All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer is deploying a Java application on Amazon EC2 instances. The application writes log entries to a local log file at `/var/log/myapp/app.log`. The developer installs the Unified CloudWatch Agent on the instances and configures it to stream these logs to Amazon CloudWatch Logs. After starting the agent service on the EC2 instances, the developer notices that no log groups or log streams are created in CloudWatch Logs, and no log data is received. Which of the following could be the reasons for this issue? (Select TWO.)

Select all that apply

The IAM role attached to the EC2 instances does not have the permissions required to create log groups, log streams, and write log events (such as the permissions provided by the CloudWatchAgentServerPolicy managed policy).

The Unified CloudWatch Agent configuration file contains a syntax error or specifies an incorrect log file path under the logs section in the collect_list.

The metric filter pattern defined in the agent configuration file incorrectly uses {

.status = "ERROR" } instead of {

.status == "ERROR" }, which causes the agent to fail to start.

The IAM role's trust policy designates lambda.amazonaws.com as the trusted entity instead of ec2.amazonaws.com, preventing the EC2 instances from assuming the role.

The EC2 instances are located in a public subnet, but logs cannot be uploaded because the subnet does not have a NAT Gateway or a VPC endpoint for CloudWatch Logs.

Show answer & explanation

Answer: The IAM role attached to the EC2 instances does not have the permissions required to create log groups, log streams, and write log events (such as the permissions provided by the CloudWatchAgentServerPolicy managed policy).; The Unified CloudWatch Agent configuration file contains a syntax error or specifies an incorrect log file path under the logs section in the collect_list.

Answer

The correct reasons are that the IAM role attached to the EC2 instances lacks the required permissions (such as those in the CloudWatchAgentServerPolicy managed policy) and that the agent configuration file contains a syntax error or a misconfigured log file path under the collect_list settings.

The correct reasons are that the IAM role attached to the EC2 instances lacks the required permissions (such as those in the CloudWatchAgentServerPolicy managed policy) to communicate with CloudWatch Logs, and that the agent configuration file contains a syntax error or a misconfigured log file path under the collect_list settings, which prevents the agent from locating or processing the log files.

Step-by-Step Solution

Analyze the IAM permissions for the Unified CloudWatch Agent.

Identify that the agent requires permissions like `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` to write logs, which are typically provided by attaching the `CloudWatchAgentServerPolicy` managed policy to the EC2 instance profile.

Without these permissions, the agent cannot authenticate or perform log upload actions to CloudWatch Logs.

Check the local configuration file of the CloudWatch Agent.

Determine that the agent relies on the local configuration file (often `amazon-cloudwatch-agent.json`) to know which log files to collect and publish under the `logs` section. A syntax error or incorrect path there prevents the agent from finding or parsing the logs.

If the configuration file is malformed, the agent daemon cannot parse the settings to identify which logs to stream.

Evaluate the distractors regarding trust policies, metric filters, and network paths.

Confirm that metric filters are evaluated on the CloudWatch service side (not by the local agent), trust policies must allow EC2 (not Lambda) to assume the role, and public subnets do not require a NAT Gateway or VPC endpoints.

This rules out incorrect options and clarifies standard EC2 and CloudWatch Logs setup.

Key Concept

Configuring the Unified CloudWatch Agent to stream logs from EC2 instances requires both a valid configuration file on the host and an IAM role with the correct permissions (like CloudWatchAgentServerPolicy) and trust policy (ec2.amazonaws.com).

Question 82Question →

A developer is designing a REST API in Amazon API Gateway that must start an AWS Step Functions state machine execution whenever a client sends a POST request. To minimize latency and avoid cold starts, the developer wants to configure a direct AWS service integration between API Gateway and Step Functions, without using an intermediate AWS Lambda function.

Which two configuration steps must the developer perform to successfully set up this integration? (Select TWO.)

Select all that apply

Configure the integration type as AWS Service, select Step Functions as the AWS service, and set the Action to StartExecution.

Create an IAM role that permits the states:StartExecution action, and specify this role's ARN in the Execution Role field of the integration.

Configure the method to use Lambda Proxy integration and set the target integration URI directly to the Step Functions state machine ARN.

Configure a Cognito User Pool authorizer on the API method and select the Step Functions action permissions within the authorizer settings.

Package the AWS SDK within the client application and configure the API Gateway method to pass client-side IAM access keys to Step Functions using request header mapping.

Show answer & explanation

Answer: Configure the integration type as AWS Service, select Step Functions as the AWS service, and set the Action to StartExecution.; Create an IAM role that permits the states:StartExecution action, and specify this role's ARN in the Execution Role field of the integration.

Answer

Configuring the integration type as AWS Service with Step Functions as the service and StartExecution as the action, and creating an IAM role that permits the states:StartExecution action and specifying its ARN in the integration settings.

To create a direct integration between Amazon API Gateway and AWS Step Functions, the developer must configure the integration type as an AWS Service. The target service is set to Step Functions, and the Action is set to StartExecution to invoke the state machine. Additionally, an IAM execution role containing permissions for states:StartExecution must be created and its ARN provided in the execution role field of the integration. This allows API Gateway to securely trigger the state machine on behalf of the client.

Step-by-Step Solution

Select the integration type for the API method.

Configure the API method integration type to AWS Service.

Since the goal is to directly call Step Functions without an intermediate Lambda function, the developer must use the built-in AWS Service integration type.

Set the action details in the integration settings.

Choose Step Functions as the target service and set the Action to StartExecution.

This maps the incoming API request to the specific Step Functions API action required to trigger a state machine execution.

Configure the execution credentials.

Specify the ARN of an IAM execution role containing the required permissions in the Execution Role field.

API Gateway requires an execution role to authenticate and authorize the call to the Step Functions backend.

Key Concept

Direct AWS Service Integrations in Amazon API Gateway

Question 83Question →

A developer is designing a serverless backend using AWS Lambda that processes sensitive customer records. Each record contains a profile payload averaging $15$ KB in size. The application must encrypt these payloads before storing them in an Amazon DynamoDB table. To meet strict performance and cost-efficiency requirements, the developer must implement client-side envelope encryption using a Customer Managed Key (CMK) managed by AWS KMS. Which of the following application workflows represents the most secure, cost-effective, and architecturally correct implementation of client-side envelope encryption?

Call the KMS Encrypt API directly, passing the

15

KB customer record as the plaintext payload. Store the returned ciphertext blob directly in the DynamoDB table.

Generate a symmetric key locally in the Lambda function, encrypt the customer record with it, and call the KMS Encrypt API to encrypt the local key. Store the encrypted record in DynamoDB, and store the encrypted symmetric key in AWS Secrets Manager using a unique secret per customer record.

Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Store this key in Systems Manager Parameter Store, and then call the KMS Decrypt API within the Lambda function to get the plaintext key to encrypt the payload.

Call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. Encrypt the customer record payload locally using the plaintext data key, delete the plaintext data key from memory, and store the encrypted payload and the encrypted data key together in the DynamoDB item.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. Encrypt the customer record payload locally using the plaintext data key, delete the plaintext data key from memory, and store the encrypted payload and the encrypted data key together in the DynamoDB item.

Answer

The correct workflow calls the KMS GenerateDataKey API to obtain both the plaintext data key and the encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table.

The correct workflow uses the GenerateDataKey API, which yields both a plaintext data key and an encrypted data key in a single request. The plaintext key is used locally to encrypt the payload and then immediately cleared from memory, while the encrypted data key is stored directly alongside the encrypted payload in the DynamoDB table. This implements client-side envelope encryption securely and efficiently, bypassing the

4

KB size limit of the Encrypt API without introducing unnecessary API calls or storage overhead.

Step-by-Step Solution

Evaluate the payload size and KMS constraints.

The record size of

15

KB exceeds the

4

KB direct encryption limit of the KMS Encrypt API, indicating envelope encryption is required.

To determine if direct KMS encryption is a viable or correct option.

Analyze key generation and retrieval efficiency.

Using GenerateDataKey provides both the plaintext key (for immediate encryption) and the ciphertext key in a single API call, whereas GenerateDataKeyWithoutPlaintext would require a second Decrypt API call.

To minimize KMS API costs and latency.

Determine the storage location for the encrypted data key.

The encrypted data key should be stored directly alongside the encrypted payload in the DynamoDB item, rather than external systems like Secrets Manager or Parameter Store.

To avoid external resource overhead, scale efficiently, and follow proper envelope encryption architecture.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:3m 0s

Question 84Question →

A developer is building a web dashboard that allows corporate employees to sign in using their existing third-party SAML Identity Provider (IdP). The application must access a secure REST API hosted on Amazon API Gateway. The developer wants to validate the user's session at the API Gateway layer using a built-in integration and extract the user's profile claims in the backend AWS Lambda function without writing custom token validation code.

Which configuration strategy should the developer implement to meet these requirements with the least development effort?

Configure an Amazon Cognito Identity Pool federated with the SAML IdP. Use API Gateway IAM authorization, sign the API requests using the temporary AWS credentials, and decode the credentials in the Lambda function to extract user claims.

Configure an Amazon Cognito User Pool federated with the SAML IdP. Create an API Gateway Lambda Authorizer that intercepts the SAML response, decodes the token, validates the signature, and injects the claims into the context.

Configure an Amazon Cognito User Pool federated with the SAML IdP. Create a Cognito User Pool Authorizer in API Gateway and pass the Cognito ID token in the request header to access the API.

Configure an Amazon Cognito Identity Pool federated with the SAML IdP. Define an IAM role with a trust policy allowing public access, associate it with the API Gateway resource, and extract the SAML assertion directly from the API gateway context mapping.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool federated with the SAML IdP. Create a Cognito User Pool Authorizer in API Gateway and pass the Cognito ID token in the request header to access the API.

Answer

Configure an Amazon Cognito User Pool federated with the SAML IdP. Create a Cognito User Pool Authorizer in API Gateway and pass the Cognito ID token in the request header to access the API.

Using Amazon Cognito User Pools federated with a SAML Identity Provider allows user directory and authentication federation. API Gateway's built-in Cognito User Pool Authorizer handles token validation natively, passing claims directly to the integration backend (Lambda) in the request context under authorizer claims. This eliminates the need for writing custom token validation code or signing API requests with AWS Signature Version 4.

Step-by-Step Solution

Select the correct Cognito service type for user authentication and federation.

Amazon Cognito User Pools is selected because it acts as a user directory and natively federates with SAML Identity Providers.

Cognito User Pools authenticate users and generate standard JSON Web Tokens (JWTs) containing identity claims.

Integrate the token validation at the API Gateway layer.

Create a built-in Cognito User Pool Authorizer on the API Gateway REST API.

This authorizer natively decodes and validates Cognito tokens sent in the Authorization header without requiring custom authorizer code.

Access user profile claims in the backend AWS Lambda function.

The Lambda function receives the verified user claims in the request event context under the authorizer claims object.

API Gateway automatically forwards claims from the validated Cognito token to the integration backend, allowing claims-based authorization.

Key Concept

Built-in integration between API Gateway and Cognito User Pools for user authentication and claims propagation.

Estimated Time:1m 30s

Question 85Question →

A SaaS billing application stores invoice records in an Amazon DynamoDB table. The table has `CustomerId` as the partition key and `InvoiceId` as the sort key. An `InvoiceStatus` attribute indicates whether the invoice is `PAID` or `UNPAID`. Approximately $98\%$ of all invoices are `PAID`. A developer needs to build a dashboard feature that retrieves only the `UNPAID` invoices for a specific customer. Which of the following strategies is the most performant and cost-effective way to retrieve these records?

Create a Global Secondary Index (GSI) with `CustomerId` as the partition key and a new attribute `UnpaidTimestamp` as the sort key, which is only populated when `InvoiceStatus` is `UNPAID`. Query this GSI using the `CustomerId`.

Perform a Scan operation on the base table using a `FilterExpression` to filter items where `CustomerId` matches the target customer and `InvoiceStatus` is `UNPAID`.

Create a Global Secondary Index (GSI) using `InvoiceStatus` as the partition key and `CustomerId` as the sort key. Query this GSI using `InvoiceStatus = UNPAID` and `CustomerId`.

Query the base table using `CustomerId` to retrieve all invoices, filter for `UNPAID` status in the application logic, and initialize the AWS SDK client using hardcoded AWS IAM access keys.

Show answer & explanation

Answer: Create a Global Secondary Index (GSI) with `CustomerId` as the partition key and a new attribute `UnpaidTimestamp` as the sort key, which is only populated when `InvoiceStatus` is `UNPAID`. Query this GSI using the `CustomerId`.

Answer

Creating a sparse Global Secondary Index (GSI) with CustomerId as the partition key and a conditional attribute like UnpaidTimestamp as the sort key, then querying that GSI.

The correct strategy uses a sparse Global Secondary Index (GSI). By defining the GSI with CustomerId as the partition key and a custom attribute (such as UnpaidTimestamp) as the sort key that is only written when the invoice is UNPAID, DynamoDB will only index the unpaid invoices. Since 98% of the invoices are PAID, they will not have the UnpaidTimestamp attribute and will be excluded from the GSI. This minimizes the storage size of the GSI and allows highly efficient, low-cost Query operations restricted to the target customer's unpaid invoices.

Step-by-Step Solution

Analyze the query pattern and data distribution.

Unpaid invoices represent only 2% of the dataset, which makes it a sparse subset. The target query needs to retrieve these records for a specific customer.

Understanding data distribution helps choose between a base table query, scan, or secondary index.

Evaluate index design options for low-frequency attributes.

A sparse GSI can be created by choosing a sort key attribute (like UnpaidTimestamp) that is only populated when the status is UNPAID. Items without this attribute will not be indexed.

Excluding paid invoices from the index reduces the GSI storage size and ensures that queries against the GSI only read relevant records.

Assess partition key cardinality to avoid throttling.

Using CustomerId as the GSI partition key distributes the load across many unique customer partitions, preventing hot partition issues.

If InvoiceStatus was used as the GSI partition key, the 98% of writes for PAID invoices would concentrate on a single partition key value, causing write throttling.

Key Concept

Sparse Global Secondary Indexes (GSIs) for filtering low-cardinality subsets of data.

Question 86Question →

A developer is designing a web application hosted on Amazon ECS behind an Application Load Balancer (ALB). The application requires users to authenticate via an Amazon Cognito User Pool. The ALB must authenticate incoming HTTP requests and forward the verified user identity claims to the backend ECS containers without requiring token validation logic inside the container code. Additionally, authenticated users must be able to upload profile images directly from their web client to their own folder within an Amazon S3 bucket. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Add an authenticate action using Cognito to the Application Load Balancer listener rule, which verifies the user session and forwards user claims to the target group in the x-amzn-oidc-data header.

Configure a Cognito Identity Pool using the User Pool as an identity provider, and attach an IAM policy to the authenticated role that grants permission to upload to the resource path arn:aws:s3:::my-bucket/uploads/${cognito-identity.amazonaws.com:sub}/*.

Create an Amazon API Gateway Cognito Authorizer and associate it with the Application Load Balancer listener to authenticate incoming HTTP requests and populate the container headers.

Enable Cognito User Pool Hosted UI on the client, and configure the client to use the User Pool JSON Web Token (JWT) directly as the AWS Access Key and Secret Key to authenticate S3 PutObject calls.

Configure the Cognito User Pool to automatically assume an IAM role for each authenticated session and return temporary credentials directly in the ID token for S3 uploads.

Show answer & explanation

Answer: Add an authenticate action using Cognito to the Application Load Balancer listener rule, which verifies the user session and forwards user claims to the target group in the x-amzn-oidc-data header.; Configure a Cognito Identity Pool using the User Pool as an identity provider, and attach an IAM policy to the authenticated role that grants permission to upload to the resource path arn:aws:s3:::my-bucket/uploads/${cognito-identity.amazonaws.com:sub}/*.

Answer

To meet the requirements, the developer must configure an authenticate action using Cognito on the Application Load Balancer listener rule and set up a Cognito Identity Pool with the User Pool as an identity provider, associating it with an IAM policy that allows access to the user-specific S3 folder path using the identity sub variable.

To offload authentication, the Application Load Balancer listener rule must be configured with an authenticate action using Cognito. The ALB then verifies the tokens and forwards the user information to backend targets via the x-amzn-oidc-data header. For S3 access, the client requires temporary AWS credentials, which are obtained by creating a Cognito Identity Pool that uses the User Pool as an identity provider. The IAM policy attached to the authenticated role uses the ${cognito-identity.amazonaws.com:sub} policy variable to dynamically restrict access to the folder matching the user's Cognito identity ID.

Step-by-Step Solution

Identify that the Application Load Balancer needs to offload authentication.

Recognize that ALB supports a native integration with Cognito User Pools using listener rules with an authenticate action.

This avoids having to write custom token validation logic inside the ECS container application code.

Determine how the Application Load Balancer passes user identities.

The ALB passes user claims to the targets in HTTP headers such as x-amzn-oidc-data.

This allows the backend application to read claims such as the user ID or email without performing JWT signature checks.

Determine how the client can directly upload to S3.

Configure a Cognito Identity Pool to exchange the user pool tokens for temporary credentials.

Since S3 requires AWS IAM credentials and does not natively accept Cognito User Pool tokens, a Cognito Identity Pool must act as the credential provider.

Secure the S3 upload path using a policy variable.

Apply an IAM policy to the authenticated role that references ${cognito-identity.amazonaws.com:sub} to restrict each user to their own upload folder.

This dynamically resolves to the Cognito Identity ID of the authenticated user, achieving fine-grained access control.

Key Concept

Integrating Application Load Balancers with Cognito User Pools for authentication and using Cognito Identity Pools for temporary AWS credentials to access S3.

Estimated Time:2m 30s

Question 87Question →

A developer has implemented an AWS Lambda function that processes PDF documents uploaded to an Amazon S3 bucket. The function downloads each PDF to the local `/tmp` directory, extracts metadata, and updates a database. During high-volume load testing, several invocations fail with a 'No space left on device' error. Additionally, the developer observes that PDF files from previous invocations occasionally persist and interfere with current executions. Which combination of actions should the developer take to resolve these issues? (Select two.)

Select all that apply

Programmatically delete the downloaded PDF files from the `/tmp` directory before the function invocation completes.

Increase the ephemeral storage (`/tmp`) configuration of the Lambda function to support larger file sizes.

Configure Provisioned Concurrency for the Lambda function to guarantee that a new execution environment is initialized for every invocation.

Save the downloaded PDF files as global variables in the execution context instead of writing them to the `/tmp` directory.

Deploy the Lambda function inside a private subnet and configure an Amazon S3 Gateway VPC Endpoint to access the bucket.

Show answer & explanation

Answer: Programmatically delete the downloaded PDF files from the `/tmp` directory before the function invocation completes.; Increase the ephemeral storage (`/tmp`) configuration of the Lambda function to support larger file sizes.

Answer

To resolve the issues, the developer must programmatically delete the downloaded files from the local directory before execution completes, and increase the ephemeral storage configuration of the Lambda function.

The correct combination of actions involves programmatically deleting files from the local directory at the end of each invocation and increasing the function's configured ephemeral storage. Programmatic deletion ensures that files do not accumulate over multiple invocations that share the same warm execution environment, resolving both the data leakage and cumulative disk space consumption issues. Increasing the ephemeral storage configuration allows the function to use more than the default 512 MB of local storage to process larger files.

Step-by-Step Solution

Analyze how AWS Lambda handles execution environment reuse and the local filesystem.

The local filesystem directory is shared across consecutive invocations that run in the same container instance.

Files written to local storage persist between invocations unless programmatically deleted, which can cause disk space exhaustion and data contamination.

Address the data leakage and file persistence issue.

Implement code to clean up downloaded files from the local directory before returning a response.

Explicit cleanup ensures that subsequent invocations reusing the execution environment start with a clean local directory.

Address the disk space limit issue.

Modify the ephemeral storage configuration in the Lambda function settings to allocate more storage.

The default size of the local directory is 512 MB, which might be insufficient for larger or concurrent files. Increasing this configuration allows up to 10 GB of storage.

Key Concept

Understanding AWS Lambda execution context reuse and configuring ephemeral storage.

Question 88Question →

A developer is configuring an application deployed on AWS App Runner in Account A. The application needs to retrieve database credentials to connect to an Amazon RDS database hosted in Account B. The database credentials must be rotated automatically every 30 days. Additionally, the application requires access to a public API endpoint URL that is non-sensitive and does not change. The developer wants to implement a secure, cost-effective parameter storage solution that allows cross-account access where necessary. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager in Account B, configure automatic rotation, and attach a resource-based policy to the secret that grants retrieve permissions to the App Runner instance role in Account A.

Store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.

Store the database credentials in AWS Systems Manager Parameter Store in Account B as a SecureString parameter, and attach a resource-based policy to the parameter to grant access to Account A.

Store the public API endpoint URL in AWS Secrets Manager in Account A, and configure a custom Lambda function to rotate the URL daily to optimize storage costs.

Hardcode the database credentials in the application's configuration file within the App Runner container image, and restrict access to the container image using Amazon ECR repository policies.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in Account B, configure automatic rotation, and attach a resource-based policy to the secret that grants retrieve permissions to the App Runner instance role in Account A.; Store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.

Answer

Store the database credentials in AWS Secrets Manager in Account B with a resource-based policy granting access to Account A, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.

The correct options are to store the database credentials in AWS Secrets Manager in Account B with a resource-based policy, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A. AWS Secrets Manager supports automatic rotation and allows direct cross-account access via resource-based policies. Systems Manager Parameter Store is a cost-effective choice for non-sensitive, static configurations since standard parameters have no storage costs.

Step-by-Step Solution

Evaluate credential storage and sharing requirements.

Database credentials need to be stored in Account B, rotated every 30 days, and accessed by Account A. AWS Secrets Manager supports automatic rotation and resource-based policies, which allow cross-account sharing directly.

This satisfies the security requirement for automatic rotation and cross-account access.

Evaluate non-sensitive configuration storage.

The public API endpoint URL is non-sensitive and static. AWS Systems Manager Parameter Store Standard parameters are ideal because they are free and do not require rotation.

This satisfies the cost-effectiveness requirement.

Configure permissions for Account A's App Runner service.

Attach a resource-based policy to the Secrets Manager secret in Account B, specifying the App Runner instance role ARN from Account A as the principal with 'secretsmanager:GetSecretValue' permissions.

This enables secure retrieval of the credentials without hardcoding them or setting up complex cross-account IAM role assumption.

Key Concept

Secrets Manager vs Parameter Store feature comparison, including rotation, pricing, and cross-account capabilities.

Question 89Question →

An application running on an Amazon ECS container using AWS Fargate in Account $A$ ( $111122223333$ ) needs to write objects to an Amazon S3 bucket in Account $B$ ( $444455556666$ ). The application code uses the AWS SDK to call the AWS Security Token Service (STS) `AssumeRole` API to assume an IAM role named `CrossAccountS3Writer` in Account $B$ . However, the application receives an `AccessDenied` error on the `AssumeRole` call.

The ECS task definition is configured with the `taskRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskRole` and the `executionRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskExecutionRole`.

Which two actions are required to resolve this access issue and allow the application to write to the S3 bucket? (Select TWO.)

Select all that apply

Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole.

Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskExecutionRole.

Modify the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call.

Hardcode a set of long-term IAM user access keys from Account B directly in the application configuration files to bypass STS.

Attach the AmazonS3FullAccess policy to the ecsTaskExecutionRole in Account A to authorize the S3 client.

Show answer & explanation

Answer: Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole.; Modify the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call.

Answer

Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole, and modify the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call.

The correct options involve updating the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole, and modifying the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call. The application runs using the container task role (ecsTaskRole), so the trust relationship must target this role. The SDK must also explicitly use the temporary credentials retrieved from AWS STS to interact with the S3 bucket.

Step-by-Step Solution

Differentiate between the ECS Task Role and the ECS Task Execution Role.

The application code running inside the container uses the ECS Task Role for AWS API permissions. The ECS Task Execution Role is used only by the container agent for setup tasks.

This determines which role identity makes the sts:AssumeRole call.

Configure the trust relationship in Account B.

The role CrossAccountS3Writer in Account B must list the ECS Task Role (arn:aws:iam::111122223333:role/ecsTaskRole) as a trusted entity in its assume role policy document.

This permits the application running under the Task Role identity to assume the target role.

Utilize temporary credentials in the application.

Capture the AccessKeyId, SecretAccessKey, and SessionToken returned by the AssumeRole API call and pass them to the AWS SDK client builder.

The client must use these temporary credentials rather than its default credentials to access the cross-account S3 bucket.

Key Concept

Cross-account access and task-level role delegation in Amazon ECS

Question 90Question →

A developer is configuring a deployment template for a new serverless application using the AWS Serverless Application Model (SAM). The template contains the following partial structure:

yaml
Transform: AWS::Serverless-2016-10-31
Resources:
MyFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src

Which two steps or configurations are required to successfully deploy and run this serverless application? (Select two.)

Select all that apply

The template must declare the Transform header at the root level of the template file to instruct CloudFormation on how to process SAM-specific resources.

The local function code located in the './src' directory must be packaged and uploaded to an Amazon S3 bucket prior to deploying the CloudFormation stack.

The template must list the Lambda function resource under the Globals section instead of the Resources section.

The API Gateway event source must be configured with a custom integration rather than a proxy integration to allow SAM to automatically map HTTP header values.

The Lambda function's IAM trust policy must explicitly grant permissions to retrieve runtime configuration secrets from AWS Secrets Manager.

Show answer & explanation

Answer: The template must declare the Transform header at the root level of the template file to instruct CloudFormation on how to process SAM-specific resources.; The local function code located in the './src' directory must be packaged and uploaded to an Amazon S3 bucket prior to deploying the CloudFormation stack.

Answer

The configurations required are: (1) declaring the Transform header at the root level of the template file, and (2) packaging and uploading the local function code in the './src' directory to an Amazon S3 bucket.

The correct answer states that the Transform declaration must be at the root of the template file to instruct CloudFormation how to parse the SAM shorthand syntax, and that local function artifacts in the source directory must be zipped and uploaded to an S3 bucket prior to CloudFormation execution.

Step-by-Step Solution

Analyze template syntax and transformation requirement.

Identify that the 'Transform: AWS::Serverless-2016-10-31' line is required at the root of the template.

This header informs AWS CloudFormation that it must parse the template using the Serverless transform to expand SAM resources into standard CloudFormation resources.

Analyze code deployment requirements.

Confirm that local files specified by 'CodeUri: ./src' must be packaged.

CloudFormation requires function code to be hosted in an Amazon S3 bucket. The packaging phase zips the local code directory, uploads it, and replaces the local path with the S3 URI.

Key Concept

AWS SAM templates require a root-level transform declaration to be parsed by AWS CloudFormation, and local deployment artifacts must be packaged and uploaded to S3.

Estimated Time:1m 0s

Question 91Question →

An AWS Lambda function is configured to run within private subnets of a custom VPC to securely query an Amazon Aurora database. The function also needs to retrieve database credentials stored as secure strings in AWS Systems Manager Parameter Store. During testing, the Lambda function times out when attempting to retrieve the parameters, though database connectivity works perfectly. A developer confirms that there is no NAT Gateway configured in the VPC.

Which configuration change will resolve the timeout issue while maintaining the current network architecture and database security?

Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

Attach an IAM policy to the Lambda execution role that grants ssm:GetParameters access, which enables the VPC-bound Lambda function to bypass the private subnet's routing table to reach the public Systems Manager service.

Update the trust relationship policy document of the Lambda execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role and push parameter values.

Migrate the database credentials from Parameter Store to AWS Secrets Manager, as Systems Manager Parameter Store does not support private VPC endpoint connections or secure string encryption.

Show answer & explanation

Answer: Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

Answer

Establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group.

The correct answer is to establish an interface VPC endpoint for Systems Manager (ssm) within the private subnets, associating a security group that allows inbound HTTPS traffic from the Lambda function's security group. Since the Lambda function is running in a private subnet with no NAT Gateway, it has no route to the public internet to reach the default Systems Manager endpoint. Creating an interface VPC endpoint places Elastic Network Interfaces (ENIs) with private IP addresses directly in the private subnets. The Lambda function can then access Parameter Store privately over port 443, provided the endpoint's security group allows inbound traffic from the Lambda function's security group.

Step-by-Step Solution

Analyze the network configuration of the Lambda function.

The Lambda function resides in a private subnet with no NAT Gateway, preventing access to public AWS service endpoints.

By default, resource-bound Lambda functions route traffic through the VPC's routing tables. Without a NAT Gateway or VPC endpoint, they cannot resolve or connect to public services.

Select the correct AWS PrivateLink service endpoint.

Identify that Systems Manager Parameter Store can be accessed privately via an interface VPC endpoint (ssm service).

Interface VPC endpoints provision Elastic Network Interfaces (ENIs) within the subnets, enabling private routing within the AWS network.

Configure the security groups for the VPC endpoint.

Associate a security group with the interface VPC endpoint that allows inbound HTTPS (port 443) traffic from the Lambda function's security group.

Since security groups are stateful and default to blocking all inbound traffic, the endpoint's security group must explicitly allow inbound requests from the client (Lambda).

Key Concept

VPC Interface Endpoints (AWS PrivateLink) and Security Group configurations for private AWS service integration.

Estimated Time:2m 30s

Question 92Question →

A serverless invoice processing application uses a Lambda function to query a relational database residing in a private subnet of a custom VPC. The function also needs to call a third-party billing service endpoint on the public internet.

Which of the following configurations are required to establish this network connectivity while maintaining secure access? (Select TWO.)

Select all that apply

Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Configure a security group for the Lambda function that permits outbound traffic to the database port and to the internet on HTTPS port 443.

Place the Lambda function in a public subnet of the VPC and enable the default auto-assign public IP setting on the function configuration to reach the billing endpoint directly.

Modify the Lambda function's execution role trust policy to allow inbound database connections from the security group of the database.

Store the database credentials in Systems Manager Parameter Store and enable the native database credential rotation feature.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.; Configure a security group for the Lambda function that permits outbound traffic to the database port and to the internet on HTTPS port 443.

Answer

To establish network connectivity for the Lambda function, associate it with the private subnets of the VPC and route outbound internet traffic through a NAT Gateway in a public subnet. Additionally, configure the function's security group to allow outbound traffic to the database port and to the internet on HTTPS port 443.

The correct configurations are to associate the Lambda function with the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway in a public subnet, and configure a security group for the Lambda function that permits outbound traffic to both the database port and HTTPS port 443. This setup ensures that the Lambda function can resolve and reach local resources like the database, while securely routing outbound internet traffic to the external endpoint via the NAT Gateway.

Step-by-Step Solution

Determine subnet placement for the Lambda function.

The Lambda function is associated with private subnets of the custom VPC to allow secure communication with the database.

Private resources should not be exposed to the public internet, and Lambda needs VPC network interfaces (ENIs) in the same subnets to reach the database.

Enable internet connectivity for the private subnets.

Configure a NAT Gateway in a public subnet, and add a route in the private subnets' route table pointing 0.0.0.0/0 traffic to the NAT Gateway.

Lambda functions in private subnets cannot reach the public internet directly; they require a NAT Gateway to translate private IPs to a public IP for internet access.

Configure the Lambda function's Security Group rules.

Add outbound rules allowing traffic to the database's Security Group on its port, and outbound HTTPS traffic to the internet.

Security groups are stateful and must explicitly allow the outbound traffic initiated by the Lambda function.

Key Concept

VPC Security for Lambda and Resource Access

Estimated Time:1m 30s

Question 93Question →

A developer is designing a serverless mobile application that integrates with a REST API hosted on Amazon API Gateway. Users must be able to register and sign in directly through the mobile application. The developer needs to secure the API Gateway endpoints so that only authenticated users can access them, while minimizing custom code and operational costs.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Configure an Amazon Cognito User Pool authorizer in Amazon API Gateway and associate it with the API methods.

Configure the mobile application to send the Cognito ID token in the Authorization header of the HTTP requests.

Create a custom Lambda authorizer in Amazon API Gateway that decodes and validates the Cognito JSON Web Token (JWT) signature.

Create an Amazon Cognito Identity Pool to exchange the Cognito User Pool token for temporary AWS credentials, and configure IAM authorization on the API methods.

Apply an API Gateway resource policy that explicitly allows requests where the principal matches the Amazon Cognito User Pool ARN.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool authorizer in Amazon API Gateway and associate it with the API methods.; Configure the mobile application to send the Cognito ID token in the Authorization header of the HTTP requests.

Answer

The developer should configure an Amazon Cognito User Pool authorizer in Amazon API Gateway, associate it with the API methods, and configure the mobile application to send the Cognito ID token in the Authorization header of the HTTP requests.

The correct options are configuring a built-in Cognito User Pool authorizer in API Gateway and passing the ID token in the Authorization header. This natively offloads JWT verification to API Gateway without custom code, minimizing cost. The API Gateway Cognito authorizer validates the signature, audience, and expiration of the ID token passed in the Authorization header.

Step-by-Step Solution

Identify the native mechanism in Amazon API Gateway to authorize requests using Amazon Cognito User Pools.

Determine that the Amazon API Gateway Cognito User Pool authorizer provides built-in integration to validate user authentication tokens without custom code.

Using the native authorizer minimizes both the operational cost of running a custom Lambda function and the development effort of writing token validation logic.

Determine how the mobile application should pass the authentication state to API Gateway.

Configure the mobile application to extract the ID token (JWT) returned upon successful authentication with Cognito and place it in the HTTP Authorization header of subsequent API calls.

The API Gateway Cognito authorizer reads the incoming token from the designated header to verify its signature and expiration.

Key Concept

Amazon API Gateway integrates natively with Amazon Cognito User Pools using a built-in authorizer. This allows developers to validate JSON Web Tokens (JWTs) generated by Cognito without writing custom Lambda functions. The client application passes the Cognito ID token in the request header, and API Gateway automatically validates it before forwarding the request to downstream services.

Question 94Question →

A microservice processes real-time telemetry data from IoT devices and writes it to an Amazon DynamoDB table. The table's partition key is DeviceType, which has three possible values: SmartWatch, FitnessTracker, and SmartScale. During periods of high traffic, the write operations fail with a ProvisionedThroughputExceededException, even though the total consumed write capacity of the table is well below the overall provisioned limit. Which TWO actions should the developer take to resolve these throttling errors? (Select TWO.)

Select all that apply

Redesign the partition key schema to use a more unique attribute, such as a combination of DeviceType and DeviceId, to distribute writes across more partitions.

Configure the application's AWS SDK client to use exponential backoff and jitter for request retries when throttled.

Modify the application configuration to execute Scan operations instead of Query operations to read data from the table.

Increase the visibility timeout of the Amazon SQS queue consuming data from the DynamoDB Streams.

Hardcode temporary AWS access keys directly in the SDK client initialization to speed up database connection times.

Show answer & explanation

Answer: Redesign the partition key schema to use a more unique attribute, such as a combination of DeviceType and DeviceId, to distribute writes across more partitions.; Configure the application's AWS SDK client to use exponential backoff and jitter for request retries when throttled.

Answer

To resolve the throttling, the developer must redesign the partition key schema to use a high-cardinality attribute (such as combining DeviceType and DeviceId) and configure the AWS SDK client to use exponential backoff and jitter for retries.

Redesigning the partition key schema to use a unique combination like DeviceType and DeviceId distributes writes evenly across multiple partition keys, eliminating the hot partition bottleneck. Implementing exponential backoff with jitter in the application SDK client handles transient throttling errors by spacing out retry attempts.

Step-by-Step Solution

Analyze the cause of the ProvisionedThroughputExceededException.

Identify that a partition key with only three values (SmartWatch, FitnessTracker, SmartScale) creates a hot partition because write requests are concentrated on too few partitions.

DynamoDB partitions are allocated throughput limits. Having a low-cardinality partition key causes individual partitions to exceed their limits, even if the total table capacity is underutilized.

Improve partition key cardinality.

Combine DeviceType with a unique identifier like DeviceId to create a synthetic key.

A high-cardinality key distributes write requests across a larger number of partitions, ensuring even workload distribution.

Configure the client application's retry logic.

Enable exponential backoff and jitter within the AWS SDK client settings.

This prevents client-side retry storms and allows the application to recover gracefully from temporary spikes in traffic.

Key Concept

DynamoDB partition throttling occurs when a low-cardinality key concentrates requests on a single partition. This is resolved by increasing partition key cardinality and implementing client-side retries with backoff and jitter.

Estimated Time:1m 30s

Question 95Question →

A developer has deployed an AWS Lambda function inside a private subnet of a custom VPC to process user registration events. The function needs to retrieve database credentials from AWS Secrets Manager to perform database updates. However, the VPC does not have a NAT Gateway or internet access, and the Lambda function executions are timing out with connection errors to the Secrets Manager service endpoint. Which two actions should the developer take to resolve this issue? (Select TWO.)

Select all that apply

Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.

Configure the security group of the VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group of the Lambda function.

Attach an Internet Gateway to the VPC and configure the private subnet's route table to route all outbound traffic through the Internet Gateway.

Modify the Lambda function configuration to assign a public IP address and place the function in a public subnet.

Increase the Lambda function's timeout configuration to 15 minutes and double the memory allocation to handle connection retries.

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.; Configure the security group of the VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group of the Lambda function.

Answer

Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the security group of the Lambda function.

The correct options are creating an interface VPC endpoint for AWS Secrets Manager and configuring the endpoint's security group to allow inbound HTTPS traffic from the Lambda function. Since the Lambda function is running in a private subnet with no NAT Gateway or internet access, it cannot resolve or connect to the public Secrets Manager API endpoints. Creating an interface VPC endpoint (AWS PrivateLink) creates local ENIs in the subnets, enabling private routing to the service. For the connection to succeed, the security group attached to the VPC endpoint must permit inbound TCP traffic on port 443 from the security group of the Lambda function.

Step-by-Step Solution

Analyze the network configuration of the Lambda function and the target service endpoint.

Identify that the Lambda function is running inside a private subnet of a VPC without internet access (no NAT Gateway) and cannot reach the public AWS Secrets Manager endpoint.

By default, Lambda functions inside a VPC require a route to the internet (via a NAT Gateway) or a VPC endpoint to reach public AWS service endpoints.

Create an interface VPC endpoint for AWS Secrets Manager.

Establish a private route for the Lambda function to connect to AWS Secrets Manager using internal IP addresses within the VPC.

An interface endpoint powered by AWS PrivateLink allows secure, private connections to supported AWS services without using a NAT Gateway or Internet Gateway.

Configure the security groups to allow traffic between the Lambda function and the VPC endpoint.

Ensure that the endpoint's security group allows inbound traffic on port 443 (HTTPS) from the security group assigned to the Lambda function.

Without adjusting the security group rules, the VPC endpoint will block the incoming connection requests from the Lambda function.

Key Concept

Configuring private access to AWS services from a VPC using interface VPC endpoints and proper security group configurations.

Estimated Time:2m 0s

Question 96Question →

A developer is building a serverless application consisting of multiple AWS Lambda functions written in Python. Each function needs to use the same large, third-party utility library as well as a shared custom logging module. The developer wants to optimize the deployment process by minimizing the deployment package size of the individual Lambda functions and centralizing the management of these shared dependencies. Which approach should the developer use to meet these requirements with the least operational overhead?

Package the shared utility library and the logging module into an AWS Lambda layer, upload the layer, and configure each Lambda function to reference this layer.

Upload the shared libraries to an Amazon S3 bucket, configure the Lambda function's IAM trust policy to grant read access to the S3 bucket, and download the libraries at runtime.

Write code inside the Lambda handler function to download the library from a public repository into the /tmp directory using pip during each execution.

Deploy the Lambda functions inside a private VPC subnet to access an Amazon Elastic File System (EFS) containing the libraries, without configuring a NAT Gateway or VPC endpoint.

Show answer & explanation

Answer: Package the shared utility library and the logging module into an AWS Lambda layer, upload the layer, and configure each Lambda function to reference this layer.

Answer

Package the shared utility library and the logging module into an AWS Lambda layer, upload the layer, and configure each Lambda function to reference this layer.

AWS Lambda layers are designed to isolate and share common dependencies across multiple Lambda functions. This centralizes dependency management, reduces deployment package sizes, and optimizes deployment workflows.

Step-by-Step Solution

Identify the requirement to share a common utility library and logging module across multiple functions while reducing deployment package sizes.

Recognized that bundling libraries into every function zip file is redundant and inefficient.

Large libraries significantly increase deployment package size, which slows down deployment times and exceeds the storage limit of functions.

Evaluate native AWS Lambda packaging tools.

Determined that AWS Lambda Layers allow separating dependencies from the main application deployment package.

Layers are specifically designed to share code and data across multiple functions, reducing package size and simplifying updates.

Select the layer configuration as the optimal approach.

Created a single deployment artifact containing the libraries, published it as a Lambda layer, and configured functions to use it.

This avoids execution runtime overhead and uses identity-based permission roles correctly.

Key Concept

AWS Lambda Layers dependency management

Estimated Time:1m 30s

Question 97Question →

A developer is managing an application stack using AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon EC2 instance within an Amazon VPC. The developer has two new requirements:

1. Securely store the database credentials and ensure they are rotated automatically every $30$ days.
2. Detect any manual configuration changes made directly to the EC2 security group and restore the security group to the state defined in the CloudFormation template.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager, configure automatic rotation, and reference the secret in the CloudFormation template using a dynamic reference.

Perform drift detection on the CloudFormation stack, review the drifted resources, and manually edit the security group in the Amazon VPC console to match the template configuration.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, configure the built-in Parameter Store rotation schedule, and reference it in the template using a dynamic reference.

Use the CloudFormation console to run drift detection, select the drifted security group, and click the Reconcile Drift button to automatically overwrite the live resource configurations with the template state.

Initiate a stack update using a modified template to trigger a rollback, then use the ContinueUpdateRollback API while the stack is in the ROLLBACK_IN_PROGRESS state to force the security group back to its original state.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager, configure automatic rotation, and reference the secret in the CloudFormation template using a dynamic reference.; Perform drift detection on the CloudFormation stack, review the drifted resources, and manually edit the security group in the Amazon VPC console to match the template configuration.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, reference it via dynamic references, perform drift detection, and manually revert the out-of-band security group changes.

The correct combination is to store the credentials in AWS Secrets Manager and use dynamic references, which supports the

30

-day rotation requirement, and to use drift detection to identify out-of-band changes, followed by manual remediation to revert the security group to the configuration defined in the template.

Step-by-Step Solution

Evaluate the database credential rotation requirement.

AWS Secrets Manager is the correct service because it natively supports secret rotation (such as RDS credentials) every

30

days, whereas Parameter Store does not have built-in rotation.

Choosing the correct secrets management service ensures security compliance and automatic rotation requirements are met.

Address the dynamic reference requirement in the CloudFormation template.

Use dynamic references to retrieve the secret securely without hardcoding parameters.

Dynamic references allow CloudFormation to pull secrets securely from Secrets Manager during stack creation or updates.

Evaluate how to detect and remediate out-of-band changes (drift) in CloudFormation.

Run drift detection on the stack to identify which resources differ from the template. Because CloudFormation does not have an automatic one-click remediation feature, manually modify the resource (security group) back to the template specifications.

This identifies the exact drift and brings the resource back to the desired configuration manually, correcting the out-of-band change.

Key Concept

AWS CloudFormation Drift Detection and secrets management integration

Question 98Question →

A developer is implementing a serverless analytics dashboard. Users must register and log in to the dashboard, which is built as a single-page application (SPA). The application needs to call secure endpoints on Amazon API Gateway to fetch user profile data. Additionally, the client-side application must publish telemetry logs directly to an Amazon Kinesis Data Stream for real-time analysis. Which TWO steps should the developer perform to meet these security requirements with the least operational overhead?

Select all that apply

Configure a Cognito User Pool to manage user authentication, and create a Cognito User Pool Authorizer in API Gateway to validate the ID tokens sent in the HTTP request headers.

Create a Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with permissions to write to the Kinesis Data Stream.

Develop a custom Lambda Authorizer in API Gateway that parses the Cognito User Pool access token, performs manual verification against the public JWKS endpoint, and generates an IAM policy for the REST API.

Configure API Gateway to use AWS_IAM authorization, and utilize the Cognito User Pool directly to issue temporary IAM credentials for signing requests to the REST API.

Integrate the Kinesis Data Stream with the Cognito User Pool, configuring a User Pool client-side policy to grant stream write permissions to authenticated users.

Show answer & explanation

Answer: Configure a Cognito User Pool to manage user authentication, and create a Cognito User Pool Authorizer in API Gateway to validate the ID tokens sent in the HTTP request headers.; Create a Cognito Identity Pool that uses the User Pool as an identity provider, and assign an authenticated IAM role with permissions to write to the Kinesis Data Stream.

Answer

To meet the requirements with the least operational overhead, the developer should configure a Cognito User Pool with a Cognito Authorizer in API Gateway to secure the API endpoints, and use a Cognito Identity Pool linked to the User Pool to provide temporary IAM credentials that grant write permissions to the Kinesis Data Stream.

The correct solution uses the native features of AWS services to minimize custom code. By configuring a Cognito User Pool, the developer establishes a user directory. Setting up a Cognito User Pool Authorizer on API Gateway allows the platform to natively inspect and validate the ID tokens. To interact with Amazon Kinesis directly from the client, the developer uses a Cognito Identity Pool to trade the User Pool's JWTs for temporary, restricted AWS IAM credentials, which contain permission to execute the write action on the stream.

Step-by-Step Solution

Configure a Cognito User Pool to provide user authentication and management for the single-page application.

The application can authenticate users and receive JSON Web Tokens (ID, Access, and Refresh tokens).

User Pools act as the primary user directory and handle user registration and login flows.

Create a Cognito User Pool Authorizer on the API Gateway REST API and configure it to validate the incoming ID tokens in the Authorization header.

API Gateway automatically validates the signature, expiration, and audience of the JWTs without requiring custom Lambda code.

This utilizes the native API Gateway integration to minimize operational overhead and custom code.

Set up a Cognito Identity Pool (Federated Identities) and configure the Cognito User Pool as an authentication provider.

The identity pool can federate users authenticated by the user pool and exchange their JWTs for temporary AWS IAM credentials.

Identity Pools are designed to authorize access to AWS resources by issuing temporary AWS credentials.

Assign an IAM role to authenticated users in the Identity Pool with a policy that allows the 'kinesis:PutRecord' action on the target stream.

Authenticated users obtain temporary AWS credentials with permissions to publish telemetry logs directly from the browser SDK.

This establishes fine-grained authorization to access AWS resources directly from client-side code.

Key Concept

Integration of Cognito User Pools for user directory authentication, Cognito Identity Pools for authorizing direct AWS resource access (such as S3, DynamoDB, or Kinesis) via temporary credentials, and API Gateway Cognito Authorizers for securing REST endpoints.

Question 99Question →

An enterprise web application requires federated authentication via an external SAML 2.0 Identity Provider (IdP). Once authenticated, users must be able to download files directly from an Amazon S3 bucket. Access must be restricted such that users can only download objects from an S3 prefix that matches their department name (e.g., `company-data/hr/*` for the 'hr' department). The department name is supplied as a custom SAML assertion claim named `department`.

Which configuration should the developer implement to meet these requirements with the least administrative and coding overhead?

Configure an Amazon Cognito Identity Pool with the SAML IdP. Set up Attribute Mapping to map the SAML `department` claim to the principal tag `department`. In the IAM policy attached to the authenticated role, grant `s3:GetObject` permission for the resource `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*`.

Configure an Amazon Cognito User Pool with the SAML IdP. Create a Post Authentication AWS Lambda trigger that checks the user's `department` attribute, generates temporary AWS credentials with a dynamic policy, and stores them in the User Pool's custom user attributes for the client to retrieve.

Configure an Amazon API Gateway endpoint with a custom Lambda Authorizer. Send the SAML assertion to API Gateway, and have the Lambda Authorizer validate it, perform an AWS STS `AssumeRole` call to get temporary credentials for the specific department prefix, and return the credentials inside the authorizer's output context.

Configure an Amazon Cognito Identity Pool with the SAML IdP. Create separate IAM roles for each department with corresponding S3 bucket policies. Use a custom Lambda function to update the Identity Pool's role mapping rules daily to map each user's email address to their specific department's IAM role.

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool with the SAML IdP. Set up Attribute Mapping to map the SAML `department` claim to the principal tag `department`. In the IAM policy attached to the authenticated role, grant `s3:GetObject` permission for the resource `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*`.

Answer

Configure an Amazon Cognito Identity Pool with the SAML IdP, map the SAML attribute to the principal tag, and reference the tag in the IAM policy using a policy variable.

The correct option maps the SAML assertion claim to a principal tag in the Cognito Identity Pool configuration. This allows the IAM role to use Attribute-Based Access Control (ABAC) and dynamic policy variables (`${aws:PrincipalTag/department}`) to restrict access to department-specific prefixes in S3 with a single IAM role, minimizing overhead.

Step-by-Step Solution

Configure the Identity Pool with the SAML Identity Provider.

This enables federation, allowing Cognito to accept SAML assertions from the external IdP.

Cognito Identity Pools broker access to AWS resources by exchanging external identity tokens for temporary AWS credentials.

Set up Attribute Mapping in the Identity Pool.

The `department` claim from the SAML assertion is mapped to the principal tag `department` in the AWS security token context.

This enables Attribute-Based Access Control (ABAC) by attaching the department tag to the assumed IAM role session.

Reference the principal tag in the IAM role's permission policy.

A dynamic resource ARN `arn:aws:s3:::company-data/${aws:PrincipalTag/department}/*` is used in the policy.

This allows a single IAM role to scale across multiple departments without requiring manual configuration changes or multiple roles.

Key Concept

Attribute-Based Access Control (ABAC) with Amazon Cognito Identity Pools and SAML federation

Estimated Time:2m 0s

Question 100Question →

An organization hosts a critical multi-region web application on Amazon ECS Fargate across the us-east-1 and us-west-2 Regions. The application connects to an Amazon Aurora Global Database. A developer needs to design a secure solution to manage the database password. The password must be rotated every 30 days, and ECS tasks in both Regions must be able to retrieve the credentials locally with minimal latency. Which solution meets these requirements with the least operational overhead?

Store the database credentials as a SecureString parameter in AWS Systems Manager Parameter Store in us-east-1 and us-west-2. Configure an AWS Lambda function triggered by an Amazon EventBridge scheduled rule to update the database password, update the parameter in the primary Region, and copy it to the secondary Region.

Store the database credentials in AWS Secrets Manager in the primary Region. In the ECS task application code, initialize the AWS SDK client using hardcoded IAM user access keys to authenticate and retrieve the secret value from the primary Region during application startup.

Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).

Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).

Answer

Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).

The correct solution leverages AWS Secrets Manager's native support for automatic rotation of database credentials using built-in AWS Lambda rotation templates. Replicating the secret to the secondary Region ensures that ECS Fargate tasks can retrieve the secret locally, minimizing latency. To inject secrets as environment variables during task startup, the ECS container agent retrieves the secret, which requires the necessary permissions to be attached to the ECS Task Execution Role, rather than the ECS Task Role.

Step-by-Step Solution

Identify the service that natively supports automatic credential rotation and multi-region replication.

AWS Secrets Manager supports automatic rotation for Amazon RDS/Aurora and cross-region replication, whereas Parameter Store lacks these native features.

Using Secrets Manager minimizes custom replication and rotation scripts, satisfying the low operational overhead requirement.

Determine how ECS tasks retrieve secrets during container startup.

ECS allows injecting secrets directly into environment variables using the valueFrom parameter in the container definition.

Injecting secrets directly prevents them from being exposed in the task definition plaintext or application logs.

Identify the correct IAM role needed for secret injection.

The ECS Task Execution Role is used by the ECS container agent to pull images and retrieve secrets, while the ECS Task Role is for application code API calls.

Granting permission to the Task Execution Role ensures the ECS agent can retrieve the secret from Secrets Manager to spin up the container successfully.

Key Concept

Database credential rotation, multi-region replication, and ECS task execution role permissions for secrets injection.

Estimated Time:2m 30s

PreviousPage 5 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept