Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 921Question →

A developer is deploying a serverless application using AWS SAM. The application features a Lambda function triggered by an API Gateway HTTP API. After using the AWS SAM CLI to package and deploy the application, the developer observes two issues:
1. The CloudFormation stack deployment fails with an error indicating that the Lambda service is unauthorized to assume the execution role associated with the function.
2. After manual role adjustment, a test request to the API Gateway endpoint fails with a 502 Bad Gateway error, even though the Lambda function executes successfully without code exceptions.

Which TWO actions should the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.; Ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match the API Gateway Lambda proxy integration requirements.

Answer

To resolve the issues, the developer must modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to assume the role, and ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match API Gateway Lambda proxy integration requirements.
The correct configurations directly address the two distinct issues. First, the IAM execution role's trust policy must explicitly permit the 'lambda.amazonaws.com' service principal to assume the role via 'sts:AssumeRole'. Second, when using Lambda proxy integration with API Gateway, the Lambda function must return a JSON response containing 'statusCode' and a stringified 'body' for API Gateway to parse the integration response successfully without returning a 502 Bad Gateway error.

Step-by-Step Solution

1
Analyze the CloudFormation error regarding role authorization.
Identify that the IAM execution role lacks a trust relationship (assume role policy) allowing the Lambda service to assume it.
Without a valid trust policy trusting lambda.amazonaws.com, the Lambda service cannot assume the role to run the code.
2
Analyze the API Gateway 502 Bad Gateway error.
Identify that the Lambda function, under Lambda proxy integration, must return a specific schema containing 'statusCode' and 'body'.
API Gateway requires this structured response to construct the HTTP response; returning arbitrary JSON structures causes a 502 error.
3
Formulate correct configuration adjustments.
Update the execution role's trust policy and modify the function code to return the required JSON response structure.
This fixes both the deployment-time trust issue and the execution-time integration format issue.

Key Concept

AWS SAM resources rely on correctly configured IAM service trust policies for function execution, and API Gateway Lambda proxy integrations demand a strict return payload contract from the backend Lambda function.
Estimated Time:2m 30s
Question 922Question →

An engineering team is developing a serverless application using the AWS Serverless Application Model (SAM). The team wants to define a default timeout of 15 seconds that automatically applies to all Lambda functions declared in the template, rather than specifying the timeout property individually for each function resource. Which of the following approaches should the team use to meet this requirement?

Show answer & explanation

Answer: Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.

Answer

Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.
Declaring the configuration under the Globals section at the root level of the template using the Function property allows the AWS SAM translator to apply that property (Timeout: 15) to all serverless functions in the template.

Step-by-Step Solution

1
Identify the AWS SAM feature used to define common configurations across resources.
The Globals section of an AWS SAM template allows developers to define common configuration settings for supported resources like Functions, APIs, and SimpleTables.
Using Globals reduces template redundancy and enforces consistent configurations.
2
Determine the correct structure for the Globals section to define Lambda timeouts.
The Globals section must be defined at the root level (same level as Transform and Resources) and contain a Function block with properties like Timeout.
This syntax tells the SAM translator to inject these properties into all AWS::Serverless::Function resources during deployment.

Key Concept

AWS SAM Globals Section
Question 923Question →

A developer is evaluating deployment strategies for an internal web application hosted on an AWS Elastic Beanstalk environment. The application can tolerate temporary downtime or reduced capacity during the update process. The primary constraint is to avoid any additional costs or the provisioning of temporary instances. Which two deployment strategies should the developer consider? (Select two.)

Select all that apply

Show answer & explanation

Answer: All-at-once; Rolling

Answer

All-at-once and Rolling
The All-at-once strategy updates all instances simultaneously, which causes downtime but incurs no additional instance costs. The Rolling strategy updates instances in batches, which reduces capacity during the deployment process but does not provision any new instances. Both strategies satisfy the requirement of not incurring additional charges or provisioning new instances while accepting downtime or reduced capacity.

Step-by-Step Solution

1
Analyze the application constraints: temporary downtime or reduced capacity is acceptable, and there must be zero additional costs or temporary instance provisioning.
Identified the need for in-place update strategies that do not increase the instance count.
This filters out any strategies that launch temporary instances to maintain capacity.
2
Evaluate the 'All-at-once' strategy against the constraints.
The strategy updates all instances at once, causing downtime, but requires no additional instances.
This is a valid option because downtime is acceptable and no additional costs are incurred.
3
Evaluate the 'Rolling' strategy against the constraints.
The strategy updates instances in batches, temporarily reducing capacity, but requires no additional instances.
This is a valid option because reduced capacity is acceptable and no additional costs are incurred.
4
Evaluate 'Immutable', 'Rolling with additional batch', and 'Traffic splitting' against the constraints.
These strategies launch new/temporary instances, which temporarily increases costs.
These are invalid because they violate the constraint against additional costs.

Key Concept

AWS Elastic Beanstalk deployment strategies trade-offs regarding cost, capacity, and downtime.
Question 924Question →

A serverless application running on AWS Lambda needs to retrieve configuration data. This includes a database hostname, which is a non-sensitive configuration parameter, and a database password, which is a sensitive credential that must be rotated automatically every month. Which two options describe the most secure and cost-effective locations to store these values? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Secrets Manager to store the database password; Systems Manager Parameter Store to store the database hostname

Answer

Secrets Manager should be used to store the database password because it supports automatic rotation, while Systems Manager Parameter Store should be used to store the database hostname to optimize costs for non-sensitive configuration data.
Storing the database password in Secrets Manager satisfies the requirement for automatic rotation. Storing the database hostname in Systems Manager Parameter Store provides a cost-effective solution for non-sensitive configuration data that does not need rotation.

Step-by-Step Solution

1
Analyze the requirements for the database password.
The password is a sensitive credential requiring automatic rotation.
Secrets Manager is selected because it manages secrets and supports automatic rotation natively.
2
Analyze the requirements for the database hostname.
The hostname is a non-sensitive configuration parameter that does not require rotation.
Systems Manager Parameter Store is selected because it is cost-effective and suited for standard configuration parameters.

Key Concept

Distinguishing between Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost-efficiency.
Estimated Time:1m 0s
Question 925Question →

A developer is deploying a serverless application using AWS SAM. The developer needs to deploy a Lambda function that retrieves a database credential from AWS Secrets Manager. The developer writes the following template (`template.yaml`):

yaml
Resources:
DBSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: my-db-secret
SecretString: '{"password":"mypassword"}'

RetrieveSecretFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Policies:
- AWSSecretsManagerGetSecretValuePolicy:
SecretArn: !Ref DBSecret
Environment:
Variables:
SECRET_NAME: !Ref DBSecret

When attempting to deploy this template using the AWS CLI `aws cloudformation deploy` command, the deployment fails with the error: `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the Lambda function code is incorrectly configured to retrieve the database credential using the Systems Manager Parameter Store SDK API client.

Which two actions must the developer take to resolve the deployment failure and ensure the Lambda function can retrieve the database credential?

Select all that apply

Show answer & explanation

Answer: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.; Modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.

Answer

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.
To successfully deploy an AWS SAM template, the `Transform: AWS::Serverless-2016-10-31` declaration must be present at the root level of the template so that AWS CloudFormation can use the serverless transform macro to compile the resources. Furthermore, the Lambda function must call the correct service API (AWS Secrets Manager client's `GetSecretValue`) since the resource is defined as `AWS::SecretsManager::Secret` and the two services do not replicate data between each other automatically.

Step-by-Step Solution

1
Add the Transform header to the AWS SAM template.
The template now contains `Transform: AWS::Serverless-2016-10-31` at the root level, allowing AWS CloudFormation to invoke the SAM transform to compile serverless resources.
Without this declaration, CloudFormation does not recognize AWS SAM resource types like `AWS::Serverless::Function`.
2
Ensure the Lambda execution role has correct permissions.
The execution role is provisioned with Secrets Manager access using the `AWSSecretsManagerGetSecretValuePolicy` SAM policy template.
The Lambda function needs permission to fetch the secret value.
3
Update the Lambda function code to use the Secrets Manager SDK client.
The code calls `GetSecretValue` from the AWS Secrets Manager client instead of querying Systems Manager Parameter Store.
SSM Parameter Store and Secrets Manager are distinct services, and the credential is saved as a Secrets Manager resource.

Key Concept

AWS SAM Template Structure and AWS Secrets Manager Integration
Question 926Question →

A developer is configuring a custom IAM role named `ApplicationLogWriterRole` for a new AWS Lambda function that must write logs to an Amazon S3 bucket. The developer attempts to define both the trust relationship and the S3 permissions in a single policy document when creating the role. The developer applies the following JSON document as the role's trust policy (Assume Role Policy):

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": [
"sts:AssumeRole",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::app-logs-2026/*"
}
]
}

No other policies are attached to the IAM role. When the Lambda function executes and attempts to upload a log file to the S3 bucket, it receives an `AccessDenied` error. How should the developer resolve this issue?

Show answer & explanation

Answer: Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.

Answer

Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.
The correct action is to modify the trust policy to allow only the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket. An IAM role trust policy governs which principal is allowed to assume the role. It cannot be used to grant permissions to access other AWS resources. To grant resource access, the permissions must be attached to the role via an identity-based permission policy.

Step-by-Step Solution

1
Isolate the role's trust relationship from the permissions.
Identify that the trust policy (Assume Role Policy) defines who can assume the role, whereas identity-based policies define what the assumed role can do.
IAM roles use two distinct types of policies: trust policies and permission policies. Combining resource access actions with assume role actions in the trust policy is invalid.
2
Correct the trust policy JSON.
Change the trust policy's Action to only allow "sts:AssumeRole", and set the Resource to "*" (as is standard for trust policies since the target is the role itself).
This allows the Lambda service principal to assume the identity of the IAM role.
3
Create and attach the identity-based permission policy.
Create a policy granting "s3:PutObject" on "arn:aws:s3:::app-logs-2026/*" and attach it directly to the IAM role.
Once the role is assumed, the temporary security credentials will carry the permissions defined in the attached identity-based policy, enabling the S3 upload.

Key Concept

Separation of Trust Policies and Permission Policies in IAM Roles
Estimated Time:2m 0s
Question 927Question →

A developer is managing an AWS CloudFormation stack for a production backend application. During a stack update, the deployment fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role referenced by the template was manually deleted out-of-band. The developer has corrected the template and needs to apply the update to the stack. Which action should the developer take to resolve the stack state and successfully deploy the update?

Show answer & explanation

Answer: Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state, optionally recreating the deleted IAM role or skipping it during the rollback, and then perform the stack update with the corrected template.

Answer

Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state (optionally skipping or recreating the deleted role), and then perform the stack update with the corrected template.
To update a CloudFormation stack that is stuck in the UPDATE_ROLLBACK_FAILED state, you must first return the stack to a stable state. Triggering ContinueUpdateRollback allows CloudFormation to complete the rollback by either skipping the deleted resource or using a recreated version of it. Once the stack is in the UPDATE_ROLLBACK_COMPLETE state, you can successfully apply the corrected template.

Step-by-Step Solution

1
Analyze the cause of the stack failure.
Confirm the stack is stuck in UPDATE_ROLLBACK_FAILED due to the missing IAM role.
You must identify the missing resource that is blocking CloudFormation from performing rollback operations.
2
Run the ContinueUpdateRollback operation.
Specify the deleted IAM role to be skipped during rollback, or recreate the IAM role with the exact same physical ID/name.
This allows CloudFormation to bypass the block and complete the rollback sequence.
3
Perform the stack update.
Deploy the corrected CloudFormation template once the stack reaches the stable UPDATE_ROLLBACK_COMPLETE state.
CloudFormation stack updates can only be initiated when the stack is in a stable, non-transitioning state.

Key Concept

Resolving CloudFormation update rollback failures due to deleted resources.
Estimated Time:1m 30s
Question 928Question →

A developer is configuring an AWS Lambda function that must run inside a private subnet of a custom VPC. The Lambda function needs to retrieve database credentials from AWS Secrets Manager without the traffic traversing the public internet, and it must also call a public API endpoint on the internet to validate transactions. Which of the following network configuration steps are required to allow the Lambda function to perform these tasks? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnet to route outbound traffic (0.0.0.0/0) through the NAT Gateway.; Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the private subnet.

Answer

To securely achieve both goals, a NAT Gateway must be deployed in a public subnet to handle internet-bound validation calls, and an Interface VPC Endpoint must be created for AWS Secrets Manager to keep the secrets retrieval traffic private.
To satisfy both requirements, the developer must configure outbound internet access and private AWS service connectivity. A NAT Gateway deployed in a public subnet allows the Lambda function in the private subnet to make outbound calls to the public API. Simultaneously, an Interface VPC Endpoint (AWS PrivateLink) is required for AWS Secrets Manager to ensure that API requests for secrets retrieval do not traverse the public internet.

Step-by-Step Solution

1
Enable internet egress for private subnet resources.
Create a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing all outbound internet traffic (0.0.0.0/0) to the NAT Gateway.
This allows the Lambda function inside the private subnet to connect to the public transaction validation API on the internet.
2
Enable private access to AWS Secrets Manager.
Create an Interface VPC Endpoint (AWS PrivateLink) specifically for AWS Secrets Manager, and map it to the private subnet with Private DNS enabled.
This routes the AWS Secrets Manager API calls through a private IP address within the VPC, ensuring that credentials traffic does not traverse the public internet.

Key Concept

Configuring public internet egress and private AWS service access for AWS Lambda functions running inside a private subnet of a custom VPC.
Estimated Time:2m 0s
Question 929Question →

An organization receives large, encrypted backup archives from an external partner. The partner encrypts these archives using envelope encryption with an AWS KMS customer managed key (CMK). Along with each archive, the partner provides the encrypted data key (ciphertext data key). Which sequence of actions must a developer implement in the decryption utility to retrieve the original plaintext data?

Show answer & explanation

Answer: Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.

Answer

Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.
In envelope encryption, data is encrypted locally using a unique symmetric data key. To decrypt the data, the application sends the ciphertext data key to AWS KMS using the Decrypt API operation. AWS KMS decrypts the key using the customer managed key and returns the plaintext data key. The application then performs the decryption locally on the large archive using the plaintext key, and then deletes the plaintext key from memory to prevent security leaks.

Step-by-Step Solution

1
Send the ciphertext data key to AWS KMS.
The AWS KMS Decrypt API decrypts the ciphertext key using the customer managed key (CMK).
Only KMS has the backing key policy and cryptographic material to decrypt the encrypted data key.
2
Receive the plaintext data key in the application memory.
The application now has the plaintext data key required for symmetric decryption.
The plaintext key is necessary to decrypt the large archive locally.
3
Decrypt the archive locally using the plaintext data key, and then zero out the key in memory.
The plaintext data is recovered, and the key is safely erased from the application's memory space.
Keeping the plaintext key in memory longer than necessary exposes it to potential memory inspection attacks.

Key Concept

AWS KMS Envelope Decryption Workflow
Estimated Time:1m 30s
Question 930Question →

A developer is configuring a continuous integration pipeline using AWS CodeBuild to compile a Node.js application, run unit tests, and push the resulting container image to an Amazon Elastic Container Registry (ECR) repository. The developer needs to configure the build process to meet the following requirements:

* The unit tests must run during the build process. If they fail, the build must stop immediately and mark the build run as failed.
* A cleanup script must execute to remove temporary files, regardless of whether the unit tests succeed or fail.
* The Docker image must only be built and pushed to Amazon ECR if all unit tests pass.

Which configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the buildspec file to run the unit tests in the build phase. Place the cleanup script in the post_build phase to run unconditionally. In the post_build phase, check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable, and only build and push the Docker image if its value is 1.

Answer

Configure the buildspec file to run the unit tests in the build phase, place the cleanup script in the post_build phase to run unconditionally, and check the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase before building and pushing the Docker image.
The correct configuration uses the build phase to run the tests and the post_build phase to run the cleanup script unconditionally. By checking the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase, the developer can conditionally build and push the Docker image only if all previous phases succeeded.

Step-by-Step Solution

1
Determine the appropriate lifecycle phases for execution and cleanup.
Unit tests are placed in the build phase so they fail the build immediately if they return a non-zero exit code. The cleanup script is placed in the post_build phase because it is guaranteed to execute even if the build phase fails.
CodeBuild executes the post_build phase regardless of the success or failure of previous phases, making it the correct place for cleanup tasks.
2
Implement conditional execution for the Docker build and push.
Check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase. If it is 1, proceed with the Docker build and ECR push commands; otherwise, skip them.
Using the built-in CODEBUILD_BUILD_SUCCEEDING variable prevents pushing an invalid or untested image if the unit tests in the build phase failed.
3
Ensure security and permission compliance.
Verify that the CodeBuild service role has a trust policy allowing codebuild.amazonaws.com to assume the role and permissions to write to ECR.
This guarantees that the CodeBuild service can assume the role and successfully push the Docker image to the registry.

Key Concept

AWS CodeBuild buildspec phases, environment variables, and execution behavior.
Question 931Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must meet the following requirements:
- Provide zero downtime for users during updates.
- Run automated integration tests to validate the replacement task set (Green) using a test port before any production traffic is shifted.
- Automatically and immediately roll back the deployment if the validation tests fail, or if a CloudWatch alarm for HTTP 5xx errors is triggered.
- Shift 10% of the production traffic to the new version initially, and shift the remaining 90% after a 15-minute soak period.

Which two configurations or lifecycle hooks should the developer use to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Use the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke an AWS Lambda function that runs the validation tests.; Select the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration for the deployment group.

Answer

Use the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a Lambda function that runs the validation tests, and select the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration for the deployment group.
The correct configurations are the AfterAllowTestTraffic lifecycle hook (which runs validation tests against the replacement task set while it is accessible via the test listener) and the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration (which routes 10% of traffic to the green deployment and the remaining 90% after 15 minutes).

Step-by-Step Solution

1
Identify the required traffic shifting behavior.
Traffic must shift 10% initially and the rest after 15 minutes.
This matches a canary traffic routing model with a 15-minute soak period, which corresponds to the CodeDeployDefault.ECSCanary10Percent15Minutes configuration.
2
Determine the correct CodeDeploy lifecycle hook for validation testing in an ECS environment.
Use the AfterAllowTestTraffic hook to run validation tests via the test port before production traffic starts shifting.
In ECS blue/green deployments, the AfterAllowTestTraffic hook executes after the replacement task set is reachable via the test listener but before production traffic is routed.
3
Identify the correct execution target for ECS lifecycle hooks.
The hook must invoke an AWS Lambda function.
Unlike EC2 deployments which run shell scripts, ECS deployments require AppSpec hooks to trigger Lambda functions.

Key Concept

Deploying updates to Amazon ECS using AWS CodeDeploy blue/green traffic shifting and lifecycle hooks.
Question 932Question →

A developer is configuring a blue/green deployment for a containerized microservice running on Amazon ECS using AWS CodeDeploy. The deployment must execute a database schema migration before the replacement task set is created. Additionally, after the replacement task set is provisioned and test traffic is routed to it via a test listener, the developer must run integration tests against the test port to validate the deployment before shifting production traffic.

Which of the following configurations should the developer implement in the AppSpec file to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify a BeforeInstall hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the database migrations.; Specify an AfterAllowTestTraffic hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the integration tests against the test port.

Answer

Specify a BeforeInstall hook in the hooks section referencing the ARN of a Lambda function to run the database migrations, and specify an AfterAllowTestTraffic hook referencing the ARN of a Lambda function to run the integration tests against the test port.
For an Amazon ECS deployment, CodeDeploy lifecycle hooks must reference AWS Lambda functions. The BeforeInstall hook runs before the replacement task set is created, which is the correct time to run database schema migrations. The AfterAllowTestTraffic hook runs after test traffic is routed to the new task set, which is the correct phase to validate the application via the test port before production traffic is shifted.

Step-by-Step Solution

1
Analyze the compute platform and deployment type for the CodeDeploy configuration.
The target compute platform is Amazon ECS, and the deployment type is blue/green.
ECS deployments have a different set of lifecycle hooks compared to EC2/On-Premises, and hooks must target AWS Lambda functions rather than local scripts.
2
Determine the correct hook for running database migrations before task set creation.
The BeforeInstall hook is selected.
BeforeInstall runs before CodeDeploy creates the replacement task set, which is the correct time to run database schema migrations.
3
Determine the correct hook for running integration tests via the test port after test traffic routing.
The AfterAllowTestTraffic hook is selected.
AfterAllowTestTraffic runs after test traffic is shifted to the replacement task set, allowing validation of the application before production traffic is routed.

Key Concept

AWS CodeDeploy ECS Lifecycle Hooks
Question 933Question →

An application hosted on an Amazon EC2 instance needs to securely retrieve configuration settings from an Amazon S3 bucket. A developer is tasked with setting up the necessary IAM permissions using security best practices. Which configuration steps should the developer perform to grant the application access to the S3 bucket? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Create an IAM role with a trust policy that permits the ec2.amazonaws.com service principal to assume the role.; Associate the IAM role with the EC2 instance by attaching an EC2 instance profile containing the role to the instance.

Answer

To allow the application on the EC2 instance to access the S3 bucket, the developer must create an IAM role with a trust policy that allows the EC2 service to assume the role, and then associate the IAM role with the EC2 instance using an EC2 instance profile.
Securing access to AWS services from an Amazon EC2 instance requires creating an IAM role with a trust policy that allows the EC2 service principal to assume the role. The role must then be attached to the EC2 instance via an EC2 instance profile, enabling the application to automatically assume the role and access S3 using temporary credentials.

Step-by-Step Solution

1
Establish trust for the EC2 service.
Create an IAM role containing a trust policy that permits the ec2.amazonaws.com service principal to call the sts:AssumeRole API action.
This enables AWS to delegate permissions to the EC2 service so it can obtain temporary credentials for the instance.
2
Associate the role with the compute resource.
Attach an EC2 instance profile containing the IAM role to the EC2 instance.
This makes the temporary credentials available to any applications or SDKs running on the EC2 instance via the instance metadata service.

Key Concept

Securing Amazon EC2 applications using IAM roles and instance profiles.
Estimated Time:1m 0s
Question 934Question →

A developer is testing a Go application locally that reads messages from an Amazon SQS queue. The developer intends to run the application using a specific AWS CLI profile named `dev-profile` defined in the `~/.aws/credentials` file. However, when executing the application in the terminal, the application connects using credentials from a different AWS account. The developer notices that the environment variables `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` are currently set in the active terminal session. Which of the following actions will resolve this issue and force the Go SDK to use the configuration from `dev-profile`?

Show answer & explanation

Answer: Unset the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` environment variables in the terminal, and set the `AWS_PROFILE` environment variable to `dev-profile`.

Answer

Unset the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the terminal, and set the AWS_PROFILE environment variable to dev-profile.
The AWS SDK credential provider chain evaluates environment variables (such as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before checking the shared credentials file. Unsetting the active environment variables and defining AWS_PROFILE forces the SDK to retrieve credentials from the specified profile.

Step-by-Step Solution

1
Analyze the AWS SDK credential lookup order.
Environment variables have the highest precedence, followed by shared credentials/config files.
To force the SDK to look at the credentials file, any higher-precedence environment variables must be cleared or bypassed.
2
Select the target profile.
Set the AWS_PROFILE environment variable to dev-profile.
This instructs the SDK's default credential provider chain to look for the specific profile configuration in the credentials file.

Key Concept

AWS SDK Default Credential Provider Chain Precedence
Question 935Question →

A developer is updating a microservice hosted on Amazon ECS. Due to budget constraints, the developer cannot provision any additional container instances in the ECS cluster. The application is currently running at its desired task count and must remain at least 50% operational during the deployment. Which deployment configuration for minimum healthy percent and maximum percent will allow the deployment to succeed under these constraints?

Show answer & explanation

Answer: minimumHealthyPercent set to 50, and maximumPercent set to 100

Answer

Setting the minimumHealthyPercent to 50 and maximumPercent to 100 allows Amazon ECS to deploy the updates within the existing cluster capacity while keeping the application partially available.
The configuration specifying minimumHealthyPercent as 50 and maximumPercent as 100 ensures that ECS can terminate up to half of the running tasks before launching new ones. This satisfies the requirement to keep the application 50% operational while ensuring that the task count never exceeds 100% of the desired limit, avoiding the need for additional instances.

Step-by-Step Solution

1
Determine the resource availability limit.
The maximum percent must be set to 100.
Since no additional container instances can be provisioned in the cluster, the deployment cannot scale out. The total number of tasks running at any time must not exceed the desired task count.
2
Determine the minimum service availability requirement.
The minimum healthy percent must be set to 50.
The service is required to remain at least 50% operational during the update, meaning at least 50% of the desired task count must be healthy and running at all times.
3
Combine the parameters to define the deployment configuration.
Select the configuration with minimumHealthyPercent at 50 and maximumPercent at 100.
This allows ECS to stop 50% of the tasks first, then start 50% of the new tasks, proceeding iteratively without exceeding the resource capacity or dropping below the availability threshold.

Key Concept

Amazon ECS Rolling Update Parameters (minimumHealthyPercent and maximumPercent)
Estimated Time:1m 0s
Question 936Question →

A developer is configuring an Amazon ECS task definition to deploy a microservice to AWS Fargate. The container image is stored in a private Amazon ECR repository. During startup, the containerized application must read database credentials from AWS Secrets Manager. The developer wants to inject these credentials as container environment variables without exposing them in plaintext or embedding them in the container image.

Which two actions should the developer take to configure the task definition and IAM roles for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action.; In the container definition, use the secrets parameter to reference the database credential secret and map it to a container environment variable.

Answer

The correct configurations are to configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action, and to reference the database credential secret using the secrets parameter in the container definition to map it to an environment variable.
The ECS agent is responsible for both pulling the container image from Amazon ECR and retrieving database credentials from Secrets Manager to inject them as environment variables during container creation. Therefore, these permissions must be granted to the ECS Task Execution Role, and the task definition container definition must use the secrets parameter to map the secret ARN to the desired environment variable name.

Step-by-Step Solution

1
Understand who performs image pulls and secrets retrieval.
The ECS agent performs these tasks during task initialization, not the containerized application code.
This determines that permissions for pulling ECR images and retrieving Secrets Manager secrets belong in the ECS Task Execution Role rather than the ECS Task Role.
2
Identify the proper IAM permissions for Secrets Manager retrieval.
Assign the secretsmanager:GetSecretValue permission to the ECS Task Execution Role policy.
The ECS agent needs this permission to call AWS Secrets Manager to retrieve the credential values.
3
Determine the proper method to inject secrets into the container definition.
Use the secrets parameter in the container definition to map the secret ARN to the environment variable.
This keeps credentials secure by injecting them at runtime, preventing the exposure of plaintext credentials in the task definition.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, and secure injection of secrets into ECS containers.
Question 937Question →

A developer is designing an AWS CloudFormation template to deploy a microservice. The microservice requires access to a database password that must be automatically rotated every 30 days, as well as a non-sensitive API endpoint URL for an external service. Which two configuration strategies should the developer use to reference these values in the CloudFormation template to ensure security, rotation support, and cost-efficiency? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Reference the database password dynamically in the template using an AWS Secrets Manager dynamic reference.; Reference the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.

Answer

Referencing the database password dynamically in the template using an AWS Secrets Manager dynamic reference, and referencing the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.
For sensitive credentials requiring automatic rotation, the correct practice is to store them in AWS Secrets Manager and reference them via an AWS Secrets Manager dynamic reference. For non-sensitive configurations that do not need rotation, the correct and cost-efficient practice is to store them in AWS Systems Manager Parameter Store and reference them via a Parameter Store dynamic reference.

Step-by-Step Solution

1
Identify the security and rotation requirements for the sensitive database password.
Determine that AWS Secrets Manager is required because it supports native automatic rotation and encryption.
Secrets Manager is built to securely store sensitive data and automate rotation workflows.
2
Identify the requirements for the non-sensitive API endpoint URL.
Determine that AWS Systems Manager Parameter Store is the most appropriate service.
Parameter Store is more cost-effective for non-sensitive data and configuration parameters that do not require rotation.
3
Integrate both services into the CloudFormation template using dynamic references.
The template securely fetches the values at runtime without exposing them in plaintext or risking resource drift.
Dynamic references allow CloudFormation to retrieve external configuration values securely when the stack is created or updated.

Key Concept

Securely referencing sensitive credentials and non-sensitive configurations in AWS CloudFormation templates using Secrets Manager and Systems Manager Parameter Store.
Question 938Question →

A developer is configuring a backend worker application to run on Amazon ECS using the AWS Fargate launch type. The application code running inside the container needs to read and write items in an Amazon DynamoDB table. The container image is hosted in a private Amazon ECR repository located in a separate, central shared AWS account. Additionally, the task definition retrieves sensitive database credentials stored in encrypted AWS Systems Manager Parameter Store parameters and injects them as environment variables at task startup. Which of the following configuration steps are required to successfully deploy the task and run the application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Assign an IAM role as the Task Role that contains a policy granting dynamodb:GetItem and dynamodb:PutItem permissions on the target DynamoDB table.; Assign an IAM role as the Task Execution Role that contains policies granting ssm:GetParameters and kms:Decrypt permissions, and configure the central ECR repository policy to allow ECR pull actions for this role.

Answer

To successfully deploy and run the application, you must assign an IAM role as the Task Role with DynamoDB access policy, and assign another IAM role as the Task Execution Role with SSM Parameter Store and KMS decryption permissions, while updating the central ECR repository policy to allow cross-account pulls.
The correct options are: assigning an IAM role as the Task Role with DynamoDB permissions, and assigning an IAM role as the Task Execution Role with SSM Parameter Store and KMS permissions alongside ECR cross-account repository access. This correctly separates the runtime application permissions (Task Role) from the container startup and orchestration permissions (Task Execution Role).

Step-by-Step Solution

1
Differentiate application-level and container-level permissions.
Identify that accessing DynamoDB is an application action, which requires permissions on the Task Role. Pulling the Docker image and retrieving configuration secrets at startup are agent-level actions, which require permissions on the Task Execution Role.
ECS separates permissions between what the container agent needs to boot the task (Task Execution Role) and what the running application needs (Task Role).
2
Configure permissions for accessing DynamoDB.
Create a policy allowing dynamodb:GetItem and dynamodb:PutItem on the target table, and attach it to the Task Role.
The code running inside the container utilizes the credentials provided by the Task Role at runtime.
3
Configure permissions for pulling the cross-account ECR image.
Update the repository policy in the central AWS account to allow the task execution role of the application account to perform pull actions (ecr:BatchGetImage, ecr:GetDownloadUrlForLayer).
Cross-account ECR pulls require both the puller to have IAM permissions and the ECR repository to explicitly trust the cross-account principal.
4
Configure permissions for SSM Parameter Store secrets resolution.
Attach policies allowing ssm:GetParameters and kms:Decrypt on the KMS key to the Task Execution Role.
Using the valueFrom syntax in the task definition instructs the ECS agent to fetch and decrypt the parameters at task creation time before launching the container.

Key Concept

Delineating responsibilities and permissions between the ECS Task Role and the ECS Task Execution Role for Fargate deployments.
Question 939Question →

To comply with security audits, the database password for an Amazon Aurora MySQL database must be stored securely and rotated automatically on a recurring schedule. Which AWS service should a developer use to manage this password and its automatic rotation?

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed for managing, retrieving, and rotating database credentials, API keys, and other secrets. It has built-in integration with Amazon RDS and Amazon Aurora to rotate database credentials automatically without requiring application redeployment.

Step-by-Step Solution

1
Identify the primary requirement
The requirement is to securely store a database password and rotate it automatically on a schedule.
This determines which AWS service has the native capabilities to handle automated lifecycle management of secrets.
2
Evaluate the capabilities of AWS Secrets Manager versus AWS Systems Manager Parameter Store
AWS Secrets Manager offers built-in integration with RDS and Aurora databases to automatically rotate credentials using AWS Lambda, whereas Parameter Store does not support automatic rotation.
Choosing the service that supports out-of-the-box rotation minimizes custom development and operational overhead.

Key Concept

AWS Secrets Manager provides native support for the automatic rotation of database credentials, whereas AWS Systems Manager Parameter Store does not.
Estimated Time:45s
Question 940Question →

An IoT analytics platform receives telemetry batches of approximately 8 MB8\text{ MB} in size from edge gateways. The data must be encrypted client-side before it is transmitted to Amazon S3. A developer is tasked with implementing this encryption using a Customer Managed Key (CMK) in AWS KMS. Which two actions must the developer perform to successfully implement this encryption workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Call the AWS KMS GenerateDataKey API specifying the Customer Managed Key to obtain both a plaintext data key and a ciphertext data key.; Encrypt the telemetry batch locally using the plaintext data key, and then discard the plaintext data key from memory.

Answer

To encrypt payloads larger than 4 KB4\text{ KB} client-side, the developer must use envelope encryption. This is done by calling GenerateDataKey to obtain both plaintext and ciphertext data keys, encrypting the data locally with the plaintext key, and then discarding the plaintext key from memory.
For payloads larger than 4 KB4\text{ KB} (such as the 8 MB8\text{ MB} telemetry batch), direct encryption using AWS KMS is not possible. The developer must implement envelope encryption. This involves calling the `GenerateDataKey` API to get both a plaintext data key and a ciphertext data key. The plaintext data key is used to encrypt the telemetry batch locally and is then deleted from memory. The ciphertext data key is stored with the encrypted data in Amazon S3 for later decryption.

Step-by-Step Solution

1
Generate cryptographic keys
Retrieve a plaintext data key and a ciphertext data key from AWS KMS.
Because the telemetry batch size (8 MB8\text{ MB}) exceeds the direct KMS encryption limit of 4 KB4\text{ KB}, envelope encryption is required.
2
Perform client-side encryption
Encrypt the telemetry batch using the plaintext data key locally.
This secures the data on the client side before transmission.
3
Clean up sensitive data in memory
Erase the plaintext data key from memory and store the ciphertext data key alongside the encrypted payload.
To prevent exposure of the plaintext key, and to ensure the data can be decrypted later using the ciphertext key.

Key Concept

AWS KMS envelope encryption workflow for handling large datasets.
Estimated Time:1m 30s
PreviousPage 47 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin