Examkin

Security

390 questions

All types390Multiple choice195Multiple select195
Question 101Question →

A developer is implementing client-side encryption for an application that processes large database backups with an average size of 1515 GB before uploading them to an Amazon S3 bucket. To comply with corporate security policies, the developer must use AWS KMS and envelope encryption. Which sequence of operations should the developer implement to encrypt the backup files?

Show answer & explanation

Answer: Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.

Answer

Call the GenerateDataKey API operation on AWS KMS to receive a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the database backup locally, erase the plaintext key from memory, and upload the encrypted backup along with the encrypted data key.
The correct approach uses the GenerateDataKey API to obtain both a plaintext key (used for local encryption of the 15 GB file) and an encrypted data key (saved alongside the encrypted file). Discarding the plaintext key from memory after use adheres to the principle of least privilege and prevents memory scraping attacks.

Step-by-Step Solution

1
Request a data key from AWS KMS.
The application calls the GenerateDataKey API, receiving a plaintext data key and an encrypted data key.
This initiates the envelope encryption process by obtaining the required cryptographic keys.
2
Perform local encryption using the plaintext key.
The database backup is encrypted locally on the application server.
Because the database backup is 15 GB, it exceeds the 4 KB limit of the KMS Encrypt API and must be encrypted locally.
3
Clean up memory and upload artifacts.
The plaintext key is deleted from the application memory, and the encrypted backup file and the encrypted data key are uploaded to the S3 bucket.
Erasing the plaintext key from memory minimizes the risk of key exposure. The encrypted data key can be decrypted by KMS later when the backup needs to be restored.

Key Concept

AWS KMS Envelope Encryption
Estimated Time:2m 0s
Question 102Question →

A developer needs to encrypt a 5 GB file on an application server using AWS KMS client-side envelope encryption. Which AWS KMS API action should the developer call to obtain both the plaintext data key for local encryption and the encrypted copy of the data key for storage?

Show answer & explanation

Answer: GenerateDataKey

Answer

GenerateDataKey
The correct action is GenerateDataKey because it returns a plaintext data key for immediate local encryption and an encrypted version of the data key that can be safely stored alongside the encrypted file.

Step-by-Step Solution

1
Identify the size of the dataset and the encryption model.
The file size is 5 GB, which exceeds the 4 KB direct encryption limit of AWS KMS, requiring client-side envelope encryption.
Large files must be encrypted locally using a data key to avoid network overhead and KMS API payload size limits.
2
Determine the API call that provides the required keys for envelope encryption.
The developer needs a plaintext data key to perform the local encryption and an encrypted data key to save with the ciphertext.
Envelope encryption relies on having both the plaintext key to encrypt the payload and the encrypted key to bundle with the data for future decryption.
3
Select the correct KMS API action that returns both keys in a single request.
The GenerateDataKey API action returns both the plaintext data key and the encrypted ciphertext data key.
This single API call satisfies the security workflow without requiring subsequent decryption or extra round trips.

Key Concept

AWS KMS Envelope Encryption Workflow
Estimated Time:45s
Question 103Question →

A developer has configured an AWS Lambda function to run inside the private subnets of a VPC so that it can securely query an Amazon RDS PostgreSQL DB instance. The Lambda function also needs to write application execution logs to an Amazon DynamoDB table. During testing, the Lambda function successfully queries the database but times out when trying to write to DynamoDB.

Which configuration change will resolve this connection issue in the most secure and cost-effective manner?

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.

Answer

Create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets.
The correct answer is to create a Gateway VPC Endpoint for DynamoDB and associate it with the route tables of the private subnets. A Gateway VPC Endpoint allows private subnets within a VPC to establish a secure, private connection to DynamoDB. The traffic remains within the AWS network, which avoids NAT Gateway processing fees, hourly charges, and the need for public IP addresses or internet routing, making it the most cost-effective and secure solution.

Step-by-Step Solution

1
Analyze the timeout error occurring during the DynamoDB call.
Determine that the Lambda function in the private subnet lacks a network route to public AWS services.
Lambda functions in private subnets cannot access public AWS endpoints directly without a NAT Gateway or a VPC Endpoint.
2
Compare connectivity options for accessing DynamoDB from the private subnet.
Identify that a Gateway VPC Endpoint is the most secure and cost-effective method to route traffic directly to DynamoDB.
VPC Endpoints route traffic over the private AWS network, avoiding the data transfer and hourly costs associated with NAT Gateways.
3
Configure the Gateway VPC Endpoint for DynamoDB.
Associate the endpoint with the route tables of the private subnets where the Lambda function resides.
Associating the endpoint adds the prefix list route to the subnet route tables, allowing traffic to DynamoDB to be routed through the endpoint.

Key Concept

VPC Endpoint configuration for secure and private access to AWS services from private subnets.
Estimated Time:1m 30s
Question 104Question →

An application is deployed on Amazon ECS using the AWS Fargate launch type within private subnets of a custom VPC. The application needs to securely establish a connection to an Amazon Aurora PostgreSQL database located in a database private subnet, using credentials that are automatically rotated. Additionally, the application must connect to an external third-party API on the public internet to process payments. Which configuration steps should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy a NAT gateway in a public subnet, and add a route in the application's private subnet route table pointing 0.0.0.0/0 to the NAT gateway.; Update the security group of the Amazon Aurora database to allow inbound traffic on port 5432 from the security group attached to the ECS tasks.

Answer

The correct configurations are to deploy a NAT gateway in a public subnet and configure the application private subnet route table to point 0.0.0.0/0 traffic to it, and to update the database security group to permit inbound connections on port 5432 from the ECS task security group.
To allow private ECS Fargate tasks to reach the internet-facing payment API, a NAT Gateway is required in a public subnet with a corresponding route in the private subnet route table. To enable connectivity to the Aurora PostgreSQL database, the database's security group must permit inbound traffic on port 5432 from the security group assigned to the ECS tasks, ensuring only authorized tasks can connect.

Step-by-Step Solution

1
Determine the requirements for outbound internet access from private subnets.
Identify that AWS Fargate tasks running in private subnets cannot communicate directly with the internet. They require a NAT Gateway deployed in a public subnet with a corresponding route in the private subnet's route table pointing outbound traffic (0.0.0.0/0) to the NAT Gateway.
This configuration enables the tasks to connect to the external payment API while keeping them in private subnets.
2
Determine the requirements for secure database access within the VPC.
Configuring the security group of the target database to accept traffic on the database port from the source security group of the Fargate tasks.
Referencing security groups instead of IP ranges maintains dynamic, secure access and satisfies least-privilege security standards.
3
Evaluate the credentials rotation and identity configurations.
Identify that automatic secrets rotation is a feature of AWS Secrets Manager, not Systems Manager Parameter Store, and that IAM trust policies govern role assumption rather than network ports.
This rules out the invalid distractors targeting parameter storage and IAM configuration.

Key Concept

VPC security group referencing and private routing configurations for secure outbound and database traffic.
Question 105Question →

A developer is configuring an AWS Lambda function that runs inside a private subnet of a VPC. The Lambda function needs to connect to an Amazon RDS database in another private subnet and call an external third-party API over the public internet.

Which two network and security configurations are required to establish these connections?

Select all that apply

Show answer & explanation

Answer: Configure the RDS security group to allow inbound traffic on the database port from the security group assigned to the Lambda function.; Route traffic destined for the internet (0.0.0.0/00.0.0.0/0) from the Lambda function's private subnet through a NAT Gateway located in a public subnet.

Answer

To establish the required connections, the RDS security group must be configured to allow inbound traffic on the database port from the Lambda function's security group, and a route to a NAT Gateway in a public subnet must be added to the private subnet's route table to allow outbound internet access for external API calls.
The correct configurations involve setting up an inbound security group rule on the RDS database that allows traffic from the Lambda function's security group, and routing internet-bound traffic from the private subnet to a NAT Gateway. This ensures the Lambda function can securely access the database inside the VPC and access external APIs over the internet.

Step-by-Step Solution

1
Configure database security group rules.
The RDS security group is updated to allow inbound traffic on the database port, referencing the security group of the Lambda function as the source.
This establishes secure, restricted communication between the Lambda function and the RDS database without opening the database to the entire subnet.
2
Configure private subnet routing for internet access.
A route for 0.0.0.0/00.0.0.0/0 is added to the private subnet's route table, pointing to a NAT Gateway in a public subnet.
Since the Lambda function is in a private subnet and does not have a public IP address, it cannot access the internet directly. Routing traffic through a NAT Gateway allows outbound-only internet access to call external APIs.

Key Concept

VPC security and connectivity configurations for AWS Lambda, involving Security Groups and NAT Gateways.
Question 106Question →

A developer is implementing a microservice using an AWS Lambda function that retrieves database credentials from AWS Secrets Manager and then connects to an Amazon RDS PostgreSQL database. The RDS database is hosted in private subnets within a VPC. To secure the database connection, the developer configures the Lambda function to run inside the same VPC and private subnets. However, during testing, the Lambda function execution times out during the SDK client initialization and call to Secrets Manager.

Which configuration change should the developer implement to resolve this issue while maintaining the most secure architecture?

Show answer & explanation

Answer: Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.

Answer

Configure an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager within the private subnets, and configure the security groups to allow HTTPS traffic from the Lambda function to the endpoint.
The correct configuration is to create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the private subnets. This registers Elastic Network Interfaces (ENIs) with private IP addresses in the VPC subnets that route traffic directly to AWS Secrets Manager over the AWS internal network. By allowing outbound HTTPS (port 443443) from the Lambda function's security group to the VPC endpoint's security group, the Lambda function can resolve the endpoint privately and securely retrieve the database credentials.

Step-by-Step Solution

1
Analyze the network path of the Lambda function running inside the private VPC subnets.
The Lambda function has access to VPC resources (like the RDS database) but lacks direct access to the public internet because there is no NAT Gateway or internet gateway routing in the private route table.
By default, AWS service endpoints like AWS Secrets Manager are public, requiring internet access or a private endpoint to connect from within a VPC.
2
Determine the most secure method to access AWS Secrets Manager without routing traffic over the public internet.
Identify that AWS PrivateLink allows creating Interface VPC Endpoints inside the VPC subnets.
VPC Endpoints provide private, secure access to AWS services by assigning private IP addresses from the VPC subnets directly to the endpoint.
3
Configure the security groups for both the Lambda function and the Interface VPC Endpoint.
The Lambda function's security group must allow outbound HTTPS (port 443443) to the VPC endpoint, and the VPC endpoint's security group must allow inbound HTTPS (port 443443) from the Lambda function.
Security groups are stateful and must explicitly allow the necessary traffic directions to establish the TCP connection.

Key Concept

VPC Endpoints (AWS PrivateLink) enable private connectivity between VPC resources and supported AWS services without internet traversal.
Estimated Time:2m 0s
Question 107Question →

A developer is designing a serverless multi-tenant SaaS application. The frontend client sends requests to an Amazon API Gateway REST API backed by AWS Lambda. The application uses an external OpenID Connect (OIDC) identity provider for user authentication. The API must validate the signature and expiration of the incoming JSON Web Token (JWT). In addition, access to specific resource paths and HTTP methods must be dynamically controlled based on the user's tenant ID and user role claims embedded in the JWT. The backend Lambda function needs to receive these validated claims to perform tenant-specific business logic without re-decoding or re-validating the token. Which solution meets these requirements with the lowest latency and follows security best practices?

Show answer & explanation

Answer: Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.

Answer

Create a Lambda Request Authorizer in API Gateway. In the authorizer function, validate the JWT from the external identity provider, dynamically generate an IAM policy that allows or denies access to the specific API resource paths and methods based on the tenant ID and user role claims, and return the policy along with the claims in the context object of the authorizer's response to be accessed via the requestContext.authorizer object in the backend Lambda function.
The correct solution uses a Lambda Request Authorizer to perform custom validation of an external OIDC token and dynamically generate an IAM policy based on the claims (tenant ID and user role) extracted from the token. By returning these claims in the context object of the authorizer's response, API Gateway automatically passes them to the backend Lambda function via the requestContext.authorizer property of the proxy integration event. This keeps latency low, prevents the backend from having to parse or validate the token again, and enforces authorization at the API Gateway layer.

Step-by-Step Solution

1
Select the appropriate API Gateway authorizer type for external OIDC JWT validation and dynamic routing/authorization policy generation.
A Lambda Request Authorizer is selected because it receives request details (path, method, headers) along with the token, allowing it to perform custom OIDC JWT signature validation and dynamically generate a fine-grained IAM policy.
Cognito User Pools authorizers cannot dynamically generate customized IAM policies based on custom claims for arbitrary external OIDC tokens directly, and Cognito Identity Pools add unnecessary latency by requiring a token-to-credential exchange.
2
Design the Lambda Authorizer logic to validate the JWT and extract claims.
The Lambda Authorizer validates the JWT signature against the external IdP's JWKS endpoint and verifies the claims.
Validation must occur at the API Gateway level to reject unauthorized traffic before it reaches the backend, saving cost and minimizing latency.
3
Generate the IAM policy and the context map in the authorizer response.
The authorizer returns an IAM Policy allowing/denying access to specific method ARNs based on user role and tenant, along with a custom context map containing the user's tenant ID and role.
API Gateway uses the returned IAM policy to authorize the request and passes the context map to the backend integration.
4
Forward the claims to the backend Lambda function via Lambda Proxy Integration.
The backend Lambda function accesses the context properties directly via the requestContext.authorizer event path (e.g., event.requestContext.authorizer.tenantId).
This eliminates the need for custom mapping templates or decoding the token again in the backend Lambda function.

Key Concept

API Gateway Lambda Authorizers with custom context propagation
Question 108Question →

A developer is implementing local client-side envelope encryption for sensitive reports in a microservice before uploading them to Amazon S3. To optimize costs and network overhead, the developer aims to generate a unique data key for each report using a customer managed key in AWS KMS. However, during integration testing, the developer observes that each file encryption requires two sequential AWS KMS API calls, which is causing latency and doubling API billing. The current implementation performs `kmsClient.generateDataKeyWithoutPlaintext(...)` followed by `kmsClient.decrypt(...)`. Which modification to the code should the developer make to reduce the integration to a single AWS KMS API call per report?

Show answer & explanation

Answer: Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.

Answer

Replace the `generateDataKeyWithoutPlaintext` call with `generateDataKey` to obtain both the plaintext data key and the ciphertext data key in a single response, and remove the subsequent `decrypt` call.
The correct solution is to change the API call to `generateDataKey`. Under envelope encryption, the client requires the plaintext data key to encrypt the payload locally, and the ciphertext data key to store alongside the encrypted payload. The `generateDataKey` operation returns both in a single response, removing the need for a separate, subsequent call to the `decrypt` API to extract the plaintext key.

Step-by-Step Solution

1
Analyze the purpose of the current KMS API calls.
The application calls `generateDataKeyWithoutPlaintext` which only returns the encrypted (ciphertext) data key. Because it lacks the plaintext key to encrypt the payload, it must make a second call using the `decrypt` API.
Understanding the current behavior helps identify where the redundant call originates.
2
Select the appropriate KMS API operation for client-side envelope encryption.
Identify that the `generateDataKey` API operation returns both the plaintext data key and the ciphertext data key in a single payload.
This operation satisfies the requirements of envelope encryption by providing the plaintext key immediately for local encryption while providing the ciphertext key for storage.
3
Refactor the code to eliminate the secondary call.
Replace the initial call with `generateDataKey`, use the returned plaintext key to encrypt the file locally, discard the plaintext key from memory after use, and save the ciphertext key to Amazon S3 alongside the encrypted report.
This reduces the integration to a single KMS API request, minimizing latency and API costs by 50%50\%.

Key Concept

AWS KMS Envelope Encryption Workflow Optimization
Question 109Question →

A developer is implementing an AWS Lambda function that must query an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager and send HTTP POST requests to an external API endpoint over the public internet.

Which network and security configuration should the developer implement to meet these requirements securely while adhering to the principle of least privilege?

Show answer & explanation

Answer: Deploy the Lambda function in the private subnets. Associate a security group with the Lambda function that allows outbound TCP traffic on port 54325432 to the database security group and outbound HTTPS traffic on port 443443. Configure the private subnets' route table to route 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway located in a public subnet. Configure the database security group to allow inbound traffic on port 54325432 only from the Lambda function's security group.

Answer

Deploy the Lambda function in the private subnets, configure a NAT Gateway in a public subnet to route 0.0.0.0/00.0.0.0/0 traffic, and associate a security group with the Aurora database that allows inbound traffic on port 54325432 only from the Lambda security group.
The correct network configuration places both the Lambda function and the database in private subnets. Outbound internet access for the Lambda function (to access the external payment gateway and public Secrets Manager endpoints) is enabled by routing 0.0.0.0/00.0.0.0/0 traffic through a NAT Gateway in a public subnet. Database access is securely restricted at the network layer by configuring the database's security group to allow inbound connections on port 54325432 only from the Lambda function's security group.

Step-by-Step Solution

1
Determine the placement of the Lambda function and the database.
Both resources are placed inside private VPC subnets to isolate them from direct public internet exposure.
This is required to protect the database and application layer in accordance with the AWS Well-Architected Framework.
2
Provide outbound internet connectivity for the Lambda function.
Route the private subnets' 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway situated in a public subnet.
The Lambda function needs internet access to communicate with the external API and public endpoints for Secrets Manager, but it lacks public IP addresses itself.
3
Configure the security groups for secure, localized communication.
Allow outbound port 54325432 and port 443443 traffic on the Lambda security group, and configure the database security group to allow inbound port 54325432 traffic only when originating from the Lambda security group.
This implements the principle of least privilege by strictly restricting database access to the Lambda function at the network layer.

Key Concept

AWS Lambda VPC networking, Security Group referencing, and NAT Gateway routing for private-to-public subnet communication.
Question 110Question →

A developer is securing a new Amazon API Gateway REST API. The developer wants to restrict access so that only authenticated users from an Amazon Cognito User Pool can call the API. Which TWO configuration steps are required to set up this built-in authorization mechanism?

Select all that apply

Show answer & explanation

Answer: Create an API Gateway authorizer of type Cognito and configure it with the Amazon Cognito User Pool details.; Set the authorization type of the API method to the Cognito authorizer that was created.

Answer

To implement native Amazon Cognito User Pools authorization for an API Gateway REST API, the developer must first create an authorizer of type Cognito linked to the Cognito User Pool, and then configure the target API methods to use this authorizer.
To secure an API using built-in Cognito validation, API Gateway requires setting up a Cognito authorizer that targets the Cognito User Pool containing the user identities, and then configuring the API methods to enforce this authorization setting.

Step-by-Step Solution

1
Define a Cognito user pool authorizer in API Gateway
API Gateway is configured with the metadata of the User Pool to validate incoming tokens.
This establishes the link between API Gateway and the Cognito User Pool identity provider.
2
Configure the API method to use the authorizer
The authorization setting on the method execution is updated to the newly created authorizer.
This secures the specific endpoint, ensuring incoming requests are automatically validated using the Cognito token before routing to the integration backend.

Key Concept

API Gateway Cognito User Pools Authorizer configuration
Question 111Question →

A containerized microservice deployed on AWS Fargate inside a private VPC subnet needs to write transaction logs to an Amazon DynamoDB table and send real-time confirmation callbacks to an external payment processor at 198.51.100.50/32198.51.100.50/32. According to company security requirements, all database traffic must remain within the AWS network, and outbound traffic from the Fargate container must be restricted to only the payment processor and the DynamoDB service. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Create a Gateway VPC Endpoint for DynamoDB, and associate it with the route table of the private subnet.; Configure the Fargate security group with outbound rules allowing HTTPS traffic on port 443443 to 198.51.100.50/32198.51.100.50/32 and to the AWS-managed prefix list representing DynamoDB.

Answer

Create a Gateway VPC Endpoint for DynamoDB associated with the private subnet's route table, and configure the Fargate security group with outbound rules allowing HTTPS traffic to the payment processor IP address and to the AWS-managed prefix list representing DynamoDB.
To secure DynamoDB traffic, a Gateway VPC Endpoint is created and associated with the private subnet's route table, which routes traffic to the service privately. To satisfy outbound restrictions, the Fargate task's security group is configured with egress rules allowing HTTPS traffic to the specific external payment processor IP address and to the AWS-managed prefix list representing DynamoDB.

Step-by-Step Solution

1
Create a Gateway VPC Endpoint for Amazon DynamoDB.
A gateway endpoint is provisioned in the VPC, associated with an AWS-managed prefix list representing DynamoDB.
Allows private connectivity to DynamoDB within the AWS network.
2
Associate the Gateway VPC Endpoint with the route table of the private subnet where Fargate runs.
The route table is updated with a route directing traffic for the DynamoDB prefix list to the Gateway VPC Endpoint.
Ensures that the private subnet's routing logic forwards database-bound requests directly to the endpoint.
3
Define outbound rules on the Fargate service security group.
An egress rule allows HTTPS (port 443443) traffic to destination 198.51.100.50/32198.51.100.50/32, and another egress rule allows traffic to the DynamoDB prefix list.
Enforces strict network boundaries, allowing outbound connections only to the payment processor and DynamoDB.

Key Concept

VPC Gateway Endpoints and security group prefix lists are used to route and restrict outbound traffic from private resources to specific AWS services and external targets.
Estimated Time:3m 0s
Question 112Question →

An application needs to encrypt large files locally before uploading them to Amazon S3. The developer decides to use client-side envelope encryption with an AWS Key Management Service (AWS KMS) customer managed key. The developer calls the GenerateDataKey API operation.

Which two components are returned by this API call to enable envelope encryption? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A plaintext data key, which the application uses to encrypt the data.; An encrypted copy of the data key (ciphertext), which is stored with the encrypted data.

Answer

The API returns a plaintext data key for immediate encryption and an encrypted data key (ciphertext) to be stored alongside the encrypted data.
In client-side envelope encryption, the GenerateDataKey API operation returns a plaintext data key and an encrypted data key. The plaintext data key is used by the application to encrypt the files locally. The encrypted data key is stored alongside the encrypted files so that it can be sent back to KMS for decryption in the future.

Step-by-Step Solution

1
Analyze the request for client-side envelope encryption using the GenerateDataKey API.
The application needs to encrypt data locally, which requires a local key.
Understanding the core flow of envelope encryption where encryption happens on the client side using a locally generated symmetric key.
2
Determine the output of the GenerateDataKey API operation.
AWS KMS returns both the plaintext data key and the encrypted data key.
The plaintext key is required for immediate local encryption, and the encrypted key is required for future decryption when requesting KMS to decrypt it.

Key Concept

AWS KMS Envelope Encryption Workflow
Question 113Question →

A microservice running on AWS Lambda needs to perform local client-side envelope encryption on application log files that range from 1010 MB to 5050 MB in size before storing them in an on-premises archive. The microservice must use a customer managed key in AWS KMS.

Which of the following configuration and SDK coding steps should the developer perform to implement this securely with minimum privilege? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Call the `GenerateDataKey` API operation in the application code, using the plaintext data key to encrypt the log file locally, and discard the plaintext key from memory immediately after encryption.; Add `kms:GenerateDataKey` permissions to the Lambda function's IAM execution role for the specific ARN of the customer managed key.

Answer

To implement local client-side envelope encryption for large files with minimum privilege, the developer must call `GenerateDataKey` in the application code to obtain the plaintext and ciphertext data keys, and grant `kms:GenerateDataKey` permissions on the customer managed key to the Lambda execution role.
For files larger than 44 KB, local client-side envelope encryption must be utilized. Calling the `GenerateDataKey` API operation provides the plaintext key required to encrypt the logs locally and the ciphertext key to store along with the encrypted logs. The Lambda execution role must be granted permissions to execute `kms:GenerateDataKey` on the specific customer managed key's ARN to adhere to the principle of least privilege.

Step-by-Step Solution

1
Analyze the size of the data to be encrypted (1010 MB to 5050 MB) to determine the encryption method.
Direct encryption via the KMS `Encrypt` API is ruled out due to its 40964096 bytes limit, indicating that local client-side envelope encryption is required.
Understanding KMS payload limits is necessary to select the correct encryption workflow.
2
Determine the correct KMS API operation to generate encryption keys.
The application must call `GenerateDataKey` to retrieve both the plaintext data key (for local encryption) and the ciphertext data key (for storage).
Calling `GenerateDataKeyWithoutPlaintext` would not yield the plaintext key needed to perform the encryption.
3
Configure the Lambda execution role's IAM policy for least privilege access to the KMS key.
Allow the `kms:GenerateDataKey` action on the specific ARN of the customer managed key.
Granting permissions on AWS managed keys like `aws/s3` is incorrect because the key policies cannot be modified and the resource constraint must point to the customer managed key.

Key Concept

AWS KMS Envelope Encryption Workflow and IAM Permissions
Estimated Time:2m 0s
Question 114Question →

An organization is deploying a multi-tenant backend on Amazon API Gateway. The developer must implement security and authorization for two specific API resources:

1. A `/dashboard` resource that needs to validate identity tokens generated by an Amazon Cognito User Pool. The validation must be handled natively by API Gateway to minimize latency and avoid executing custom backend code.
2. A `/partner-integration` resource that must validate custom OAuth 2.0 tokens issued by a third-party partner's identity provider, using custom validation and database lookups.

Which TWO configuration steps should the developer perform to secure these resources?

Select all that apply

Show answer & explanation

Answer: Create a Cognito User Pools authorizer for the API and configure the `/dashboard` methods to use this authorizer.; Create a Lambda authorizer for the API and configure the `/partner-integration` methods to use it to validate the third-party tokens.

Answer

Create a Cognito User Pools authorizer for the dashboard resource, and a Lambda authorizer to handle the custom third-party token validation for the partner integration resource.
To authenticate requests using Amazon Cognito User Pools without writing custom code, API Gateway provides a built-in Cognito User Pools authorizer. For validating third-party OAuth 2.0 tokens that require custom logic and database lookups, a Lambda authorizer must be implemented.

Step-by-Step Solution

1
Analyze the requirements for the dashboard resource
The dashboard needs native validation of Amazon Cognito User Pool tokens without custom code, pointing to the built-in Cognito User Pools authorizer.
This offloads JWT validation to API Gateway directly.
2
Analyze the requirements for the partner integration resource
The partner integration requires custom database lookups and custom token validation for a third-party provider, pointing to a Lambda authorizer.
Built-in authorizers do not support custom third-party OAuth validation logic.

Key Concept

API Gateway provides native Cognito User Pools authorizers for built-in JWT verification and Lambda authorizers for custom authentication logic.
Question 115Question →

A digital media streaming service uses Amazon API Gateway to expose a REST API that retrieves subscriber profiles. The backend integration uses an AWS Lambda function with a proxy integration. The company uses a custom external identity provider that issues JSON Web Tokens (JWTs) to authenticated users. The developer must secure the API Gateway endpoints to ensure that only users with an active subscription (indicated by a claim named 'subscriptionStatus' with a value of 'active' inside the JWT payload) can access the API. The solution must minimize costs by preventing unauthorized requests from invoking the backend Lambda function, and must cache the authorization decision for 5 minutes. Which security configuration will meet these requirements?

Show answer & explanation

Answer: Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.

Answer

Configure a Lambda token authorizer in API Gateway. In the authorizer's Lambda function, validate the JWT signature, extract the 'subscriptionStatus' claim, and return an IAM policy that allows access if the status is active or denies access otherwise. Enable authorizer caching and set the identity source to the header containing the JWT.
The correct solution involves configuring a Lambda token authorizer. A Lambda authorizer executes custom logic (such as checking if 'subscriptionStatus' is 'active' in the JWT payload) and returns an IAM policy. Because API Gateway evaluates this policy before invoking the integration backend, unauthorized requests are blocked early, preventing unnecessary backend executions. Enabling caching on the authorizer ensures that subsequent requests with the same token use the cached policy for 5 minutes, optimizing performance and reducing authorizer costs.

Step-by-Step Solution

1
Select the appropriate API Gateway authorization type for custom JWT validation and claim inspection.
Determine that a Lambda token authorizer (custom authorizer) is required because it allows running custom validation logic (such as checking the 'subscriptionStatus' claim value) on incoming JWTs, which built-in Cognito Authorizers or IAM Authorization cannot perform natively.
API Gateway Cognito Authorizers can validate JWT tokens from Cognito User Pools but cannot perform conditional authorization checks on custom claims before deciding to allow or deny the request.
2
Implement the authorization logic within the Lambda authorizer function.
The Lambda function receives the token, validates its signature, extracts the payload, checks if 'subscriptionStatus' is 'active', and generates an IAM policy with an Allow or Deny effect along with the user's principal ID.
API Gateway requires the Lambda authorizer to return an IAM policy document that explicitly allows or denies the execution of the API method.
3
Configure caching for the Lambda authorizer in the API Gateway console.
Enable caching, set the TTL (Time to Live) to 300 seconds (5 minutes), and specify the identity source header (e.g., method.request.header.Authorization) as the cache key.
Caching the policy document prevents API Gateway from invoking the Lambda authorizer function for subsequent requests containing the same token, minimizing latency and Lambda invocation costs.

Key Concept

API Gateway Custom Lambda Authorizers allow developers to validate incoming custom tokens (like JWTs from external providers) and perform fine-grained authorization checks based on claims before routing the request to the backend integration, with optional caching to control costs.
Question 116Question →

A backend system executes inside private subnets of a VPC to process financial transactions. This workload requires outbound connections to both an internal database within the VPC and a public third-party banking API. The database traffic is successful, but all connection attempts to the public API timeout. Which network configuration will enable the workload to connect to the external API?

Show answer & explanation

Answer: Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.

Answer

Provision a NAT Gateway within a subnet that has a route to an Internet Gateway, and update the workload's subnet route table to direct destination 0.0.0.0/0 traffic to the NAT Gateway.
Providing a NAT Gateway in a public subnet and configuring the private subnet's route table to target it for all external traffic (0.0.0.0/0) allows resources within the private subnet to securely initiate outbound connections to the internet, resolving the timeout issue to the public banking API.

Step-by-Step Solution

1
Identify the destination type for the failing connections.
The failing traffic is destined for a public third-party banking API, which resides on the public internet.
Traffic to public internet endpoints from a private subnet requires a NAT mechanism since the private subnet lacks public IP addresses and direct internet routes.
2
Determine the appropriate NAT deployment architecture.
A NAT Gateway must be placed in a public subnet (a subnet with a route to an Internet Gateway).
NAT Gateways translate private source IPs to a public IP and route the traffic to the Internet Gateway.
3
Configure the private subnet routing.
Add a route to the private subnet's route table with destination 0.0.0.0/0 pointing to the NAT Gateway.
This directs all non-VPC bound traffic (internet traffic) through the NAT Gateway for translation and outbound delivery.

Key Concept

Outbound internet connectivity from private VPC subnets using a NAT Gateway
Question 117Question →

An engineering team is troubleshooting a newly deployed backend application hosted in a private subnet of a custom VPC. The application needs to retrieve objects from an Amazon S3 bucket and send messages to an Amazon SQS queue. The VPC has no Internet Gateway or NAT Gateway. The developer creates an Amazon S3 Gateway Endpoint and an Amazon SQS Interface Endpoint. However, the application is still experiencing connection timeouts when trying to access these services. Which of the following configuration changes must the developer make to resolve this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Verify that the route table associated with the private subnet contains an entry that directs traffic for S3 to the Gateway Endpoint.; Ensure the security group associated with the SQS Interface Endpoint allows inbound HTTPS (TCP port 443443) traffic from the application's security group.

Answer

Verify that the route table associated with the private subnet contains an entry directing S3 traffic to the Gateway Endpoint, and ensure that the security group of the SQS Interface Endpoint allows inbound HTTPS traffic from the application's security group.
For the Gateway Endpoint to route traffic to Amazon S3 from the private subnet, the subnet's route table must contain an entry directing S3 traffic to the S3 Gateway Endpoint. For the Interface Endpoint (PrivateLink) to route SQS traffic, the application connects to the endpoint's Elastic Network Interface (ENI) private IPs, which requires the security group attached to the SQS Interface Endpoint to allow inbound HTTPS (TCP port 443443) traffic from the application's security group.

Step-by-Step Solution

1
Evaluate Gateway Endpoint configuration requirements.
Confirm that Gateway Endpoints (like Amazon S3) require route table entries in the private subnet's route table pointing to the gateway endpoint (`vpce-xxx`) to correctly route traffic.
Without route table updates, traffic destined for S3 will attempt to use the default route, which fails since there is no internet gateway or NAT gateway.
2
Evaluate Interface Endpoint configuration requirements.
Confirm that Interface Endpoints (like Amazon SQS) provision ENIs in the private subnet and rely on security groups to allow inbound HTTPS (TCP port 443443) traffic from the client.
Because Interface Endpoints use private IP addresses within the VPC, the security group of the endpoint must allow inbound traffic from the application's security group.
3
Rule out non-network configurations.
Identify that IAM execution roles, trust policies, and AWS Secrets Manager configurations do not resolve TCP connection timeouts.
Connection timeouts represent network layer blocks or routing failures, not IAM permission denials or credential management issues.

Key Concept

Configuring VPC endpoints (Gateway and Interface) and their respective route tables and security groups to allow secure, private access to AWS services.
Estimated Time:2m 30s
Question 118Question →

A developer needs to secure a database connection string containing credentials. The string is 2 KB2\text{ KB} in size, and the developer wants to perform direct server-side encryption using an AWS KMS customer managed key without generating and managing local data keys. Which AWS KMS API operation should the developer call to encrypt this payload directly?

Show answer & explanation

Answer: Encrypt

Answer

The correct answer is the Encrypt API operation, which allows direct encryption of small payloads up to 4 KB4\text{ KB}.
The Encrypt API operation in AWS KMS is designed to directly encrypt small payloads up to 4 KB4\text{ KB} using a specified KMS key. Since the database connection string is only 2 KB2\text{ KB} in size, the developer can send the plaintext directly to AWS KMS for encryption without the overhead of generating, managing, and storing local data keys.

Step-by-Step Solution

1
Analyze the payload size and the requirement to avoid local data key management.
The database connection string is 2 KB2\text{ KB} in size, and direct encryption is preferred over envelope encryption.
This determines if direct encryption is possible and matches the developer's preference.
2
Check the maximum payload limit for the AWS KMS Encrypt API.
The Encrypt API supports direct encryption of data payloads up to 4 KB4\text{ KB}.
To verify that the 2 KB2\text{ KB} payload is within the direct encryption threshold.
3
Identify the KMS API operation that performs direct encryption on the payload.
The Encrypt operation takes the plaintext payload and returns the ciphertext directly.
To select the operation that meets all requirements without introducing envelope encryption complexity.

Key Concept

AWS KMS Direct Encryption Limits
Estimated Time:45s
Question 119Question →

A developer is implementing client-side decryption for a microservice that retrieves encrypted configuration files (each under 1010 KB in size) from an external datastore. The files were encrypted using envelope encryption with an AWS KMS customer managed key. The datastore contains the ciphertext payload and the encrypted data key (ciphertext data key). Which two steps must the developer's application perform to decrypt the payload?

Select all that apply

Show answer & explanation

Answer: Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to retrieve the plaintext data key.; Decrypt the ciphertext payload locally using the retrieved plaintext data key and the appropriate decryption algorithm.

Answer

To decrypt the payload, the application must call the KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then decrypt the ciphertext payload locally using that plaintext data key.
To decrypt a payload that was encrypted using envelope encryption, the client application first extracts the encrypted data key (ciphertext data key) that is stored alongside the payload. The application then sends this ciphertext data key to AWS KMS by calling the Decrypt API operation. AWS KMS decrypts the data key using the specified customer managed key and returns the plaintext data key to the application. Finally, the application uses this plaintext data key to decrypt the ciphertext payload locally. This ensures that the heavy decryption workload is done client-side and the sensitive raw payload is never sent over the network to AWS KMS.

Step-by-Step Solution

1
Isolate the ciphertext data key.
The ciphertext data key is separated from the encrypted configuration payload.
AWS KMS envelope encryption requires decrypting the data key before the data itself can be decrypted.
2
Decrypt the data key via AWS KMS.
AWS KMS decrypts the ciphertext data key and returns the plaintext data key.
The client application does not have access to the backing customer managed key and must delegate decryption of the data key to AWS KMS.
3
Decrypt the payload locally.
The configuration payload is decrypted back to plaintext.
Performing decryption locally avoids the network overhead of sending the payload to AWS KMS and bypasses the payload size limits of the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption Decryption Workflow
Question 120Question →

A logistics company is exposing a shipment tracking API via an Amazon API Gateway REST API. The developer needs to secure the API to authenticate and authorize two categories of consumers:

1. Internal warehouse applications running on Amazon EC2 instances within the company's AWS account. These applications must be granted access using their IAM roles under the principle of least privilege.
2. Mobile client applications used by delivery drivers. These drivers authenticate against an external identity provider (IdP). The authorization process must validate custom claims in their security tokens to restrict access to specific geographical regions.

Which two configurations should the developer implement to secure the API Gateway endpoints for these consumers? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and attach an IAM policy to the EC2 instances' instance profile role that allows the execute-api:Invoke action on the specific API resource ARN.; Configure a Lambda Request Authorizer for the delivery driver methods. In the authorizer Lambda function, validate the token from the external IdP, extract the custom geographic claim, and generate an IAM policy that allows access to the requested API resource.

Answer

Configure the API Gateway methods for the warehouse applications to use AWS_IAM authorization, and configure a Lambda Request Authorizer for the delivery driver methods to validate the external IdP token and return an IAM policy.
The correct configurations involve using AWS_IAM authorization for the warehouse applications, combined with a Lambda Request Authorizer for the delivery drivers. AWS_IAM authorization natively validates requests signed using SigV4 from EC2 instance profiles. A Lambda Request Authorizer allows running custom authorization logic against an external identity provider's tokens and returning an IAM policy dynamically based on custom claims.

Step-by-Step Solution

1
Identify the authentication mechanism for internal AWS resources.
AWS_IAM authorization is identified as the native, secure mechanism.
Since the warehouse applications run on EC2 instances inside AWS, utilizing instance profiles and IAM roles with SigV4 signing avoids hardcoding credentials and provides fine-grained access control.
2
Determine the resource policy assignment for EC2.
Attach an IAM policy allowing execute-api:Invoke on the API's ARN to the EC2 instances' role.
The client role needs permission to call the API Gateway endpoint when AWS_IAM authorization is enabled.
3
Identify the authorization mechanism for external IdP users requiring custom claim validation.
A Lambda Request Authorizer is selected.
Because the identity provider is external and custom claims (geographical region) must be verified to grant access, a custom Lambda authorizer must validate the token and dynamically generate an IAM policy.
4
Verify that API Gateway client certificates and Cognito User Pools do not fit the direct requirements.
Reject Cognito User Pools and client certificates configurations.
Client certificates authenticate API Gateway to the backend, not the client to API Gateway. Cognito User Pools Authorizers cannot natively validate external IdP tokens with complex custom validation logic without a user directory interface.

Key Concept

API Gateway Security and Authorization mechanisms, specifically matching IAM authorization for AWS services and Lambda Authorizers for external custom token validation.
Estimated Time:3m 0s
PreviousPage 6 / 20Next
Security Practice Questions — AWS Certified Developer - Associate — Page 6 | Examkin