default credential provider chain evaluates environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before it checks the shared credentials file (~/.aws/credentials). If invalid or expired credentials are set in the terminal environment variables, the SDK will attempt to use them and fail, ignoring the valid credentials configured in the default profile of the shared credentials file.

Step-by-Step Solution

Analyze the error message and context.

The application returns a SignatureDoesNotMatch error, indicating that the AWS service rejected the signature generated by the SDK using the active credentials.

This error means the request was signed with an incorrect or corrupted access key/secret key combination, rather than missing credentials.

Determine the AWS SDK credential provider chain order.

The AWS SDK Default Credential Provider Chain looks for credentials in the following order: 1. Environment variables, 2. Shared credentials file, 3. Container credentials, 4. Instance profile credentials.

Understanding the lookup order helps identify which credentials the SDK actually loaded.

Identify the source of the invalid credentials.

Since environment variables have higher precedence than the shared credentials file, any credentials defined as environment variables in the current shell session will be used, even if the shared credentials file has valid credentials.

The presence of invalid environment variables explains why the valid profile credentials were ignored, resulting in the signature mismatch error.

Key Concept

AWS SDK Default Credential Provider Chain Precedence

Question 905Question →

A developer is writing an AWS Serverless Application Model (SAM) template to deploy a Lambda function that handles API requests. The developer wants to apply a default timeout of 10 seconds to all functions and ensure that the template is parsed correctly by AWS CloudFormation as a SAM template.

yaml
AWSTemplateFormatVersion: '2010-09-09'
# [Configuration 1]

Globals:
# [Configuration 2]

Resources:
ProcessRequestFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: index.handler
Runtime: nodejs18.x

Which two configuration steps must the developer take to complete the template?

Select all that apply

Declare `Transform: AWS::Serverless-2016-10-31` at the root level of the template

Define `Function:` followed by `Timeout: 10` inside the `Globals` section

Declare `Transform: AWS::CloudFormation::Serverless` at the root level of the template

Define `Parameters:` followed by `DefaultTimeout: 10` inside the `Globals` section

Define `Role:` followed by `AssumeRolePolicyDocument: Timeout: 10` inside the `Globals` section

Show answer & explanation

Answer: Declare `Transform: AWS::Serverless-2016-10-31` at the root level of the template; Define `Function:` followed by `Timeout: 10` inside the `Globals` section

Answer

The developer must declare the correct SAM transform at the root level of the template and specify the function timeout under the Globals section.

To complete the AWS SAM template, the template must include the correct `Transform` header at the root level to instruct CloudFormation to process it using the SAM translator, and the `Globals` section must define the `Timeout` under `Function` to apply it to all functions in the template.

Step-by-Step Solution

Identify the required header to enable AWS SAM parsing in CloudFormation.

The root of the template must include the `Transform: AWS::Serverless-2016-10-31` declaration.

Without the correct Transform header, AWS CloudFormation will fail to recognize SAM-specific resources such as AWS::Serverless::Function.

Configure the global default properties for all Lambda functions defined in the template.

Under the `Globals` section, add a `Function` block containing `Timeout: 10`.

The `Globals` section allows properties common to multiple resources, like function timeouts, to be defined once and applied to all instances of that resource type.

Key Concept

AWS Serverless Application Model (SAM) templates require a specific Transform header to be processed by CloudFormation, and support a Globals section to define shared resource properties.

Question 906Question →

A developer is deploying a web application to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a script named initialize.sh immediately after the application files are copied to the target instances, but before the application service starts. Which configuration action should the developer take to accomplish this?

Modify the trust policy of the EC2 instance profile to allow the EC2 service to assume the CodeDeploy service role.

Store the script in AWS Secrets Manager and configure automatic rotation to run it during deployment.

Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.

Define the script path under the AfterAllowTraffic event in the resources section of the appspec.yml file.

Show answer & explanation

Answer: Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.

Answer

Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.

Defining the script path under the AfterInstall event in the hooks section of the appspec.yml file is the correct way to execute scripts on Amazon EC2 instances immediately after files are copied, but before the application starts.

Step-by-Step Solution

Identify the target compute platform for the CodeDeploy deployment.

The target compute platform is Amazon EC2.

Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec file structures and lifecycle hooks.

Select the correct section in the AppSpec file for Amazon EC2 deployments.

The 'hooks' section is used for EC2 deployments, whereas the 'resources' section is used for ECS/Lambda.

EC2 deployments use the 'hooks' section to execute scripts during deployment lifecycle events.

Choose the appropriate lifecycle hook that executes after file copying but before application startup.

The 'AfterInstall' hook runs right after the files are copied, which is before the application service starts.

This meets the requirement of running the initialization script immediately after file copy and before startup.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for EC2 deployments require using the 'hooks' section and the 'AfterInstall' event to run scripts after files are copied.

Question 907Question →

A developer is designing a server-to-server integration where a partner company's backend application must programmatically invoke a private REST API hosted on Amazon API Gateway. The partner application needs to access the API without any interactive user login. The developer wants to use Amazon Cognito to authenticate and authorize the client application requests. Which combination of steps should the developer perform to securely configure this authentication flow? (Select TWO.)

Select all that apply

Configure a Cognito User Pool with a resource server defining custom scopes. Create an app client, enable the client credentials flow, and associate the custom scopes with the app client.

Configure a Cognito User Pool authorizer in API Gateway. For the API methods, set the authorization type to use this authorizer, and add the custom scopes to the OAuth Scopes method configuration.

Configure a Cognito Identity Pool to exchange client credentials for temporary IAM credentials, and configure the API Gateway API methods to use AWS_IAM authorization.

Create a custom API Gateway Lambda authorizer to parse and validate client credentials in the authorization header, as Cognito User Pool authorizers only support authorization code and implicit flows.

Configure the API Gateway method to use AWS_IAM authorization, and edit the IAM role's trust policy to allow the Cognito User Pool service principal (cognito-idp.amazonaws.com) to assume the role directly.

Show answer & explanation

Answer: Configure a Cognito User Pool with a resource server defining custom scopes. Create an app client, enable the client credentials flow, and associate the custom scopes with the app client.; Configure a Cognito User Pool authorizer in API Gateway. For the API methods, set the authorization type to use this authorizer, and add the custom scopes to the OAuth Scopes method configuration.

Answer

Configure an Amazon Cognito User Pool with a resource server, client credentials flow, and custom scopes, then secure the API Gateway methods using a Cognito User Pool authorizer configured with those custom scopes.

To secure server-to-server communication without interactive user login, the developer should use the OAuth 2.0 client credentials flow. This is achieved by creating an Amazon Cognito User Pool, defining a resource server with custom scopes, and setting the app client to allow the client credentials flow. On the API Gateway side, a built-in Cognito User Pool authorizer can validate the resulting JWT access tokens. By configuring the OAuth Scopes on the API Gateway methods, API Gateway will automatically verify that the client has the required scopes before granting access.

Step-by-Step Solution

Set up Cognito User Pool credentials flow.

An app client is configured to allow the client_credentials OAuth flow, and a resource server defines the custom scopes that the partner application can request.

This allows the partner application to authenticate programmatically using its client ID and client secret, obtaining an access token without requiring user interaction.

Secure API Gateway using the Cognito User Pool.

A Cognito User Pool authorizer is created in API Gateway, and the targeted method is configured to use this authorizer with the custom OAuth scopes.

This ensures that API Gateway automatically validates the signature of the incoming JWT access token and checks that the token contains the authorized scopes.

Key Concept

Securing server-to-server integrations using Amazon Cognito User Pools OAuth 2.0 client credentials flow and API Gateway authorizers.

Question 908Question →

An organization requires a build environment in AWS CodeBuild to execute integration tests against an internal Amazon RDS DB instance situated in a private subnet. The build container must fetch external software packages from the public internet and retrieve a database password from AWS Secrets Manager. Currently, the build execution fails because it cannot access external repositories, and an authorization error occurs when fetching the credential from AWS Secrets Manager.

Which combination of steps should be taken to resolve these network and access issues? (Select TWO.)

Select all that apply

Configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet to allow internet connectivity.

Ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions and that its trust policy allows the service principal codebuild.amazonaws.com to assume the role.

Update the CodeBuild IAM service role's trust policy to allow secretsmanager.amazonaws.com to assume the role, allowing AWS Secrets Manager to push the credential into the build environment.

Migrate the database password to AWS Systems Manager Parameter Store as a Standard parameter, configure automatic rotation, and retrieve it using the parameter-store block in the buildspec.

Place the buildspec.yml file containing the secret configuration in a sub-folder named config/ within the repository without changing the default CodeBuild project buildspec settings.

Show answer & explanation

Answer: Configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet to allow internet connectivity.; Ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions and that its trust policy allows the service principal codebuild.amazonaws.com to assume the role.

Answer

To resolve the issues, configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet, and ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions with a trust policy allowing codebuild.amazonaws.com to assume the role.

The correct configuration requires routing outbound traffic from CodeBuild's private VPC subnets to a NAT gateway so that the build container can reach the public internet to download external dependencies. Additionally, the CodeBuild IAM service role must have secretsmanager:GetSecretValue permission and a trust policy that allows codebuild.amazonaws.com to assume the role, enabling CodeBuild to authenticate and retrieve the database password.

Step-by-Step Solution

Analyze the networking failure

Identify that CodeBuild containers configured to run within a VPC do not receive public IP addresses. Therefore, placing them in public subnets or subnets without NAT gateways will prevent them from accessing the public internet to download dependencies.

To fix internet access inside a VPC, the CodeBuild project must be configured with private subnets that route outbound traffic through a NAT gateway.

Analyze the authorization failure for the database password

Identify that CodeBuild relies on an IAM service role to perform API operations like retrieving Secrets Manager secrets. The role requires the permission to get the secret, and the role's trust policy must trust codebuild.amazonaws.com.

Configuring the IAM service role with the correct trust relationship and the secretsmanager:GetSecretValue permission enables the build process to retrieve the secret.

Key Concept

AWS CodeBuild VPC networking and service role configuration

Estimated Time:2m 30s

Question 909Question →

A developer is implementing a microservice that integrates with an external service provider. The integration requires a sensitive API key that needs to be rotated automatically every 90 days. Which AWS service should the developer use to store this API key and handle its automatic rotation?

AWS Systems Manager Parameter Store

AWS Key Management Service (AWS KMS)

AWS Secrets Manager

Hardcode the API key in the application source code

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager is the correct service to use because it is specifically designed to store sensitive API keys and supports automated rotation using AWS Lambda.

AWS Secrets Manager is designed to store secrets and credentials securely. It has native support for automatic rotation of secrets using built-in templates or custom AWS Lambda functions.

Step-by-Step Solution

Identify the primary requirement.

The requirement is to store a sensitive API key and automatically rotate it every 90 days.

This helps determine which AWS service supports both secure storage and automatic lifecycle management.

Compare candidate AWS services.

AWS Secrets Manager provides built-in integration with Lambda for automatic secret rotation. Systems Manager Parameter Store does not support automated rotation out of the box. AWS KMS manages cryptographic keys, not the secret payloads themselves.

Choosing the service with native rotation capability minimizes custom development and operational overhead.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on security and rotation requirements.

Estimated Time:45s

Question 910Question →

A development team is deploying a containerized worker application to Amazon ECS using the AWS Fargate launch type. The application is designed to process messages from an Amazon SQS queue. The container image is hosted in a private Amazon Elastic Container Registry (Amazon ECR) repository, and the ECS agent must send container logs to Amazon CloudWatch Logs. Which of the following IAM configurations are required for this deployment to succeed? (Select TWO.)

Select all that apply

Configure the ECS Task Role (taskRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), and establish a trust relationship allowing ecs-tasks.amazonaws.com to assume the role.

Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows ECR actions (ecr:GetAuthorizationToken, ecr:BatchGetImage) and CloudWatch Logs actions (logs:CreateLogStream, logs:PutLogEvents), and trust ecs-tasks.amazonaws.com.

Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), as containerized applications automatically inherit permissions from the execution role.

Configure the ECS Task Role (taskRoleArn) with a policy that allows ECR image pull permissions, because the container runtime must possess credentials to download its own image during container creation.

Hardcode temporary credentials retrieved from AWS STS using a custom script inside the Dockerfile's ENTRYPOINT to bypass IAM role configuration.

Show answer & explanation

Answer: Configure the ECS Task Role (taskRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), and establish a trust relationship allowing ecs-tasks.amazonaws.com to assume the role.; Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows ECR actions (ecr:GetAuthorizationToken, ecr:BatchGetImage) and CloudWatch Logs actions (logs:CreateLogStream, logs:PutLogEvents), and trust ecs-tasks.amazonaws.com.

Answer

Configure the ECS Task Role with a policy allowing SQS actions and a trust policy for the ECS tasks service principal, and configure the ECS Task Execution Role with ECR and CloudWatch Logs permissions along with a trust policy for the ECS tasks service principal.

For an ECS container running on Fargate, the application code inherits permissions from the Task Role (taskRoleArn), while the ECS agent requires permissions from the Task Execution Role (executionRoleArn). Therefore, the Task Role must be configured to allow the application's SQS calls, and the Task Execution Role must be configured to allow the ECS agent's ECR pull and CloudWatch logging actions. Both roles require trust policies that allow the ecs-tasks.amazonaws.com service principal to assume them.

Step-by-Step Solution

Determine the resource access required by the application code executing inside the container.

The application code needs to communicate with Amazon SQS to receive and delete messages, requiring an ECS Task Role.

Permissions for resource access by application code must be granted via the taskRoleArn parameter.

Determine the resource access required by the ECS agent/infrastructure to instantiate and monitor the container.

The ECS agent needs to authenticate with Amazon ECR to pull the image and write to CloudWatch Logs, requiring an ECS Task Execution Role.

Permissions for infrastructure operations performed by the ECS container agent must be granted via the executionRoleArn parameter.

Configure trust policies for both IAM roles to allow the ECS service to assume them.

Both roles must have trust relationships defined for the ecs-tasks.amazonaws.com service principal.

AWS services require explicit trust relationships to assume roles on behalf of resources.

Key Concept

Distinguishing between the ECS Task Role and the ECS Task Execution Role.

Question 911Question →

A developer is managing a production web application deployed on AWS Elastic Beanstalk. The application experiences consistent high traffic, and the environment's capacity must remain at $100\%$ at all times during updates to prevent performance degradation. In the event of a deployment failure, the application must support an immediate rollback with minimal impact, without requiring a manual rollback deployment. Additionally, to avoid issues with client-side DNS caching, the deployment must not involve swapping DNS CNAMEs or changing Route 53 configurations.

Which Elastic Beanstalk deployment strategy should the developer select?

Immutable

Rolling with additional batch

Blue/Green deployment

Rolling

Show answer & explanation

Answer: Immutable

Answer

The immutable deployment strategy

The immutable deployment strategy meets all requirements. It maintains

100\%

capacity by deploying the new version to a temporary Auto Scaling group alongside the existing one under the same load balancer. If the deployment fails, Elastic Beanstalk immediately deletes the temporary Auto Scaling group, resulting in an immediate rollback with zero downtime. Since it uses the same environment and load balancer, no CNAME swaps or DNS changes are required.

Step-by-Step Solution

Analyze capacity constraints.

The requirement to maintain

100\%

capacity during updates rules out the standard Rolling strategy because it takes active instances out of service, reducing capacity.

To prevent performance degradation on a high-traffic site, capacity cannot drop below the baseline.

Evaluate rollback speed and procedure.

The requirement for immediate rollback without a manual rollback deployment rules out Rolling with additional batch.

Rolling with additional batch requires a new deployment of the previous version to revert changes, which is slow and manual.

Check DNS and routing constraints.

The requirement to avoid DNS CNAME swapping or Route 53 changes rules out Blue/Green deployment.

Blue/Green deployments rely on switching DNS CNAMEs, which can cause traffic to split due to client-side DNS caching.

Identify the matching strategy.

The Immutable strategy satisfies all constraints by deploying to a temporary Auto Scaling group behind the same load balancer, maintaining

100\%

capacity, and allowing immediate automatic rollback by terminating the new group if health checks fail.

It runs the new version in parallel behind the same load balancer, avoiding DNS changes, and rolls back instantly by deleting the temporary group.

Key Concept

AWS Elastic Beanstalk Deployment Strategies

Estimated Time:2m 30s

Question 912Question →

A developer is designing a secure communication channel between an internal inventory processing application running on Amazon ECS tasks and a backend Amazon API Gateway REST API in the same AWS account. The API must only accept requests originating from the ECS tasks, and unauthorized access must be blocked at the API Gateway layer before invoking any backend integration. The developer wants to implement this security control with the least administrative and custom development effort.

Which of the following authorization strategies meets these requirements?

Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.

Configure a Lambda custom authorizer that intercepts incoming requests, parses the ECS container metadata, and manually validates the caller's IAM role credentials against an access control list.

Configure an Amazon Cognito Identity Pool as the API Gateway method authorizer, and configure the ECS application to obtain and submit OpenID Connect tokens to authenticate requests.

Set up API Gateway to use Lambda Proxy Integration, and write custom validation logic in the backend Lambda function to verify the caller's identity in the request context.

Show answer & explanation

Answer: Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.

Answer

The correct strategy leverages the native AWS_IAM authorization feature of Amazon API Gateway. When a REST API method is configured with AWS_IAM authorization, callers must sign their requests using AWS Signature Version 4 (SigV4). The ECS Task Role is granted permissions via an IAM policy allowing the execute-api:Invoke action. This approach meets all security requirements, enforces authorization at the API Gateway layer before invoking backend resources, and requires zero custom code or authorizer management.

Step-by-Step Solution

Select the built-in AWS_IAM authorization type on the API Gateway method configuration page.

This ensures that API Gateway intercepts incoming requests and expects them to be signed using Signature Version 4 (SigV4).

Enabling native IAM authorization blocks unauthorized requests at the edge (API Gateway layer) without running backend code or custom Lambda authorizers.

Assign an IAM policy to the ECS Task Role with permission to execute the invoke action on the API Gateway resource.

The ECS task gains permission to call the API Gateway endpoint under the action execute-api:Invoke.

This implements the principle of least privilege, granting only the necessary permissions to the specific ECS task executing the application.

Configure the ECS application code to sign outgoing HTTPS requests to the API Gateway endpoint using AWS Signature Version 4.

The requests contain the necessary authorization headers (derived from the temporary ECS credentials) for API Gateway to validate.

SigV4 signing is required for any request authenticated via AWS_IAM.

Key Concept

API Gateway AWS_IAM Authorization

Question 913Question →

A developer is troubleshooting a local Java application that is failing to authenticate with Amazon DynamoDB. The developer has configured a profile in the shared credentials file (~/.aws/credentials) and also set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal session.

In which of the following locations will the default credential provider chain look to resolve credentials, and which has higher precedence? (Select TWO.)

Select all that apply

Environment variables are evaluated first and have higher precedence than the shared credentials file.

The shared credentials file is evaluated after environment variables are checked.

Hardcoded credentials in the application's source code are evaluated as the final fallback in the default credential provider chain.

AWS Systems Manager Parameter Store is checked before the shared credentials file.

The IAM trust policy of the developer's local workstation is evaluated first.

Show answer & explanation

Answer: Environment variables are evaluated first and have higher precedence than the shared credentials file.; The shared credentials file is evaluated after environment variables are checked.

Answer

The default credential provider chain evaluates environment variables first, and then evaluates the shared credentials file.

The Default Credentials Provider Chain in the AWS SDK evaluates credential sources in a specific order of precedence. Environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) are evaluated first, while the shared credentials file (~/.aws/credentials) is checked later in the chain.

Step-by-Step Solution

Determine the first locations checked by the Default Credentials Provider Chain.

The SDK checks environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) first.

Environment variables have higher precedence in the default credential chain than configuration files.

Determine where the SDK looks if environment variables are not present or to establish the next fallback.

The SDK checks the shared credentials file (~/.aws/credentials) next.

The shared credentials file is evaluated after environment variables.

Key Concept

AWS SDK Default Credentials Provider Chain precedence order

Estimated Time:1m 0s

Question 914Question →

A developer is deploying a containerized API application to Amazon ECS on AWS Fargate. The container needs to send its application logs to Amazon CloudWatch Logs using the awslogs log driver. Additionally, the application code itself needs to store uploaded user profile images in an Amazon S3 bucket. How should the developer configure the IAM roles in the task definition to satisfy these requirements?

Associate an IAM role containing both Amazon S3 write and CloudWatch Logs write permissions as the Task Execution Role, and omit the Task Role.

Associate an IAM role with CloudWatch Logs write permissions as the Task Role, and associate an IAM role with Amazon S3 write permissions as the Task Execution Role.

Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Associate an IAM role with Amazon S3 write permissions as the Task Role, and hardcode temporary AWS credentials for CloudWatch Logs write access within the container's environment variables.

Show answer & explanation

Answer: Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Answer

Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

The correct answer correctly separates the roles: the Task Role provides AWS credentials to the application code running inside the container, granting access to Amazon S3. The Task Execution Role provides credentials to the Amazon ECS container agent, allowing it to write container logs to Amazon CloudWatch Logs.

Step-by-Step Solution

Analyze the permission requirements for the containerized application.

The application code running inside the container requires access to Amazon S3, while the container agent requires access to Amazon CloudWatch Logs for logging.

This separates the security contexts of the application code versus the infrastructure/agent management.

Map the application code permissions to the appropriate ECS configuration parameter.

Assign the S3 access permissions to the Task Role.

The Task Role is designed to provide credentials to the containerized application code.

Map the ECS agent permissions to the appropriate ECS configuration parameter.

Assign the CloudWatch Logs write permissions to the Task Execution Role.

The Task Execution Role is designed to grant permissions to the Amazon ECS container agent to pull images and write logs.

Key Concept

ECS Task Role vs. ECS Task Execution Role

Estimated Time:1m 30s

Question 915Question →

A developer is designing an application that must encrypt large payload files locally before sending them to an external storage system. The developer wants to implement client-side envelope encryption using an AWS KMS customer managed key. Which of the following actions must the developer perform to implement this encryption workflow? (Select TWO.)

Select all that apply

Call the AWS KMS GenerateDataKey API operation using the customer managed key to retrieve a plaintext data key and a ciphertext data key.

Encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from application memory.

Call the AWS KMS Encrypt API operation directly with the large payload and the customer managed key.

Call the AWS KMS GenerateDataKeyWithoutPlaintext API operation, and use the returned ciphertext data key to encrypt the payload.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter for subsequent local encryption operations.

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API operation using the customer managed key to retrieve a plaintext data key and a ciphertext data key.; Encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from application memory.

Answer

To implement client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and a ciphertext data key, encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from memory.

In envelope encryption, the developer first obtains both a plaintext and a ciphertext data key by calling the GenerateDataKey API with a customer managed key. The plaintext data key is used to encrypt the payload locally, and then the plaintext key is immediately destroyed from memory to maintain security. The ciphertext data key is stored alongside the encrypted payload.

Step-by-Step Solution

Generate the data keys using AWS KMS.

Call GenerateDataKey with the identifier of the customer managed key to obtain both a plaintext data key and an encrypted ciphertext data key.

The plaintext key is needed for the local encryption process, while the ciphertext key will be stored alongside the encrypted data.

Perform local encryption and secure the keys.

Encrypt the payload locally using the plaintext data key, and then immediately destroy the plaintext data key from memory.

Destroying the plaintext key ensures that it cannot be retrieved from memory by unauthorized processes, while the ciphertext key can be safely stored.

Key Concept

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key (the KMS key). This workflow allows local encryption of large datasets without sending the actual data to KMS.

Question 916Question →

A developer is setting up AWS CodeDeploy to deploy an application to Amazon EC2 instances. The deployment fails because CodeDeploy lacks the necessary permissions to interact with AWS services on behalf of the developer.

Which configuration must the developer implement to resolve this permission issue?

Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.

Create an IAM role for the EC2 instances and attach a policy allowing the codedeploy:AssumeRole action directly on the instances.

Store the AWS credentials for CodeDeploy in AWS Systems Manager Parameter Store and retrieve them using an EC2 user data script.

Configure the AppSpec file with the EC2-specific ApplicationStart hook to execute a script that elevates CodeDeploy agent permissions.

Show answer & explanation

Answer: Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.

Answer

Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.

The correct answer is to create an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to perform necessary operations, such as interacting with EC2 instances, on the developer's behalf.

Step-by-Step Solution

Identify the service that requires permissions.

AWS CodeDeploy needs permissions to interact with EC2 instances and other AWS services.

CodeDeploy acts as a service principal and must be authorized to perform actions on your behalf.

Create an IAM service role with the correct trust relationship.

A service role is created where the trust policy allows the service principal codedeploy.amazonaws.com to perform the sts:AssumeRole action.

This trust relationship enables the CodeDeploy service to assume the permissions defined in the role.

Attach the AWSManagedPolicy for CodeDeploy to the role.

The AWSCodeDeployRole policy is attached to the created IAM role.

This policy contains the permissions CodeDeploy needs to manage deployments.

Key Concept

AWS CodeDeploy Service Role configuration and trust policy requirements

Question 917Question →

A developer is implementing a microservice on Amazon ECS that needs to decrypt application configuration data using a customer managed key stored in AWS KMS. The developer attaches an IAM policy to the ECS Task Role that grants the `kms:Decrypt` permission for the specific KMS key. However, the microservice fails to decrypt the data and receives an `AccessDeniedException`. Which of the following is the most likely explanation for this authorization failure?

The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.

The `kms:Decrypt` permission must be attached to the ECS Task Execution Role instead of the ECS Task Role to allow the containerized application to call the KMS API.

The ECS Task Role is not permitted to call the AWS KMS API directly, so the developer must store the configuration as a SecureString in AWS Systems Manager Parameter Store.

The customer managed key is a symmetric key, which restricts direct decryption API calls and requires the application to implement client-side envelope encryption.

Show answer & explanation

Answer: The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.

Answer

The correct answer explains that for customer managed keys, the KMS key policy is the ultimate authority. An IAM policy cannot grant access to a KMS key unless the key policy explicitly allows the principal or delegates authority to the AWS account to allow IAM-based delegation. Without this key policy configuration, KMS calls will result in an AccessDeniedException.

Step-by-Step Solution

Analyze the IAM policy and the error message.

The ECS Task Role has the required IAM permission (`kms:Decrypt`), but the application receives an `AccessDeniedException` from KMS.

To determine if the issue is inside the IAM policy or elsewhere in AWS KMS authorization.

Recall AWS KMS evaluation logic for key policies and IAM policies.

KMS requires an explicit allowance in the KMS key policy. Unlike other services, IAM policies alone cannot grant access to a KMS key unless the key policy delegates authority to the account's IAM policies.

To identify where the missing permission configuration resides.

Evaluate the key policy requirements for a customer managed key.

The key policy must either explicitly list the ECS Task Role's ARN as a principal allowed to call `kms:Decrypt`, or it must delegate permission to the account root principal, which then allows IAM policies to grant the permission.

To select the correct reason for the authorization failure.

Key Concept

AWS KMS Key Policies vs IAM Policies

Question 918Question →

A developer is designing a web-based smart-home dashboard. Users must sign in using an external corporate OpenID Connect (OIDC) identity provider. After signing in, the dashboard client application must be able to:

1. Invoke an Amazon API Gateway REST API to retrieve telemetry data, using the user's authenticated profile to authorize the requests.
2. Download device logs directly from a private Amazon S3 bucket, where each user has access only to their own device subfolder (prefixed with their user ID).

Which TWO configurations are required to meet these requirements with the least operational overhead? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, and configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API.

Configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, and associate an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.

Configure an Amazon Cognito User Pool, and map the OIDC claims to local attributes to generate temporary AWS credentials directly within the User Pool for direct S3 access.

Create a custom Amazon API Gateway Lambda authorizer that retrieves OIDC provider public keys, verifies the JWT, and calls the STS AssumeRole API to return temporary AWS credentials back to the client application for S3 access.

Create an IAM User with a policy allowing read access to the S3 bucket, configure the User Pool to distribute the IAM User's access key and secret key to the client application, and initialize the AWS SDK client.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, and configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API.; Configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, and associate an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.

Answer

The developer must configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API, and configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, associating an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.

To authenticate external OIDC users and secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool with the OIDC provider as a federated identity provider, and secure the API Gateway with a built-in Cognito authorizer. To allow secure, direct S3 downloads using dynamic user-specific prefixes, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool, and map authenticated users to an IAM role that uses policy variables to restrict access to their specific directory prefix.

Step-by-Step Solution

Set up User Authentication

Configure an Amazon Cognito User Pool to federate with the external OIDC provider. This allows the web dashboard client to authenticate users and obtain JSON Web Tokens (JWTs) representing their identity.

Cognito User Pools serve as the identity directory and handle the OIDC handshake, token issuance, and user profile management.

Secure API Gateway REST API

Configure a built-in Cognito Authorizer on Amazon API Gateway REST API pointing to the User Pool. The client will pass the identity token in the authorization header.

Using the built-in Cognito Authorizer validates the JWT signature and expiration automatically, reducing operational overhead and custom code.

Enable Fine-Grained AWS Resource Access

Create a Cognito Identity Pool (federated identities) and configure the User Pool as an authentication provider. Map the authenticated role to an IAM role that permits S3 operations on prefixes filtered by the Cognito identity ID policy variable.

Cognito Identity Pools exchange the User Pool JWT for temporary, limited-privilege AWS credentials, allowing direct, secure S3 downloads without exposing long-lived IAM keys.

Key Concept

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize access to AWS resources by exchanging these tokens for temporary AWS credentials.

Question 919Question →

A developer is deploying a secure microservice to Amazon ECS using the AWS Fargate launch type behind an Application Load Balancer (ALB). The container definition references a database connection string stored in AWS Systems Manager Parameter Store using the container definition `secrets` parameter. The containerized application listens on port 8080. Which combination of configurations must the developer implement to successfully route traffic to the application and allow the container to start?

Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task execution role.

Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task role.

Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Store the database connection string in AWS Secrets Manager instead, because Systems Manager Parameter Store parameters cannot be referenced in the container definition secrets parameter.

Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Update the ECS task execution role's trust policy to allow the ec2.amazonaws.com service principal to assume the role.

Show answer & explanation

Answer: Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task execution role.

Answer

To deploy a containerized service on AWS Fargate behind an ALB and retrieve secrets from Systems Manager Parameter Store at task startup, the developer must use the awsvpc network mode, configure the ALB target group with target type ip, and grant ssm:GetParameters permission to the ECS task execution role.

The correct option correctly identifies that the awsvpc network mode is required for AWS Fargate. When using awsvpc, the ALB target group must register targets by IP address, so the target type must be set to ip. Additionally, since the database connection string is retrieved at task startup by the ECS agent via the container definition's secrets parameter, the permissions for ssm:GetParameters must be assigned to the ECS task execution role.

Step-by-Step Solution

Identify the networking requirements for AWS Fargate tasks.

AWS Fargate tasks must use the awsvpc network mode.

Fargate does not support other network modes like bridge or host.

Determine the correct ALB target group registration type for the awsvpc network mode.

The target group type must be configured as ip.

Because tasks using the awsvpc network mode are allocated their own Elastic Network Interfaces (ENIs) with private IP addresses, they must be registered with the ALB by IP address rather than instance ID.

Identify the correct IAM role required for the ECS container agent to retrieve secrets during task initialization.

The ssm:GetParameters permission must be attached to the ECS task execution role.

The task execution role is used by the Amazon ECS container agent to pull images and retrieve secrets from Parameter Store or Secrets Manager before the containers start. The task role is used by the application code itself once running.

Key Concept

Differentiating between ECS Task Role and Task Execution Role, and configuring networking for Fargate behind an Application Load Balancer.

Estimated Time:2m 30s

Question 920Question →

A developer is running a local Node.js application that uses the AWS SDK for JavaScript (v3) to read data from an Amazon DynamoDB table. The local machine has multiple AWS profiles defined in the `~/.aws/credentials` file. When executing the application, it fails with an `AccessDeniedException` because it attempts to use the default profile instead of a specific profile named `development-admin`. Which of the following actions can the developer take to resolve this issue? (Select TWO.)

Select all that apply

Set the `AWS_PROFILE` environment variable to `development-admin` in the local terminal before executing the application.

Import the `fromIni` credential provider from the SDK and use it to explicitly instantiate the DynamoDB client with the `development-admin` profile.

Hardcode the AWS Access Key ID and Secret Access Key from the `development-admin` profile directly into the application code during client initialization.

Store the access keys in AWS Systems Manager Parameter Store and retrieve them dynamically without configuring any local credentials.

Update the IAM trust policy of the DynamoDB service role to allow access from local development IP addresses without credentials.

Show answer & explanation

Answer: Set the `AWS_PROFILE` environment variable to `development-admin` in the local terminal before executing the application.; Import the `fromIni` credential provider from the SDK and use it to explicitly instantiate the DynamoDB client with the `development-admin` profile.

Answer

Configure the local application to use the correct profile by setting the AWS_PROFILE environment variable or by explicitly loading the profile using the fromIni credential provider in the application code.

Setting the AWS_PROFILE environment variable forces the AWS SDK to look for the specified profile inside the shared credentials file. Alternatively, programmatically loading the profile via the fromIni credential provider configures the client to explicitly request credentials matching the development-admin profile.

Step-by-Step Solution

Analyze how the AWS SDK for JavaScript resolves local credentials.

Identify that the SDK uses the Default Credential Provider Chain, which looks for the AWS_PROFILE environment variable before falling back to the default profile in the credentials file.

Understanding credential precedence is key to routing local requests to the correct IAM profile.

Configure the execution environment using a named profile.

Setting the AWS_PROFILE environment variable instructs the SDK to use the development-admin profile from the shared configuration, resolving the AccessDeniedException.

Environment variables are evaluated early in the provider chain and require no code changes.

Implement code-based profile selection as an alternative.

Use the fromIni provider to programmatically select the development-admin profile from the credentials file.

This guarantees that the application consistently targets the correct profile, regardless of the developer's terminal environment variables.

Key Concept

AWS SDK Credential Provider Chain and Named Profiles

Estimated Time:1m 0s

PreviousPage 46 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept