Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 941Question →

A developer is configuring a serverless application where an AWS Lambda function in Account A (111111111111111111111111) needs to ingest records from an Amazon Kinesis data stream located in Account B (222222222222222222222222). The Lambda function runs under the execution role `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

To accomplish this, the developer creates a role named `CrossAccountStreamReader` in Account B with the following permission policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kinesis:DescribeStream",
"kinesis:GetShardIterator",
"kinesis:GetRecords"
],
"Resource": "arn:aws:kinesis:us-east-1:222222222222:stream/DataIngestStream"
}
]
}

The Lambda function code is written to assume this role using the AWS Security Token Service (STS) before calling Kinesis APIs. However, when executing the function, the developer receives an `AccessDenied` error during the STS `AssumeRole` API call.

Which TWO configurations are required to resolve this error? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to `LambdaExecutionRole` in Account A that allows the `sts:AssumeRole` action on `arn:aws:iam::222222222222:role/CrossAccountStreamReader`.; Configure the trust policy of the `CrossAccountStreamReader` role in Account B to allow the `sts:AssumeRole` action with the Principal set to `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

Answer

To resolve the issue, the developer must attach an IAM policy to the Lambda execution role in Account A that allows the `sts:AssumeRole` action on the target cross-account role, and configure the trust policy of the cross-account role in Account B to trust the Lambda execution role.
To successfully execute a cross-account API call using STS assume role, the permission must be allowed on both sides. The calling identity in the source account (the Lambda execution role) must have an identity-based permission policy allowing it to call the `sts:AssumeRole` action on the target role. Concurrently, the target role in the destination account must have a trust policy (resource-based policy on the role itself) that lists the caller's ARN as a trusted principal.

Step-by-Step Solution

1
Grant permission to the Lambda function's execution role to assume the target role.
Create and attach an IAM policy to the execution role in Account A allowing the `sts:AssumeRole` action on the target role ARN (`arn:aws:iam::222222222222:role/CrossAccountStreamReader`).
By default, IAM entities do not have permission to assume roles, especially across accounts. This permission must be explicitly granted on the source side.
2
Establish the trust relationship on the target role in the destination account.
Edit the trust policy of the cross-account role in Account B to declare the execution role ARN (`arn:aws:iam::111111111111:role/LambdaExecutionRole`) as a trusted Principal.
An IAM role must explicitly define who is authorized to assume it. This prevents unauthorized identities from gaining access to resources in Account B.

Key Concept

Cross-account access via IAM roles requires a two-way authorization configuration: the calling identity must have permission to assume the role, and the target role's trust policy must trust the calling identity. Additionally, Amazon Kinesis Data Streams do not support resource-based policies, necessitating the use of cross-account IAM roles for this scenario.
Question 942Question →

A developer writes an AWS Serverless Application Model (SAM) template to deploy a Lambda function that reads objects from an Amazon S3 bucket. The template is configured as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessUploadsFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: ./src
Handler: index.handler
Runtime: nodejs18.x
Policies:
- S3ReadPolicy

When executing `sam deploy`, the deployment fails with a CloudFormation template validation or parsing error. Which of the following describes the root cause of this deployment failure and the correct resolution?

Show answer & explanation

Answer: The S3ReadPolicy template requires a parameter. The developer must specify the target bucket name by structuring the policy as an object with the BucketName property.

Answer

The S3ReadPolicy template requires a parameter, meaning the developer must specify the target bucket name by structuring the policy as an object with the BucketName property.
AWS SAM policy templates allow developers to easily scope permissions for Lambda functions. However, many policy templates (such as `S3ReadPolicy`) require parameters to be explicitly defined. Specifying the policy template name as a string element under the `Policies` list is invalid when parameters are required. The correct approach is to define it as an object with the required parameters (e.g., `S3ReadPolicy` mapped to a nested `BucketName` property).

Step-by-Step Solution

1
Examine the Policies property configuration in the SAM template.
The template defines the policy as a string element in a list: `- S3ReadPolicy`.
To identify why the validation or parsing error occurred during deployment.
2
Review the requirements for the AWS SAM S3ReadPolicy template.
The S3ReadPolicy requires the `BucketName` parameter to scope the read permissions to a specific S3 bucket.
To determine whether the policy template requires arguments or can be used as a simple string.
3
Reformat the policy definition to supply the required parameter.
Change the policy definition to a key-value object containing the policy template name and the bucket reference.
To satisfy the parameter validation requirements of the SAM translator.

Key Concept

AWS SAM Policy Templates Parameter Requirements
Question 943Question →

A developer is building a new web application and needs to implement user registration, login, and profile management. The developer wants to store user profile data directly in a managed user directory and support federated sign-in through external identity providers. Which Amazon Cognito feature should the developer use?

Show answer & explanation

Answer: Amazon Cognito user pools

Answer

Amazon Cognito user pools
Amazon Cognito user pools act as user directories that provide sign-up and sign-in services for web and mobile applications. They store user profiles and support authentication using external identity providers.

Step-by-Step Solution

1
Analyze the requirements for storing user profiles, managing registration/login, and supporting federated identity providers.
The requirements point to a need for a managed user directory.
Before selecting a service, the specific authentication vs. authorization needs must be identified.
2
Distinguish between the directories component and the credentials federation component of Amazon Cognito.
User Pools manage authentication and directories, while Identity Pools manage authorization and temporary AWS credentials.
This prevents mixing up the two main features of Amazon Cognito.
3
Select the component that natively matches the directory, registration, and login requirements.
Amazon Cognito user pools is the correct selection.
User Pools are specifically designed to act as the identity provider and user directory.

Key Concept

Distinction between Amazon Cognito User Pools and Identity Pools
Estimated Time:45s
Question 944Question →

A developer is configuring the deployment settings for a critical production API hosted on AWS Elastic Beanstalk. The application currently runs on an Auto Scaling group of 8 instances and experiences a constant heavy workload. The deployment of the new application version must meet the following requirements:

- The environment must maintain its full capacity of 8 healthy instances running the current version during the deployment process.
- If the deployment fails, the rollback must be immediate and must not require redeploying the previous version to the instances, preventing any service disruption to the active environment.
- The new version must be deployed to new instances and pass health checks before any production traffic is routed to them.

Which Elastic Beanstalk deployment strategy satisfies these requirements?

Show answer & explanation

Answer: Immutable

Answer

The immutable deployment strategy satisfies the requirements by launching a temporary Auto Scaling group to deploy the new application version, maintaining full capacity of the original environment, and allowing for an immediate, non-disruptive rollback if health checks fail.
The correct answer is the immutable deployment strategy. An immutable deployment ensures that a temporary Auto Scaling group is created to host the new version of the application, running alongside the existing Auto Scaling group. This setup maintains the full capacity of the original instances (8 instances) during the update. If health checks on the new instances fail, the rollback is immediate and clean because AWS Elastic Beanstalk only needs to terminate the temporary Auto Scaling group. The active instances in the original Auto Scaling group remain completely untouched, ensuring zero disruption and avoiding any redeployment steps for rolling back.

Step-by-Step Solution

1
Analyze the capacity requirement.
Since the environment must maintain its full capacity of 8 healthy instances running the current version, any strategy that takes existing instances offline (such as Rolling or All-at-once) is ruled out. This leaves 'Immutable' and 'Rolling with additional batch' as potential options.
To ensure peak performance is not degraded during the deployment.
2
Evaluate the rollback and active environment constraints.
A rollback must be immediate and must not perform redeployment steps on the existing active instances. 'Rolling with additional batch' updates the existing instances in the active Auto Scaling group; if a failure occurs, it must perform a rollback by redeploying the older version back to the updated instances, which takes time and modifies active instances. 'Immutable' uses a separate temporary Auto Scaling group, so a rollback simply involves terminating that group, leaving the original group completely untouched.
To determine which strategy isolates the rollback impact and provides the fastest recovery time.
3
Confirm health check validation.
The immutable deployment strategy validates the health of all instances in the temporary Auto Scaling group before cutting over traffic, meeting the validation requirement.
To verify that the chosen strategy aligns with all remaining constraints.

Key Concept

AWS Elastic Beanstalk Immutable deployments isolate new version instances in a temporary Auto Scaling group, ensuring full capacity is maintained and rollbacks are immediate and clean.
Question 945Question →

A developer is building a partner portal API using an Amazon API Gateway REST API. External partner organizations will access this API using JSON Web Tokens (JWTs) issued by their own external OAuth 2.0 Identity Provider (IdP). The developer needs to secure the API so that requests are authorized only if the JWT is valid and contains a specific custom scope.

Which approach should the developer use to meet these security requirements with the least administrative and operational overhead?

Show answer & explanation

Answer: Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.

Answer

Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.
The correct approach is to configure a Lambda authorizer on the REST API. Since API Gateway REST APIs do not have a native JWT authorizer for third-party token validation (unlike HTTP APIs), a Lambda authorizer is required to run custom logic. The Lambda authorizer receives the bearer token, validates its signature against the external Identity Provider's public keys, checks the custom scopes, and returns an IAM policy that allows or denies access. This keeps the authorization logic at the API Gateway tier, protecting the backend.

Step-by-Step Solution

1
Analyze the requirements for authorization: REST API, external OAuth 2.0 IdP issuing JWTs, custom scope check, and minimum operational overhead.
The solution must validate third-party JWT tokens at the API Gateway level before hitting the backend integration.
Securing the API at the gateway level prevents unauthorized traffic from executing backend code and consuming resources.
2
Evaluate the native authorization options in API Gateway REST APIs for third-party JWTs.
Amazon API Gateway REST APIs do not natively support third-party JWT validation (unlike HTTP APIs which support JWT authorizers). Cognito User Pool authorizers only accept tokens generated by Cognito User Pools.
This rules out native Cognito User Pool authorizers for direct validation of external JWTs.
3
Select the appropriate custom authorization mechanism.
A Lambda authorizer (custom authorizer) is the standard and recommended way to validate external JWTs in a REST API. The Lambda function verifies the token signature against the IdP's JWKS (JSON Web Key Set), checks the custom scopes, and generates an IAM policy specifying whether the client is allowed to call the API method.
This achieves security verification at the gateway boundary with minimal administrative overhead.

Key Concept

API Gateway Lambda Authorizers for Third-Party JWT Validation
Question 946Question →

A developer is configuring a containerized microservice deployed on AWS App Runner that needs to access a secure legacy database running on-premises and a third-party logistics API. The database credentials must be rotated automatically every 30 days using a custom rotation function that interacts with the on-premises database via an AWS Direct Connect connection. The third-party logistics API key is static, does not require automated rotation, and needs to be shared across multiple development environments cost-effectively. Which combination of steps should the developer take to manage these credentials in compliance with security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the on-premises database credentials in AWS Secrets Manager, and configure a custom rotation Lambda function associated with a VPC to rotate the password every 30 days.; Store the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter to leverage its free tier and cross-environment accessibility.

Answer

The developer should store the on-premises database credentials in AWS Secrets Manager and configure a custom rotation Lambda function associated with a VPC to rotate the password, while storing the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database credentials require automated rotation and access to an on-premises network over Direct Connect, which is best handled by AWS Secrets Manager using a custom VPC-configured Lambda function. For the static API key that does not require automatic rotation, AWS Systems Manager Parameter Store SecureString is the most cost-effective option since standard parameters do not incur a monthly fee.

Step-by-Step Solution

1
Analyze rotation and network requirements for the database credentials.
Since the legacy database is on-premises and requires automatic 30-day rotation, AWS Secrets Manager is selected. A custom Lambda function is required because native templates do not support on-premises targets. The Lambda function must be associated with a VPC to route traffic over AWS Direct Connect.
Secrets Manager provides native scheduling for rotation, and custom Lambda functions can be deployed inside a VPC to access private or on-premises networks.
2
Analyze rotation and cost requirements for the static API key.
Since the third-party logistics API key is static, does not require automated rotation, and needs to be shared across environments cost-effectively, AWS Systems Manager Parameter Store is selected as a SecureString parameter.
Parameter Store standard parameters are free, making it the most cost-effective choice for secrets that do not require the automatic rotation feature of Secrets Manager.
3
Ensure secure reference and deployment architectures.
Avoid embedding any credentials in the Dockerfile or application source code, and retrieve them dynamically at runtime from their respective parameter store and secrets manager locations.
This prevents credential leakage via image registries or source repositories.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation requirements, network path constraints, and cost optimization.
Estimated Time:2m 30s
Question 947Question →

A developer manages a web application deployed via an AWS CloudFormation stack. The stack contains an Amazon ECS service and an Amazon RDS database instance. During troubleshooting, a team member manually modifies the RDS security group rules in the AWS Management Console to allow temporary access. During a subsequent stack update to deploy a new ECS task definition, the update fails and the stack is left in the UPDATE_ROLLBACK_FAILED state. Additionally, the developer needs to store the database credentials securely and enable automatic rotation. Which approach should the developer take to resolve the stack's state and manage the credentials?

Show answer & explanation

Answer: Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.

Answer

Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.
The correct approach involves first resolving the UPDATE_ROLLBACK_FAILED state by invoking the Continue Update Rollback action, which allows the stack to return to a stable ROLLBACK_COMPLETE state. Afterwards, drift detection should be used to identify manual, out-of-band changes (such as the security group modifications) so that the template can be updated to align with the actual infrastructure. For database credentials requiring automatic rotation, AWS Secrets Manager is the appropriate service, and using a dynamic reference in the template ensures secure integration without hardcoding secrets.

Step-by-Step Solution

1
Resolve the rollback state of the CloudFormation stack.
The stack transitions from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE.
You cannot perform new updates on a stack stuck in UPDATE_ROLLBACK_FAILED. Continue Update Rollback must be executed to return the stack to a stable state.
2
Perform drift detection and reconcile out-of-band changes.
Template is updated to align with the manually modified security groups or the resources are reverted to match the template.
Out-of-band changes create drift, causing subsequent stack operations to fail or overwrite configuration unintentionally.
3
Configure secure credential management with automatic rotation.
Credentials are created in AWS Secrets Manager and referenced dynamically in the template.
AWS Secrets Manager natively supports automatic rotation of database credentials, unlike Systems Manager Parameter Store which only stores static parameters without built-in rotation workflows.

Key Concept

Handling CloudFormation rollback failures, managing resource drift, and using AWS Secrets Manager dynamic references for credentials requiring automatic rotation.
Estimated Time:2m 0s
Question 948Question →

A developer is deploying an AWS Lambda function that processes transaction requests. The function is configured to run within the private subnets of a custom VPC. The Lambda function must connect to a private Amazon RDS PostgreSQL database cluster in the same VPC, call a public API endpoint of an external payment provider, and retrieve parameters from AWS Systems Manager Parameter Store. Which two network and security configurations should the developer implement to enable this connectivity? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the RDS database security group to allow inbound TCP traffic on port 54325432 from the security group associated with the Lambda function.; Configure a route in the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to a NAT Gateway deployed in a public subnet.

Answer

To enable connectivity, the developer must allow inbound TCP traffic on port 54325432 from the Lambda function's security group in the RDS database's security group, and configure a route in the private subnet route table directing outbound internet traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway deployed in a public subnet.
To connect the Lambda function to the RDS database, the database security group must explicitly allow inbound traffic from the security group associated with the Lambda function. Additionally, since the Lambda function runs in a private VPC subnet, it cannot access external endpoints directly. Configuring a route pointing to a NAT Gateway in a public subnet allows the Lambda function to route traffic to the external payment API and Systems Manager Parameter Store.

Step-by-Step Solution

1
Configure the security group of the destination database to permit inbound traffic from the source.
The RDS database cluster security group is updated with a rule allowing inbound TCP traffic on port 54325432 from the Lambda function's security group.
Since both resources reside within the same VPC, communication is routed locally but must be explicitly permitted by the database's security group.
2
Configure outbound routing for external internet endpoints and public AWS services.
A route is added to the private subnet route table directing 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway deployed in a public subnet.
Lambda functions inside private VPC subnets do not have public IP addresses and cannot connect directly to an Internet Gateway. A NAT Gateway translates their addresses and forwards traffic to the public internet, enabling access to the payment provider API and Systems Manager Parameter Store.

Key Concept

VPC security group rules and routing configurations for Lambda functions in private subnets.
Question 949Question →

A company is developing a client-side web application where users need to log in to their accounts and then upload profile images directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Amazon Cognito User Pools to manage user registration, authentication, and directory services.; Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.

Answer

To authenticate users and obtain temporary AWS credentials for S3 uploads, the developer should use Amazon Cognito User Pools for user directory management, and Amazon Cognito Identity Pools to authorize and obtain temporary AWS credentials.
The correct solution involves using Amazon Cognito User Pools to authenticate the users and manage their directory, combined with Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS credentials that allow the client application to upload files to the S3 bucket directly.

Step-by-Step Solution

1
Select the component for user directory management and authentication.
Use Amazon Cognito User Pools.
Cognito User Pools provide sign-up and sign-in services for web and mobile application users.
2
Select the component to exchange identity tokens for temporary AWS security credentials.
Use Amazon Cognito Identity Pools (Federated Identities).
Cognito Identity Pools enable you to grant authenticated users temporary AWS credentials to access AWS services such as Amazon S3 directly.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).
Question 950Question →

A company is evaluating AWS deployment strategies for its web application to ensure that any new version is deployed to brand new instances rather than updating the existing instances in-place. This approach is required to allow a clean separation of environments and a rapid rollback if issues are detected in production. Which two deployment strategies satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Blue/green deployment; Immutable deployment

Answer

The correct strategies are blue/green deployment and immutable deployment, as both strategies provision entirely new instances for the new application version rather than updating existing instances in-place.
Blue/green deployment and immutable deployment are designed to launch new instances for the new deployment version. Blue/green deployment creates a duplicate environment where the new version is tested before shifting traffic. Immutable deployment replaces the existing instances with new ones by launching a temporary Auto Scaling group, verifying the instances, and terminating the old ones. Both strategies preserve the original instances unchanged during the initial deployment phase, allowing for a fast and clean rollback.

Step-by-Step Solution

1
Analyze the scenario constraints and requirements.
The target strategy must deploy the application to brand new instances and avoid in-place updates to facilitate a clean separation and quick rollback.
This allows filtering out any deployment strategies that update existing instances directly.
2
Evaluate the deployment strategies against the requirement of using new instances.
Blue/green deployment creates a separate parallel environment of new instances. Immutable deployment provisions new instances in a separate Auto Scaling group or environment before terminating the old ones.
Both methods fulfill the core requirement of using new instances to avoid configuration drift and allow rapid rollback.
3
Identify why other options fail.
Rolling, all-at-once, and in-place updates deploy code directly onto the existing virtual machines, meaning they update the instances in-place.
This confirms that only blue/green and immutable deployments meet all constraints.

Key Concept

Identifying deployment strategies that utilize new instances (immutable and blue/green) versus those that update existing instances in-place (rolling and all-at-once).
Question 951Question →

A developer is configuring the following trust policy for an IAM role to be used by an AWS Lambda function:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following describes the purpose of this trust policy?

Show answer & explanation

Answer: It allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.

Answer

The correct answer states that the policy allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.
The trust policy (or trust relationship) of an IAM role defines the trusted entities (principals) that can assume the role. Specifying the service principal 'lambda.amazonaws.com' and the action 'sts:AssumeRole' allows the Lambda service to assume the role and request temporary security credentials on behalf of the function execution context.

Step-by-Step Solution

1
Analyze the JSON structure of the policy.
The document contains a 'Principal' element specifying 'lambda.amazonaws.com' and an 'Action' of 'sts:AssumeRole'.
This shows the policy is a trust policy designed to establish a trust relationship with a specific AWS service.
2
Determine the effect of the 'sts:AssumeRole' action on the service principal.
The trust policy grants the AWS Lambda service authorization to assume the IAM role.
When assumed, the role provides temporary, short-lived security credentials for the Lambda execution context.

Key Concept

IAM Role Trust Policies vs. Permissions Policies
Estimated Time:45s
Question 952Question →

A development team is preparing to deploy an application to Amazon ECS using the AWS Fargate launch type. The application container needs to pull its Docker image from a private Amazon ECR repository. Once the container is running, the application code needs to retrieve data from an Amazon S3 bucket.

Which IAM role configuration is required in the task definition to support this deployment?

Show answer & explanation

Answer: Assign an IAM role with S3 read permissions to the Task Role, and assign an IAM role with ECR pull permissions to the Task Execution Role.

Answer

Assign an IAM role with S3 read permissions to the Task Role, and assign an IAM role with ECR pull permissions to the Task Execution Role.
The correct option correctly maps S3 read permissions to the Task Role and ECR pull permissions to the Task Execution Role. When using AWS Fargate, the ECS container agent runs outside the user container and needs credentials to pull the image from ECR and write logs; these permissions must be in the Task Execution Role. Once the container is running, the application code runs inside the container and requires separate credentials to access AWS resources like Amazon S3; these permissions must be in the Task Role.

Step-by-Step Solution

1
Identify the entity responsible for pulling the Docker container image from Amazon ECR.
The Amazon ECS container agent is responsible for pulling the image before the container starts.
The container agent runs outside the user's container and requires AWS credentials to pull from a private ECR repository.
2
Determine which IAM role provides permissions to the ECS container agent.
The Task Execution Role provides these credentials.
AWS Fargate uses the Task Execution Role for actions the ECS agent performs on your behalf (such as pulling ECR images and pushing logs to CloudWatch).
3
Identify the entity running the application code and the AWS services it needs to access.
The application code runs inside the container and needs to access Amazon S3.
The Task Role supplies temporary AWS credentials directly to the containerized application at runtime.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Question 953Question →

A developer is managing a continuous delivery pipeline in AWS CodePipeline that consists of Source, Build, Test, and Production stages. The developer needs to temporarily stop code changes from being deployed to the Production stage while allowing developers to continue committing code and verifying builds in the Test stage. Additionally, the developer must configure the system to send email alerts to the operations team whenever any stage in the pipeline fails. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the inbound transition on the Production stage in AWS CodePipeline.; Create an Amazon EventBridge rule that filters for CodePipeline stage execution failures and targets an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the operations team.

Answer

Disable the inbound transition on the Production stage in AWS CodePipeline, and create an Amazon EventBridge rule that filters for CodePipeline stage execution failures and targets an Amazon Simple Notification Service (Amazon SNS) topic subscribed to by the operations team.
To satisfy the deployment restriction requirement, disabling the inbound transition on the Production stage ensures that new changes can propagate through Source, Build, and Test but will not enter Production. To satisfy the email alert requirement, creating an EventBridge rule that filters on failed stage executions and targets an SNS topic is the correct and standard integration pattern.

Step-by-Step Solution

1
Identify the stage transition control mechanism in AWS CodePipeline.
Disabling the transition into the Production stage stops new executions from entering the Production stage while keeping transitions between Source, Build, and Test active.
This satisfies the requirement to allow developers to continue committing code and running tests without deploying to production.
2
Identify the notification mechanism for pipeline failures.
An Amazon EventBridge rule is created to detect CodePipeline Stage Execution State Changes where the state is FAILED.
EventBridge can trigger an Amazon SNS topic to send emails to the operations team, which is the standard event-driven approach for CodePipeline notifications.

Key Concept

AWS CodePipeline stage transitions and EventBridge notifications integration
Question 954Question →

A developer is building a mobile fitness tracking app. The app requires users to create an account, sign in with a username and password, and manage their profile data. The application does not need to access other AWS services directly from the mobile client. Which Amazon Cognito feature should the developer implement to provide the user directory and authentication services?

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools
Amazon Cognito User Pools provide a fully managed user directory that handles user registration, authentication (sign-up/sign-in), and profile management. Since the application does not require direct access to other AWS services from the mobile client, a User Pool alone satisfies the requirements.

Step-by-Step Solution

1
Analyze the requirements for user authentication, registration, and directory management in the mobile application context.
The application needs a secure user directory to store profile data, along with registration (sign-up) and login (sign-in) flows.
This identifies that the core need is authentication (AuthN) and user management, not AWS resource authorization (AuthZ).
2
Evaluate the role of Amazon Cognito User Pools for this requirement.
Amazon Cognito User Pools act as the identity provider, containing the user directory, sign-up, sign-in, and account recovery features out-of-the-box.
Since the app only needs to authenticate users and manage their profiles without accessing other AWS resources directly, a User Pool is the correct and complete solution.
3
Distinguish from Cognito Identity Pools and other security configurations.
Cognito Identity Pools are for granting temporary credentials for AWS resources, which is not needed. Custom Lambda Authorizers control API Gateway access, and hardcoded IAM keys violate security best practices.
This rules out the incorrect options and confirms that a Cognito User Pool is the most appropriate and secure architecture.

Key Concept

Cognito User Pools vs. Identity Pools
Estimated Time:45s
Question 955Question →

A developer is building a serverless web application that allows users to authenticate using external social identity providers (Google and Apple). After logging in, users must be able to upload files directly to a private Amazon S3 bucket. The frontend application runs in the user's browser.

Which two steps should the developer perform to configure authentication and authorization for this application? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito user pool with Google and Apple as social identity providers to manage user authentication and issue identity tokens.; Configure an Amazon Cognito identity pool using the user pool as an identity provider, and link it to an authenticated IAM role that permits S3 PutObject operations.

Answer

The correct configurations are to configure an Amazon Cognito user pool with Google and Apple as social identity providers to manage user authentication, and configure an Amazon Cognito identity pool using the user pool as an identity provider linked to an authenticated IAM role that permits S3 PutObject operations.
To support authentication with external social providers and direct access to AWS resources like Amazon S3 from a client-side application, a combination of Amazon Cognito user pools and identity pools is required. The user pool acts as the user directory and manages federation with Google and Apple, returning identity tokens upon successful login. The identity pool then exchanges these tokens for temporary AWS credentials by assuming an authenticated IAM role. This IAM role contains the permission policy permitting write access to S3, and its trust policy allows the identity pool service to assume the role.

Step-by-Step Solution

1
Configure user authentication using a Cognito user pool.
Users can log in using Google or Apple and receive JSON Web Tokens (JWTs) representing their identity.
Cognito User Pools serve as the identity provider and directory to authenticate users via external social providers.
2
Configure a Cognito identity pool to exchange the tokens for AWS credentials.
The identity pool exchanges the JWTs for temporary, limited-privilege AWS credentials.
Cognito Identity Pools handle authorization by mapping authenticated user identities to IAM roles that permit direct access to AWS services.
3
Associate an authenticated IAM role with the identity pool that grants S3 permissions.
The client application receives temporary credentials allowing it to execute PutObject calls to the S3 bucket.
An IAM role must have a trust policy allowing Cognito Identity Pools to assume it, and a permissions policy granting access to the S3 bucket.

Key Concept

Separation of authentication and authorization using Amazon Cognito User Pools and Identity Pools.
Question 956Question →

A developer is updating a web application hosted on an AWS Elastic Beanstalk environment. The developer needs to deploy the new application version as quickly as possible. The application is for internal testing, so temporary downtime during the deployment is acceptable, and there is no budget for additional Amazon EC2 instances. Which Elastic Beanstalk deployment strategy meets these requirements?

Show answer & explanation

Answer: All-at-once

Answer

All-at-once
The All-at-once deployment strategy deploys the new version to all instances simultaneously. It is the fastest deployment method and does not require any additional instances, making it the most cost-effective. However, it takes all instances out of service during the deployment, resulting in temporary downtime.

Step-by-Step Solution

1
Identify the deployment constraints from the scenario
The requirements are: fastest deployment time, acceptance of temporary downtime, and zero budget for additional EC2 instances.
Understanding the constraints is necessary to narrow down the viable deployment strategies.
2
Evaluate the deployment strategies against the capacity/cost constraint
Strategies that launch additional EC2 instances (Immutable, Rolling with additional batch) are eliminated because there is no budget for extra instances.
This filters out strategies that violate the zero extra cost constraint.
3
Compare the remaining strategies (All-at-once vs. Rolling) against the speed and downtime constraints
All-at-once is faster than Rolling and takes all instances out of service, which fits the downtime tolerance. Rolling avoids downtime but is slower.
This identifies the option that best matches the speed and downtime requirements.

Key Concept

AWS Elastic Beanstalk deployment strategies trade-offs between downtime, deployment speed, and cost.
Question 957Question →

A company is deploying a secure microservice to Amazon ECS using the AWS Fargate launch type. The application code inside the container must pull messages from an Amazon SQS queue and write processed records to an Amazon DynamoDB table. Additionally, when the container is initialized, the Amazon ECS agent must retrieve database credentials from AWS Secrets Manager using the container definition secrets parameter and inject them as environment variables. The secret is encrypted using an AWS KMS customer managed key (CMK). During deployment, the tasks fail to transition to the RUNNING state, and the developer receives an error indicating that the container helper was unable to retrieve the Secrets Manager secret. How should the developer configure the IAM roles to resolve this issue and adhere to the principle of least privilege?

Show answer & explanation

Answer: Associate an IAM policy granting secretsmanager:GetSecretValue and kms:Decrypt permissions to the ECS Task Execution Role, and associate a separate IAM policy granting SQS and DynamoDB permissions to the ECS Task Role.

Answer

The developer should associate an IAM policy with the ECS Task Execution Role that allows secretsmanager:GetSecretValue and kms:Decrypt, and associate another IAM policy with the ECS Task Role that allows Amazon SQS and DynamoDB access.
The correct option correctly separates the responsibilities of the two IAM roles. The ECS Task Execution Role is used by the ECS container agent to perform setup operations, such as pulling container images from ECR and retrieving secrets from Secrets Manager. Because the secret is encrypted with a KMS customer managed key, the execution role also requires kms:Decrypt permissions. The ECS Task Role is assumed by the application container itself at runtime to interact with AWS services like Amazon SQS and DynamoDB.

Step-by-Step Solution

1
Determine which role is responsible for retrieving secrets during container startup.
The ECS agent retrieves the secrets from Secrets Manager during the task startup phase, which requires permissions to be attached to the ECS Task Execution Role.
The Task Execution Role grants permissions to the ECS container agent, not the application itself.
2
Determine the required permissions for retrieving and decrypting the secret.
The ECS Task Execution Role must be granted secretsmanager:GetSecretValue and kms:Decrypt permissions because the secret is encrypted with a KMS customer managed key (CMK).
The ECS agent must be authorized to read the secret value and decrypt it using the specific key.
3
Determine which role is responsible for application-level AWS service access.
The application code runs inside the container and requires access to SQS and DynamoDB, which must be granted to the ECS Task Role.
The Task Role gives temporary credentials directly to the containerized application process.
4
Ensure the trust policy for both roles is correct.
Verify that both the Task Role and Task Execution Role have a trust relationship allowing the ecs-tasks.amazonaws.com service principal to assume the role.
If the trust relationship is set to ecs.amazonaws.com or another service, the tasks will fail to assume the roles during launch.

Key Concept

Understanding the separation of concerns between the ECS Task Role (application runtime permissions) and the ECS Task Execution Role (agent orchestration and startup permissions), and configuring necessary KMS decryption policies.
Estimated Time:3m 0s
Question 958Question →

A developer is deploying a microservices application to Amazon ECS using the AWS Fargate launch type in AWS Account A. The container image is stored in a private Amazon Elastic Container Registry (Amazon ECR) repository located in AWS Account B. During deployment, the ECS tasks fail to transition to the RUNNING state, and the task status shows an error indicating that the container image cannot be pulled from the remote registry. Which combination of steps should the developer perform to resolve this authentication and access issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS task execution role in Account A with an IAM policy that allows the ecr:GetAuthorizationToken action on all resources, and the ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage actions on the Account B repository.; Configure the ECR repository policy in Account B to grant read-only access for the ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage actions to the ECS task execution role ARN from Account A.

Answer

Configure the ECS task execution role in Account A with permissions to pull the ECR image, and configure the ECR repository policy in Account B to grant access to Account A's task execution role.
To pull private ECR images cross-account, the ECS task execution role in Account A needs permissions to retrieve the authorization token and access the repository layers. Simultaneously, the repository policy in Account B must allow access from the Account A task execution role principal.

Step-by-Step Solution

1
Ensure the ECS Task Execution Role in Account A has permissions to authenticate and pull from ECR.
The ECS agent can invoke ecr:GetAuthorizationToken (on resource '*') to authenticate and has read permissions on the target repository.
The task execution role provides the ECS agent with the required credentials to pull images and push logs before the container code executes.
2
Update the ECR Repository Policy in Account B to trust the Task Execution Role from Account A.
Cross-account access is authorized on the repository level.
By default, AWS resources are isolated across accounts. The ECR repository policy must explicitly allow the Task Execution Role ARN from Account A to read image layers.

Key Concept

Configuring cross-account private ECR repository access for Amazon ECS tasks by separating Task Execution Role from Task Role permissions.
Question 959Question →

A company is building a financial transactions API where an AWS Lambda function, attached to private subnets in a custom VPC, must query a private Amazon Aurora MySQL database. The function also needs to retrieve database credentials from AWS Systems Manager Parameter Store and dispatch transaction receipts to an external payment gateway. Security policies mandate that database traffic and credentials retrieval must not traverse the public internet. Which combination of network configurations and security settings will allow the function to perform all required tasks?

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.

Answer

Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
The correct configuration establishes private connectivity to AWS Systems Manager Parameter Store using an Interface VPC Endpoint, avoiding the public internet. At the same time, it uses a NAT Gateway in a public subnet to allow the Lambda function to securely route outbound internet traffic to the external payment gateway.

Step-by-Step Solution

1
Determine the routing requirements for each destination endpoint.
Database traffic must remain local within the VPC; AWS Systems Manager Parameter Store must be accessed privately within the AWS network; the external payment gateway requires routing to the public internet.
Understanding where traffic needs to route is critical for designing the correct VPC components.
2
Configure the private endpoint for Systems Manager Parameter Store.
Provision an Interface VPC Endpoint (PrivateLink) for Systems Manager (ssm) inside the private subnets.
This routes Parameter Store requests entirely within the AWS network, fulfilling the security requirement that credentials retrieval does not traverse the public internet.
3
Configure outbound routing for external internet access.
Deploy a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route in the private subnets' route table pointing 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
Because Lambda functions inside private subnets lack public IP addresses, they must use a NAT Gateway to send traffic to external endpoints like the payment gateway.

Key Concept

VPC endpoints allow private access to supported AWS services, whereas resources inside private subnets must use a NAT Gateway in a public subnet to communicate with external internet services.
Estimated Time:2m 0s
Question 960Question →

A developer is writing an appspec.yaml file to deploy updates to an AWS Lambda function using AWS CodeDeploy. Which of the following sections or hooks are valid for an AWS Lambda deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The resources section, which specifies the Lambda function name, alias, current version, and target version.; The AfterAllowTraffic hook, which is used to run validation tasks after traffic has shifted to the new version.

Answer

The valid sections or hooks for an AWS Lambda CodeDeploy deployment are the resources section and the AfterAllowTraffic hook.
In AWS CodeDeploy, the AppSpec file structure depends on the compute platform. For an AWS Lambda deployment, the resources section must be defined to specify the Lambda function name, alias, and versions. Additionally, only two lifecycle hooks are supported: BeforeAllowTraffic and AfterAllowTraffic. The correct choices represent these valid components.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target compute platform is AWS Lambda.
AppSpec file schemas and valid hooks differ significantly between AWS Lambda, Amazon ECS, and EC2/On-Premises.
2
Filter out sections and hooks that are specific to EC2/On-Premises deployments.
The files section, BeforeInstall hook, and ApplicationStart hook are identified as EC2/On-Premises specific.
EC2 deployments copy files to instances and manage local service lifecycles, which does not apply to serverless Lambda functions.
3
Select the valid Lambda-specific configuration elements from the remaining options.
The resources section (used to define the function metadata) and the AfterAllowTraffic hook (used to run post-deployment validation Lambda functions) are chosen.
AWS Lambda AppSpec files strictly require the resources section and only support BeforeAllowTraffic and AfterAllowTraffic lifecycle hooks.

Key Concept

AWS CodeDeploy AppSpec file structure for AWS Lambda compute platform
Estimated Time:1m 0s
PreviousPage 48 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin