Examkin

All practice questions

1542 questions

All types1,542Multiple choice782Multiple select746Ordering14
Question 121Question →

A developer is writing an on-premises Python application that uses the AWS SDK (Boto3) to retrieve objects from an Amazon S3 bucket located in a separate, secondary AWS account. The developer has configured the on-premises server with an IAM user's long-term access keys stored in the default profile of the local credentials file. The security team has created an IAM role in the secondary account named CrossAccountS3ReadRole that has the required permission to access the bucket. How should the developer configure the AWS SDK to retrieve the S3 objects using the permissions of the secondary account's IAM role?

Show answer & explanation

Answer: Configure a new profile in the AWS config file containing the target role's ARN and the source profile, and then initialize the SDK session using this profile name.

Answer

Configure a new profile in the AWS config file containing the target role's ARN and the source profile, and then initialize the SDK session using this profile name.
Configuring a named profile in the AWS configuration file using 'role_arn' and 'source_profile' is the recommended way to handle role assumption in the AWS SDK. The SDK handles the API call to AWS STS (AssumeRole) using the credentials from the source profile and automatically manages the lifecycle and refresh of the temporary credentials.

Step-by-Step Solution

1
Define a named profile in the AWS configuration file (~/.aws/config) specifying the parameters for role assumption.
The profile is configured with the role_arn of the secondary account role and the source_profile set to 'default'.
This establishes the relationship between the target role to assume and the local credentials that have permission to assume it.
2
Initialize the Boto3 session in the Python code by passing the new profile name to the session constructor.
The session is initialized using the temporary credentials obtained from assuming the target role.
By passing the profile name, the SDK's default credential provider chain delegates the authentication to the STS assume-role provider, which handles token generation and automatic refreshes transparently.

Key Concept

AWS SDK Profile-based IAM Role Assumption
Estimated Time:1m 30s
Question 122Question →

A developer is implementing a custom backend service hosted on Amazon ECS that processes requests from a mobile application. The mobile application authenticates users via an Amazon Cognito User Pool and includes the obtained JSON Web Token (JWT) in the Authorization header of each API request. To minimize latency, the developer wants the backend service to validate these tokens locally rather than making network calls to Amazon Cognito for every incoming request.

Which process should the developer implement to validate the incoming JWTs?

Show answer & explanation

Answer: Download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, match the token's key ID (kid) to a key in the JWKS, verify the cryptographic signature using the corresponding public key, and validate the token's expiration, audience, and issuer claims.

Answer

The correct process is to download and cache the JSON Web Key Set (JWKS) from the Cognito User Pool endpoint, locate the matching public key using the key ID (kid) header, verify the cryptographic signature, and validate the claims locally (expiration, audience, and issuer).
The correct approach is to retrieve the public JSON Web Key Set (JWKS) from the Cognito User Pool's public URI and cache it. When a request arrives, the backend service parses the JWT header to find the key ID (kid), verifies the cryptographic signature with the matching public key, and then verifies the claims locally (expiration, audience, and issuer). This avoids any network call during request processing.

Step-by-Step Solution

1
Retrieve the User Pool's JSON Web Key Set (JWKS) from the well-known public URI.
A collection of public keys that Cognito uses to sign JSON Web Tokens.
The backend service needs the public keys to cryptographically verify the token's signature.
2
Decode the token header to locate the Key ID (kid) and match it against the JWKS.
Identifies the correct public key to use for signature verification.
Cognito rotates signing keys, so the client must match the key ID from the token with the correct public key.
3
Verify the signature and validate claims (expiration, audience, issuer) locally.
Confirmed authenticity and validity of the user's session without making external network calls.
Verifying the claims ensures the token is not expired, was issued by the expected User Pool, and belongs to the correct App Client.

Key Concept

Local validation of Amazon Cognito User Pool JWTs
Estimated Time:1m 30s
Question 123Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation Lambda function after the test traffic is routed to the replacement task set but before the production traffic is shifted. Additionally, the developer must ensure that AWS CodeDeploy has the necessary permissions to execute the deployment steps and update the Application Load Balancer listeners. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section.; Configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section, and configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using the AfterAllowTestTraffic hook in the ECS AppSpec file to trigger the validation Lambda function after test traffic routing, and configuring the CodeDeploy service IAM role trust policy to allow codedeploy.amazonaws.com to assume the role. These steps ensure CodeDeploy has the authority to orchestrate the deployment and execute verification tests at the correct stage.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for validating an Amazon ECS blue/green deployment before production traffic is shifted.
Identify that AfterAllowTestTraffic is the designated hook that runs validation tests after the test traffic is routed to the new task set.
This hook provides a window to verify the health and behavior of the new version using test traffic before exposing it to live production users.
2
Examine the IAM configurations required for CodeDeploy to assume a service role and manage ECS and ALB resources.
Identify that the CodeDeploy service IAM role must have a trust policy configured with the codedeploy.amazonaws.com principal and the sts:AssumeRole action.
This trust policy allows the AWS CodeDeploy service to securely assume the role and perform administrative actions on behalf of the developer.

Key Concept

AWS CodeDeploy for Amazon ECS uses a specific set of lifecycle hooks in the AppSpec file (such as AfterAllowTestTraffic) and requires an IAM service role with a trust policy for the codedeploy.amazonaws.com service principal.
Question 124Question →

A developer is building a serverless web application where users sign in using their email and password. Once authenticated, the application must allow users to upload files to a private Amazon S3 bucket and make requests to a backend API hosted on Amazon API Gateway. The developer wants to leverage Amazon Cognito for authentication and authorization. Which TWO configuration steps should the developer perform to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and sign-in, and use a Cognito authorizer in Amazon API Gateway to authenticate API requests.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and map Cognito user groups to IAM roles that grant the required Amazon S3 permissions.

Answer

Configure an Amazon Cognito User Pool to handle user registration and sign-in, use a Cognito authorizer in Amazon API Gateway, and configure an Amazon Cognito Identity Pool linked to the User Pool to map user groups to IAM roles for S3 access.
The correct solution involves using a Cognito User Pool to register and authenticate users, generating JWTs. A Cognito Identity Pool is then linked to the User Pool to exchange these JWTs for temporary AWS IAM credentials, which are mapped to specific roles allowing S3 upload access. Finally, the native Cognito authorizer in API Gateway is configured to validate the User Pool's tokens directly, minimizing operational overhead.

Step-by-Step Solution

1
Set up authentication directory.
Created an Amazon Cognito User Pool to manage user sign-up, sign-in, and generate JWT tokens.
User Pools act as the identity provider for user credentials and session management.
2
Establish S3 authorization.
Created an Amazon Cognito Identity Pool, integrated it with the User Pool, and mapped user groups to IAM roles with S3 permissions.
Identity Pools are necessary to vend temporary AWS credentials required for direct S3 API interactions.
3
Configure API Gateway protection.
Configured a Cognito authorizer on the API Gateway REST API endpoints.
Using the built-in Cognito authorizer allows API Gateway to validate User Pool tokens natively without needing custom Lambda code.

Key Concept

Amazon Cognito Authentication and Authorization Integration
Question 125Question →

A developer is updating a critical serverless API hosted on AWS Lambda using AWS CodeDeploy. The deployment must meet the following requirements:

- Direct only 10%10\% of the production traffic to the new Lambda function version initially.
- Route all remaining traffic to the new version after a 1010-minute monitoring window.
- Roll back the deployment automatically if any error metrics exceed the normal threshold.

Which of the following configuration options should the developer select to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify CodeDeployDefault.LambdaCanary10Percent10Minutes as the deployment configuration.; Configure CloudWatch alarms in the CodeDeploy deployment group to monitor error metrics and trigger automatic rollbacks.

Answer

To meet the requirements, the developer must select the Canary 10 percent 10 minutes deployment configuration to manage the traffic routing, and configure CloudWatch alarms on the CodeDeploy deployment group to handle automatic rollbacks on error metrics.
The correct configuration is achieved by using the Canary 10 percent 10 minutes deployment strategy and configuring CloudWatch alarms in the CodeDeploy deployment group. The canary strategy ensures the new version receives 10%10\% of the traffic initially, and shifts the remaining traffic after 1010 minutes. The CloudWatch alarms enable CodeDeploy to monitor the error metrics and perform an automated rollback to the previous version if thresholds are breached.

Step-by-Step Solution

1
Analyze the traffic shifting pattern.
The requirements specify routing 10%10\% of the traffic first, waiting 1010 minutes, and then routing the remaining 90%90\%. This corresponds to a canary deployment strategy with a 1010-minute interval.
Identifying the shift pattern helps filter out linear strategies and incorrect canary intervals.
2
Select the correct predefined AWS CodeDeploy configuration.
Choose the configuration named CodeDeployDefault.LambdaCanary10Percent10Minutes.
This matches the target behavior of a 10%10\% shift followed by a 1010-minute pause before complete routing.
3
Identify the mechanism for automated rollback.
CodeDeploy deployment groups can be associated with CloudWatch alarms (such as Lambda invocation errors).
If an alarm triggers during the deployment, CodeDeploy detects it and automatically executes a rollback to the original Lambda version.

Key Concept

AWS Lambda Canary Deployment and Automated Rollbacks using CodeDeploy
Estimated Time:1m 30s
Question 126Question →

An organization has an AWS Lambda function running in Account A (111122223333111122223333). The Lambda function needs to be triggered by an Amazon SQS queue located in Account B (444455556666444455556666). A developer is configuring a cross-account event source mapping in Account A to process messages from the queue. During setup, the event source mapping enters an `ERR` status with a permission-related error.

Which combination of actions will resolve this authorization failure? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Update the Lambda function's IAM execution role policy in Account A to grant permission for `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` on the SQS queue's ARN in Account B.; Update the SQS queue policy in Account B to grant `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` permissions to the ARN of the Lambda function's execution role in Account A.

Answer

Updating the Lambda function's execution role policy in Account A to allow SQS actions on the Account B queue, and updating the SQS queue policy in Account B to allow the Lambda execution role ARN.
To configure a cross-account SQS event source mapping, the Lambda function's execution role in Account A must be granted IAM permissions to receive, delete, and get attributes from the queue in Account B. Additionally, the SQS queue policy in Account B must be updated to trust and grant those same permissions to the Lambda function's execution role ARN in Account A.

Step-by-Step Solution

1
Identify the Lambda execution role ARN in Account A and the SQS queue ARN in Account B.
Obtained the unique identifiers needed to configure the cross-account permissions.
Both ARNs are needed to configure the resource policies and IAM policies correctly.
2
Modify the Lambda execution role's permissions policy in Account A.
Granted sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes permissions on the Account B SQS queue ARN.
Allows the Lambda service (acting on behalf of the function) to access the SQS queue in the other account.
3
Modify the SQS queue resource policy in Account B.
Added a statement allowing the Lambda execution role ARN from Account A to perform sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes.
Grants cross-account access at the resource level, allowing the external role from Account A to access Account B's SQS queue.

Key Concept

Cross-account authorization for poll-based event sources (SQS) in AWS Lambda requires both identity-based policies (on the Lambda execution role) and resource-based policies (on the SQS queue) to grant permissions.
Question 127Question →

A developer is migrating a legacy desktop application to a modern cloud-native web application. The application must support federated single sign-on (SSO) using a corporate SAML identity provider. Once users log in, the web client needs to access a private Amazon S3 bucket to retrieve user-specific reports and call a secured Amazon API Gateway HTTP API. Which TWO configurations must the developer implement to meet these requirements with the least operational overhead?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with a SAML identity provider integration, and configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens.; Configure an Amazon Cognito Identity Pool that trusts the User Pool, and associate the authenticated IAM role with permissions to read from the target S3 bucket.

Answer

Configure an Amazon Cognito User Pool with a SAML identity provider integration, configure the API Gateway HTTP API to use a JWT authorizer that validates the User Pool tokens, and configure an Amazon Cognito Identity Pool that trusts the User Pool, associating the authenticated IAM role with permissions to read from the target S3 bucket.
To meet the requirements with the least operational overhead, the developer should combine Amazon Cognito User Pools and Identity Pools. The User Pool handles authentication, integrating with the SAML identity provider to authenticate users. For API Gateway HTTP APIs, the built-in JWT authorizer validates the User Pool tokens without requiring custom code. To access Amazon S3, the developer needs an Identity Pool to exchange the authenticated User Pool token for temporary AWS credentials, allowing the web client to perform direct S3 API requests using an IAM role.

Step-by-Step Solution

1
Configure user authentication and identity federation.
Create an Amazon Cognito User Pool, integrate it with the corporate SAML identity provider, and configure the application to redirect users for login.
This establishes the identity directory and federated identity management with the external SAML provider.
2
Implement API Gateway authorization.
Configure a native JWT authorizer on the API Gateway HTTP API pointing to the Cognito User Pool issuer URL.
This secures the HTTP API endpoints by validating the JSON Web Tokens (JWT) issued by Cognito, requiring zero custom Lambda code.
3
Enable secure S3 access.
Create an Amazon Cognito Identity Pool, configure the User Pool as an identity provider, and attach an IAM policy to the authenticated role allowing read permissions to the S3 bucket.
This enables the web client to exchange its Cognito User Pool token for temporary AWS credentials to read reports directly from Amazon S3.

Key Concept

Combining Cognito User Pools for user authentication and API Gateway token validation with Cognito Identity Pools for temporary AWS credential authorization.
Estimated Time:2m 0s
Question 128Question →

A developer is deploying a containerized microservice to Amazon ECS using the AWS Fargate launch type. The application code inside the container must read messages from an Amazon SQS queue, decrypt the message payloads using an AWS KMS key, and write results to an Amazon DynamoDB table. Additionally, the task definition specifies that the database password, stored as a secure string in Systems Manager Parameter Store, should be injected as an environment variable at startup. The container image is pulled from a private Amazon ECR repository.

Which of the following configurations are required to establish the correct IAM permissions for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key.; Configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.

Answer

Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key; and configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.
To establish the correct IAM permissions, the ECS Task Role and the ECS Task Execution Role must be configured with the appropriate trust policies and permissions. The ECS Task Role is used by the application code running inside the container; therefore, it must be granted permissions to read from the SQS queue, write to the DynamoDB table, and decrypt the SQS payloads using the KMS key. The ECS Task Execution Role is used by the ECS container agent to perform actions on behalf of the task before the container starts; therefore, it must be granted permissions to pull the container image from the private Amazon ECR repository, write log streams to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store to inject it as an environment variable.

Step-by-Step Solution

1
Distinguish between infrastructure actions (ECS agent) and application actions (running code).
The application code reads from SQS, decrypts payloads, and writes to DynamoDB. The ECS agent pulls the Docker image, handles container logs, and pulls secrets to inject as environment variables at startup.
This separation determines whether a permission belongs to the Task Role or the Task Execution Role.
2
Assign the application permissions to the ECS Task Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for SQS, DynamoDB, and KMS decryption.
The containerized application assumes this role at runtime to authenticate its AWS SDK client requests.
3
Assign the infrastructure/agent permissions to the ECS Task Execution Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for ECR pulling, CloudWatch Logs writing, and Systems Manager Parameter Store reading.
The ECS container agent uses this role during container provisioning and startup phases.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role in AWS Fargate
Estimated Time:2m 30s
Question 129Question →

A developer is optimizing a high-traffic web application that stores user session data in an Amazon DynamoDB table. The application frequently retrieves session data by searching for the user's email address, which is not the table's primary key. During peak traffic hours, the application logs show numerous ProvisionedThroughputExceededException errors and users experience high latency. Which TWO actions should the developer take to resolve these issues and improve performance? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a Global Secondary Index (GSI) on the DynamoDB table with the email address as the partition key, and use the Query API instead of the Scan API to retrieve session data.; Implement Amazon ElastiCache for Redis to store and manage active user session states, offloading the frequent read and write operations from the DynamoDB table.

Answer

Configure a Global Secondary Index (GSI) on the DynamoDB table with the email address as the partition key to Query the data, and implement Amazon ElastiCache for Redis to store and manage active user session states.
The correct options are to configure a Global Secondary Index (GSI) on the DynamoDB table with the email address as the partition key, using the Query API instead of the Scan API, and to implement Amazon ElastiCache for Redis to store and manage active session states. A GSI allows querying on the non-key email attribute efficiently, while ElastiCache for Redis provides an in-memory store that handles frequent session writes and reads with sub-millisecond latency.

Step-by-Step Solution

1
Analyze the cause of the performance degradation and throttling.
The application is searching by email, which is a non-key attribute. This triggers inefficient full table Scan operations that exhaust read capacity.
Understanding the access pattern is necessary to choose the correct optimization strategy.
2
Address the inefficient querying on the non-key attribute.
Create a Global Secondary Index (GSI) using the email address as the partition key, allowing the use of Query instead of Scan.
GSIs enable lookup on non-key attributes with low latency and optimal capacity unit utilization.
3
Offload transient session state storage from the relational or primary database layer.
Introduce Amazon ElastiCache for Redis as a dedicated session store.
Caching active sessions in-memory provides sub-millisecond latency, scales horizontally, and removes unnecessary read/write load from DynamoDB.

Key Concept

Optimizing session state storage and application performance using Amazon DynamoDB Global Secondary Indexes and Amazon ElastiCache for Redis.
Question 130Question →

A Go-based web application is running on Amazon EC2 instances inside a private subnet. The application handles incoming user requests and calls a downstream microservice on another EC2 instance via HTTP. The developer has installed the AWS X-Ray daemon on all EC2 instances and wants to implement distributed tracing to monitor end-to-end performance. However, currently, no traces are appearing in the AWS X-Ray console, and the downstream HTTP calls are not being correlated with the upstream web requests.

Which two actions must the developer take to resolve these issues and ensure proper end-to-end tracing?

Select all that apply

Show answer & explanation

Answer: Attach an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances to allow the X-Ray daemon to upload trace data.; Use the AWS X-Ray SDK to instrument the HTTP client in the Go application to automatically inject the tracing header into outgoing requests.

Answer

Attach an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances, and use the AWS X-Ray SDK to instrument the HTTP client in the Go application.
The solution requires addressing both daemon communication permissions and service-to-service context propagation. First, the daemon running on the EC2 instance requires IAM permissions to upload trace segments, which is resolved by granting the AWSXRayDaemonWriteAccess policy to the instance's role. Second, trace context must be forwarded to downstream HTTP services, which is accomplished by wrapping the HTTP client with the X-Ray SDK so it injects the X-Amzn-Trace-Id header into outgoing requests.

Step-by-Step Solution

1
Configure permissions for the daemon.
The X-Ray daemon can authenticate and push data.
By attaching an IAM role with the AWSXRayDaemonWriteAccess policy to the EC2 instances, the daemon on EC2 obtains the permissions required to make PutTraceSegments API calls to AWS X-Ray.
2
Instrument the HTTP client code using the AWS X-Ray SDK.
The HTTP client automatically appends the tracing header to outgoing calls.
To propagate the trace context across HTTP boundaries, the client must generate and inject the X-Amzn-Trace-Id header into downstream requests.

Key Concept

To enable distributed tracing on EC2, the developer must ensure the X-Ray daemon has the necessary IAM permissions via an instance profile, and that HTTP clients are instrumented using the X-Ray SDK to propagate tracing context down the service call stack.
Estimated Time:2m 30s
Question 131Question →

A gaming company is developing a new multiplayer dashboard application. The application must authenticate users against an existing, on-premises legacy database containing user credentials without migrating user data to the cloud. Once authenticated, the client application must be able to query leaderboard data directly from an Amazon DynamoDB table and publish telemetry events directly to an Amazon Kinesis Data Stream. Which TWO actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis.; Build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.

Answer

Configure an Amazon Cognito Identity Pool to support developer authenticated identities (developer provider name) and associate an IAM role for authenticated users with policies allowing access to DynamoDB and Kinesis; and build a backend authentication service that validates the user's legacy credentials and calls the GetOpenIdTokenForDeveloperIdentity API to return a Cognito identity ID and an OpenID Connect token to the client.
The correct options work in tandem to implement Developer Authenticated Identities. The developer-designed backend validates user credentials against the legacy database and uses the GetOpenIdTokenForDeveloperIdentity API to obtain an OpenID Connect token and Cognito identity ID. The client application then uses these to request temporary AWS credentials from the Cognito Identity Pool, which assumes the authenticated IAM role containing the necessary DynamoDB and Kinesis permissions.

Step-by-Step Solution

1
Implement a custom backend service that validates credentials against the legacy database.
The user is authenticated successfully within the company's existing on-premises authentication domain.
Since the legacy credentials cannot be migrated to the cloud, the validation must happen on a secure backend system controlled by the developer.
2
Use the backend service to invoke the Cognito GetOpenIdTokenForDeveloperIdentity API.
Cognito registers the developer-authenticated identity and returns a unique identity ID and an OpenID Connect (OIDC) token to the backend, which forwards them to the client.
This establishes a mapping between the custom user identity and an Amazon Cognito Identity Pool identifier.
3
Configure the Amazon Cognito Identity Pool to trust the developer provider name, and attach an authenticated IAM role with read/write access to DynamoDB and Kinesis.
The client application can call GetCredentialsForIdentity using the OIDC token to retrieve temporary, limited-privilege AWS credentials.
This enables the client application to query DynamoDB and publish to Kinesis directly without passing through a custom API proxy.

Key Concept

Cognito Developer Authenticated Identities (Developer Provider Flow)
Question 132Question →

A developer is designing a serverless backend where a single-page application (SPA) needs to access a private REST API hosted on Amazon API Gateway. The developer wants to authenticate users using an Amazon Cognito User Pool and grant them access to the API Gateway endpoints. The client application needs to acquire a JSON Web Token (JWT) after user login and pass it to API Gateway for validation. Which configuration should the developer implement in API Gateway to authorize these requests with the least administrative effort and cost?

Show answer & explanation

Answer: Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.

Answer

Create a Cognito User Pool Authorizer in API Gateway, and configure the API method to use this authorizer while specifying the Identity Source header.
The correct option is to create a Cognito User Pool Authorizer in API Gateway and configure the API method to use this authorizer. This option represents the native integration designed specifically for Amazon Cognito User Pools. It automatically validates incoming JWT signatures, expiration, and audiences at the API Gateway edge, requiring zero custom code and adding no extra execution costs for custom Lambda authorizers.

Step-by-Step Solution

1
Identify the authentication source and token type.
The authentication source is an Amazon Cognito User Pool, and the token is a standard JWT.
This determines which authorization mechanisms are natively supported by API Gateway.
2
Evaluate native API Gateway features against custom solutions.
API Gateway offers a built-in Cognito User Pool Authorizer that handles JWT validation natively.
A native feature reduces administrative overhead, eliminates the need for custom Lambda authorizers, and minimizes costs.
3
Configure the method execution settings.
Bind the API method to the Cognito User Pool Authorizer and define the header where the JWT will be supplied.
This ensures the API Gateway enforces authorization at the entry point prior to routing requests downstream.

Key Concept

API Gateway Cognito User Pool Authorizer
Estimated Time:1m 30s
Question 133Question →

An organization uses AWS CodePipeline to automate their application deployment. During a recent deployment, an AWS CloudFormation action updating a nested stack fails, triggering a rollback. The parent stack fails to roll back completely and becomes stuck in the `UPDATE_ROLLBACK_FAILED` state because a Lambda function backing a Custom Resource was manually deleted prior to the deployment. Which action should the developer take to resolve this issue and return the stack to a stable state?

Show answer & explanation

Answer: Execute the `continue-update-rollback` command in the AWS CLI, specifying the logical ID of the failed custom resource in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Afterward, recreate the Lambda function or update the template to point to a valid resource, and redeploy.

Answer

Execute the `continue-update-rollback` command in the AWS CLI, specifying the logical ID of the failed custom resource in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Afterward, recreate the Lambda function or update the template to point to a valid resource, and redeploy.
When a Custom Resource's provider (like a Lambda function) is deleted, CloudFormation cannot invoke the cleanup logic during rollback, which leaves the stack in the `UPDATE_ROLLBACK_FAILED` state. The developer must use the `continue-update-rollback` command with the `--resources-to-skip` parameter. This allows CloudFormation to bypass execution of the missing resource's logic and transitions the stack to `UPDATE_ROLLBACK_COMPLETE`. After the stack is in a stable state, proper template fixes can be safely applied.

Step-by-Step Solution

1
Analyze the state of the CloudFormation stack.
The stack is stuck in `UPDATE_ROLLBACK_FAILED` because a Custom Resource's deletion/cleanup handler failed (due to the missing backing Lambda function).
You cannot perform direct updates or standard rollbacks while a stack is in this non-stable state.
2
Execute the recovery operation using the AWS CLI or Console.
Run `aws cloudformation continue-update-rollback --stack-name <stack-name> --resources-to-skip <failed-custom-resource-logical-id>`.
This instructs CloudFormation to skip the cleanup behavior for the deleted Lambda-backed Custom Resource and force the stack into `UPDATE_ROLLBACK_COMPLETE`.
3
Remediate and redeploy.
Update the template with correct Lambda ARNs or recreate the missing Lambda resource, then run the pipeline deployment again.
Now that the stack is in a stable state (`UPDATE_ROLLBACK_COMPLETE`), new deployment updates can be accepted.

Key Concept

Recovering CloudFormation stacks from the UPDATE_ROLLBACK_FAILED state.
Estimated Time:3m 0s
Question 134Question →

A developer is updating an AWS CloudFormation stack that manages a production application. The update fails during the creation of a new database instance due to a parameter conflict. CloudFormation automatically initiates a rollback, but the rollback fails because an Amazon S3 bucket, which was manually modified out-of-band, now has a bucket policy that denies the CloudFormation service role the permissions required to delete it. The stack is now in the `UPDATE_ROLLBACK_FAILED` state. The developer updates the S3 bucket policy to allow the CloudFormation service role to delete the bucket.

Which action must the developer perform next to return the stack to a stable state so that future updates can be applied?

Show answer & explanation

Answer: Execute the `aws cloudformation continue-update-rollback` command to resume the rollback and return the stack to a stable state.

Answer

Execute the `aws cloudformation continue-update-rollback` command to resume the rollback and return the stack to a stable state.
The correct action is to resume the rollback by executing the `continue-update-rollback` command. Since the permissions issue blocking the deletion of the S3 bucket has been resolved, CloudFormation will successfully delete the bucket and return the stack to the `UPDATE_ROLLBACK_COMPLETE` state, which allows subsequent updates.

Step-by-Step Solution

1
Analyze the stack state.
The stack is in the `UPDATE_ROLLBACK_FAILED` state, which prevents direct stack updates.
You must understand the current lifecycle state of the stack to determine the correct troubleshooting command.
2
Identify the cause of the rollback failure and verify its resolution.
The S3 bucket deletion failure due to bucket policy restrictions has been resolved by modifying the bucket policy.
Resuming the rollback will fail again if the underlying resource blocking the rollback is not fixed first.
3
Trigger the resumption of the rollback process.
Executing the `continue-update-rollback` command resumes the rollback, transitioning the stack to `UPDATE_ROLLBACK_COMPLETE`.
This returns the stack to a stable configuration, enabling future update operations.

Key Concept

Handling CloudFormation stack update rollback failures using the ContinueUpdateRollback action.
Estimated Time:2m 0s
Question 135Question →

A developer is configuring an AWS CodeDeploy deployment group for a critical serverless application. To minimize the blast radius of potential failures, the developer needs a strategy that shifts traffic to the new AWS Lambda function version gradually over time. If any CloudWatch alarms are triggered during the deployment, CodeDeploy must immediately roll back all traffic to the original version.

Which of the following CodeDeploy deployment configuration types will satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Canary configurations; Linear configurations

Answer

The correct configurations are Canary configurations and Linear configurations.
Canary and Linear configurations are the two native AWS CodeDeploy deployment configuration types that support gradual traffic shifting for serverless applications. Canary configurations route a portion of traffic to the new version, wait for a specified period, and then route the rest. Linear configurations shift traffic in equal increments at regular intervals. If a CloudWatch alarm triggers during either deployment, CodeDeploy immediately routes 100% of the traffic back to the original version by updating the Lambda alias.

Step-by-Step Solution

1
Analyze the requirements from the scenario: gradual traffic shifting to minimize blast radius and immediate rollback capability using CloudWatch alarms.
Identified that the solution must support shifting a fraction of traffic to the new version of the AWS Lambda function first, and instantly routing 100% of traffic back to the old version upon failure.
This narrows the choices to CodeDeploy deployment configurations designed for AWS Lambda traffic shifting.
2
Evaluate the available AWS CodeDeploy configurations for serverless deployments against the requirements.
Canary configurations (e.g., Canary10Percent5Minutes) shift a portion of traffic initially, while Linear configurations (e.g., Linear10PercentEvery1Minute) shift traffic incrementally. Both types support immediate rollback via alias re-pointing.
These two configuration types are the only native CodeDeploy options for AWS Lambda that shift traffic gradually.

Key Concept

AWS CodeDeploy Traffic Shifting Configurations for AWS Lambda
Question 136Question →

A developer is configuring an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application is configured to stream logs to Amazon CloudWatch using the `awslogs` log driver, and it retrieves a database password from AWS Secrets Manager by referencing the secret in the container definition's environment variables. Inside the container, the application code uses the AWS SDK to write processed reports to an Amazon S3 bucket.

Which of the following IAM configurations must the developer apply to allow the task to run and successfully perform all of these operations?

Show answer & explanation

Answer: Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.

Answer

Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.
The correct answer properly separates the runtime application permissions (S3 upload) into the Task Role and the container agent's operational permissions (CloudWatch logs and Secrets Manager retrieval) into the Task Execution Role. It also correctly specifies the ecs-tasks.amazonaws.com service principal in the trust policy of both roles to allow Amazon ECS to assume them.

Step-by-Step Solution

1
Differentiate between the permissions needed by the application runtime and those needed by the ECS agent.
The application code needs S3 permissions, which requires the ECS Task Role. The ECS container agent needs CloudWatch Logs and Secrets Manager permissions to set up the container, which requires the ECS Task Execution Role.
Splitting these permissions correctly conforms to the principle of least privilege and allows both the agent and application to execute successfully.
2
Verify the correct trust relationship service principal for ECS task roles.
Both roles must specify the ecs-tasks.amazonaws.com service principal in their trust policy.
This allows the ECS service to assume these roles on behalf of the tasks running on AWS Fargate.

Key Concept

Differentiating between the ECS Task Role and the ECS Task Execution Role is critical when deploying containerized applications. The Task Role is assumed by the application code inside the container to make AWS API calls, whereas the Task Execution Role is assumed by the Amazon ECS container agent to perform setup operations like pulling images, writing logs to CloudWatch, and reading environment variables from Systems Manager Parameter Store or Secrets Manager.
Question 137Question →

A developer is implementing a serverless application where an AWS Lambda function in Account A (111122223333111122223333) needs to access a DynamoDB table in Account B (444455556666444455556666). The developer creates an IAM role named `CrossAccountDynamoDBRole` in Account B that has the required permissions to access the DynamoDB table. The Lambda function is configured with an execution role named `arn:aws:iam::111122223333:role/LambdaExecutionRole` and runs code that calls the `AssumeRole` API of AWS Security Token Service (STS) to assume `CrossAccountDynamoDBRole`.

However, when the Lambda function runs, the `AssumeRole` call fails with an `AccessDenied` error. The developer reviews the trust policy of `CrossAccountDynamoDBRole` in Account B:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy of `CrossAccountDynamoDBRole` in Account B will resolve this error?

Show answer & explanation

Answer: Update the `Principal` block to reference the ARN of the Lambda function's IAM execution role in Account A:

"Principal": {
"AWS": "arn:aws:iam::111122223333:role/LambdaExecutionRole"
}

Answer

Update the Principal block of the target role's trust policy in Account B to trust the Lambda execution role's ARN in Account A.
The correct option is correct because when Lambda code runs, the AWS SDK client initiates API calls signed with the function's execution role credentials. To assume the cross-account role, the trust policy in Account B must specify the caller's IAM execution role ARN (`arn:aws:iam::111122223333:role/LambdaExecutionRole`) as the principal in the trust relationship statement.

Step-by-Step Solution

1
Analyze the IAM configuration and identify the entity calling the `AssumeRole` API.
The Lambda function uses its execution role (`arn:aws:iam::111122223333:role/LambdaExecutionRole`) to sign and execute AWS API requests, including `sts:AssumeRole`.
When a function runs, it uses the temporary credentials of its execution role to authorize all actions.
2
Inspect the trust policy of the target role `CrossAccountDynamoDBRole` in Account B.
The current trust policy only allows the service principal `lambda.amazonaws.com` to assume the role.
This configuration is for allowing the Lambda service to assume an execution role, not for allowing an assumed role to call another role.
3
Update the trust policy of the target role to authorize the correct principal.
The principal is changed to `"AWS": "arn:aws:iam::111122223333:role/LambdaExecutionRole"`.
This establishes a cross-account trust relationship allowing the execution role in Account A to assume the role in Account B.

Key Concept

Cross-Account IAM Roles and Service vs. AWS Principals
Question 138Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application is packaged in a Docker image stored in a private Docker Hub repository. During task initialization, the Amazon ECS agent must pull this image using credentials stored in AWS Secrets Manager. Once running, the application code must publish messages to an Amazon SQS queue. Which combination of IAM configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a policy to the ECS task execution role that allows the secretsmanager:GetSecretValue action on the secret containing the private registry credentials.; Attach a policy to the ECS task role that allows the sqs:SendMessage action on the Amazon SQS queue.

Answer

To configure this setup correctly, the developer must attach the secretsmanager:GetSecretValue permission to the ECS task execution role to allow the ECS agent to retrieve the private registry credentials, and attach the sqs:SendMessage permission to the ECS task role to allow the application code to write to the SQS queue.
The correct configurations involve assigning the registry credentials access to the ECS task execution role and assigning SQS permissions to the ECS task role. The ECS task execution role is assumed by the ECS agent to perform actions such as pulling the container image and pulling secrets from Secrets Manager. The ECS task role is assumed by the application running inside the container, granting it permissions to interact with AWS resources like SQS.

Step-by-Step Solution

1
Determine the role required for container image pull authentication.
The ECS container agent handles pulling the image from the private registry during task initialization, which requires accessing the secret credentials. This requires the ECS Task Execution Role.
Permissions needed by the ECS daemon/agent (such as pulling images and reading secrets to start containers) must be defined in the Task Execution Role.
2
Determine the role required for SQS message publishing.
The application code running inside the container performs the SQS operations once the container starts. This requires the ECS Task Role.
Permissions needed by the containerized application code itself (such as interacting with AWS APIs like DynamoDB, S3, or SQS) must be defined in the Task Role.
3
Select the two correct configuration steps.
Assign secrets retrieval to the task execution role, and assign SQS send message permission to the task role.
This correctly maps permissions based on which entity (the ECS agent vs. the application code) performs each action.

Key Concept

ECS Task Role vs. Task Execution Role
Question 139Question →

A developer is designing a high-traffic web application hosted on Amazon ECS. The application requires a caching layer to store session state data for logged-in users. The session states must be replicated across multiple Availability Zones to ensure high availability, and the cache must support automatic failover. Additionally, the configuration credentials for the cache cluster must be retrieved securely from a service that supports automatic credential rotation. Which architecture should the developer implement to meet these requirements?

Show answer & explanation

Answer: Configure Amazon ElastiCache for Redis with replication enabled. Store the cache access credentials in AWS Secrets Manager and configure automatic rotation for the credentials.

Answer

Configure Amazon ElastiCache for Redis with replication enabled. Store the cache access credentials in AWS Secrets Manager and configure automatic rotation for the credentials.
The correct solution uses Amazon ElastiCache for Redis with replication enabled, which provides multi-AZ replication, high availability, and automatic failover. The credentials are stored in AWS Secrets Manager, which natively supports automatic rotation of secrets. This directly satisfies all the requirements.

Step-by-Step Solution

1
Analyze high availability and failover requirements for the session store.
Identify Amazon ElastiCache for Redis as the correct choice since it supports replication, Multi-AZ, and automatic failover, whereas Memcached does not support replication.
The system requires session state data to be replicated across multiple Availability Zones with automatic failover.
2
Analyze security and rotation requirements for credentials.
Select AWS Secrets Manager as the credential storage solution because it supports native automatic rotation, unlike Systems Manager Parameter Store.
The configuration credentials must be stored securely and rotated automatically.
3
Evaluate DynamoDB configurations to rule out anti-patterns.
Discard options suggesting manual Scan cleanups or low-entropy partition keys as they introduce severe performance bottlenecks and high costs.
DynamoDB should use high-entropy keys to avoid hot partitions and use Time to Live (TTL) for session expiration instead of manual Scan operations.

Key Concept

Selecting and configuring the appropriate caching and state management services in AWS based on high availability, performance, and security requirements.
Question 140Question →

A serverless microservice uses an AWS Lambda function to retrieve user configuration profiles from an Amazon ElastiCache cluster located in a private VPC subnet, and then sends SMS notifications by calling a third-party gateway's HTTP API over the internet. The Lambda function is configured to run in the same VPC and private subnets as the ElastiCache cluster. During execution, the Lambda function successfully connects to ElastiCache, but the HTTP requests to the third-party gateway consistently fail with connection timeout errors. Which two configuration actions should the developer take to resolve this network connectivity issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet of the VPC, and configure the route table of the Lambda function's private subnets to route traffic destined for 0.0.0.0/00.0.0.0/0 through the NAT Gateway.; Verify that the security group associated with the Lambda function has outbound rules allowing egress HTTP/HTTPS traffic to the internet.

Answer

Deploy a NAT Gateway in a public subnet of the VPC, route traffic destined for the internet through it, and ensure the Lambda function's security group allows outbound HTTP/HTTPS traffic.
The correct options involve deploying a NAT Gateway in a public subnet and configuring the private subnet's route table to direct internet-bound traffic (0.0.0.0/00.0.0.0/0) to it, while also verifying that the Lambda function's security group allows outbound egress traffic on web ports. This ensures both routing and firewall policies allow the Lambda function to reach the external HTTP API.

Step-by-Step Solution

1
Analyze the network paths and resources.
The database connection to ElastiCache works because both resources are inside the private subnets of the VPC. The outbound internet calls fail because there is no route to the internet from the private subnets.
Identifying that the failure is related to outbound internet access helps narrow down the solution to VPC egress configurations.
2
Configure the routing tables for internet access.
Deploy a NAT Gateway in a public subnet, and add a route to 0.0.0.0/00.0.0.0/0 in the private subnet's route table pointing to the NAT Gateway.
This establishes a valid network path for resources in the private subnets to communicate with public internet services.
3
Verify security group rules.
Ensure the security group attached to the Lambda function permits outbound traffic to the internet on ports 80 and 443.
Even with correct route tables, restrictive outbound security group rules can block connection attempts.

Key Concept

Lambda VPC networking requires a NAT Gateway for outbound internet access from private subnets.
PreviousPage 7 / 78Next
All practice questions — AWS Certified Developer - Associate | Examkin