Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is deploying an AWS Lambda function that processes transaction requests. The function is configured to run within the private subnets of a custom VPC. The Lambda function must connect to a private Amazon RDS PostgreSQL database cluster in the same VPC, call a public API endpoint of an external payment provider, and retrieve parameters from AWS Systems Manager Parameter Store. Which two network and security configurations should the developer implement to enable this connectivity? (Select two.)

Select all that apply

Configure the RDS database security group to allow inbound TCP traffic on port

5432

from the security group associated with the Lambda function.

Configure a route in the private subnet route table pointing

0.0.0.0/0

to a NAT Gateway deployed in a public subnet.

Enable public IP assignment on the Lambda function and configure a route in the private subnet route table pointing

0.0.0.0/0

to the Internet Gateway.

Modify the trust policy of the Lambda function's IAM execution role to allow the rds.amazonaws.com service principal to assume the role.

Migrate the configurations to AWS Secrets Manager to utilize a Gateway VPC Endpoint for database and external API routing.

Show answer & explanation

Answer: Configure the RDS database security group to allow inbound TCP traffic on port $5432$ from the security group associated with the Lambda function.; Configure a route in the private subnet route table pointing $0.0.0.0/0$ to a NAT Gateway deployed in a public subnet.

Answer

To enable connectivity, the developer must allow inbound TCP traffic on port

5432

from the Lambda function's security group in the RDS database's security group, and configure a route in the private subnet route table directing outbound internet traffic (

0.0.0.0/0

) to a NAT Gateway deployed in a public subnet.

To connect the Lambda function to the RDS database, the database security group must explicitly allow inbound traffic from the security group associated with the Lambda function. Additionally, since the Lambda function runs in a private VPC subnet, it cannot access external endpoints directly. Configuring a route pointing to a NAT Gateway in a public subnet allows the Lambda function to route traffic to the external payment API and Systems Manager Parameter Store.

Step-by-Step Solution

Configure the security group of the destination database to permit inbound traffic from the source.

The RDS database cluster security group is updated with a rule allowing inbound TCP traffic on port

5432

from the Lambda function's security group.

Since both resources reside within the same VPC, communication is routed locally but must be explicitly permitted by the database's security group.

Configure outbound routing for external internet endpoints and public AWS services.

A route is added to the private subnet route table directing

0.0.0.0/0

traffic to a NAT Gateway deployed in a public subnet.

Lambda functions inside private VPC subnets do not have public IP addresses and cannot connect directly to an Internet Gateway. A NAT Gateway translates their addresses and forwards traffic to the public internet, enabling access to the payment provider API and Systems Manager Parameter Store.

Key Concept

VPC security group rules and routing configurations for Lambda functions in private subnets.

Question 262Question →

A company is developing a client-side web application where users need to log in to their accounts and then upload profile images directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Amazon Cognito User Pools to manage user registration, authentication, and directory services.

Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.

Amazon Cognito User Pools to directly issue temporary AWS credentials for the S3 bucket access.

An Amazon API Gateway Lambda Authorizer to exchange user login tokens for S3 write permissions.

AWS IAM user access keys embedded in the application code to authenticate requests to the S3 bucket.

Show answer & explanation

Answer: Amazon Cognito User Pools to manage user registration, authentication, and directory services.; Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.

Answer

To authenticate users and obtain temporary AWS credentials for S3 uploads, the developer should use Amazon Cognito User Pools for user directory management, and Amazon Cognito Identity Pools to authorize and obtain temporary AWS credentials.

The correct solution involves using Amazon Cognito User Pools to authenticate the users and manage their directory, combined with Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS credentials that allow the client application to upload files to the S3 bucket directly.

Step-by-Step Solution

Select the component for user directory management and authentication.

Use Amazon Cognito User Pools.

Cognito User Pools provide sign-up and sign-in services for web and mobile application users.

Select the component to exchange identity tokens for temporary AWS security credentials.

Use Amazon Cognito Identity Pools (Federated Identities).

Cognito Identity Pools enable you to grant authenticated users temporary AWS credentials to access AWS services such as Amazon S3 directly.

Key Concept

The separation of concerns between Amazon Cognito User Pools (authentication) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).

Question 263Question →

A developer is configuring the following trust policy for an IAM role to be used by an AWS Lambda function:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following describes the purpose of this trust policy?

It defines the permissions the Lambda function has to perform actions on other AWS resources.

It configures the Lambda function to authenticate using hardcoded access keys in the SDK code.

It allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.

It grants the Lambda function permission to access S3 buckets and DynamoDB tables directly.

Show answer & explanation

Answer: It allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.

Answer

The correct answer states that the policy allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.

The trust policy (or trust relationship) of an IAM role defines the trusted entities (principals) that can assume the role. Specifying the service principal 'lambda.amazonaws.com' and the action 'sts:AssumeRole' allows the Lambda service to assume the role and request temporary security credentials on behalf of the function execution context.

Step-by-Step Solution

Analyze the JSON structure of the policy.

The document contains a 'Principal' element specifying 'lambda.amazonaws.com' and an 'Action' of 'sts:AssumeRole'.

This shows the policy is a trust policy designed to establish a trust relationship with a specific AWS service.

Determine the effect of the 'sts:AssumeRole' action on the service principal.

The trust policy grants the AWS Lambda service authorization to assume the IAM role.

When assumed, the role provides temporary, short-lived security credentials for the Lambda execution context.

Key Concept

IAM Role Trust Policies vs. Permissions Policies

Estimated Time:45s

Question 264Question →

A developer is building a mobile fitness tracking app. The app requires users to create an account, sign in with a username and password, and manage their profile data. The application does not need to access other AWS services directly from the mobile client. Which Amazon Cognito feature should the developer implement to provide the user directory and authentication services?

Amazon Cognito Identity Pools

Amazon Cognito User Pools

API Gateway Lambda Authorizers

AWS Identity and Access Management (IAM) access keys hardcoded in the app code

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools

Amazon Cognito User Pools provide a fully managed user directory that handles user registration, authentication (sign-up/sign-in), and profile management. Since the application does not require direct access to other AWS services from the mobile client, a User Pool alone satisfies the requirements.

Step-by-Step Solution

Analyze the requirements for user authentication, registration, and directory management in the mobile application context.

The application needs a secure user directory to store profile data, along with registration (sign-up) and login (sign-in) flows.

This identifies that the core need is authentication (AuthN) and user management, not AWS resource authorization (AuthZ).

Evaluate the role of Amazon Cognito User Pools for this requirement.

Amazon Cognito User Pools act as the identity provider, containing the user directory, sign-up, sign-in, and account recovery features out-of-the-box.

Since the app only needs to authenticate users and manage their profiles without accessing other AWS resources directly, a User Pool is the correct and complete solution.

Distinguish from Cognito Identity Pools and other security configurations.

Cognito Identity Pools are for granting temporary credentials for AWS resources, which is not needed. Custom Lambda Authorizers control API Gateway access, and hardcoded IAM keys violate security best practices.

This rules out the incorrect options and confirms that a Cognito User Pool is the most appropriate and secure architecture.

Key Concept

Cognito User Pools vs. Identity Pools

Estimated Time:45s

Question 265Question →

A company is building a financial transactions API where an AWS Lambda function, attached to private subnets in a custom VPC, must query a private Amazon Aurora MySQL database. The function also needs to retrieve database credentials from AWS Systems Manager Parameter Store and dispatch transaction receipts to an external payment gateway. Security policies mandate that database traffic and credentials retrieval must not traverse the public internet. Which combination of network configurations and security settings will allow the function to perform all required tasks?

Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for

0.0.0.0/0

pointing to the NAT Gateway.

Associate the Lambda function with the private subnets. Rely on the default VPC subnet routing to reach the external payment gateway and Systems Manager without deploying a NAT Gateway or VPC endpoints.

Associate the Lambda function with the private subnets. Store the database credentials in Systems Manager Parameter Store and enable automatic credential rotation. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for

0.0.0.0/0

pointing to the NAT Gateway.

Associate the Lambda function with the private subnets. Configure the trust policy of the Lambda execution role to trust ssm.amazonaws.com so that the service can retrieve the credentials. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for

0.0.0.0/0

pointing to the NAT Gateway.

Show answer & explanation

Answer: Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for $0.0.0.0/0$ pointing to the NAT Gateway.

Answer

0.0.0.0/0

pointing to the NAT Gateway.

The correct configuration establishes private connectivity to AWS Systems Manager Parameter Store using an Interface VPC Endpoint, avoiding the public internet. At the same time, it uses a NAT Gateway in a public subnet to allow the Lambda function to securely route outbound internet traffic to the external payment gateway.

Step-by-Step Solution

Determine the routing requirements for each destination endpoint.

Database traffic must remain local within the VPC; AWS Systems Manager Parameter Store must be accessed privately within the AWS network; the external payment gateway requires routing to the public internet.

Understanding where traffic needs to route is critical for designing the correct VPC components.

Configure the private endpoint for Systems Manager Parameter Store.

Provision an Interface VPC Endpoint (PrivateLink) for Systems Manager (ssm) inside the private subnets.

This routes Parameter Store requests entirely within the AWS network, fulfilling the security requirement that credentials retrieval does not traverse the public internet.

Configure outbound routing for external internet access.

Deploy a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route in the private subnets' route table pointing

0.0.0.0/0

to the NAT Gateway.

Because Lambda functions inside private subnets lack public IP addresses, they must use a NAT Gateway to send traffic to external endpoints like the payment gateway.

Key Concept

VPC endpoints allow private access to supported AWS services, whereas resources inside private subnets must use a NAT Gateway in a public subnet to communicate with external internet services.

Estimated Time:2m 0s

Question 266Question →

A developer is building a mobile fitness application that integrates with an Amazon API Gateway REST API backed by AWS Lambda. The application requires users to sign in using their corporate Google Workspace accounts via OpenID Connect (OIDC). Once authenticated, the mobile client must send a secure token with every API request. The API Gateway must validate this token before forwarding the request to the Lambda function. Additionally, the Lambda function needs to access the user's Cognito group memberships to enforce fine-grained access control.

Which solution meets these requirements with the least operational overhead?

Configure an Amazon Cognito Identity Pool with Google as an identity provider. Secure the API Gateway REST API using a custom API Gateway Lambda authorizer that exchanges the Google token for temporary credentials, validates the session, and retrieves the group claims.

Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Configure an Amazon Cognito User Pool with Google as an identity provider. Implement a custom API Gateway Lambda authorizer that validates the JSON Web Token (JWT) sent by the client, calls the Cognito AdminGetUser API to retrieve user attributes, and passes the claims in the authorization context.

Configure an Amazon Cognito Identity Pool with Google as an identity provider. Set the API Gateway method authorization to AWS_IAM. Have the mobile application exchange the OIDC token for temporary AWS credentials via the Identity Pool, sign requests using Signature Version 4, and pass the group information in a custom request header.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Answer

Configure an Amazon Cognito User Pool with Google as an identity provider, secure the API Gateway using a built-in Cognito User Pool authorizer with Lambda proxy integration, and inspect the requestContext.authorizer.claims object in the Lambda function.

The correct solution utilizes an Amazon Cognito User Pool to manage authentication with the OIDC provider (Google) and secures the API Gateway REST API using the native Cognito User Pool authorizer. This authorizer validates incoming JSON Web Tokens (JWTs) automatically without writing custom code. Using a Lambda proxy integration ensures that all claims, including user groups, are parsed and passed in the requestContext.authorizer.claims object of the Lambda event payload, minimizing operational overhead.

Step-by-Step Solution

Determine the correct Cognito pool type for directory authentication and federation.

Cognito User Pool is selected because it acts as the user directory and supports OIDC/SAML federation, whereas Identity Pools are used for authorization and vending temporary AWS credentials.

The scenario requires users to sign in and authenticate via Google Workspace before accessing custom API endpoints.

Select the appropriate API Gateway authorization mechanism to validate the token with minimal overhead.

API Gateway Cognito User Pool Authorizer is selected instead of a custom Lambda Authorizer.

API Gateway native Cognito authorizers validate JWTs automatically without writing or maintaining custom code, reducing latency and operational overhead.

Configure the API Gateway integration and access token claims in the backend Lambda function.

Configure API Gateway with Lambda proxy integration. Retrieve the groups from the event's requestContext.authorizer.claims context object.

Lambda proxy integration automatically populates validated token claims in the event payload, allowing the backend function to perform fine-grained authorization using trusted group data.

Key Concept

Amazon Cognito User Pool Authorizer integration with Amazon API Gateway and Lambda proxy integration.

Question 267Question →

A developer is implementing client-side envelope encryption in a custom application to encrypt large payload files (greater than $10\text{ MB}$ ) before uploading them to Amazon S3. The application needs to perform the encryption locally using a customer managed key stored in AWS KMS.

Which sequence of AWS SDK operations should the developer use to perform this client-side encryption?

Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.

Call Encrypt with the payload data to perform direct encryption in AWS KMS, then store the returned ciphertext payload in Amazon S3.

Call GenerateDataKeyWithoutPlaintext to retrieve the ciphertext data key. Use the ciphertext key to encrypt the payload locally, then store both the encrypted payload and the ciphertext key.

Call GetParameter with decryption enabled to retrieve the customer managed key from AWS Systems Manager Parameter Store, then use it to encrypt the payload locally.

Show answer & explanation

Answer: Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.

Answer

The correct approach is to call the GenerateDataKey API to obtain both a plaintext data key (for local cryptographic operations) and a ciphertext data key (for safe storage). The plaintext key is used to encrypt the payload locally and must be removed from memory immediately afterward to ensure security.

Step-by-Step Solution

Request a data key from AWS KMS.

Call the GenerateDataKey API passing the identifier of the customer managed key, which returns both a plaintext data key and a ciphertext data key.

The application needs the plaintext key to perform the local cryptographic operation, and the ciphertext key to store with the data for future decryption.

Perform local encryption.

Encrypt the

10\text{ MB}

payload locally using the plaintext data key and a local encryption algorithm (e.g., AES-256).

Encrypting the data locally avoids sending large payloads over the network to AWS KMS, which has a strict

4\text{ KB}

limit for direct encryption.

Clean up memory and persist metadata.

Wipe the plaintext data key from memory and upload the encrypted payload along with the ciphertext data key to Amazon S3.

Discarding the plaintext key ensures security, while saving the ciphertext key ensures that the data can be decrypted later by calling the Decrypt API with KMS.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:1m 30s

Question 268Question →

A developer is building a document search portal. The portal must support user registration and sign-in. Once authenticated, users must be able to call an Amazon API Gateway REST API to search for document metadata, and then download the corresponding PDF files directly from a private Amazon S3 bucket. Which TWO actions should the developer take to implement the authentication and authorization for this portal?

Select all that apply

Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.

Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Configure an Amazon Cognito User Pool to generate temporary AWS IAM credentials directly for users to download files from the Amazon S3 bucket.

Implement a custom API Gateway Lambda Authorizer to validate Cognito User Pool tokens and generate temporary AWS IAM credentials for S3 access.

Configure an Amazon Cognito Identity Pool to manage the user registration, profile data, and login flow for the portal.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.; Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Answer

To secure the portal, the developer must configure an Amazon Cognito User Pool to handle user registration and authentication, utilizing a Cognito Authorizer on the API Gateway REST API. The developer must also configure an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS IAM credentials allowing direct S3 access.

The correct strategy leverages the Amazon Cognito User Pool to manage authentication and user profiles, paired with a Cognito Authorizer on API Gateway to validate the resulting tokens. The Amazon Cognito Identity Pool is then utilized to exchange these tokens for temporary AWS credentials so the client can safely read objects from S3 without passing static credentials or routing file payloads through API Gateway.

Step-by-Step Solution

Configure user authentication and API protection.

Amazon Cognito User Pool is created, and the API Gateway API is configured with a Cognito Authorizer.

This establishes a user directory for registration/sign-in and allows API Gateway to validate user tokens natively.

Configure direct S3 access authorization.

Amazon Cognito Identity Pool is created, linked to the User Pool, and mapped to an IAM role with S3 read permissions.

This enables clients to exchange their User Pool tokens for temporary AWS IAM credentials to retrieve files directly from S3.

Key Concept

Distinction between Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization of AWS resource access.

Question 269Question →

A company is building a mobile travel application where users authenticate via a client interface and receive a JSON Web Token (JWT). The application's backend services are exposed through an Amazon API Gateway REST API. The developer needs to secure the API endpoints so that only authenticated users can access them, verifying the JWT signature on each request. Which of the following is the most operationally efficient method to implement this security requirement with the least development effort?

Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Configure a Cognito Identity Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Create a custom Lambda authorizer that parses, validates, and verifies the incoming JSON Web Token signature on each request.

Implement custom token verification logic directly within the backend Lambda function using a Lambda Proxy integration.

Show answer & explanation

Answer: Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Answer

Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Using a Cognito User Pools authorizer is the most operationally efficient approach. It leverages API Gateway's built-in capability to automatically validate incoming JSON Web Tokens (JWTs) without requiring custom code or additional Lambda executions for validation, lowering development effort and ongoing maintenance.

Step-by-Step Solution

Identify the token type and authentication provider.

The application uses JSON Web Tokens (JWT) generated by a Cognito User Pool for user authentication.

Knowing the token format helps choose between native integrations and custom authorization logic.

Compare native integration versus custom code solutions.

API Gateway offers a built-in Cognito User Pools authorizer, whereas custom Lambda authorizers require writing token verification code.

Evaluating options based on developer effort and operational efficiency helps identify the best option with the least overhead.

Select the built-in Cognito User Pools authorizer.

API Gateway automatically verifies the JWT signature and expiration, allowing only valid requests to reach the backend.

This satisfies the requirement of validating tokens with minimal custom code and maximum operational efficiency.

Key Concept

Amazon API Gateway Cognito User Pools Authorizer

Estimated Time:1m 30s

Question 270Question →

A developer is building a compliance utility that runs on an Amazon EC2 instance. The utility must encrypt database backup files of approximately $250\text{ MB}$ client-side before sending them to an external partner's storage server. The developer wants to use envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS.

Which TWO actions must the developer perform in the application code to implement this client-side encryption workflow? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.

Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.

Call the Encrypt API operation of AWS KMS, passing the database backup file payload directly to KMS, to retrieve the encrypted ciphertext.

Call the GenerateDataKeyWithoutPlaintext API operation of AWS KMS, and use the returned ciphertext data key to encrypt the database backup file.

Store the database backup file in AWS Secrets Manager, and configure Secrets Manager to automatically rotate the data key after each backup operation.

Show answer & explanation

Answer: Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.; Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.

Answer

Calling the GenerateDataKey API to obtain both the plaintext and encrypted data keys, encrypting the backup file locally with the plaintext key, and then deleting the plaintext key from memory while storing the encrypted key with the ciphertext.

For client-side envelope encryption, the developer must call the GenerateDataKey API to obtain both the plaintext data key and the encrypted version of the data key. The plaintext key is used to perform the actual local encryption of the large

250\text{ MB}

backup file. Once the encryption completes, the plaintext data key must be discarded from the system memory. The encrypted data key is then stored or sent alongside the ciphertext so that it can be used for decryption in the future.

Step-by-Step Solution

Generate the data keys using AWS KMS.

The application calls the GenerateDataKey API with the CMK. KMS returns a plaintext data key and an encrypted data key.

This establishes the unique keys needed for local symmetric encryption without sending large payloads to KMS.

Perform local symmetric encryption.

The application encrypts the

250\text{ MB}

database backup file using the plaintext data key with a standard library (e.g., AES-256).

Symmetric encryption handles large datasets efficiently and keeps data secure before transit.

Clean up memory and prepare the payload.

The plaintext data key is deleted from the application memory. The encrypted backup file and the encrypted data key are packaged together.

Removing the plaintext key from memory prevents unauthorized access. The encrypted data key is required later to decrypt the file.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 271Question →

A developer is designing a new web application and needs to implement user sign-up, sign-in, and directory management capabilities. Which Amazon Cognito component should the developer use to meet these requirements?

Amazon Cognito Identity Pools

Amazon Cognito User Pools

Amazon API Gateway Lambda Authorizers

AWS Identity and Access Management (IAM) Roles

Show answer & explanation

Answer: Amazon Cognito User Pools

Answer

Amazon Cognito User Pools

The correct answer is Amazon Cognito User Pools because they function natively as a user directory, offering built-in workflows for user registration, user authentication, password recovery, and directory management.

Step-by-Step Solution

Analyze the core requirements of the application: user sign-up, sign-in, and user directory management.

The application needs an identity provider that can store user credentials, manage user profiles, and issue identity tokens.

This establishes that the task is authentication and identity management.

Compare Cognito features against these requirements.

Cognito User Pools provide a serverless user directory, host registration/authentication pages, and issue tokens (ID, access, refresh). Cognito Identity Pools, conversely, provide temporary credentials to access AWS resources.

This clarifies the distinction between user authentication (directories) and resource authorization (credentials).

Select the correct component.

Amazon Cognito User Pools satisfies all requirements with minimal configuration.

It matches the target use case perfectly, leaving other components for authorization or custom integration.

Key Concept

Amazon Cognito User Pools are user directories used for authentication (sign-up, sign-in, password reset), whereas Cognito Identity Pools are used for authorization (granting temporary AWS credentials).

Question 272Question →

A developer is configuring an application running on an Amazon EC2 instance that needs to read items from an Amazon DynamoDB table. The developer has created the following trust policy for an IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which TWO steps must the developer complete to enable the application on the EC2 instance to securely access the DynamoDB table without hardcoding credentials?

Select all that apply

Attach a permissions policy to the IAM role that grants the necessary DynamoDB permissions (such as dynamodb:GetItem).

Associate the IAM role with an IAM instance profile and attach the instance profile to the EC2 instance.

Embed IAM user access keys with DynamoDB permissions directly in the application's configuration files.

Change the service principal in the trust policy to dynamodb.amazonaws.com so the database can access the instance.

Attach the IAM permissions policy directly to the EC2 instance's security group using the AWS Management Console.

Show answer & explanation

Answer: Attach a permissions policy to the IAM role that grants the necessary DynamoDB permissions (such as dynamodb:GetItem).; Associate the IAM role with an IAM instance profile and attach the instance profile to the EC2 instance.

Answer

To securely grant access, the developer must attach a permissions policy with DynamoDB access to the IAM role, and then associate the IAM role with an IAM instance profile and attach it to the EC2 instance.

The correct steps are to attach a permissions policy containing the required DynamoDB permissions to the IAM role, and to associate the role with an IAM instance profile and attach it to the EC2 instance. This combination allows the application on the EC2 instance to assume the role and gain the necessary permissions to read DynamoDB data securely.

Step-by-Step Solution

Analyze the trust policy.

The trust policy currently allows the Amazon EC2 service principal to assume the IAM role.

This establishes the trust relationship allowing EC2 instances to use the role.

Define and attach the permissions policy.

Create an IAM policy that grants DynamoDB permissions and attach it to the IAM role.

An IAM role must have a permissions policy to define what actions are allowed on resources.

Associate the role with the EC2 instance.

Create an IAM instance profile, associate the role with it, and attach the instance profile to the EC2 instance.

EC2 instances cannot assume IAM roles directly; they must do so via an IAM instance profile.

Key Concept

Granting EC2 instances permissions to access AWS services using IAM roles and instance profiles.

Estimated Time:1m 30s

Question 273Question →

An engineering team is developing a document management application. The application's frontend is a single-page application (SPA). The backend APIs are deployed on Amazon API Gateway (REST API) with AWS Lambda integrations. The application uses an Amazon Cognito User Pool for user authentication, which includes federated identity providers. The backend Lambda functions must receive the authenticated user's custom department attribute ('custom:department') to authorize document access at the application layer. The developers want to implement a highly performant and secure authorization mechanism that minimizes API calls and operational overhead.

Which solution should the developer implement to meet these requirements?

Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito ID token in the Authorization header of API requests. Access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].

Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito Access token in the Authorization header. In the backend Lambda function, call the Cognito Identity Provider GetUser API using the Access token to retrieve the custom:department attribute.

Create an Amazon API Gateway Lambda Authorizer. In the authorizer's Lambda function, parse the token from the header, call the Cognito AdminGetUser API using the AWS SDK to retrieve the user's attributes, and pass the department attribute in the authorizer context.

Configure an Amazon Cognito Identity Pool using the User Pool as the identity provider. Configure the frontend to exchange the User Pool token for temporary AWS credentials, sign the API Gateway requests using Signature Version 4 (SigV4), and map the department attribute to the IAM role session tags to be passed to Lambda.

Show answer & explanation

Answer: Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito ID token in the Authorization header of API requests. Access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].

Answer

Configure an Amazon API Gateway Cognito User Pool Authorizer, configure the frontend to send the Cognito ID token in the Authorization header of API requests, and access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].

The correct solution uses the built-in API Gateway Cognito User Pool Authorizer along with the Cognito ID token. The ID token natively carries user profile attributes, including the custom department attribute. Once validated by the authorizer, API Gateway automatically injects these claims into the Lambda integration context under the path 'event.requestContext.authorizer.claims'. This fulfills the security and functional requirements without requiring any custom validation code, downstream API queries, or Cognito Identity Pool credential exchanges, thereby minimizing execution latency and operational overhead.

Step-by-Step Solution

Select the appropriate Amazon Cognito token type.

Cognito ID tokens contain user identity claims, including custom attributes such as 'custom:department', whereas standard Access tokens do not contain these user-specific directory attributes by default.

Choosing the ID token ensures that the required custom user attributes are sent to the gateway without requiring back-channel API requests to retrieve them.

Configure the API Gateway Authorizer.

Create a built-in Cognito User Pool Authorizer on API Gateway and associate it with the REST API resource methods. Set the Authorization header as the token source.

Using the built-in Cognito Authorizer offloads token signature verification and expiration checks to API Gateway, avoiding the operational overhead of managing custom authorizer functions.

Extract claims inside the backend Lambda function.

In the backend Lambda handler, read the custom attribute from 'event.requestContext.authorizer.claims["custom:department"]'.

When using a Cognito User Pool Authorizer with API Gateway Lambda proxy integration, the gateway automatically populates the claims from the validated ID token into the request context, allowing the backend to retrieve the attribute with zero database or API lookups.

Key Concept

Amazon API Gateway Cognito User Pool Authorizers natively validate ID tokens and inject user claims, including custom attributes, into the backend Lambda context, avoiding the latency and cost of custom authorizers or downstream user lookup APIs.

Estimated Time:2m 0s

Question 274Question →

A developer is configuring an AWS Lambda function that needs to retrieve files from an Amazon S3 bucket. Which two IAM configurations are required to allow the Lambda function to assume its execution role and read the objects from the bucket? (Select TWO.)

Select all that apply

A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "lambda.amazonaws.com" service principal.

An IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket resource.

A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "s3.amazonaws.com" service principal.

Hardcoded IAM user credentials embedded within the Lambda function code to initialize the S3 SDK client.

An IAM permissions policy attached to the IAM role that allows the "sts:AssumeRole" action on the S3 bucket resource.

Show answer & explanation

Answer: A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "lambda.amazonaws.com" service principal.; An IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket resource.

Answer

The correct configurations are: a trust policy on the IAM role that grants the "sts:AssumeRole" action to the Lambda service principal, and an IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket.

The correct options state that a trust policy must grant the "sts:AssumeRole" action to the Lambda service principal, and that a permissions policy must grant the "s3:GetObject" action on the target S3 bucket. Together, these allow the Lambda service to assume the execution role and grant that role the specific permissions needed to retrieve S3 objects.

Step-by-Step Solution

Identify the AWS service principal executing the function code.

The service principal is "lambda.amazonaws.com".

This principal must be permitted to assume the execution role via the trust policy.

Determine the necessary data access actions and resource boundaries.

The action is "s3:GetObject" and the resource is the specific Amazon S3 bucket ARN.

A permissions policy must be created to grant the role read access to the S3 bucket.

Attach both policies to the Lambda execution role.

The trust policy establishes trust with AWS Lambda, and the permissions policy grants S3 read access to the role.

Both policies must be present for the Lambda function to safely execute and access the S3 objects under the security envelope of the role.

Key Concept

IAM execution roles require a trust policy to define the assuming principal (who) and permissions policies to define the allowed actions and resources (what).

Estimated Time:1m 0s

Question 275Question →

An application downloads a $150\text{ KB}$ encrypted payload and its corresponding encrypted data key from an Amazon S3 bucket. The payload was encrypted client-side using envelope encryption with an AWS KMS customer managed key. Which of the following workflows should the developer implement in the application code to decrypt the payload?

Send the encrypted data key to the AWS KMS GenerateDataKey API operation to regenerate the plaintext key, and then decrypt the payload locally.

Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.

Send the encrypted payload directly to the AWS KMS Decrypt API operation, as KMS can decrypt payloads up to

512\text{ KB}

using a customer managed key.

Store the encrypted data key in AWS Systems Manager Parameter Store as a SecureString, and call the GetParameter API operation to automatically decrypt the payload.

Show answer & explanation

Answer: Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.

Answer

The correct workflow involves calling the KMS Decrypt API operation with the encrypted data key. Because direct KMS cryptographic operations are capped at

4096\text{ bytes}

(

4\text{ KB}

), a

150\text{ KB}

payload cannot be decrypted directly by KMS. Instead, the application must delegate the decryption of the small data key to KMS. Once the plaintext data key is returned, the actual data payload is decrypted locally using cryptographic libraries in the application code, and the plaintext data key is discarded from memory.

Step-by-Step Solution

Call the AWS KMS Decrypt API passing the encrypted data key.

AWS KMS decrypts the data key and returns the plaintext data key along with the KMS key ARN.

The ciphertext payload is too large (

150\text{ KB}

) to be decrypted directly by KMS, which has a limit of

4\text{ KB}

for direct operations.

Use the plaintext data key to decrypt the payload locally in memory.

The plaintext version of the

150\text{ KB}

payload is recovered.

Client-side decryption must occur locally using the symmetric key (the plaintext data key) generated during the initial encryption process.

Erase the plaintext data key from memory as soon as decryption is complete.

The plaintext data key is destroyed.

This is a security best practice to prevent the plaintext key from remaining in application memory longer than necessary.

Key Concept

KMS Envelope Decryption Workflow

Estimated Time:1m 30s

Question 276Question →

A developer is building a serverless web application that allows users to sign in and upload files directly to an Amazon S3 bucket. The application must support user registration and sign-in, and provide temporary AWS credentials to authenticated users for S3 uploads. Which two Amazon Cognito features should the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Amazon Cognito User Pools to manage user registration, authentication, and directory services

Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access

Amazon Cognito Identity Pools to store user profiles and host the sign-in web interface

Amazon Cognito User Pools to issue temporary AWS IAM credentials directly to the client application

A custom AWS Lambda Authorizer linked with Amazon Cognito to generate temporary AWS credentials

Show answer & explanation

Answer: Amazon Cognito User Pools to manage user registration, authentication, and directory services; Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access

Answer

Amazon Cognito User Pools to manage user registration, authentication, and directory services, and Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access.

To support user sign-up and authentication, a Cognito User Pool is required. To authorize the users and grant temporary AWS credentials for direct S3 upload access, a Cognito Identity Pool is required.

Step-by-Step Solution

Determine the service needed for user authentication and directory management.

Amazon Cognito User Pools provides the directory and authentication features required for user registration and sign-in.

User Pools handle authentication and act as the identity provider.

Determine the service needed to access AWS resources directly from the client.

Amazon Cognito Identity Pools (federated identities) allows exchanging authentication tokens for temporary AWS IAM credentials.

Identity Pools manage authorization and provide credentials for AWS resources like Amazon S3.

Key Concept

Cognito User Pools authenticate users and manage directories, while Cognito Identity Pools authorize users to access AWS resources by issuing temporary credentials.

Question 277Question →

A developer is implementing authorization for an Amazon API Gateway REST API. The API serves as the backend for a web application where users register and log in directly using Amazon Cognito. The developer needs to validate the JSON Web Tokens (JWT) sent in the HTTP authorization header for each request. The solution should minimize both custom development effort and operational overhead. Which of the following approaches should the developer choose to secure the API?

Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.

Write a Lambda token authorizer that downloads the JSON Web Key Set (JWKS), decodes the token, and performs signature verification.

Use an Amazon Cognito federated identity pool to exchange the token for temporary security credentials to sign requests with Signature Version 4.

Set up a Lambda proxy integration and handle token decryption and validation within the business logic of the backend Lambda function.

Show answer & explanation

Answer: Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.

Answer

Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.

Deploying a native Amazon Cognito authorizer is the correct approach. API Gateway provides built-in integration with Cognito User Pools. By configuring a Cognito authorizer, API Gateway automatically validates the signature and expiration of the JWT before forwarding the request to the integration backend. This requires zero custom code, minimizes developer effort, and lowers latency and costs.

Step-by-Step Solution

Identify the authentication source

The identity source is Amazon Cognito User Pools, which issues standard JSON Web Tokens (JWT) upon successful authentication.

This determines which authorization methods are compatible with the token type.

Evaluate the architectural constraints

The solution must minimize custom development effort and operational overhead.

This rules out options that require writing custom authorizer code or backend validation logic.

Select the native API Gateway capability

API Gateway has a built-in Cognito User Pools authorizer that handles JWT validation natively.

A native authorizer requires no custom code, lowering operational overhead and automatically rejecting unauthorized requests before they reach backend integrations.

Key Concept

Amazon API Gateway Cognito User Pools Authorizer

Estimated Time:1m 30s

Question 278Question →

A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table. The developer creates an IAM role to grant the application the required permissions. The developer wants to configure the trust policy for this IAM role.

Consider the following trust policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "<PLACEHOLDER>"
},
"Action": "sts:AssumeRole"
}
]
}

To allow the EC2 instance to assume this IAM role, which value should replace `<PLACEHOLDER>`?

ec2.amazonaws.com

dynamodb.amazonaws.com

arn:aws:iam::aws:policy/AmazonDynamoDBReadOnlyAccess

arn:aws:iam::123456789012:user/app-credentials

Show answer & explanation

Answer: ec2.amazonaws.com

Answer

ec2.amazonaws.com

The correct answer is the option specifying the EC2 service principal. An IAM role's trust policy defines the principals (users, roles, accounts, or services) that are allowed to assume the role. Since the application is running on an Amazon EC2 instance, the EC2 service itself must be trusted to assume the role on behalf of the instance. The service principal for EC2 is ec2.amazonaws.com.

Step-by-Step Solution

Analyze the requirement of the application running on the Amazon EC2 instance.

The application runs on EC2 and needs to assume an IAM role to access DynamoDB.

Before the application can use the role, the EC2 service must be allowed to assume it.

Identify the purpose of a trust policy in an IAM role.

The trust policy determines which entity (Principal) is allowed to assume the role via the sts:AssumeRole action.

Only trusted entities defined in the trust policy can obtain temporary credentials for the role.

Determine the correct service principal for Amazon EC2.

The service principal for EC2 is ec2.amazonaws.com.

Replacing the placeholder with ec2.amazonaws.com successfully establishes trust with the EC2 service.

Key Concept

IAM role trust policies dictate which AWS services or identities can assume a role.

Estimated Time:45s

Question 279Question →

A developer is implementing client-side envelope encryption in a containerized microservice to encrypt application configuration payloads that are approximately $2\text{ MB}$ in size. The developer wants to use an AWS KMS customer managed key for this process. Which of the following actions must the developer perform to encrypt the payloads? (Select two.)

Select all that apply

Call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.

Encrypt the configuration payload locally using the plaintext data key, and then discard the plaintext data key from memory.

Call the KMS Encrypt API operation directly using the customer managed key to encrypt the payload.

Call the KMS GenerateDataKeyWithoutPlaintext API operation to obtain the encrypted data key and use it to encrypt the payload locally.

Retrieve the plaintext data key from the AWS Systems Manager Parameter Store before executing the local encryption.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.; Encrypt the configuration payload locally using the plaintext data key, and then discard the plaintext data key from memory.

Answer

The developer must call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key, encrypt the payload locally using the plaintext data key, and then discard the plaintext data key from memory.

To perform client-side envelope encryption on payloads larger than

4\text{ KB}

, the developer must first call GenerateDataKey to get both the plaintext data key (used for local encryption) and the encrypted data key (stored with the ciphertext). The developer then encrypts the payload locally using the plaintext data key and discards the plaintext data key from memory to maintain security.

Step-by-Step Solution

Request a data key from AWS KMS.

The application receives a plaintext data key and an encrypted copy of the data key.

The KMS customer managed key cannot directly encrypt payloads larger than

4\text{ KB}

, so a data key is generated for local envelope encryption.

Encrypt the payload locally.

The payload is encrypted into ciphertext using the plaintext data key.

Local encryption using the plaintext data key is performed outside of AWS KMS to support large payloads.

Clean up the memory.

The plaintext data key is removed from application memory.

Discarding the plaintext key prevents unauthorized memory inspection from exposing the encryption key.

Key Concept

Client-side envelope encryption workflow with AWS KMS

Question 280Question →

A developer is setting up an AWS Lambda function that must read from an Amazon DynamoDB table. The developer creates an IAM role named AppStoreExecutionRole and attaches a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations. However, when invoking the Lambda function, it fails to execute with an authorization error because it cannot assume the role. The role's current trust policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this authorization error?

Attach a permissions policy to the role that allows the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.

Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.

Update the trust policy's Action block to allow lambda:InvokeFunction instead of sts:AssumeRole.

Configure the Lambda function's application code to call the Security Token Service (STS) AssumeRole API using the AWS SDK during initialization.

Show answer & explanation

Answer: Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.

Answer

Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.

The correct answer is to update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal. AWS Lambda requires that any execution role assigned to a function trusts the Lambda service principal so that AWS Lambda can assume the role when invoking the function on the developer's behalf.

Step-by-Step Solution

Examine the trust policy's Principal and Action fields.

The trust policy currently delegates trust only to the root account identifier, meaning only IAM identities within account 123456789012 who have sts:AssumeRole permissions can assume it.

To identify why the AWS Lambda service is blocked from assuming the execution role.

Determine how the AWS Lambda service assumes roles to execute functions.

AWS Lambda requires the service principal lambda.amazonaws.com to be declared as the trusted entity in the trust policy.

The Lambda service itself, not an IAM identity inside the account, is initiating the sts:AssumeRole call.

Replace the AWS account principal reference with the Lambda service principal.

The trust policy is updated to permit the lambda.amazonaws.com service principal to perform sts:AssumeRole.

This allows AWS Lambda to assume the role when running the function, resolving the initialization error.

Key Concept

IAM trust policies define which principals (users, accounts, or services) are allowed to assume a role. For AWS services like Lambda to assume a role, the trust policy must explicitly grant the sts:AssumeRole action to the service's principal name (e.g., lambda.amazonaws.com).

Estimated Time:2m 0s

PreviousPage 14 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept