Security

390 questions

All types390 Multiple choice195 Multiple select195

An internal employee portal has a frontend application that retrieves account data by calling a REST API hosted on Amazon API Gateway. The employees are authenticated using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints so that only authenticated users can access the resources. The developer needs to validate the JSON Web Tokens (JWT) at the API Gateway level with the least operational overhead.

Which configuration should the developer implement to meet these requirements?

Configure a Lambda Proxy integration in API Gateway and validate the JWT token using custom integration mapping templates.

Implement a custom AWS Lambda authorizer that retrieves the public JSON Web Key Set from Cognito to validate the JWT signature.

Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.

Configure an API Gateway authorizer that integrates with an Amazon Cognito Identity Pool to validate the employee JWT tokens.

Show answer & explanation

Answer: Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.

Answer

Create a Cognito User Pools authorizer in API Gateway and configure the API method to use this authorizer.

The correct option is to create a Cognito User Pools authorizer in API Gateway and configure the API method to use it. This utilizes API Gateway's native capability to validate JWT tokens generated by Amazon Cognito User Pools without writing any custom code, satisfying the requirement for the least operational overhead.

Step-by-Step Solution

Identify the authentication source and the validation requirement.

The authentication source is an Amazon Cognito User Pool which generates JSON Web Tokens (JWTs). Validation must occur at the API Gateway layer.

Understanding the source and location of authentication determines the available integration types.

Evaluate the requirement for least operational overhead and least custom code.

API Gateway offers a built-in authorizer specifically designed for Cognito User Pools that handles JWT validation natively.

Choosing the native authorizer eliminates the need to write and maintain custom validation functions.

Configure the API Gateway method.

Create the Cognito User Pools authorizer in API Gateway and associate it with the HTTP methods of the API.

This secures the API endpoints by ensuring that only valid Cognito JWTs are allowed to pass through to the backend.

Key Concept

API Gateway Cognito User Pools Authorizer

Question 122Question →

An application needs to decrypt a large dataset ( $5\text{ GB}$ ) that was previously encrypted client-side using envelope encryption with an AWS KMS Customer Managed Key (CMK). The encrypted dataset consists of the ciphertext data and the encrypted data key, both of which are stored in an Amazon S3 bucket. The application's IAM role has been granted `kms:Decrypt` permissions.

Which of the following steps must the developer implement in the application code to successfully decrypt the dataset? (Select TWO.)

Select all that apply

Call the AWS KMS `Decrypt` API operation, passing the encrypted data key to retrieve the plaintext data key.

Decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

Call the AWS KMS `Decrypt` API operation, passing the entire ciphertext dataset to retrieve the decrypted plaintext data directly.

Call the AWS KMS `GenerateDataKey` API operation, passing the KMS key identifier to generate a new plaintext key for decrypting the data.

Call the AWS KMS `ReEncrypt` API operation, passing the encrypted data key and the ciphertext dataset to decrypt it in a single request.

Show answer & explanation

Answer: Call the AWS KMS `Decrypt` API operation, passing the encrypted data key to retrieve the plaintext data key.; Decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

Answer

To decrypt a large dataset encrypted client-side with envelope encryption, the application must call the KMS Decrypt API operation, passing the encrypted data key to obtain the plaintext data key, and then decrypt the ciphertext data locally using the plaintext data key and a symmetric decryption algorithm.

In client-side envelope encryption, the Customer Managed Key (CMK) in AWS KMS is only used to decrypt the encrypted data key. The application must first send the encrypted data key to KMS via the `Decrypt` API to retrieve the plaintext data key. Once retrieved, the actual decryption of the large dataset (in this case,

5\text{ GB}

) is performed locally on the client side using a symmetric decryption algorithm (like AES) with the plaintext data key. This avoids sending large files over the network to KMS and bypasses KMS API payload limits.

Step-by-Step Solution

Retrieve the encrypted data key and the ciphertext dataset from the S3 bucket.

The application has the encrypted data key and the encrypted dataset ready in memory or buffer.

Before performing any cryptographic operations, both the encrypted key and ciphertext must be accessed.

Call the AWS KMS `Decrypt` API, providing the encrypted data key as the CiphertextBlob parameter.

AWS KMS decrypts the data key using the designated Customer Managed Key (CMK) and returns the plaintext data key.

The Customer Managed Key (CMK) is kept securely within KMS HSMs; only KMS can decrypt the encrypted data key.

Use the returned plaintext data key with a local cryptographic library (such as AES-GCM) to decrypt the ciphertext dataset.

The

5\text{ GB}

ciphertext is decrypted locally into its original plaintext state.

KMS cannot decrypt large data directly due to the

4\text{ KB}

payload limit, so decryption of the dataset must occur client-side.

Securely wipe the plaintext data key from the application's memory.

The plaintext data key is erased.

This minimizes the risk of the plaintext data key being exposed in memory dumps or logs.

Key Concept

Client-side envelope encryption relies on using a local plaintext data key (retrieved by decrypting the encrypted data key via KMS) to perform symmetric decryption on the actual dataset locally, rather than sending the large dataset to KMS.

Estimated Time:3m 0s

Question 123Question →

An organization is deploying a secure microservice where an AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function must retrieve database credentials from AWS Secrets Manager and query an Amazon DynamoDB table. To meet strict security standards, no traffic is allowed to traverse the public internet. The developer has created a gateway VPC endpoint for DynamoDB and an interface VPC endpoint for Secrets Manager in the same private subnet. While DynamoDB queries succeed, the Lambda function times out when attempting to retrieve credentials from Secrets Manager. Which action must the developer take to allow the Lambda function to successfully retrieve the secrets?

Move the Lambda function to a public subnet within the VPC and assign a public IP address to its execution configuration to allow direct routing to the public Secrets Manager endpoint.

Update the trust policy of the Lambda execution role to trust the interface VPC endpoint service principal, allowing the network interface to assume the role's permissions.

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Migrate the database credentials from AWS Secrets Manager to Systems Manager Parameter Store and provision a gateway VPC endpoint for Parameter Store.

Show answer & explanation

Answer: Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

Answer

Configure the security group attached to the Secrets Manager interface VPC endpoint to allow inbound TCP port 443 traffic from the security group attached to the Lambda function.

The correct option correctly configures the security group associated with the Secrets Manager interface VPC endpoint. Interface endpoints (PrivateLink) create network interfaces inside the VPC with private IP addresses. For the Lambda function to reach these network interfaces over HTTPS, the security group of the interface endpoint must allow inbound traffic on TCP port 443 from the security group of the Lambda function.

Step-by-Step Solution

Analyze the network path and failure point.

The Lambda function times out when attempting to connect to Secrets Manager. Because there is no NAT Gateway or internet path, traffic must route through the interface VPC endpoint.

Since the DynamoDB query succeeds via the gateway endpoint, the Lambda function's internal VPC subnet configuration and basic execution routing are functional, indicating a specific block on the Secrets Manager interface endpoint path.

Identify the network requirements for interface VPC endpoints.

Interface endpoints (AWS PrivateLink) deploy ENIs inside the VPC. Clients connect to these ENIs using HTTPS on TCP port 443.

Unlike gateway endpoints, interface endpoints act as local network interfaces in the subnet and are subject to security group evaluation.

Configure the endpoint security group rules.

Add an inbound rule to the security group associated with the Secrets Manager interface VPC endpoint allowing TCP port 443 traffic from the Lambda function's security group.

This permits the Lambda function's network interface to successfully initiate and complete the TLS handshake with the Secrets Manager endpoint ENIs.

Key Concept

Security group configuration for interface VPC endpoints

Question 124Question →

An application runs on an Amazon EC2 instance located within a private subnet of a Virtual Private Cloud (VPC). The application must access AWS Systems Manager Parameter Store to retrieve configuration parameters. The security policy dictates that this traffic must not traverse the public internet. Which VPC configuration should be implemented to satisfy this requirement?

Create an interface VPC endpoint for Systems Manager within the VPC.

Configure a NAT Gateway in a public subnet and route all internet-bound traffic from the private subnet through it.

Update the IAM role trust policy on the EC2 instance to trust the Systems Manager service principal.

Migrate the parameters to AWS Secrets Manager and enable automatic credential rotation.

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager within the VPC.

Answer

Create an interface VPC endpoint for Systems Manager within the VPC.

Creating an interface VPC endpoint for Systems Manager within the VPC is the correct solution. Interface VPC endpoints use AWS PrivateLink, which places elastic network interfaces (ENIs) with private IP addresses in the subnets. Traffic to Systems Manager is routed privately within the AWS network, satisfying the requirement to avoid the public internet.

Step-by-Step Solution

Identify the environment and target service requirements.

An application on an EC2 instance in a private subnet needs to access AWS Systems Manager Parameter Store.

This establishes the source and destination for the network traffic.

Apply the security constraint regarding internet traversal.

The traffic must remain entirely within the AWS network and cannot route through the public internet.

This eliminates options that route traffic through internet gateways or NAT gateways to public service endpoints.

Select the VPC private connectivity option for AWS services.

An interface VPC endpoint (powered by AWS PrivateLink) is configured for Systems Manager, providing private IP addresses within the VPC.

Interface VPC endpoints allow private subnets to communicate with AWS services securely without using public endpoints.

Key Concept

AWS PrivateLink and Interface VPC Endpoints allow private resources inside a VPC to securely connect to supported AWS services without internet traversal.

Question 125Question →

A serverless application needs to retrieve credentials from AWS Secrets Manager and query an Amazon RDS database located in a private VPC subnet. What network configuration should be implemented to allow the Lambda function to securely retrieve the credentials and access the database without exposing any traffic to the public internet?

Run the Lambda function in the private VPC subnets without any VPC endpoints or NAT gateways, as Lambda functions automatically bypass VPC routing to connect to public AWS service endpoints.

Store the database credentials in AWS Systems Manager Parameter Store and enable automatic rotation to allow the private Lambda function to retrieve them over standard HTTP.

Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Modify the Lambda function's IAM role trust policy to allow public internet gateway access for database credentials validation.

Show answer & explanation

Answer: Attach the Lambda function to the private VPC subnets, configure an interface VPC endpoint for Secrets Manager, and permit inbound database security group traffic from the Lambda function's security group.

Answer

The correct configuration is to attach the Lambda function to the private subnets, set up an interface VPC endpoint for Secrets Manager to allow private API calls, and configure the RDS database's security group to allow inbound traffic from the Lambda function's security group. This achieves fully private, secure access for both credentials retrieval and database queries.

Step-by-Step Solution

Configure the Lambda function to run inside the private subnets of the VPC.

The Lambda function gains private network access to VPC resources, including the RDS database in the same VPC.

This establishes private network routing to the database.

Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager inside the VPC.

A private network interface is placed in the subnets, routing traffic to Secrets Manager privately.

This allows the Lambda function to retrieve secrets without traversing the public internet.

Modify the RDS database's security group inbound rules to allow traffic on the database port from the Lambda function's security group.

The RDS database will accept connection requests initiated by the Lambda function.

This ensures secure access to the database using the principle of least privilege.

Key Concept

VPC endpoints and security groups for private AWS service and database connectivity from Lambda functions.

Question 126Question →

An enterprise archiving application is designed to write raw sensor datasets (each averaging $500\text{ KB}$ in size) to a self-managed object store. The compliance team mandates client-side encryption before transmission. To minimize AWS KMS API requests and network latency, the development team plans to use local envelope encryption. Which sequence of AWS SDK operations represents the correct and most cost-effective implementation of this encryption workflow?

Request a data key by calling `GenerateDataKey`. Use the returned plaintext data key to encrypt the dataset locally, immediately wipe the plaintext key from application memory, and store the dataset along with the returned ciphertext data key.

Encrypt the dataset directly by calling `Encrypt` with the customer managed key, and then upload the resulting ciphertext to the object store.

Request only the encrypted key structure by calling `GenerateDataKeyWithoutPlaintext`. Use this returned ciphertext data key to perform the local encryption of the dataset.

Request a data key by calling `GenerateDataKey` to get a plaintext key. Use it to encrypt the dataset locally, then call `Encrypt` to encrypt that plaintext key, storing the resulting ciphertext key alongside the data.

Show answer & explanation

Answer: Request a data key by calling `GenerateDataKey`. Use the returned plaintext data key to encrypt the dataset locally, immediately wipe the plaintext key from application memory, and store the dataset along with the returned ciphertext data key.

Answer

Request a data key by calling `GenerateDataKey`, use the returned plaintext data key to encrypt the dataset locally, wipe the plaintext key from memory, and store the dataset alongside the returned ciphertext data key.

The correct workflow for client-side envelope encryption involves requesting a data key using `GenerateDataKey`. This operation returns both the plaintext key (for immediate encryption) and the encrypted ciphertext key (for storage). The plaintext key should be cleared from memory as soon as encryption completes.

Step-by-Step Solution

Analyze the file size constraint and encryption method.

The files average

500\text{ KB}

, which exceeds the

4\text{ KB}

payload limit of direct KMS `Encrypt` operations, confirming that envelope encryption is required.

Determines whether direct encryption or envelope encryption must be used.

Determine the correct API call to retrieve the necessary keys for envelope encryption.

Calling `GenerateDataKey` returns both a plaintext key (required to perform the encryption algorithm locally) and a ciphertext key (stored for later decryption).

Identifies the correct AWS KMS API operation that yields the cryptographic keys needed for client-side envelope encryption.

Review the workflow steps for security and cost efficiency.

Wiping the plaintext data key from memory immediately after encryption secures the system, and storing the returned ciphertext key directly avoids extra API calls (such as a redundant `Encrypt` call).

Ensures the application adheres to security best practices and minimizes AWS KMS cost and latency.

Key Concept

AWS KMS Envelope Encryption Workflow

Estimated Time:1m 30s

Question 127Question →

A developer is building a secure enterprise document management portal. User authentication is managed by a third-party Identity Provider (IdP). The client applications send a JSON Web Token (JWT) issued by the IdP in the `Authorization` header of every request to an Amazon API Gateway REST API. The developer must secure the `/documents/delete` resource so that only users who have a custom claim `user_role` set to `Administrator` in the JWT are permitted to invoke the backend service. This validation must be enforced at the API Gateway boundary to prevent unauthorized requests from invoking the backend integration. Which solution should the developer implement to meet these requirements with the least operational overhead?

Create an API Gateway Lambda Request Authorizer. In the Lambda function, verify the signature of the incoming JWT using the Identity Provider's JSON Web Key Set (JWKS), extract the custom `user_role` claim, and return an IAM policy that allows the `execute-api:Invoke` action on the target resource if the claim value is `Administrator`.

Set up an Amazon Cognito User Pool federated with the third-party IdP, and configure an API Gateway Cognito User Pools Authorizer. In the method request settings for the `/documents/delete` resource, add custom OAuth Scopes to validate that the custom `user_role` attribute in the user's identity token matches `Administrator`.

Set up an Amazon Cognito Identity Pool to exchange the third-party JWT for temporary AWS credentials. Enable IAM authorization on the `/documents/delete` resource, and write a custom API Gateway Resource Policy that denies requests if the `$context.authorizer.claims.user_role` context variable does not match `Administrator`.

Set up a Lambda Proxy Integration for the `/documents/delete` resource. In the backend Lambda function, extract the custom `user_role` claim from the request payload, and return an API Gateway Resource Policy dynamically to deny the request if the claim value is not `Administrator`.

Show answer & explanation

Answer: Create an API Gateway Lambda Request Authorizer. In the Lambda function, verify the signature of the incoming JWT using the Identity Provider's JSON Web Key Set (JWKS), extract the custom `user_role` claim, and return an IAM policy that allows the `execute-api:Invoke` action on the target resource if the claim value is `Administrator`.

Answer

Create an API Gateway Lambda Request Authorizer to decode and validate the token, extract the custom claim, and generate an IAM policy that grants access if the claim matches the required role.

Implementing an API Gateway Lambda Request Authorizer allows the developer to run custom code at the API Gateway boundary. The Lambda function can fetch the IdP's JSON Web Key Set (JWKS), verify the JWT signature, read the custom `user_role` claim, and generate an IAM policy that allows or denies access using the `execute-api:Invoke` action.

Step-by-Step Solution

Analyze client authentication token properties.

The client passes a standard JWT issued by a third-party IdP containing custom claims.

Understanding the token type and claims is essential for choosing the correct authorizer type.

Evaluate API Gateway native authorizer capabilities.

Built-in Cognito User Pool Authorizers cannot perform custom authorization logic (such as validating custom claims like `user_role` at the API Gateway level) and do not support OIDC scopes on ID tokens.

Enforcing custom claim checks at the API Gateway boundary prevents unauthorized backend execution.

Select the appropriate authorization mechanism.

A custom Lambda Authorizer must be implemented to validate the JWT signature against the IdP's JWKS and programmatically inspect the custom claim.

Only Lambda Authorizers allow running custom code at the API Gateway boundary to generate dynamic IAM policies based on arbitrary JWT claims.

Return an IAM policy from the Lambda Authorizer.

The Lambda Authorizer returns an IAM policy allowing or denying the `execute-api:Invoke` action on the resource.

API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Key Concept

API Gateway custom Lambda Authorizers allow developers to perform custom JWT verification and inspect arbitrary token claims at the API Gateway boundary to return an IAM policy.

Estimated Time:3m 0s

Question 128Question →

A developer needs to encrypt local application backup files before uploading them to Amazon S3 using client-side envelope encryption with an AWS KMS customer managed key. Which TWO actions must the developer perform to complete this encryption process? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation to retrieve both a plaintext and a ciphertext version of the data key.

Encrypt the files locally using the plaintext data key, and then delete the plaintext data key from memory.

Call the KMS Encrypt API operation directly for each file to encrypt the payload on the server side.

Call the GenerateDataKeyWithoutPlaintext API operation and use the returned ciphertext data key to encrypt the files.

Store the plaintext data key in AWS Systems Manager Parameter Store to use during future decryption processes.

Show answer & explanation

Answer: Call the GenerateDataKey API operation to retrieve both a plaintext and a ciphertext version of the data key.; Encrypt the files locally using the plaintext data key, and then delete the plaintext data key from memory.

Answer

To perform local envelope encryption, the developer must call the GenerateDataKey API to obtain a plaintext and ciphertext data key, encrypt the files locally using the plaintext key, and then delete the plaintext key from memory.

In client-side envelope encryption, the client must obtain a data key from KMS by calling the GenerateDataKey API. The API returns both a plaintext data key and a ciphertext data key. The developer uses the plaintext data key to encrypt the files locally and then immediately deletes the plaintext key from memory to prevent unauthorized access. The ciphertext data key is stored next to the encrypted file so it can be decrypted later when needed.

Step-by-Step Solution

Request a data key from AWS KMS

Obtained a plaintext data key and a ciphertext data key by invoking the GenerateDataKey API with the customer managed key.

The plaintext key is necessary for local encryption, while the ciphertext key is stored alongside the data for subsequent decryption.

Encrypt the file locally

Encrypted the backup files using the plaintext data key with a local cryptographic library.

This performs client-side encryption without sending the file payload to AWS KMS.

Clean up the memory

Deleted the plaintext data key from memory and retained the ciphertext data key.

Ensures the plaintext key does not persist in memory, which would compromise the security of the encrypted files.

Key Concept

AWS KMS Client-Side Envelope Encryption Workflow

Question 129Question →

A developer is securing a feedback collection REST API hosted on Amazon API Gateway. The requirement is to allow access only to authenticated corporate users who reside in an Amazon Cognito User Pool. Which two steps should the developer perform to implement this authentication mechanism? (Select TWO).

Select all that apply

Create an Amazon API Gateway authorizer of type Cognito and select the Cognito User Pool.

Configure the API Gateway resource methods to use the Cognito authorizer.

Configure an Amazon Cognito Identity Pool to authenticate requests and associate it directly with the API Gateway resource.

Write a custom AWS Lambda authorizer that manually decodes and validates the Cognito JSON Web Tokens (JWT).

Configure the API Gateway resource with a Lambda proxy integration to handle user pool authentication inside the backend integration code.

Show answer & explanation

Answer: Create an Amazon API Gateway authorizer of type Cognito and select the Cognito User Pool.; Configure the API Gateway resource methods to use the Cognito authorizer.

Answer

To secure the API using an Amazon Cognito User Pool, the developer must create a Cognito authorizer in API Gateway pointing to the User Pool, and then configure the API methods to use this authorizer.

To secure the API using an Amazon Cognito User Pool natively, the developer must first create an API Gateway authorizer of type Cognito, linking it directly to the User Pool. The developer then configures the relevant API resource methods to use this Cognito authorizer. This allows API Gateway to automatically authenticate incoming requests by validating the JWT passed in the Authorization header.

Step-by-Step Solution

Create a Cognito authorizer in Amazon API Gateway.

An authorizer configured to validate JSON Web Tokens (JWTs) issued by the specified Amazon Cognito User Pool is established.

This sets up the connection between API Gateway and the user directory where corporate users are managed.

Configure the HTTP method (e.g., GET, POST) on the API Gateway resource to use the newly created Cognito authorizer.

The API method is secured, requiring a valid Authorization header containing a JWT.

This enforces the authorizer check at the API Gateway edge before any request is forwarded to backend integrations.

Key Concept

API Gateway Cognito Authorizers

Estimated Time:1m 30s

Question 130Question →

A developer is deploying a containerized API on AWS Fargate within a private subnet of a custom VPC. The API needs to read and write data to an Amazon Aurora PostgreSQL database located in a different private subnet within the same VPC. Additionally, the API must fetch sensitive API keys from AWS Secrets Manager. There is no route to the internet or any NAT Gateway configured in the VPC. Which set of configurations is required to establish these connections securely?

Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Deploy a NAT Gateway in the Fargate task's private subnet, add a route in its route table pointing 0.0.0.0/0 to the NAT Gateway, and configure the Aurora security group to allow inbound traffic from the NAT Gateway's private IP address.

Modify the IAM trust policy of the ECS task execution role to trust secretsmanager.amazonaws.com and add a policy allowing secretsmanager:GetSecretValue, then configure the Aurora routing table to propagate routes from the Fargate subnet.

Migrate the API keys from AWS Secrets Manager to Systems Manager Parameter Store, as Parameter Store is natively accessible within private subnets without requiring VPC endpoints or NAT gateways, and open port 5432 on the Aurora subnet's Network Access Control List (NACL) for inbound and outbound traffic.

Show answer & explanation

Answer: Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.

Answer

The correct option establishes a private, secure path to Secrets Manager via AWS PrivateLink within the VPC, and allows the Fargate task to securely communicate with the Aurora database in another private subnet of the same VPC using security groups.

Step-by-Step Solution

Analyze destination endpoints.

Amazon Aurora PostgreSQL is hosted within the VPC, while AWS Secrets Manager is a public AWS service endpoint outside the VPC.

This determines which connections require VPC-native routing and which require external access or endpoints.

Configure the database connection.

The Aurora security group is modified to allow inbound traffic on port 5432 originating from the security group of the Fargate task.

Since both resources reside in different private subnets of the same VPC, local routing is automatic, and security groups are used to restrict access.

Configure access to AWS Secrets Manager without internet access.

An interface VPC endpoint (PrivateLink) for Secrets Manager is created in the VPC subnets, and its security group is set to allow inbound HTTPS traffic (port 443) from the Fargate task's security group.

Since there is no internet route or NAT Gateway, a VPC endpoint is required to establish private connectivity to Secrets Manager.

Key Concept

VPC Security Groups and Private VPC Endpoints

Estimated Time:2m 0s

Question 131Question →

A team is deploying a serverless data ingestion application. An AWS Lambda function needs to read and write data to an Amazon ElastiCache for Redis cluster located in the private subnets of a VPC. The Lambda function also must perform outbound HTTPS requests to an external validation API on the public internet. Which TWO network and security configurations must the developer implement to establish this connectivity? (Select TWO.)

Select all that apply

Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.

Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.

Attach the Lambda function to the public subnets of the VPC to allow direct outbound communication to the external API via an Internet Gateway.

Modify the trust policy of the Lambda execution role to allow the Systems Manager Parameter Store service principal to access VPC resources.

Configure the ElastiCache connection endpoint as a Parameter Store SecureString parameter and configure Parameter Store to automatically rotate the parameter daily.

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route to a NAT Gateway in a public subnet to route outbound traffic from the private subnets to the internet.; Configure the security group of the ElastiCache cluster to allow inbound TCP traffic on port 6379 from the security group assigned to the Lambda function.

Answer

To establish the required connectivity, the developer must place the Lambda function in the VPC's private subnets and use a NAT Gateway in a public subnet for public internet access, while also adjusting the ElastiCache security group to allow inbound traffic on port 6379 from the Lambda function's security group.

Configuring the Lambda function inside private subnets with a NAT Gateway in a public subnet allows the function to access both private resources (ElastiCache) and the public internet (external API). Modifying the ElastiCache security group to accept inbound traffic from the Lambda security group is required to allow connection requests.

Step-by-Step Solution

Place the Lambda function inside the private subnets of the VPC to grant it network path access to the ElastiCache cluster.

The Lambda function is associated with ENIs in the private subnets, enabling it to reach local VPC resources.

VPC-enabled Lambda functions require association with subnets inside the VPC to interact with private endpoints like ElastiCache.

Set up a NAT Gateway in a public subnet of the VPC and update the private subnets' route table to forward 0.0.0.0/0 traffic to the NAT Gateway.

The Lambda function in the private subnets can now establish outbound HTTPS connections to the external validation API.

Lambda functions in private subnets cannot access the public internet directly through an Internet Gateway and must use a NAT Gateway.

Modify the ElastiCache security group to allow inbound Redis traffic (TCP 6379) from the security group assigned to the Lambda function.

Network communication on port 6379 is allowed through the stateful firewall rules of both security groups.

Security groups act as firewalls at the instance/resource level, and inbound access must be explicitly allowed for connection requests to succeed.

Key Concept

VPC Security for Lambda and ElastiCache connectivity, including security group rules and private-to-public routing.

Estimated Time:2m 0s

Question 132Question →

A developer is implementing client-side decryption for a serverless application. The application retrieves encrypted log archives (each averaging $150\text{ MB}$ in size) from an Amazon S3 bucket. The logs were encrypted using envelope encryption with an AWS KMS customer managed key. The encrypted data key is stored as metadata alongside each S3 object.

Which two actions must the developer perform to decrypt the log archives? (Select TWO.)

Select all that apply

Call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key.

Decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

Send the encrypted log archive directly to the KMS Decrypt API to be decrypted by AWS KMS.

Call the KMS GetKeyPolicy API to retrieve the private key of the customer managed key to perform local decryption.

Retrieve the plaintext decryption key from the AWS Systems Manager Parameter Store using the GetParameter API.

Show answer & explanation

Answer: Call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key.; Decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

Answer

To decrypt the log archives, the developer must call the KMS Decrypt API operation, passing the encrypted data key to retrieve the plaintext data key, and then decrypt the log archive locally using the retrieved plaintext data key and a symmetric decryption algorithm.

The correct options identify the proper steps for client-side envelope decryption: first, the client must call the KMS Decrypt API to decrypt the encrypted data key (which is small enough to fit within the

4\text{ KB}

KMS limit); second, the client must perform the decryption of the actual

150\text{ MB}

log file locally using the resulting plaintext data key and a symmetric decryption algorithm. This avoids transmitting large data payloads over the network to KMS.

Step-by-Step Solution

Extract the encrypted data key from the S3 object metadata.

The encrypted data key is loaded into the Lambda function's memory.

The encrypted data key must be decrypted before it can be used to decrypt the actual log archive.

Invoke the AWS KMS Decrypt API operation, passing the encrypted data key.

AWS KMS returns the plaintext data key.

Only AWS KMS can decrypt the data key because the customer managed key remains secured within the KMS hardware security modules.

Decrypt the

150\text{ MB}

log archive locally using the plaintext data key and a symmetric algorithm like AES.

The log archive is successfully decrypted.

Direct decryption via AWS KMS is limited to payloads of

4\text{ KB}

or less, requiring large files to be decrypted locally using envelope encryption.

Key Concept

Envelope encryption is a method where data is encrypted with a unique data key, and the data key itself is encrypted under a root key (an AWS KMS customer managed key). To decrypt the data, the encrypted data key must first be sent to KMS to be decrypted. The resulting plaintext data key is then used locally by the application to decrypt the large payload, avoiding the transmission of large files over the network to KMS.

Estimated Time:1m 30s

Question 133Question →

A developer is building a high-throughput microservice deployed on AWS Fargate that processes sensitive financial transactions. The system must encrypt each transaction payload client-side before storing it in an Amazon DynamoDB table. To meet strict security compliance, the team has established the following requirements:

1. Access to the AWS Key Management Service (AWS KMS) customer managed key (CMK) must be managed centrally using IAM policies, avoiding direct updates to the KMS key policy whenever a new microservice is deployed.
2. The microservice's IAM execution role (`TxServiceRole`) must be granted the absolute minimum permissions required to perform local client-side envelope encryption.

Which two configuration steps must the developer perform to satisfy these requirements? (Select TWO.)

Select all that apply

Include a statement in the KMS key policy of the customer managed key that grants the AWS account root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform all KMS actions (`kms:*`).

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKey` action on the ARN of the customer managed key.

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:Encrypt` and `kms:Decrypt` actions on the ARN of the customer managed key.

Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKeyWithoutPlaintext` action on the ARN of the customer managed key.

Configure the microservice to store the generated plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to reuse across transaction sessions.

Show answer & explanation

Answer: Include a statement in the KMS key policy of the customer managed key that grants the AWS account root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform all KMS actions (`kms:*`).; Attach an IAM policy to the `TxServiceRole` that grants permission to perform the `kms:GenerateDataKey` action on the ARN of the customer managed key.

Answer

To configure client-side envelope encryption with IAM-based access management, the KMS key policy must delegate permission control to IAM by granting the account root user permissions to perform all KMS actions. Additionally, the microservice execution role must be granted permissions in IAM to run the `kms:GenerateDataKey` action on the key.

The correct configuration requires delegating control of the KMS Customer Managed Key (CMK) to IAM, and granting the microservice the minimal API action required for envelope encryption. Delegating control to IAM is achieved by adding a policy statement to the key policy that grants `kms:*` to the account's root user. The microservice requires the `kms:GenerateDataKey` action to retrieve both the plaintext and encrypted versions of the data key needed to perform envelope encryption client-side.

Step-by-Step Solution

Configure the KMS key policy to delegate authorization to IAM.

Include a statement in the KMS key policy that grants the root user (`arn:aws:iam::<ACCOUNT_ID>:root`) permission to perform `kms:*` operations.

This is a prerequisite for managing KMS key access centrally via IAM policies. Without this statement, IAM policies granting access to the key will be ignored.

Determine the necessary KMS API action for envelope encryption.

Identify that the application needs to run `GenerateDataKey` to retrieve both the plaintext and ciphertext versions of the data key.

Envelope encryption requires the plaintext key to encrypt the payload locally and the ciphertext key to store with the encrypted payload for later decryption.

Attach the minimum required IAM permissions to the microservice role.

An IAM policy allowing `kms:GenerateDataKey` on the key ARN is attached to the role.

This implements the principle of least privilege, giving the microservice only the permission it needs to generate keys for client-side encryption without granting administrative or direct encryption capabilities.

Key Concept

KMS Key Policies and Envelope Encryption Integration

Question 134Question →

A software-as-a-service (SaaS) provider is exposing a REST API hosted on Amazon API Gateway to business partners. The partners need to authenticate using their own enterprise SAML 2.0 Identity Providers (IdPs). The provider wants to minimize custom authorization code and directly validate partner users before allowing them to invoke backend services. Which two configuration steps must the developer perform to meet these requirements?

Select all that apply

Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool.

Create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).

Configure the external SAML 2.0 Identity Provider (IdP) as an authentication provider in an Amazon Cognito Identity Pool, and create an API Gateway Cognito authorizer pointing directly to the Identity Pool.

Develop a Custom Lambda authorizer that intercepts the SAML token, executes the AssumeRoleWithSAML API call on AWS STS, and uses the resulting temporary credentials to call the backend service.

Develop a Custom Lambda authorizer that validates the token and returns a standardized Lambda proxy integration response containing statusCode and body keys to authorize the request.

Show answer & explanation

Answer: Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool.; Create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).

Answer

Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool, and create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).

To authenticate external SAML 2.0 Identity Providers with Amazon API Gateway while minimizing custom code, the developer should configure the SAML IdP as a federated identity provider in an Amazon Cognito User Pool. The client application will authenticate with the User Pool and receive a JSON Web Token (JWT). The developer should then create a built-in Cognito User Pool Authorizer in API Gateway. This authorizer automatically validates the JWT passed in the specified Identity Source header without requiring any custom Lambda code.

Step-by-Step Solution

Configure SAML 2.0 federation in an Amazon Cognito User Pool.

External partner users can authenticate with their own IdP, and Cognito User Pools will issue standard OIDC JSON Web Tokens (JWTs).

This establishes federation and manages user sessions without requiring custom login directories or credentials storage.

Configure a Cognito User Pool Authorizer on the REST API methods.

API Gateway automatically verifies the JWT signature and claims for each API call against the Cognito User Pool configuration.

This fulfills the requirement to validate user authenticity at the API Gateway edge with zero custom code.

Key Concept

Integrating Amazon API Gateway with Amazon Cognito User Pools allows federated authentication (like SAML 2.0) to be easily validated at the API edge. The built-in Cognito Authorizer handles signature verification and token validation automatically, avoiding the need for custom Lambda authorizers or manual STS credential exchange.

Question 135Question →

A developer is designing a client-side encryption solution for a custom application. The application will use envelope encryption to secure data packets before storing them. The developer calls the AWS KMS `GenerateDataKey` API operation.

Which components does AWS KMS return to the application in the API response?

The plaintext data key and the encrypted data payload

A plaintext data key and a ciphertext data key

A ciphertext data key and the encrypted data payload

A plaintext data key and a Systems Manager parameter reference

Show answer & explanation

Answer: A plaintext data key and a ciphertext data key

Answer

A plaintext data key and a ciphertext data key

The correct option is the one stating that a plaintext data key and a ciphertext data key are returned. The `GenerateDataKey` operation is designed to support client-side envelope encryption by providing a plaintext key for immediate encryption by the client application, and a ciphertext key that can be safely stored alongside the encrypted data.

Step-by-Step Solution

Analyze the request to use envelope encryption via the `GenerateDataKey` API operation.

The application needs to encrypt data locally, which requires a data key generated by AWS KMS.

Envelope encryption relies on a data key generated by a root key (KMS Customer Managed Key) to encrypt the actual data.

Identify the outputs returned by the `GenerateDataKey` operation.

AWS KMS returns two parts: a plaintext data key for immediate encryption, and a ciphertext data key for storage.

The plaintext key is used to encrypt the data locally and then deleted from memory. The ciphertext key is stored with the encrypted data so it can be decrypted later by calling the KMS Decrypt API.

Key Concept

AWS KMS Envelope Encryption and the GenerateDataKey API

Estimated Time:45s

Question 136Question →

A developer is configuring an AWS Lambda function to run inside a custom VPC. The function needs to retrieve database configuration parameters stored in AWS Systems Manager Parameter Store. The corporate security policy requires that no traffic to Systems Manager may traverse the public internet. During testing, the Lambda function times out whenever it attempts to call the GetParameter API. How should the developer resolve this issue while complying with the security policy?

Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.

Associate the Lambda function with a public subnet in the VPC and add a route to the subnet's route table pointing to an Internet Gateway.

Modify the trust policy of the Lambda function's execution role to allow the Systems Manager service principal to assume the role.

Migrate the configuration parameters to AWS Secrets Manager, enable automatic rotation, and configure a Gateway VPC Endpoint for Secrets Manager.

Show answer & explanation

Answer: Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.

Answer

Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.

The correct answer correctly identifies that an interface VPC endpoint (AWS PrivateLink) allows resources inside private subnets to securely connect to Systems Manager over private IP addresses. It also correctly states that the security group of the VPC endpoint must permit inbound HTTPS traffic from the Lambda function's security group.

Step-by-Step Solution

Identify the root cause of the timeout.

The Lambda function inside the VPC has no path to the public Systems Manager endpoint.

By default, resources in private subnets cannot reach the public internet or public AWS services without a NAT Gateway or VPC Endpoint.

Apply the corporate security constraint.

Discard solutions involving NAT Gateways or Internet Gateways.

The security policy forbids traffic from traversing the public internet.

Select the correct private connectivity mechanism.

Determine that Systems Manager supports Interface VPC Endpoints (AWS PrivateLink).

Interface VPC Endpoints assign private IPs within the VPC to route traffic securely to the service.

Configure security groups for the endpoint.

Allow inbound port 443 traffic from the Lambda function's security group to the endpoint's security group.

Security groups control the traffic flow between the Lambda function's ENI and the VPC endpoint's ENI.

Key Concept

VPC Security and PrivateLink Interface Endpoints for Lambda

Question 137Question →

A developer needs to secure a configuration file containing sensitive application credentials that is $15\text{ KB}$ in size. The developer wants to implement client-side encryption using a customer managed key in AWS Key Management Service (AWS KMS) before storing the file.

Which approach should the developer take to encrypt this file?

Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.

Call the KMS Encrypt API directly, passing the

15\text{ KB}

configuration file as the plaintext payload, and store the resulting ciphertext in the application storage.

Call the KMS GenerateDataKeyWithoutPlaintext API to receive an encrypted data key. Decrypt the data key using the KMS Decrypt API, encrypt the configuration file locally, and then discard the plaintext data key.

Store the configuration file as a secret in AWS Secrets Manager, and configure AWS Systems Manager Parameter Store to perform client-side envelope decryption of the secret values.

Show answer & explanation

Answer: Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.

Answer

The configuration file is

15\text{ KB}

, which exceeds the

4\text{ KB}

limit for direct encryption using the AWS KMS `Encrypt` API. Therefore, client-side envelope encryption is required. Calling `GenerateDataKey` provides both the plaintext data key to perform the local encryption and the encrypted data key to be stored alongside the ciphertext for future decryption.

Step-by-Step Solution

Determine the file size and verify AWS KMS limits.

The file is

15\text{ KB}

, which exceeds the

4\text{ KB}

limit for direct encryption via the KMS `Encrypt` API.

To choose the correct API, the developer must recognize that envelope encryption is required due to the payload size.

Generate a data key using AWS KMS.

The developer calls `GenerateDataKey`, receiving a plaintext data key and an encrypted version of it.

The plaintext key is required for local encryption, and the encrypted key is required for future decryption.

Encrypt the data locally and clean up memory.

The file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory to maintain security.

Keeping the plaintext key in memory increases the security risk of key exposure.

Key Concept

AWS KMS Envelope Encryption Workflow

Question 138Question →

A developer is designing a serverless web application where users authenticate via an Amazon Cognito User Pool. The application must meet the following requirements:

1. Access a REST API hosted on Amazon API Gateway, where endpoints must be secured so that only authenticated users can access them with minimal validation latency and zero custom validation code.
2. Upload files directly to an Amazon S3 bucket into a user-specific prefix (s3://app-uploads/\${user_id}/) without routing the files through a backend server.

Which TWO configurations should the developer implement to meet these requirements?

Select all that apply

Configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the Cognito ID token in the request Authorization header.

Create an Amazon Cognito Identity Pool with the User Pool configured as an identity provider, and assign an authenticated IAM role that grants access to the S3 bucket using the \${cognito-identity.amazonaws.com:sub} policy variable.

Configure an API Gateway Lambda Authorizer that parses the client request and calls the Cognito Identity Provider GetUser API to validate the token on every method invocation.

Apply an S3 bucket policy that uses the Amazon Cognito User Pool ARN as the Principal to authorize upload actions based on the cognito:username claim.

Enable IAM authorization on the API Gateway REST API, and configure the client to pass the raw Cognito User Pool access token in the Authorization header.

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the Cognito ID token in the request Authorization header.; Create an Amazon Cognito Identity Pool with the User Pool configured as an identity provider, and assign an authenticated IAM role that grants access to the S3 bucket using the \${cognito-identity.amazonaws.com:sub} policy variable.

Answer

Configure a Cognito User Pool Authorizer on the API Gateway REST API, and create a Cognito Identity Pool to obtain temporary AWS credentials mapped to an IAM policy that uses the client's identity ID prefix.

To secure the API Gateway REST API with zero custom code and low latency, a native Cognito User Pool Authorizer is configured to inspect the Authorization header and validate the ID token locally. To authorize direct uploads to S3, a Cognito Identity Pool is required to act as the credential broker. The client exchanges the User Pool token for temporary AWS credentials. By associating the authenticated IAM role of the Identity Pool with a policy that limits access using the identity ID context variable, users are securely restricted to their own folders.

Step-by-Step Solution

Select the appropriate authorization mechanism for API Gateway endpoints.

Using the native Cognito User Pool Authorizer validates tokens at the API Gateway edge, meeting the requirement of zero custom code and minimal latency.

This avoids the overhead of managing a custom Lambda authorizer or calling external Cognito APIs on every request.

Address the requirement for direct S3 bucket access from the client.

Since S3 does not validate Cognito User Pool JWT tokens directly, temporary AWS credentials must be obtained.

An AWS Identity Pool is required to exchange Cognito User Pool tokens for short-lived IAM credentials.

Implement resource isolation for S3 prefixes in the IAM policy.

Associate the authenticated role of the Identity Pool with an IAM policy that grants permission to the S3 bucket using the context variable for the Cognito identity ID.

This ensures users can only write to their own folder path using the unique identity pool subject identifier.

Key Concept

Integrating Amazon Cognito User Pools for API Gateway authentication and Cognito Identity Pools for S3 authorization.

Estimated Time:3m 0s

Question 139Question →

An AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function retrieves transaction data from an internal Amazon RDS database and must then send a confirmation request to an external, public HTTP API. The database connection is successful, but the external API call times out. Which network configuration change will resolve the timeout issue?

Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic (

0.0.0.0/0

) to the NAT Gateway.

Relocate the Lambda function to a public subnet of the VPC so that it can directly assign a public IP address to its elastic network interface (ENI).

Update the trust policy of the Lambda function's execution role to grant assume role permissions to the external API's domain.

Migrate the external API credentials from the Lambda function code to AWS Secrets Manager and create an interface VPC endpoint for Secrets Manager in the private subnet.

Show answer & explanation

Answer: Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic ( $0.0.0.0/0$ ) to the NAT Gateway.

Answer

Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic to the NAT Gateway.

For resources inside a private subnet to establish outbound connections to the internet, they must route traffic through a NAT Gateway. The NAT Gateway must be located in a public subnet and have a route from the private subnet's route table pointing

0.0.0.0/0

to it.

Step-by-Step Solution

Analyze the network route requirements.

The Lambda function needs to communicate internally with the Amazon RDS database and externally with a public API endpoint.

Establishing both private and public paths helps determine the required VPC components.

Select the correct translation gateway for private subnets.

A NAT Gateway must be provisioned in a public subnet of the VPC.

A NAT Gateway maps private IP addresses to a public IP to enable outbound communication with internet resources.

Configure the route table.

A route is added to the private subnet's route table directing destination traffic

0.0.0.0/0

to the NAT Gateway.

This instructs the VPC router to forward all outbound internet traffic from the private subnet through the NAT Gateway, resolving the connection timeout.

Key Concept

VPC Routing for Lambda Functions needing Public and Private Access

Estimated Time:55s

Question 140Question →

A developer is designing a containerized microservice on Amazon ECS that processes and stores sensitive customer profiles. During a compliance audit, the security team mandates that any profile larger than $4\text{ KB}$ must be encrypted before being written to an external database. The microservice must also retrieve and decrypt these profiles. Additionally, the database credentials used by the microservice must be rotated automatically every 30 days.

Which combination of AWS services and programmatic workflows should the developer implement to meet these requirements?

Store the database credentials in AWS Secrets Manager and configure automatic rotation. For customer profiles, implement client-side envelope encryption by calling the KMS GenerateDataKey API to obtain a plaintext data key and a ciphertext data key, encrypting the profile locally with the plaintext data key, and storing the ciphertext data key along with the encrypted profile.

Store the database credentials and customer profiles in AWS Systems Manager Parameter Store, and enable automatic parameter rotation. For customer profiles larger than

4\text{ KB}

, call the KMS Encrypt API directly to encrypt the profiles in a single API call before saving them.

Store the database credentials in AWS Secrets Manager and enable automatic rotation. For customer profiles, call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, use it to encrypt the profiles locally using a symmetric encryption library, and store the encrypted profile.

Store the database credentials in AWS KMS and enable automatic rotation of the Customer Managed Key. For customer profiles, call the KMS Encrypt API directly for profiles smaller than

4\text{ KB}

, and for profiles larger than

4\text{ KB}

, split the payload into

4\text{ KB}

chunks and call the Encrypt API for each chunk.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation. For customer profiles, implement client-side envelope encryption by calling the KMS GenerateDataKey API to obtain a plaintext data key and a ciphertext data key, encrypting the profile locally with the plaintext data key, and storing the ciphertext data key along with the encrypted profile.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation, and use client-side envelope encryption with the KMS GenerateDataKey API to encrypt and decrypt the large customer profiles.

The correct option correctly identifies AWS Secrets Manager for storing and automatically rotating database credentials. It also correctly specifies the client-side envelope encryption workflow using the KMS GenerateDataKey API to obtain both plaintext and ciphertext data keys, allowing the application to encrypt the large profile payload locally.

Step-by-Step Solution

Analyze the file size constraint and encryption method.

Since customer profiles exceed the

4\text{ KB}

(4096 bytes) payload limit of the KMS direct encryption APIs (such as Encrypt), client-side envelope encryption must be used.

Direct encryption with KMS is restricted to small data sizes, whereas envelope encryption allows encrypting data of any size locally using a data key generated by KMS.

Select the correct KMS API for generating the data key.

Call the GenerateDataKey API to receive both the plaintext data key and the ciphertext (encrypted) data key.

The application needs the plaintext key to encrypt the profile locally using a symmetric algorithm. GenerateDataKeyWithoutPlaintext only returns the ciphertext key, which cannot be used for encryption without an additional Decrypt call.

Determine the service and mechanism for credentials storage and rotation.

Store database credentials in AWS Secrets Manager and enable automatic rotation.

AWS Secrets Manager natively supports automatic rotation of database credentials, whereas AWS KMS manages cryptographic keys rather than credentials, and Systems Manager Parameter Store does not offer built-in automatic rotation.

Key Concept

AWS KMS envelope encryption and secrets rotation constraints

PreviousPage 7 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept