All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is configuring an AWS CodeBuild project that runs inside a private subnet of a VPC to perform integration tests against an internal Amazon RDS database. The build process must retrieve a database password stored as a SecureString parameter in Systems Manager Parameter Store. The developer stores the build commands in a custom file named `build_config.yml` inside a subdirectory named `specs/` in the source repository.

During the initial run, the build fails with an error indicating that the build specification cannot be found.

Which combination of actions will resolve the buildspec finding error and allow the build to retrieve the parameter?

Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.

Move the `build_config.yml` file to the root of the repository and rename it to `buildspec.yml`. In the CodeBuild project settings, configure the Buildspec path to point to the `specs/` directory. Ensure that the CodeBuild service role has the `ssm:GetParameters` permission.

Modify the trust policy of the CodeBuild service role to allow the `ssm.amazonaws.com` service principal to assume the role. In the `build_config.yml` file, define a custom `run-as` parameter under the `pre_build` phase pointing to the CodeBuild service role.

In the CodeBuild project settings, change the environment variable type from Parameter Store to Secrets Manager. In the `build_config.yml` file, change the `env.parameter-store` block to `env.secrets-manager` and migrate the credential to AWS Secrets Manager, as Systems Manager Parameter Store is not supported in VPC-enabled builds.

Show answer & explanation

Answer: Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.

Answer

The correct answer resolves the buildspec finding failure by specifying the custom path in the CodeBuild project configuration. It also addresses the connectivity issue by establishing a valid network path from the private VPC subnet to the public Systems Manager API.

Step-by-Step Solution

Address the buildspec location error.

By default, AWS CodeBuild looks for a file named `buildspec.yml` at the root of the source directory. Since the developer used a custom filename and path, the CodeBuild project's Buildspec setting must be updated to match this path.

This resolves the initial phase failure where CodeBuild cannot find the build specification.

Analyze VPC network requirements for accessing public AWS services.

CodeBuild containers running inside a private subnet of a VPC do not have direct internet access. To interact with public AWS services like Systems Manager Parameter Store, they need a route to the internet or private VPC endpoints.

Without this routing configuration, the build container will time out or fail when attempting to fetch parameters from Systems Manager.

Key Concept

AWS CodeBuild custom buildspec paths and VPC network access to AWS services

Estimated Time:2m 0s

Question 962Question →

An AWS Lambda function is configured to upload generated reports to an Amazon S3 bucket. During execution, the Lambda function fails to write to the bucket and returns an 'Access Denied' error. How should the developer resolve this authorization failure?

Attach an IAM policy to the Lambda execution role that grants the s3:PutObject action on the target S3 bucket ARN.

Modify the Lambda execution role's trust policy to include s3:PutObject in the Action block.

Initialize the S3 SDK client inside the Lambda function using hardcoded Administrator access keys.

Create an Amazon Cognito User Pool and configure it to generate temporary AWS credentials for the Lambda function.

Show answer & explanation

Answer: Attach an IAM policy to the Lambda execution role that grants the s3:PutObject action on the target S3 bucket ARN.

Answer

Attach an IAM policy to the Lambda execution role that grants the s3:PutObject action on the target S3 bucket ARN.

The correct option addresses the authorization failure by adding a policy to the Lambda execution role. In AWS, Lambda functions use an execution role to acquire temporary security credentials. Granting the 's3:PutObject' permission on the specific bucket ARN in this execution role permits the Lambda function to upload reports successfully.

Step-by-Step Solution

Identify the IAM role assigned as the Lambda function's execution role.

The execution role is located, which determines the identity and permissions of the executing function.

Permissions in Lambda are governed by the execution role.

Define an IAM policy document containing an 'Allow' statement for the 's3:PutObject' action on the S3 bucket's ARN.

A valid permission policy JSON or visual definition is created.

This policy specifies the exact resource and action that are currently failing due to authorization issues.

Attach the defined IAM policy to the identified Lambda execution role.

The Lambda execution role now possesses permissions to write to the S3 bucket.

Attaching the policy applies the permissions to the Lambda function's identity context, resolving the Access Denied error.

Key Concept

Resolving AWS permission failures by attaching identity-based IAM policies to execution roles.

Estimated Time:1m 0s

Question 963Question →

A developer is building a mobile fitness application that integrates with an Amazon API Gateway REST API backed by AWS Lambda. The application requires users to sign in using their corporate Google Workspace accounts via OpenID Connect (OIDC). Once authenticated, the mobile client must send a secure token with every API request. The API Gateway must validate this token before forwarding the request to the Lambda function. Additionally, the Lambda function needs to access the user's Cognito group memberships to enforce fine-grained access control.

Which solution meets these requirements with the least operational overhead?

Configure an Amazon Cognito Identity Pool with Google as an identity provider. Secure the API Gateway REST API using a custom API Gateway Lambda authorizer that exchanges the Google token for temporary credentials, validates the session, and retrieves the group claims.

Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Configure an Amazon Cognito User Pool with Google as an identity provider. Implement a custom API Gateway Lambda authorizer that validates the JSON Web Token (JWT) sent by the client, calls the Cognito AdminGetUser API to retrieve user attributes, and passes the claims in the authorization context.

Configure an Amazon Cognito Identity Pool with Google as an identity provider. Set the API Gateway method authorization to AWS_IAM. Have the mobile application exchange the OIDC token for temporary AWS credentials via the Identity Pool, sign requests using Signature Version 4, and pass the group information in a custom request header.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Answer

Configure an Amazon Cognito User Pool with Google as an identity provider, secure the API Gateway using a built-in Cognito User Pool authorizer with Lambda proxy integration, and inspect the requestContext.authorizer.claims object in the Lambda function.

The correct solution utilizes an Amazon Cognito User Pool to manage authentication with the OIDC provider (Google) and secures the API Gateway REST API using the native Cognito User Pool authorizer. This authorizer validates incoming JSON Web Tokens (JWTs) automatically without writing custom code. Using a Lambda proxy integration ensures that all claims, including user groups, are parsed and passed in the requestContext.authorizer.claims object of the Lambda event payload, minimizing operational overhead.

Step-by-Step Solution

Determine the correct Cognito pool type for directory authentication and federation.

Cognito User Pool is selected because it acts as the user directory and supports OIDC/SAML federation, whereas Identity Pools are used for authorization and vending temporary AWS credentials.

The scenario requires users to sign in and authenticate via Google Workspace before accessing custom API endpoints.

Select the appropriate API Gateway authorization mechanism to validate the token with minimal overhead.

API Gateway Cognito User Pool Authorizer is selected instead of a custom Lambda Authorizer.

API Gateway native Cognito authorizers validate JWTs automatically without writing or maintaining custom code, reducing latency and operational overhead.

Configure the API Gateway integration and access token claims in the backend Lambda function.

Configure API Gateway with Lambda proxy integration. Retrieve the groups from the event's requestContext.authorizer.claims context object.

Lambda proxy integration automatically populates validated token claims in the event payload, allowing the backend function to perform fine-grained authorization using trusted group data.

Key Concept

Amazon Cognito User Pool Authorizer integration with Amazon API Gateway and Lambda proxy integration.

Question 964Question →

A developer is deploying a new version of a critical web application to AWS Elastic Beanstalk. The application must maintain $100\%$ availability (no downtime) and full capacity during the deployment. If a failure occurs, the deployment must support a rapid rollback to the previous version. The developer has no budget constraints. Which two deployment strategies meet these requirements? (Select TWO.)

Select all that apply

Blue/Green deployment

Immutable deployment

All-at-once deployment

Rolling deployment

Rolling with additional batch deployment

Show answer & explanation

Answer: Blue/Green deployment; Immutable deployment

Answer

Blue/Green deployment and Immutable deployment

Blue/Green and Immutable deployments satisfy all requirements. A Blue/Green deployment swaps DNS/CNAME records between two separate environments, maintaining

100\%

capacity and allowing an instant rollback. An Immutable deployment creates a temporary Auto Scaling group with the new version, ensuring

100\%

capacity is maintained and allowing a rapid rollback by simply deleting the new group.

Step-by-Step Solution

Identify the constraints specified in the deployment scenario.

The key constraints are: zero downtime,

100\%

capacity maintained, rapid rollback capabilities, and no budget constraints.

This sets up the criteria used to evaluate each Elastic Beanstalk deployment option.

Evaluate the impact of each deployment strategy on application capacity and downtime.

All-at-once causes downtime. Rolling reduces capacity during the update. Rolling with additional batch, Immutable, and Blue/Green all maintain

100\%

capacity and have no downtime.

This narrows the candidate list to strategies that maintain full application availability.

Assess the rollback speed of the remaining strategy options.

Rolling with additional batch requires a slow rolling deployment of the older version to roll back. Blue/Green (CNAME swap) and Immutable (terminating the new Auto Scaling group) both support near-instantaneous rollbacks.

This identifies the final two strategies that satisfy the rapid rollback constraint.

Key Concept

AWS Elastic Beanstalk deployment strategies differ in their impact on environment capacity, downtime, and rollback time.

Estimated Time:1m 0s

Question 965Question →

A developer is implementing client-side envelope encryption in a custom application to encrypt large payload files (greater than $10\text{ MB}$ ) before uploading them to Amazon S3. The application needs to perform the encryption locally using a customer managed key stored in AWS KMS.

Which sequence of AWS SDK operations should the developer use to perform this client-side encryption?

Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.

Call Encrypt with the payload data to perform direct encryption in AWS KMS, then store the returned ciphertext payload in Amazon S3.

Call GenerateDataKeyWithoutPlaintext to retrieve the ciphertext data key. Use the ciphertext key to encrypt the payload locally, then store both the encrypted payload and the ciphertext key.

Call GetParameter with decryption enabled to retrieve the customer managed key from AWS Systems Manager Parameter Store, then use it to encrypt the payload locally.

Show answer & explanation

Answer: Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.

Answer

The correct approach is to call the GenerateDataKey API to obtain both a plaintext data key (for local cryptographic operations) and a ciphertext data key (for safe storage). The plaintext key is used to encrypt the payload locally and must be removed from memory immediately afterward to ensure security.

Step-by-Step Solution

Request a data key from AWS KMS.

Call the GenerateDataKey API passing the identifier of the customer managed key, which returns both a plaintext data key and a ciphertext data key.

The application needs the plaintext key to perform the local cryptographic operation, and the ciphertext key to store with the data for future decryption.

Perform local encryption.

Encrypt the

10\text{ MB}

payload locally using the plaintext data key and a local encryption algorithm (e.g., AES-256).

Encrypting the data locally avoids sending large payloads over the network to AWS KMS, which has a strict

4\text{ KB}

limit for direct encryption.

Clean up memory and persist metadata.

Wipe the plaintext data key from memory and upload the encrypted payload along with the ciphertext data key to Amazon S3.

Discarding the plaintext key ensures security, while saving the ciphertext key ensures that the data can be decrypted later by calling the Decrypt API with KMS.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:1m 30s

Question 966Question →

A developer is designing the authentication and authorization architecture for a new serverless web application. The frontend of the application is a Single-Page Application (SPA) that will interact with backend services exposed via an Amazon API Gateway HTTP API. The developer needs to authenticate users using an Amazon Cognito User Pool and ensure that only authenticated users can access the HTTP API routes. The solution must minimize both custom code development and execution cost.

Which combination of steps should the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Configure a JWT authorizer in the API Gateway HTTP API, specifying the Cognito User Pool's Issuer URL as the identity source and the app client ID as the audience.

Configure the frontend application to include the ID token or access token in the Authorization header of HTTP requests sent to the API Gateway.

Configure an Amazon Cognito Identity Pool to exchange User Pool tokens for temporary IAM credentials, and configure API Gateway to use AWS_IAM authorization.

Create a custom AWS Lambda authorizer that validates and decodes the JSON Web Tokens (JWT) issued by the Cognito User Pool.

Establish an IAM trust policy that allows the Cognito User Pool to assume an IAM role with permission to invoke the API Gateway HTTP API.

Show answer & explanation

Answer: Configure a JWT authorizer in the API Gateway HTTP API, specifying the Cognito User Pool's Issuer URL as the identity source and the app client ID as the audience.; Configure the frontend application to include the ID token or access token in the Authorization header of HTTP requests sent to the API Gateway.

Answer

Configure a JWT authorizer in the API Gateway HTTP API, specifying the Cognito User Pool's Issuer URL as the identity source and the app client ID as the audience, and configure the frontend application to include the ID token or access token in the Authorization header of HTTP requests sent to the API Gateway.

To secure an API Gateway HTTP API with Amazon Cognito User Pools while minimizing custom code and costs, a developer should utilize the native JWT authorizer. The JWT authorizer validates tokens issued by Cognito User Pools automatically by checking their signature, issuer, and audience claims. The frontend application must retrieve this token upon user sign-in and include it in the Authorization header of all API calls so the gateway can inspect and authorize the requests.

Step-by-Step Solution

Identify the built-in authorization options for API Gateway HTTP APIs.

Determine that native JWT Authorizers can validate Cognito User Pool tokens directly without writing custom code or incurring execution fees.

This meets the requirement of minimizing both custom development effort and execution costs.

Configure the JWT authorizer parameters in API Gateway.

Point the authorizer to the Cognito User Pool's Issuer URL as the identity source and set the app client ID as the audience parameter.

This allows API Gateway to verify that the token was signed by the correct User Pool and generated for the correct application client.

Pass the JWT from the frontend application.

Update the frontend application logic to attach the ID or access token in the Authorization header of API requests.

This ensures that API Gateway receives the token in the expected request location to perform authorization checks.

Key Concept

JWT authorizer integration with Amazon Cognito User Pools for API Gateway HTTP APIs

Estimated Time:2m 0s

Question 967Question →

A developer is configuring a deployment for a web application running on an Auto Scaling group of four Amazon EC2 instances using AWS CodeDeploy. The deployment must meet the following constraints:
- The application must experience zero downtime, meaning at least some instances must remain online and healthy to serve traffic at all times.
- Due to strict budget limitations, no additional EC2 instances can be provisioned during the deployment.

Which two AWS CodeDeploy default deployment configurations satisfy these requirements? (Select two.)

Select all that apply

CodeDeployDefault.OneAtATime

CodeDeployDefault.HalfAtATime

CodeDeployDefault.AllAtOnce

A CodeDeploy Blue/Green deployment

CodeDeployDefault.ECSLinear10PercentEvery1Minute

Show answer & explanation

Answer: CodeDeployDefault.OneAtATime; CodeDeployDefault.HalfAtATime

Answer

The correct configurations are CodeDeployDefault.OneAtATime and CodeDeployDefault.HalfAtATime.

The correct configurations are CodeDeployDefault.OneAtATime and CodeDeployDefault.HalfAtATime. Because the deployment must not launch additional EC2 instances, it must be performed in-place. To prevent downtime, the deployment configuration must ensure that some instances remain online and healthy during the update. CodeDeployDefault.OneAtATime updates one instance at a time (keeping three online), and CodeDeployDefault.HalfAtATime updates two instances at a time (keeping two online). Both options satisfy the zero-downtime and zero-additional-cost constraints.

Step-by-Step Solution

Analyze the deployment platform and constraints.

The platform is Amazon EC2. The constraints are zero downtime (at least one instance must remain online) and zero additional instances (the update must be in-place).

This establishes that we must use an in-place deployment strategy for EC2 that does not deploy to all instances simultaneously.

Evaluate CodeDeploy default in-place configurations.

CodeDeployDefault.OneAtATime deploys to 1 of 4 instances (leaving 3 healthy). CodeDeployDefault.HalfAtATime deploys to 2 of 4 instances (leaving 2 healthy). CodeDeployDefault.AllAtOnce deploys to 4 of 4 instances (leaving 0 healthy).

Both OneAtATime and HalfAtATime maintain application availability during the in-place update process.

Filter out configurations that violate the constraints.

AllAtOnce causes downtime. Blue/Green requires provisioning a replacement Auto Scaling group (incurring extra instance costs). ECSLinear10PercentEvery1Minute is incompatible with EC2 deployments.

This confirms that only the two selected in-place configurations meet both the availability and budget requirements.

Key Concept

AWS CodeDeploy in-place deployment configurations for EC2 that balance fleet capacity and update progress without provisioning new instances.

Question 968Question →

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The template defines an AWS::Serverless::Api resource with an OpenAPI specification in the DefinitionBody property. The template also defines an AWS::Serverless::Function resource.

Within the OpenAPI specification, the developer configures the integration for a POST route as follows:

yaml
paths:
/orders:
post:
x-amazon-apigateway-integration:
type: "aws"
httpMethod: "POST"
uri:
Fn::Sub: "arn:aws:apigateway: ${AWS::Region}:lambda:path/2015-03-31/functions/$ {OrderFunction.Arn}/invocations"

The Lambda function handler is implemented to return the following structure:

{
"statusCode": 201,
"body": "{\"message\": \"Order created successfully\"}",
"headers": {
"Content-Type": "application/json"
}
}

When the client sends a POST request to /orders, it receives an HTTP status code of 200 OK with the following response body:

{
"statusCode": 201,
"body": "{\"message\": \"Order created successfully\"}",
"headers": {
"Content-Type": "application/json"
}
}

Which configuration change should the developer make to ensure the client receives an HTTP status code of 201 Created with the message body '{"message": "Order created successfully"}'?

Modify the Lambda function handler to return only the JSON string '{"message": "Order created successfully"}' directly as the payload.

Change the integration type to 'aws_proxy' in the x-amazon-apigateway-integration extension inside the OpenAPI specification.

Update the Lambda function's execution role to define the 'apigateway.amazonaws.com' service principal as a trusted entity in the trust policy.

Remove the 'Transform: AWS::Serverless-2016-10-31' line from the top of the template and deploy the stack.

Show answer & explanation

Answer: Change the integration type to 'aws_proxy' in the x-amazon-apigateway-integration extension inside the OpenAPI specification.

Answer

The correct answer is to change the integration type to 'aws_proxy' in the x-amazon-apigateway-integration extension inside the OpenAPI specification.

Changing the integration type to 'aws_proxy' enables the Lambda proxy integration. With proxy integration, API Gateway automatically parses the JSON response returned by the Lambda function, setting the HTTP status code, response headers, and response body matching the keys 'statusCode', 'headers', and 'body' in the returned object. This ensures the client receives the status code 201 instead of 200 with the raw JSON payload.

Step-by-Step Solution

Analyze the current client response and the integration configuration in the template.

The client receives a 200 OK HTTP status code containing the raw JSON output of the Lambda function. The template uses a custom integration ('type: "aws"').

In custom integrations, API Gateway does not parse the status code or body from the Lambda response payload by default; it simply forwards the raw output with a default 200 OK status.

Identify the correct integration type required to automatically parse the Lambda proxy response structure.

Lambda proxy integration ('type: "aws_proxy"') is required.

When using 'aws_proxy', API Gateway automatically maps the 'statusCode', 'headers', and 'body' fields returned by the Lambda function to the final HTTP response.

Select the option that configures the Lambda proxy integration in the template.

Change 'type: "aws"' to 'type: "aws_proxy"' under x-amazon-apigateway-integration.

This correctly switches the API Gateway integration type to Lambda proxy integration, enabling the desired response mapping behavior.

Key Concept

API Gateway Integration Types in AWS SAM

Question 969Question →

A developer is configuring the AppSpec file for an AWS CodeDeploy deployment to Amazon ECS. The developer wants to run a validation test before production traffic is routed to the newly deployed task set. Which lifecycle hook should the developer use in the AppSpec file?

BeforeAllowTraffic

ApplicationStart

ValidateService

ApplicationStop

Show answer & explanation

Answer: BeforeAllowTraffic

Answer

BeforeAllowTraffic

The lifecycle hook designed for Amazon ECS deployments to run tasks before traffic shifts to the new task set is BeforeAllowTraffic. This hook allows developers to invoke a Lambda function to validate the new task set prior to routing live traffic.

Step-by-Step Solution

Identify the target compute platform for the CodeDeploy deployment.

The target platform is Amazon ECS.

ECS deployments use a specific, limited set of lifecycle hooks compared to EC2/On-premises deployments.

Determine the timing requirement for running the validation test.

The test must run after containers are deployed but before production traffic is shifted.

This corresponds to the phase before allowing traffic to the replacement task set.

Select the correct Amazon ECS lifecycle hook that executes before traffic shifting.

BeforeAllowTraffic is the correct hook.

This allows running Lambda functions to validate the deployment before any users access it.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks vary by compute platform. Amazon ECS deployments support BeforeAllowTraffic and AfterAllowTraffic to validate deployments before and after traffic shifting, while EC2 deployments support hooks like ApplicationStart and ValidateService.

Question 970Question →

An application container deployed on Amazon ECS tasks is designed to read encrypted objects from an Amazon S3 bucket. The objects are encrypted using an AWS KMS customer managed key. During execution, the application receives an 'Access Denied' error when trying to retrieve and decrypt the files. Which two configurations should the developer verify or modify to resolve this authorization failure? (Select TWO.)

Select all that apply

Add s3:GetObject and kms:Decrypt permissions to the IAM policy attached to the ECS Task Role.

Update the AWS KMS key policy to permit the ECS Task Role to perform the kms:Decrypt action.

Add s3:GetObject and kms:Decrypt permissions to the IAM policy attached to the ECS Task Execution Role.

Grant the ECS Task Execution Role permissions to read the objects in the S3 bucket policy.

Modify the trust policy of the ECS Task Role to allow the AWS Key Management Service (KMS) principal to assume the role.

Show answer & explanation

Answer: Add s3:GetObject and kms:Decrypt permissions to the IAM policy attached to the ECS Task Role.; Update the AWS KMS key policy to permit the ECS Task Role to perform the kms:Decrypt action.

Answer

Attach an IAM policy to the ECS Task Role granting s3:GetObject and kms:Decrypt permissions, and ensure the KMS key policy allows the ECS Task Role to execute the kms:Decrypt action.

The correct configuration requires identifying that the application running inside the container uses the ECS Task Role for accessing AWS services. Since the objects in the S3 bucket are encrypted with a customer managed KMS key, the Task Role needs permissions for both reading from S3 and decrypting with the KMS key. Additionally, the key policy of the customer managed key must be updated to allow the Task Role to perform the decryption operation, as KMS key policies must explicitly allow access to IAM roles.

Step-by-Step Solution

Distinguish between the ECS Task Role and the ECS Task Execution Role.

Identify that the application code running inside the container uses the ECS Task Role to access AWS resources, while the ECS agent uses the Task Execution Role.

This prevents assigning application permissions to the wrong role.

Configure permissions for the S3 and KMS actions on the ECS Task Role.

Apply an IAM policy to the Task Role that includes s3:GetObject and kms:Decrypt permissions.

The application needs identity-based permissions to read the S3 objects and decrypt them using the custom key.

Ensure the KMS key policy delegates access to the ECS Task Role.

Update the KMS key policy of the customer managed key to allow the Task Role's ARN to call kms:Decrypt.

Unlike AWS managed keys, customer managed KMS keys require the key policy to explicitly authorize the IAM role.

Key Concept

Resolving authorization issues when accessing KMS-encrypted S3 resources from ECS tasks requires distinguishing between ECS Task Roles and Task Execution Roles, and ensuring both IAM identity policies and KMS key policies permit the action.

Question 971Question →

A developer is configuring a blue/green deployment for a microservice hosted on Amazon Elastic Container Service (Amazon ECS) using AWS CodeDeploy. The deployment must meet the following operational requirements:

* Traffic must be shifted in two increments: $10\%$ of traffic must be routed to the new task set immediately, followed by the remaining $90\%$ after a $15$ -minute evaluation period.
* The original task set must remain active for exactly $1$ hour ( $60$ minutes) after traffic is fully routed to the new task set to allow for manual rollback if issues arise, after which the original task set should be automatically terminated.

Which two configurations will satisfy these requirements? (Select TWO.)

Select all that apply

Configure the deployment settings in the deployment group to use the Canary10Percent15Minutes deployment configuration.

Configure the deployment group's blue/green deployment settings to wait 60 minutes before terminating the original task set.

Configure the deployment settings in the deployment group to use the Linear10Percent15Minutes deployment configuration.

Configure the deployment settings in the deployment group to use the Canary10Percent5Minutes deployment configuration.

Add an ApplicationStop lifecycle hook in the AppSpec file with a script that pauses execution for 3600 seconds.

Show answer & explanation

Answer: Configure the deployment settings in the deployment group to use the Canary10Percent15Minutes deployment configuration.; Configure the deployment group's blue/green deployment settings to wait 60 minutes before terminating the original task set.

Answer

Configure the deployment settings in the deployment group to use the Canary10Percent15Minutes deployment configuration, and configure the deployment group's blue/green deployment settings to wait 60 minutes before terminating the original task set.

To shift

10\%

of traffic immediately and the remaining

90\%

after a

15

-minute evaluation period, the Canary10Percent15Minutes configuration is required. To retain the original task set for

1

hour after traffic shifting completes, the developer must specify a termination wait time of

60

minutes in the deployment group settings.

Step-by-Step Solution

Analyze traffic shifting requirements to choose the correct CodeDeploy configuration.

The requirement calls for shifting

10\%

of traffic immediately and the remaining

90\%

after a

15

-minute window. This represents a canary deployment pattern with a

15

-minute evaluation interval, pointing to Canary10Percent15Minutes.

Linear configurations shift traffic incrementally over multiple steps (e.g.,

10\%

every

15

minutes), which does not match the two-increment canary requirement.

Determine the proper mechanism for delaying the termination of the old task set.

Identify that the CodeDeploy deployment group settings contain a specific configuration for specifying the termination wait time of the original (blue) task set.

Configuring this to

60

minutes allows the old task set to remain active for exactly

1

hour after traffic is fully shifted, facilitating manual rollback if needed.

Evaluate AppSpec lifecycle hooks to identify incorrect configuration options.

Verify that ECS deployments support specific hooks (such as BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic) but do not support EC2 hooks like ApplicationStop.

Attempting to use ApplicationStop in an ECS AppSpec file will cause deployment validation errors.

Key Concept

AWS CodeDeploy deployment configurations and task set lifecycle management for ECS blue/green deployments.

Question 972Question →

A developer is troubleshooting an AWS Lambda function that processes batch files. The function fails during execution, and the Amazon CloudWatch logs show the message: "Task timed out after $3.00$ seconds". The developer realizes the function requires at least $4$ minutes to process the files. Which configuration change will resolve this issue?

Associate the Lambda function with a public subnet in a VPC to bypass execution time limits.

Add an Access-Control-Allow-Origin header to the Lambda function's environment variables.

Increase the Lambda function timeout setting from the default of

3

seconds to a value greater than

4

minutes.

Initialize the AWS SDK inside the handler by hardcoding permanent IAM credentials to speed up execution.

Show answer & explanation

Answer: Increase the Lambda function timeout setting from the default of $3$ seconds to a value greater than $4$ minutes.

Answer

Increase the Lambda function timeout setting from the default of

3

seconds to a value greater than

4

minutes.

The correct answer is to increase the Lambda function timeout setting from the default of

3

seconds to a value greater than

4

minutes. By default, Lambda functions have a

3

-second timeout, which is insufficient for tasks requiring several minutes of processing. Adjusting the timeout configuration in the AWS Management Console, CLI, or infrastructure-as-code template resolves this issue.

Step-by-Step Solution

Analyze the error message from CloudWatch logs.

The message indicates a timeout after

3.00

seconds, which is the default timeout limit for Lambda functions.

Understanding the error symptom is the first step in identifying the root cause.

Compare the required execution time with the configured limit.

The function needs at least

4

minutes, but it is currently limited to

3

seconds.

This establishes that the timeout limit must be raised to cover the required execution window.

Modify the Lambda function's configuration.

Change the timeout configuration to a value greater than

4

minutes (e.g.,

5

minutes or

300

seconds).

Adjusting the timeout configuration allows the function to execute to completion.

Key Concept

AWS Lambda function timeout configuration and troubleshooting

Question 973Question →

A developer is building a document search portal. The portal must support user registration and sign-in. Once authenticated, users must be able to call an Amazon API Gateway REST API to search for document metadata, and then download the corresponding PDF files directly from a private Amazon S3 bucket. Which TWO actions should the developer take to implement the authentication and authorization for this portal?

Select all that apply

Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.

Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Configure an Amazon Cognito User Pool to generate temporary AWS IAM credentials directly for users to download files from the Amazon S3 bucket.

Implement a custom API Gateway Lambda Authorizer to validate Cognito User Pool tokens and generate temporary AWS IAM credentials for S3 access.

Configure an Amazon Cognito Identity Pool to manage the user registration, profile data, and login flow for the portal.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.; Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Answer

To secure the portal, the developer must configure an Amazon Cognito User Pool to handle user registration and authentication, utilizing a Cognito Authorizer on the API Gateway REST API. The developer must also configure an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS IAM credentials allowing direct S3 access.

The correct strategy leverages the Amazon Cognito User Pool to manage authentication and user profiles, paired with a Cognito Authorizer on API Gateway to validate the resulting tokens. The Amazon Cognito Identity Pool is then utilized to exchange these tokens for temporary AWS credentials so the client can safely read objects from S3 without passing static credentials or routing file payloads through API Gateway.

Step-by-Step Solution

Configure user authentication and API protection.

Amazon Cognito User Pool is created, and the API Gateway API is configured with a Cognito Authorizer.

This establishes a user directory for registration/sign-in and allows API Gateway to validate user tokens natively.

Configure direct S3 access authorization.

Amazon Cognito Identity Pool is created, linked to the User Pool, and mapped to an IAM role with S3 read permissions.

This enables clients to exchange their User Pool tokens for temporary AWS IAM credentials to retrieve files directly from S3.

Key Concept

Distinction between Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization of AWS resource access.

Question 974Question →

A company is building a mobile travel application where users authenticate via a client interface and receive a JSON Web Token (JWT). The application's backend services are exposed through an Amazon API Gateway REST API. The developer needs to secure the API endpoints so that only authenticated users can access them, verifying the JWT signature on each request. Which of the following is the most operationally efficient method to implement this security requirement with the least development effort?

Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Configure a Cognito Identity Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Create a custom Lambda authorizer that parses, validates, and verifies the incoming JSON Web Token signature on each request.

Implement custom token verification logic directly within the backend Lambda function using a Lambda Proxy integration.

Show answer & explanation

Answer: Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Answer

Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Using a Cognito User Pools authorizer is the most operationally efficient approach. It leverages API Gateway's built-in capability to automatically validate incoming JSON Web Tokens (JWTs) without requiring custom code or additional Lambda executions for validation, lowering development effort and ongoing maintenance.

Step-by-Step Solution

Identify the token type and authentication provider.

The application uses JSON Web Tokens (JWT) generated by a Cognito User Pool for user authentication.

Knowing the token format helps choose between native integrations and custom authorization logic.

Compare native integration versus custom code solutions.

API Gateway offers a built-in Cognito User Pools authorizer, whereas custom Lambda authorizers require writing token verification code.

Evaluating options based on developer effort and operational efficiency helps identify the best option with the least overhead.

Select the built-in Cognito User Pools authorizer.

API Gateway automatically verifies the JWT signature and expiration, allowing only valid requests to reach the backend.

This satisfies the requirement of validating tokens with minimal custom code and maximum operational efficiency.

Key Concept

Amazon API Gateway Cognito User Pools Authorizer

Estimated Time:1m 30s

Question 975Question →

A software engineer is configuring an Amazon ECS task definition to deploy a containerized application to AWS Fargate. To simplify log management, the engineer configures the container to use the `awslogs` log driver and sets the `awslogs-create-group` option to `true` in the log configuration. The task definition specifies a custom IAM role for the task execution role. When the engineer attempts to launch the task, the task fails to start and remains in the `STOPPED` state, citing an authorization error related to CloudWatch Logs.

Which configuration change will resolve this deployment issue?

Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the ECS task role.

Update the ECS task execution role trust policy to allow the `logs.amazonaws.com` service principal to assume the role.

Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the task execution role.

Configure the application code inside the Docker container to use the AWS SDK to verify and create the CloudWatch log group at startup.

Show answer & explanation

Answer: Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the task execution role.

Answer

Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the task execution role.

The correct answer is to add the `logs:CreateLogGroup` permission to the task execution role. When the `awslogs` log driver is configured with `awslogs-create-group` set to `true`, the Amazon ECS container agent automatically attempts to create the specified log group in CloudWatch. Because the agent performs this infrastructure setup action, it requires authorization via the task execution role. The default managed policy `AmazonECSTaskExecutionRolePolicy` only provides permissions to create log streams and put log events, meaning that `logs:CreateLogGroup` must be explicitly added to a custom policy attached to the task execution role.

Step-by-Step Solution

Differentiate between the roles: Identify that the ECS agent is responsible for creating the log group during container startup, which requires permissions in the Task Execution Role.

The Task Execution Role is selected as the target for IAM policy modification instead of the Task Role.

The Task Execution Role is used by the ECS agent for lifecycle tasks like pulling ECR images and writing logs, whereas the Task Role is for application-level AWS API calls.

Analyze the policy permissions: Review the managed policy `AmazonECSTaskExecutionRolePolicy` and notice it only grants `logs:CreateLogStream` and `logs:PutLogEvents`.

Confirm that `logs:CreateLogGroup` is missing from the default policies when configuring `awslogs-create-group` to `true`.

If `awslogs-create-group` is set to `true`, the agent needs to explicitly create the log group, which requires a custom inline or managed policy with the `logs:CreateLogGroup` action.

Apply the IAM policy updates: Attach a policy containing `logs:CreateLogGroup` to the ECS Task Execution Role.

The ECS task successfully creates the log group and transitions to the `RUNNING` state.

Providing the necessary action to the Task Execution Role grants the ECS agent the authorization it needs to complete task provisioning.

Key Concept

Understanding the division of responsibilities and IAM permissions between the Amazon ECS Task Execution Role and the Task Role when configuring logging.

Question 976Question →

A developer is configuring a custom stage action in AWS CodePipeline that invokes an AWS Lambda function to perform integration testing. Arrange the following events in the correct chronological order, from the moment the Lambda action is initiated by the pipeline to the transition of the pipeline to the next stage.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order starts with CodePipeline transitioning the action to In Progress and generating a Job ID, followed by CodePipeline invoking the Lambda function with the payload. Next, the Lambda function executes and retrieves the Job ID, then calls PutJobSuccessResult with the Job ID, and finally, CodePipeline receives the result and transitions the action status to Succeeded.

The correct chronological order starts with CodePipeline generating the Job ID and transitioning the action to In Progress. Next, CodePipeline invokes the Lambda function, passing the Job ID in the event payload. The Lambda function then runs its code, retrieves the Job ID from the event payload, and finishes its tasks. Finally, the function calls the PutJobSuccessResult API with the Job ID, allowing CodePipeline to mark the action as Succeeded and proceed.

Step-by-Step Solution

Initiate the action in the pipeline

CodePipeline transitions the Lambda action to In Progress and generates a unique Job ID containing execution details.

AWS CodePipeline manages the lifecycle of the action and creates a tracking Job ID for the execution.

Invoke the Lambda function

CodePipeline invokes the Lambda function asynchronously, passing the job event as the JSON payload.

This transfers execution control to the Lambda function and provides the necessary context, including the Job ID.

Process the custom logic and parse the event payload

The Lambda function runs its code and extracts the Job ID from the input event object.

The function must have the Job ID in memory to report the outcome back to CodePipeline.

Submit the success callback

The Lambda function calls the PutJobSuccessResult API operation using the AWS SDK, referencing the Job ID.

CodePipeline requires an explicit API call (PutJobSuccessResult or PutJobFailureResult) to update the status of the action; otherwise, the stage will hang and eventually time out.

Complete the stage transition

CodePipeline transitions the action status to Succeeded and proceeds to the next stage or action.

The received API call confirms the successful completion of the custom action.

Key Concept

AWS CodePipeline integration with AWS Lambda requires the Lambda function to explicitly return a success or failure status by calling the PutJobSuccessResult or PutJobFailureResult API operation using the Job ID provided in the invocation event payload.

Question 977Question →

A developer is troubleshooting an AWS Lambda function that processes customer orders and writes them to an Amazon RDS PostgreSQL database located in a private subnet. The Lambda function is configured to run inside the same VPC and private subnets. Additionally, the Lambda function must call a third-party payment gateway endpoint on the public internet. During execution, the Lambda function successfully connects to the database but fails with a timeout error when attempting to reach the payment gateway. Which configuration change is required to resolve this execution issue?

Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing destination traffic of

0.0.0.0/0

to the NAT Gateway.

Associate the Lambda function with the public subnets of the VPC to allow direct outbound communication via the VPC's Internet Gateway.

Increase the execution timeout limit of the Lambda function to

15

minutes to accommodate the external payment gateway response times.

Attach an Internet Gateway directly to the Lambda function's elastic network interface (ENI) and assign a public IP address using the Lambda configuration console.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing destination traffic of $0.0.0.0/0$ to the NAT Gateway.

Answer

Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing destination traffic of

0.0.0.0/0

to the NAT Gateway.

The correct answer is correct because AWS Lambda functions configured within a VPC do not receive public IP addresses on their elastic network interfaces (ENIs). Consequently, they cannot communicate directly with the internet through an Internet Gateway. To access public endpoints while remaining inside a VPC, the Lambda function must run in private subnets, and the outbound traffic must be routed through a NAT Gateway positioned in a public subnet.

Step-by-Step Solution

Analyze the symptoms and network path.

The Lambda function successfully connects to the RDS database in the private subnet but fails to reach the external public internet endpoint, resulting in a timeout.

This confirms that VPC-internal routing is functional, but outbound internet routing from the Lambda's private subnets is blocked or missing.

Evaluate Lambda networking constraints in a VPC.

Understand that Lambda ENIs lack public IP addresses and cannot utilize an Internet Gateway directly, even if placed in a public subnet.

To communicate with the public internet from within a VPC, Lambda requires a NAT Gateway or NAT instance located in a public subnet.

Configure the private subnet routing.

Configure a NAT Gateway in a public subnet and add a route for

0.0.0.0/0

pointing to this NAT Gateway in the private subnet's route table.

This configuration allows the Lambda function to route its internet-bound traffic through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Networking for AWS Lambda Functions

Question 978Question →

A developer is writing an AWS CloudFormation template to deploy an Amazon EC2 instance that runs a web application. The developer uses the AWS::CloudFormation::Init metadata key to install several software packages and configure application files during startup. However, when deploying the stack, CloudFormation marks the EC2 instance status as CREATE_COMPLETE immediately after the instance is provisioned, but before the software installation and configuration tasks have finished running. Which configuration should the developer implement to ensure the stack creation waits until the software setup on the instance is fully complete?

Manually log into the EC2 instance via SSH to run the software installation scripts, and then use the AWS Management Console to update the stack parameters to force a manual synchronization.

Configure the EC2 instance's UserData to write a completion status to AWS Secrets Manager, and use an AWS Systems Manager Parameter Store dynamic reference in the EC2 instance properties to poll for this secret during stack creation.

Add a CreationPolicy attribute to the EC2 instance resource in the template, and execute the cfn-signal helper script at the end of the UserData property after the cfn-init execution.

Run a script that detects if the stack enters the ROLLBACK_IN_PROGRESS state, and execute the cfn-signal script locally from the developer's command line to override the rollback process and force the stack to CREATE_COMPLETE.

Show answer & explanation

Answer: Add a CreationPolicy attribute to the EC2 instance resource in the template, and execute the cfn-signal helper script at the end of the UserData property after the cfn-init execution.

Answer

Add a CreationPolicy attribute to the EC2 instance resource in the template, and execute the cfn-signal helper script at the end of the UserData property after the cfn-init execution.

The correct configuration is to add a CreationPolicy attribute to the EC2 instance resource and call the cfn-signal script at the end of UserData. This instructs CloudFormation to pause the status of the resource in CREATE_IN_PROGRESS until it receives the required number of signals or the timeout duration is reached.

Step-by-Step Solution

Define the application metadata and configuration script on the EC2 resource using the AWS::CloudFormation::Init key.

The instance metadata contains the configuration details, which will be processed by cfn-init.

This allows CloudFormation to manage packages, files, and services systematically on the EC2 instance.

Add a CreationPolicy attribute with a ResourceSignal count of 1 and a timeout configuration to the EC2 resource.

CloudFormation is instructed to pause resource creation and wait for a success signal before marking the instance as CREATE_COMPLETE.

This prevents CloudFormation from prematurely finishing stack creation before the software is operational.

Execute the cfn-signal helper script at the very end of the instance's UserData property, immediately after invoking cfn-init.

A success signal is sent to the CloudFormation endpoint once all setup steps successfully run.

This signals CloudFormation that the instance setup is successful, causing the resource status to transition to CREATE_COMPLETE.

Key Concept

Using CreationPolicy and helper scripts (cfn-init, cfn-signal) to synchronize resource provisioning inside AWS CloudFormation.

Estimated Time:1m 30s

Question 979Question →

A developer is configuring an AWS CodeDeploy deployment for an AWS Lambda function. The developer needs to define the target Lambda function to deploy and run a validation test before any production traffic shifts to the new version. Which two configurations must the developer include in the AppSpec file to accomplish this? (Select TWO.)

Select all that apply

A resources section that specifies the Lambda function name, alias, current version, and target version

A BeforeAllowTraffic hook under the hooks section that references a validation Lambda function

An ApplicationStart hook under the hooks section to run the validation script

An IAM trust policy definition under a permissions section to grant execution rights to CodeDeploy

A parameters section referencing AWS Systems Manager Parameter Store to retrieve database passwords

Show answer & explanation

Answer: A resources section that specifies the Lambda function name, alias, current version, and target version; A BeforeAllowTraffic hook under the hooks section that references a validation Lambda function

Answer

The developer must include a resources section with the Lambda function details (name, alias, current version, and target version) and define a BeforeAllowTraffic lifecycle hook under the hooks section pointing to a validation Lambda function.

To deploy a Lambda function using AWS CodeDeploy, the AppSpec file must define the target function details under the resources section. To run validation tests before shifting traffic, the developer must use the BeforeAllowTraffic lifecycle hook, which runs a separate validation Lambda function before any production traffic begins routing to the new version.

Step-by-Step Solution

Identify the compute platform for the CodeDeploy deployment.

The compute platform is AWS Lambda.

Different compute platforms (EC2, ECS, Lambda) have distinct AppSpec schema requirements.

Determine how to define the deployment target for AWS Lambda.

Define the function name, alias, current version, and target version in the resources section.

This tells CodeDeploy which function and versions are involved in the deployment.

Determine how to run a validation test before traffic shifting.

Add a BeforeAllowTraffic hook in the hooks section pointing to a validation Lambda function.

This hook executes before traffic shifting begins, allowing tests to run and potentially roll back the deployment if they fail.

Key Concept

AWS CodeDeploy AppSpec file structure and lifecycle hooks for AWS Lambda deployments.

Estimated Time:1m 0s

Question 980Question →

A developer is building a compliance utility that runs on an Amazon EC2 instance. The utility must encrypt database backup files of approximately $250\text{ MB}$ client-side before sending them to an external partner's storage server. The developer wants to use envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS.

Which TWO actions must the developer perform in the application code to implement this client-side encryption workflow? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.

Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.

Call the Encrypt API operation of AWS KMS, passing the database backup file payload directly to KMS, to retrieve the encrypted ciphertext.

Call the GenerateDataKeyWithoutPlaintext API operation of AWS KMS, and use the returned ciphertext data key to encrypt the database backup file.

Store the database backup file in AWS Secrets Manager, and configure Secrets Manager to automatically rotate the data key after each backup operation.

Show answer & explanation

Answer: Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.; Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.

Answer

Calling the GenerateDataKey API to obtain both the plaintext and encrypted data keys, encrypting the backup file locally with the plaintext key, and then deleting the plaintext key from memory while storing the encrypted key with the ciphertext.

For client-side envelope encryption, the developer must call the GenerateDataKey API to obtain both the plaintext data key and the encrypted version of the data key. The plaintext key is used to perform the actual local encryption of the large

250\text{ MB}

backup file. Once the encryption completes, the plaintext data key must be discarded from the system memory. The encrypted data key is then stored or sent alongside the ciphertext so that it can be used for decryption in the future.

Step-by-Step Solution

Generate the data keys using AWS KMS.

The application calls the GenerateDataKey API with the CMK. KMS returns a plaintext data key and an encrypted data key.

This establishes the unique keys needed for local symmetric encryption without sending large payloads to KMS.

Perform local symmetric encryption.

The application encrypts the

250\text{ MB}

database backup file using the plaintext data key with a standard library (e.g., AES-256).

Symmetric encryption handles large datasets efficiently and keeps data secure before transit.

Clean up memory and prepare the payload.

The plaintext data key is deleted from the application memory. The encrypted backup file and the encrypted data key are packaged together.

Removing the plaintext key from memory prevents unauthorized access. The encrypted data key is required later to decrypt the file.

Key Concept

AWS KMS Envelope Encryption Workflow

PreviousPage 49 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept