Security

390 questions

All types390 Multiple choice195 Multiple select195

A developer is implementing a security feature for a web application to encrypt sensitive transaction records using an AWS KMS customer managed key (CMK). During the `Encrypt` API call, the developer passes the transaction ID as part of the encryption context: `{"TransactionID": "TX-98765"}`. During a scheduled audit, an offline compliance service attempts to decrypt the transaction records using the AWS SDK. The service's IAM role has full permissions to call `kms:Decrypt` on the CMK, but the decryption requests fail with an `InvalidCiphertextException`. How should the developer resolve this issue?

Ensure that the compliance service includes the exact encryption context `{"TransactionID": "TX-98765"}` in its `Decrypt` API request.

Update the KMS key policy of the customer managed key to permit the compliance service to bypass the encryption context verification.

Store the encryption context value in AWS Systems Manager Parameter Store as a secure string and reference it in the service's IAM policy.

Call the `ReEncrypt` API to move the ciphertext to a different customer managed key that does not require an encryption context.

Show answer & explanation

Answer: Ensure that the compliance service includes the exact encryption context `{"TransactionID": "TX-98765"}` in its `Decrypt` API request.

Answer

Ensure that the compliance service includes the exact encryption context `{"TransactionID": "TX-98765"}` in its `Decrypt` API request.

The encryption context in AWS KMS acts as additional authenticated data (AAD) and is cryptographically bound to the ciphertext. To decrypt the data, the exact same encryption context (key-value pair) must be provided in the Decrypt API request. Without it, KMS cannot verify the integrity of the ciphertext and returns an InvalidCiphertextException.

Step-by-Step Solution

Analyze the error: `InvalidCiphertextException` when attempting to decrypt.

Identify that the key-value pair `{"TransactionID": "TX-98765"}` was provided as an encryption context during the `Encrypt` operation.

Any data encrypted with an encryption context requires the same context to be passed during decryption.

Review the API documentation for AWS KMS `Decrypt` operation.

Confirm that the `EncryptionContext` parameter must be supplied and match the one used during encryption.

The encryption context is bound as Additional Authenticated Data (AAD) to the ciphertext.

Configure the compliance service's decryption request to pass the `EncryptionContext` parameter.

The KMS `Decrypt` call succeeds, returning the plaintext record.

Matching the encryption context allows KMS to cryptographically authenticate and decrypt the payload.

Key Concept

AWS KMS Encryption Context behaves as Additional Authenticated Data (AAD) that must match exactly during decryption operations.

Question 162Question →

A company requires a developer to implement client-side encryption for sensitive application log files before uploading them to an Amazon S3 bucket. The log files range in size from $5\text{ MB}$ to $50\text{ MB}$ . The developer wants to minimize network overhead and ensure compliance by utilizing a customer managed key in AWS Key Management Service (AWS KMS) for envelope encryption. Which workflow should the developer implement to encrypt the log files?

Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.

Call the Encrypt API using the customer managed key, passing the raw log file payload in the request. Store the returned ciphertext file in the S3 bucket.

Call the GenerateDataKey API using the customer managed key to obtain a plaintext data key. Encrypt the log file locally using this key, and then store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString parameter to allow the decryption service to retrieve it.

Call the GenerateDataKey API by initializing an AWS SDK client that hardcodes the access keys of an IAM user who has permissions to use the customer managed key, encrypt the log file locally with the returned plaintext key, and upload the encrypted log file to S3.

Show answer & explanation

Answer: Call the GenerateDataKey API using the customer managed key to receive a plaintext data key and an encrypted data key. Encrypt the log file locally using the plaintext data key, delete the plaintext data key from memory, and upload the encrypted log file and the encrypted data key to the S3 bucket.

Answer

The correct workflow is to use envelope encryption. The developer calls the GenerateDataKey API, which utilizes the customer managed key to output a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the payload locally, after which it is deleted from memory. The encrypted data key is stored alongside the encrypted payload. This allows encryption of large objects without hitting the

4\text{ KB}

limit of KMS direct encryption operations and minimizes network overhead because the large payload is not sent to KMS.

Step-by-Step Solution

Invoke the GenerateDataKey API operation using the AWS SDK.

AWS KMS returns a plaintext data key and an encrypted data key (ciphertext).

This avoids sending the large payload to AWS KMS, overcoming the

4\text{ KB}

limitation of direct encryption API operations.

Encrypt the log file locally using the plaintext data key.

The log file is converted into ciphertext using a local symmetric encryption algorithm (such as AES-256).

Doing this locally minimizes network overhead and ensures the plaintext data never leaves the client environment.

Clean up memory and upload the artifacts to Amazon S3.

The plaintext data key is purged from memory. The encrypted log file and the encrypted data key are uploaded together to Amazon S3.

Removing the plaintext data key prevents unauthorized memory inspection, and keeping the encrypted data key with the file enables decryption later.

Key Concept

AWS KMS Envelope Encryption Workflow and Limits

Estimated Time:2m 0s

Question 163Question →

A developer has configured an AWS Lambda function to run inside private subnets of a VPC. The function needs to connect to an external, third-party payment gateway API on the public internet, but the connection attempts are failing due to timeouts. Which configuration change should the developer implement to allow the Lambda function to connect to the external API?

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound

0.0.0.0/0

traffic to the NAT Gateway.

Configure the private subnet's route table to route outbound

0.0.0.0/0

traffic directly to the VPC's Internet Gateway.

Update the trust policy of the Lambda function's IAM execution role to explicitly allow connections to the payment gateway API domain.

Store the payment gateway API URL in Systems Manager Parameter Store and enable automatic parameter rotation.

Show answer & explanation

Answer: Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound $0.0.0.0/0$ traffic to the NAT Gateway.

Answer

Deploy a NAT Gateway in a public subnet, and add a route in the private subnet's route table directing outbound traffic to the NAT Gateway.

The correct answer provides a valid network path for the Lambda function. Since the Lambda function is placed in a private subnet, it has no public IP address and cannot directly route traffic to an Internet Gateway. Deploying a NAT Gateway in a public subnet and routing the private subnet's outbound traffic to the NAT Gateway allows the Lambda function to reach public endpoints securely.

Step-by-Step Solution

Analyze the network requirements of the Lambda function.

The Lambda function is inside private subnets of a VPC and needs to access an endpoint on the public internet.

Since the Lambda is within a VPC private subnet, it lacks a path to the public internet by default.

Select the correct AWS VPC component to enable outbound-only internet connectivity.

A NAT Gateway must be deployed in a public subnet of the VPC.

A NAT Gateway translates private IP addresses to a public IP to facilitate outbound communication with the internet.

Update the routing configuration of the private subnet.

Add a route for

0.0.0.0/0

pointing to the NAT Gateway.

This ensures all internet-bound traffic from the Lambda function is correctly forwarded to the NAT Gateway.

Key Concept

Outbound internet connectivity for VPC-enabled Lambda functions requires a NAT Gateway and appropriate route table entries.

Estimated Time:1m 0s

Question 164Question →

A startup is deploying a secure REST API on Amazon API Gateway. External clients will authenticate using JSON Web Tokens (JWTs) issued by a third-party identity provider. The startup needs to implement an authorization solution at the API Gateway layer that validates the JWT, denies unauthorized access before invoking backend resources, and performs fine-grained authorization based on the user's subscription tier claim embedded in the JWT. The backend is an AWS Lambda function integrated using a Lambda custom integration (non-proxy). Which approach meets these requirements with the least operational complexity?

Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.

Configure an Amazon Cognito Identity Pool to authenticate the third-party tokens. In API Gateway, configure a Cognito User Pool authorizer to validate the incoming token, and rely on API Gateway to automatically forward the user claims in the integration request to the backend Lambda custom integration.

Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to append the subscription tier claim as a custom header in the API Gateway integration request. Configure the backend Lambda function to automatically retrieve this header from the handler's default event.headers payload.

Implement a Lambda custom authorizer to validate the JWT. Configure the authorizer to return an IAM policy that allows execute-api:Invoke on the backend Lambda function's ARN, and passes the subscription tier claim using the $stageVariables.subscriptionTier context variable.

Show answer & explanation

Answer: Implement a Lambda custom authorizer to validate the JWT and return an IAM policy allowing access to the API Gateway method along with a context map containing the subscription tier. Configure an API Gateway mapping template in the integration request to extract the value from $context.authorizer.subscriptionTier and pass it to the backend Lambda function.

Answer

The correct approach involves using a Lambda custom authorizer because it allows validating JWTs from external identity providers. The authorizer returns an IAM policy allowing the execute-api:Invoke action on the API Gateway method ARN, along with a context map. Since the backend Lambda function is integrated using a Lambda custom integration (non-proxy), we must use an API Gateway mapping template to extract the subscription tier metadata from the authorizer context using the $context.authorizer.subscriptionTier variable and pass it to the backend Lambda function payload.

Step-by-Step Solution

Select the appropriate authorizer type for third-party identity providers.

Lambda custom authorizer is chosen because built-in Cognito User Pool authorizers are designed for Amazon Cognito User Pools, not arbitrary third-party JWTs.

API Gateway needs to validate external JWTs and deny access before invoking the backend integration.

Define the IAM policy and context returned by the custom authorizer.

The Lambda custom authorizer returns an IAM policy targeting the execute-api:Invoke action on the API Gateway method ARN, along with a context map payload containing the subscription tier claim.

The authorizer must authorize the API Gateway execution path and pass custom validation metadata downstream.

Map the authorizer context payload to the backend Lambda custom integration.

An API Gateway mapping template is created for the integration request, mapping $context.authorizer.subscriptionTier to a property in the request payload.

Under Lambda custom integration (non-proxy), the backend does not automatically receive the raw API Gateway request or authorizer context. Thus, explicit mapping is required.

Key Concept

API Gateway custom Lambda authorizers evaluate external tokens, return IAM policies targeting API Gateway execution ARNs, and provide context metadata that must be mapped to custom integrations.

Question 165Question →

A developer is configuring security for a REST API in Amazon API Gateway. The API has two separate endpoints with different access control requirements:

1. The first endpoint must authenticate users using JSON Web Tokens (JWTs) from a Cognito User Pool.
2. The second endpoint must restrict access to specific IAM users and roles within the AWS account.

Which two configuration actions must the developer take to implement these security controls? (Select TWO.)

Select all that apply

Create a Cognito User Pool authorizer in API Gateway and associate it with the first endpoint.

Set the authorization type for the second endpoint to AWS_IAM in API Gateway.

Create a Cognito Identity Pool authorizer in API Gateway and associate it with the first endpoint.

Set the authorization type for the second endpoint to CUSTOM and attach an IAM policy to the API Gateway stage.

Configure a Lambda proxy integration on the first endpoint to automatically validate Cognito User Pool tokens.

Show answer & explanation

Answer: Create a Cognito User Pool authorizer in API Gateway and associate it with the first endpoint.; Set the authorization type for the second endpoint to AWS_IAM in API Gateway.

Answer

To secure the API, the developer must create a Cognito User Pool authorizer in API Gateway for the first endpoint and set the authorization type for the second endpoint to AWS_IAM.

The correct options are configuring a Cognito User Pool authorizer for the first endpoint and setting the authorization type to AWS_IAM for the second endpoint. A Cognito User Pool authorizer allows API Gateway to authenticate API calls using tokens from Amazon Cognito User Pools without needing custom Lambda authorizer code. Setting the authorization type to AWS_IAM ensures that callers must sign their requests with AWS credentials, allowing the developer to control access via IAM policies.

Step-by-Step Solution

Identify the authentication mechanism for the first endpoint.

The requirement specifies using Cognito User Pool JWTs. The native way to handle this in API Gateway is by creating a Cognito User Pool Authorizer.

This allows API Gateway to validate the token signature and expiration automatically before invoking the backend integration.

Identify the authentication mechanism for the second endpoint.

The requirement specifies restricting access to specific IAM users and roles. The native way to handle this in API Gateway is to set authorization to AWS_IAM.

This requires callers to sign their requests using AWS Signature Version 4, which API Gateway authenticates against IAM policies.

Key Concept

API Gateway supports native integration with Cognito User Pools using Cognito Authorizers, and native IAM authorization using AWS_IAM to restrict access to IAM identities.

Question 166Question →

An application running on Amazon ECS needs to decrypt sensitive customer configuration files that were previously encrypted using client-side envelope encryption with an AWS KMS customer managed key. The application has access to the encrypted files and the corresponding ciphertext data keys stored alongside them. Which TWO actions must the developer implement in the application code to retrieve the original configuration files?

Select all that apply

Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to obtain the plaintext data key.

Decrypt the configuration file locally using the plaintext data key and a symmetric decryption algorithm.

Call the Decrypt API operation of AWS KMS, passing the entire encrypted configuration file to AWS KMS.

Call the GenerateDataKey API operation of AWS KMS using the customer managed key to retrieve the plaintext decryption key.

Call the AWS Secrets Manager GetSecretValue API using the customer managed key identifier to fetch the stored plaintext data key.

Show answer & explanation

Answer: Call the Decrypt API operation of AWS KMS, passing the ciphertext data key to obtain the plaintext data key.; Decrypt the configuration file locally using the plaintext data key and a symmetric decryption algorithm.

Answer

To retrieve the original configuration files, the developer must call the Decrypt API operation of AWS KMS to decrypt the ciphertext data key, and then decrypt the configuration file locally using the resulting plaintext data key.

The correct solution involves calling the AWS KMS Decrypt API operation with the ciphertext data key to get the plaintext data key, and then using that key to decrypt the payload locally. This process separates key management from data processing, satisfying envelope encryption requirements.

Step-by-Step Solution

Retrieve the ciphertext data key that is stored alongside the encrypted configuration file.

The application has the encrypted data key ready for the API call.

The ciphertext data key must be decrypted by AWS KMS because only the KMS customer managed key can decrypt it.

Call the AWS KMS Decrypt API passing the ciphertext data key as a parameter.

AWS KMS returns the plaintext data key.

The application needs the plaintext data key in memory to perform the local decryption algorithm.

Perform local symmetric decryption of the configuration file using the plaintext data key.

The configuration file is returned to its original plaintext form.

Under client-side envelope encryption, actual data decryption is done by the client application to avoid sending large payloads over the network.

Key Concept

Client-side envelope decryption workflow using AWS KMS

Question 167Question →

An enterprise is deploying a REST API using Amazon API Gateway. The API will be accessed solely by internal server-to-server microservices running on Amazon EC2 instances within a private VPC. The security policy mandates that all communication must be encrypted, credentials must not be hardcoded in application code, and access must be restricted using IAM policies based on the principle of least privilege. Which configuration should a developer implement to secure the API Gateway with the least operational effort?

Enable AWS_IAM authorization on the API Gateway methods. Associate an IAM role with the EC2 instances that grants permissions for the `execute-api:Invoke` action, and configure the clients to sign their API requests using Signature Version 4.

Configure a Cognito User Pool Authorizer on the API Gateway methods. Use Amazon Cognito Identity Pools to exchange the EC2 instance role credentials for a JSON Web Token (JWT) to pass in the Authorization header.

Create a custom Lambda authorizer for the API Gateway methods. Write code within the Lambda authorizer to validate the Signature Version 4 signature of incoming requests against IAM policies before allowing access.

Set up the API Gateway integration as a Lambda proxy integration. Configure the backend Lambda function to inspect the raw request headers, extract the access key, and verify permissions against an IAM policy before returning a response.

Show answer & explanation

Answer: Enable AWS_IAM authorization on the API Gateway methods. Associate an IAM role with the EC2 instances that grants permissions for the `execute-api:Invoke` action, and configure the clients to sign their API requests using Signature Version 4.

Answer

Enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances granting the `execute-api:Invoke` action, and sign requests using Signature Version 4.

The correct option is to enable AWS_IAM authorization on the API Gateway methods, associate an IAM role with the EC2 instances, and configure the client to sign requests with Signature Version 4. This utilizes API Gateway's built-in capabilities to validate access using IAM roles without requiring custom authorization logic or external token providers, providing the least operational overhead.

Step-by-Step Solution

Select AWS_IAM as the authorization type on the target API Gateway resource methods.

API Gateway will now reject any requests to these methods that are not signed with valid AWS Signature Version 4 credentials.

This offloads authorization and credential validation entirely to AWS, eliminating the need to write custom verification logic.

Assign an IAM execution role (via an EC2 instance profile) to the EC2 instances running the microservices, and attach a policy permitting `execute-api:Invoke` on the API Gateway resource ARN.

The microservices can retrieve temporary security credentials from the EC2 instance metadata service.

This satisfies the requirement that credentials must not be hardcoded, adhering to IAM least-privilege principles.

Configure the microservice client applications to sign their outgoing HTTP requests to the API Gateway using AWS Signature Version 4 (SigV4) with the temporary credentials.

The requests are successfully authenticated and authorized by API Gateway.

SigV4 signing is required for any API Gateway method configured with AWS_IAM authorization.

Key Concept

AWS_IAM Authorization in API Gateway

Question 168Question →

A company is building an employee portal that allows users to access internal resources via an Amazon API Gateway REST API. The client application authenticates users directly using an Amazon Cognito User Pool. The developer needs to secure the API Gateway methods to ensure that only users authenticated by this Cognito User Pool can access the endpoints. The solution must minimize development effort and avoid unnecessary execution costs.

Which two of the following configuration steps must be performed in Amazon API Gateway to secure the API?

Select all that apply

Create a Cognito user pool authorizer in API Gateway by specifying the Amazon Cognito User Pool ARN and the token source header name.

Create a Cognito identity pool authorizer in API Gateway by specifying the Identity Pool ID and the token source header name.

Edit the Method Request settings for the API methods, select the Cognito authorizer as the Authorization type, and redeploy the API.

Create a custom Lambda authorizer that extracts the JSON Web Token (JWT) from the headers, verifies it using public keys, and returns an IAM policy.

Configure the integration request as a Lambda Proxy integration and implement code in the backend Lambda function to validate the JWT.

Show answer & explanation

Answer: Create a Cognito user pool authorizer in API Gateway by specifying the Amazon Cognito User Pool ARN and the token source header name.; Edit the Method Request settings for the API methods, select the Cognito authorizer as the Authorization type, and redeploy the API.

Answer

To secure the API natively using Cognito User Pools with the least overhead, the developer must create a Cognito user pool authorizer in API Gateway, link it to the Method Request settings for the API methods, and redeploy the API.

To secure the API with the minimum development and operational overhead, the developer should create a native Cognito User Pool authorizer by linking the Amazon Cognito User Pool ARN and the token source header name. The authorizer must then be assigned to the API's Method Request settings, followed by a redeployment of the API. This native validation does not require writing custom code and does not incur Lambda execution costs for the authorization layer.

Step-by-Step Solution

Create a Cognito user pool authorizer in the API Gateway configuration.

A native authorizer of type COGNITO is registered using the Cognito User Pool ARN and configured with a token header source (e.g., Authorization).

This establishes the validation connection between API Gateway and the Cognito User Pool so API Gateway can verify incoming JWT tokens.

Configure the API Gateway Method Request settings to use the Cognito authorizer.

The API Gateway method settings are updated to enforce authentication using the Cognito authorizer.

This binds the authorizer to specific endpoints and methods, preventing unauthenticated requests from passing through.

Deploy the API Gateway API to a stage.

The API configuration updates are applied to the active stage endpoint.

API Gateway requires an active deployment for configuration updates, including authorization settings, to become active for clients.

Key Concept

API Gateway integration with Amazon Cognito User Pools

Question 169Question →

A developer is designing a serverless backend using AWS Lambda that connects to an Amazon RDS for PostgreSQL database. The application security policy requires that database passwords be rotated automatically every 30 days. Additionally, the Lambda function needs to retrieve non-sensitive configuration parameters, such as logging levels and external API endpoints. Which combination of actions should the developer take to implement these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.

Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Store the database credentials in AWS Systems Manager Parameter Store as SecureString parameters and configure built-in automatic rotation.

Hardcode the database credentials directly within the Lambda function's handler initialization code to avoid API latency.

Store the non-sensitive configuration parameters in AWS Secrets Manager to centralize all secrets and configurations.

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.; Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Answer

Storing the database credentials in AWS Secrets Manager with built-in automatic rotation enabled, and storing the non-sensitive configurations in AWS Systems Manager Parameter Store as Standard parameters.

AWS Secrets Manager is designed for managing secrets such as database credentials and supports automated rotation out of the box, specifically with integrations for Amazon RDS. AWS Systems Manager Parameter Store is ideal for general, non-sensitive configuration parameters because Standard parameters are free, making it the most cost-effective choice for configurations that do not require rotation or encryption.

Step-by-Step Solution

Identify the storage and rotation requirements for the database credentials.

Database credentials are sensitive and require automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in rotation integration with Amazon RDS.

Parameter Store does not natively support automatic rotation, so using Parameter Store would require writing custom rotation logic.

Identify the storage and cost requirements for non-sensitive configurations.

Non-sensitive configurations (like logging levels) do not require rotation or encryption. Storing them in Parameter Store as Standard parameters is free and meets the cost-effectiveness requirement.

Storing non-sensitive config in Secrets Manager would incur unnecessary monthly costs per secret.

Key Concept

Distinguishing between AWS Secrets Manager and AWS Systems Manager Parameter Store features and cost profiles.

Question 170Question →

A developer is designing a secure mobile banking application. The application uses Amazon API Gateway for its backend REST APIs and stores user documents in an Amazon S3 bucket. The security requirements are:

1. Access to the API Gateway APIs must be restricted to authenticated users. The API Gateway must natively validate the users' JSON Web Tokens (JWTs) without invoking a custom function.
2. Users must be able to upload documents directly to their own folder within the S3 bucket using temporary AWS credentials, ensuring least-privilege access.

Which two configurations should the developer implement to meet these requirements?

Select all that apply

Configure an API Gateway Lambda Custom Authorizer to validate the JWT, then invoke AssumeRole against AWS STS to return temporary AWS credentials directly in the authorization context to S3.

Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.

Configure a Cognito Identity Pool as the primary API Gateway Authorizer, and use the Identity Pool client credentials to authenticate REST API calls via Lambda Proxy integration.

Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.

Create a Cognito User Pool and write an IAM policy that allows the User Pool client credentials to authenticate S3 API calls using KMS envelope encryption.

Show answer & explanation

Answer: Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.; Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.

Answer

To meet the requirements, the developer should configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate user tokens, and associate the Cognito User Pool with a Cognito Identity Pool to issue temporary AWS IAM credentials with policies that grant restricted folder access to the S3 bucket.

The correct configurations involve using a Cognito User Pool Authorizer to validate JWT tokens natively at the API Gateway level, and utilizing a Cognito Identity Pool in conjunction with the User Pool to provide authenticated users with temporary AWS IAM credentials. This enables secure, direct document uploads to specific S3 folders using IAM policies containing user identity variables.

Step-by-Step Solution

Configure the native authentication mechanism at API Gateway.

Create and deploy a Cognito User Pool Authorizer on the REST API methods. This offloads the token signature and expiration verification directly to API Gateway.

This meets the requirement of natively validating JWTs without writing and invoking custom Lambda functions.

Establish federated identity for AWS resource authorization.

Create an Amazon Cognito Identity Pool and configure the Cognito User Pool as an authentication provider.

This allows the client application to exchange the ID token received during user login for temporary AWS IAM credentials.

Enforce least-privilege direct access on the S3 bucket.

Attach an IAM policy to the Identity Pool's authenticated role that grants s3:PutObject permissions to paths matching the user's specific identity ID using the policy variable ${cognito-identity.amazonaws.com:sub}.

This allows authenticated mobile users to upload files directly to their personal folders on S3 without passing through backend servers, complying with the principle of least privilege.

Key Concept

Combining Cognito User Pools for native API Gateway authorization and Cognito Identity Pools for exchanging authentication tokens for temporary AWS credentials to access S3 directly under least privilege.

Estimated Time:2m 0s

Question 171Question →

A developer needs to encrypt a configuration file containing sensitive database credentials. The file size is $2\text{ KB}$ , and the developer decides to use direct encryption with an AWS Key Management Service (AWS KMS) customer managed key before uploading the file to Amazon S3. Which of the following actions must be taken to successfully encrypt this file? (Select TWO.)

Select all that apply

Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.

Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.

Call the `GenerateDataKey` API operation to perform client-side envelope encryption, as direct encryption is not supported for files smaller than

64\text{ KB}

Call the `GenerateDataKeyWithoutPlaintext` API operation to generate a plaintext data key for local file encryption.

Store the configuration file in AWS Systems Manager Parameter Store as a `SecureString` to automatically trigger direct KMS encryption on the file object.

Show answer & explanation

Answer: Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.; Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.

Answer

The configuration file can be encrypted by calling the KMS `Encrypt` API operation directly, and the application's IAM role must have the `kms:Encrypt` permission allowed in the customer managed key's key policy.

Direct encryption using the KMS `Encrypt` API operation is suitable for data payloads up to

4\text{ KB}

. To perform this action, the caller's IAM role must be granted permissions in the customer managed key's key policy.

Step-by-Step Solution

Determine the size of the payload to be encrypted.

The file size is

2\text{ KB}

, which is under the

4\text{ KB}

limit for direct KMS encryption.

Knowing the payload size helps determine whether direct encryption or envelope encryption is appropriate.

Verify key policy permissions.

Ensure the KMS key policy allows the IAM role to call `kms:Encrypt`.

KMS key policies must explicitly grant usage permissions even if the IAM policy allows it.

Perform the encryption using the SDK.

Call the `Encrypt` API with the plaintext payload and the key ID.

This generates the ciphertext directly without generating local data keys.

Key Concept

Direct encryption with AWS KMS using the Encrypt API operation is suitable for small payloads up to

4\text{ KB}

, provided that appropriate key policy permissions are configured.

Estimated Time:1m 30s

Question 172Question →

An application's secure ingestion service receives files and needs to prepare them for later encryption by a separate worker service running in a restricted environment. The ingestion service must generate an encrypted data key and store it alongside each file's metadata in a database. To minimize the attack surface, the security architecture requires that the ingestion service must never have access to the plaintext version of the data key. Which AWS KMS API operation should the developer call in the ingestion service to meet these requirements?

GenerateDataKeyWithoutPlaintext

GenerateDataKey

Encrypt

GetParameter

Show answer & explanation

Answer: GenerateDataKeyWithoutPlaintext

Answer

GenerateDataKeyWithoutPlaintext

The GenerateDataKeyWithoutPlaintext operation generates a unique symmetric data key under a specified KMS key and returns only the encrypted ciphertext representation of that data key. This prevents the ingestion service from exposing or holding the plaintext data key in memory, satisfying the security policy.

Step-by-Step Solution

Analyze the security constraints and envelope encryption requirements.

The ingestion service needs an encrypted data key to store but must not access the plaintext data key.

This determines the specific KMS API call needed to omit the plaintext data key from the response.

Identify the KMS API operation that generates data keys without returning the plaintext component.

GenerateDataKeyWithoutPlaintext is identified as the operation that returns only the ciphertext data key.

Unlike GenerateDataKey, which returns both plaintext and ciphertext, GenerateDataKeyWithoutPlaintext satisfies the zero-plaintext exposure constraint.

Key Concept

AWS KMS Envelope Encryption API operations

Question 173Question →

A developer is building a client-facing web application and needs to restrict access to a REST API hosted on Amazon API Gateway. The application's users will sign in using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints by validating the identity tokens issued to users upon login, with the least amount of development effort and custom code. Which authorization method should the developer configure on the API Gateway resources?

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Create a custom Lambda authorizer to parse and validate the JSON Web Token (JWT) issued by the User Pool.

Configure an Amazon Cognito Identity Pool authorizer to directly authenticate the API Gateway request.

Configure a Lambda proxy integration to manually inspect the user credentials in the incoming request body.

Show answer & explanation

Answer: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Answer

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Using the built-in Amazon Cognito User Pools authorizer is the most efficient method because Amazon API Gateway natively validates tokens issued by Amazon Cognito. This eliminates the need to develop, test, and maintain custom Lambda authorizer code, which minimizes development effort and operational overhead.

Step-by-Step Solution

Identify the authentication provider and the development constraints.

The application uses Amazon Cognito User Pools for user sign-in and token issuance, and requires token validation with the least development effort.

This establishes that we need a solution that integrates natively with Cognito User Pools tokens without custom code.

Evaluate API Gateway security integration types.

Amazon API Gateway offers a built-in Cognito User Pools authorizer that automatically validates the signature and expiration of Cognito JSON Web Tokens (JWTs).

Choosing a native authorizer avoids the need to write and maintain custom validation logic inside a Lambda function.

Key Concept

Built-in Cognito User Pools Authorizer in Amazon API Gateway

Question 174Question →

A developer is writing a backend application hosted on AWS Lambda that needs to decrypt a sensitive database connection string. The connection string was previously encrypted directly using an AWS KMS customer managed key (CMK). The Lambda function's IAM execution role has been granted permissions to use the key. Which AWS KMS API action must the developer invoke within the application code to retrieve the plaintext connection string?

Decrypt

GenerateDataKey

GetSecretValue

ReEncrypt

Show answer & explanation

Answer: Decrypt

Answer

Decrypt

The Decrypt API operation is the correct action to call because it decrypts ciphertext that was encrypted directly using an AWS KMS key, returning the decrypted plaintext to the application.

Step-by-Step Solution

Identify the source of encryption and the desired output.

The database connection string was encrypted directly using an AWS KMS customer managed key, and the application needs to retrieve the plaintext string.

This establishes that we are dealing with direct decryption of KMS ciphertext rather than local envelope encryption or retrieving a secret from a secret store.

Select the correct AWS KMS API operation for direct decryption.

The Decrypt operation is selected.

The Decrypt API operation takes ciphertext encrypted under a KMS key and returns the decrypted plaintext, which matches the application's requirement.

Key Concept

Direct decryption using AWS KMS API

Question 175Question →

A developer is deploying a microservice on Amazon ECS that processes sensitive configurations. A configuration file of size $150\text{ KB}$ is encrypted client-side using envelope encryption with an AWS KMS customer managed key (CMK). During deployment, the application container fails to start because it cannot decrypt the configuration file.

The current configuration is as follows:
- The `kms:Decrypt` permission is granted to the ECS task execution role.
- The application code attempts to decrypt the entire configuration file by calling the `kms:Decrypt` API directly with the encrypted file content.

Which combination of actions will resolve the decryption failure and allow the application to start up successfully?

Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass the entire encrypted configuration file to the `kms:Decrypt` API, and ensure that the payload size does not exceed the

40\text{ MB}

payload limit of the API.

Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Update the application code to call the `kms:Decrypt` API with the encrypted data key to retrieve the plaintext data key, and then decrypt the configuration file locally using the plaintext data key.

Retain the `kms:Decrypt` permission on the ECS Task Execution Role. Configure the application to use the Systems Manager Parameter Store to retrieve the plaintext KMS customer managed key at runtime, and decrypt the configuration file locally.

Show answer & explanation

Answer: Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

Answer

Associate the kms:Decrypt permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the kms:Decrypt API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

The correct answer correctly identifies that application code running inside an ECS container must use the ECS Task Role for runtime authorization to call KMS APIs. Additionally, in envelope encryption, the actual payload is encrypted locally with a data key, and only the encrypted data key is sent to AWS KMS for decryption. This bypasses the

4\text{ KB}

payload size limit of the `kms:Decrypt` API.

Step-by-Step Solution

Identify the correct IAM role for containerized application execution.

Determine that the ECS Task Role must be configured with `kms:Decrypt` permissions rather than the ECS Task Execution Role.

The ECS Task Execution Role is used by the ECS agent, not the application itself. The ECS Task Role is required for the application container to access AWS services at runtime.

Identify the limitations of the KMS Decrypt API.

Determine that the configuration file size of

150\text{ KB}

exceeds the

4\text{ KB}

size limit of the `kms:Decrypt` API.

Direct decryption using KMS is limited to small payloads under

4\text{ KB}

, necessitating envelope encryption.

Apply the correct envelope decryption workflow.

Update the code to send only the encrypted data key to KMS, receive the plaintext data key, and decrypt the file locally.

This is the standard envelope encryption pattern, which avoids sending large payloads over the network and bypasses API limits.

Key Concept

AWS KMS Envelope Decryption and ECS IAM Roles

Estimated Time:2m 0s

Question 176Question →

A developer is building a serverless integration service. An AWS Lambda function is configured to run inside a custom VPC to process sensitive data. The function must poll messages from an Amazon SQS queue, store the processed data in an Amazon Aurora PostgreSQL database located in a private database subnet, and send a confirmation payload to an external HTTP webhook API on the public internet.

Which two configurations are required to ensure the Lambda function has the necessary network paths and security settings?

Select all that apply

Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing

0.0.0.0/0

to a NAT Gateway located in a public subnet.

Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port

5432

from the Security Group associated with the Lambda function.

Configure the Lambda function to run in public subnets with an assigned public IP address to allow direct outbound access to the external webhook.

Create a Gateway VPC Endpoint for Amazon SQS and associate it with the route tables of the private subnets to allow private polling of SQS messages.

Modify the IAM trust policy of the Lambda function's execution role to allow the Amazon SQS service to assume the role and push messages directly to the function's execution context.

Show answer & explanation

Answer: Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing $0.0.0.0/0$ to a NAT Gateway located in a public subnet.; Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port $5432$ from the Security Group associated with the Lambda function.

Answer

Configure the Lambda function to run in private subnets with a route to a NAT Gateway, and configure the database's Security Group to allow inbound traffic from the Lambda function's Security Group.

To allow the Lambda function to connect to the private database, the database security group must authorize inbound traffic on port

5432

from the Lambda function's security group. To allow the function to reach the external HTTP webhook on the public internet, the Lambda function must run in private subnets with a route directing outbound traffic to a NAT Gateway in a public subnet.

Step-by-Step Solution

Analyze database connectivity requirements

The Lambda function needs to connect to Aurora PostgreSQL on port

5432

. The database's security group must authorize inbound traffic on port

5432

originating from the security group assigned to the Lambda function.

Security groups act as firewalls at the instance/resource level and must be configured for stateful communication.

Analyze internet connectivity requirements

The Lambda function needs to call an external webhook. A VPC-enabled Lambda function must be placed in private subnets with a route directing

0.0.0.0/0

to a NAT Gateway.

VPC-enabled Lambda functions do not receive public IP addresses and cannot connect directly to the internet from a public subnet.

Evaluate SQS connectivity requirements

SQS traffic can flow either via the NAT Gateway or through an Interface VPC Endpoint. SQS does not support Gateway VPC Endpoints.

Only Amazon S3 and DynamoDB support Gateway VPC Endpoints; all other supported services use Interface VPC Endpoints.

Key Concept

VPC networking configurations for AWS Lambda, including NAT Gateway routing, security groups, and VPC endpoint types.

Question 177Question →

A developer is securing a REST API hosted on Amazon API Gateway for a serverless application. External third-party partner systems must programmatically access this API using a machine-to-machine authentication flow. The partner systems do not have AWS accounts and support only the OAuth 2.0 Client Credentials grant flow. The developer wants to enforce authorization at the API Gateway layer with minimal custom code and low maintenance overhead. Which configuration should the developer implement?

Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.

Configure a Cognito Identity Pool to authenticate the partner systems using anonymous guest access. Grant the partner systems temporary AWS credentials to sign their requests using AWS Signature Version 4 (SigV4), and enable IAM authorization on the API Gateway methods.

Configure a Cognito User Pool with a resource server and client credentials. In API Gateway, create a custom Lambda authorizer that retrieves the JSON Web Key Set (JWKS) from Cognito, decodes and validates the signature of the incoming JWT access token, and returns an IAM policy. Configure the API method to use this Lambda authorizer.

Enable Lambda Proxy integration on API Gateway to forward the requests to a backend Lambda function. Within the backend Lambda function code, parse the Authorization header, extract the access token, and perform custom validation against client client_id and client_secret pairs stored in AWS Systems Manager Parameter Store.

Show answer & explanation

Answer: Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.

Answer

The correct configuration leverages Amazon Cognito User Pools with a Resource Server to support the OAuth 2.0 Client Credentials flow. External partner systems can obtain an access token and pass it to API Gateway. The built-in Cognito User Pool authorizer natively validates these access tokens and checks for the required custom scopes. This requires zero custom code and operates at the API Gateway layer, minimizing maintenance overhead and execution cost.

Step-by-Step Solution

Set up the Cognito User Pool acting as an OAuth 2.0 authorization server.

A Resource Server is defined in the Cognito User Pool with custom scopes representing API permissions. An App Client is created with the client credentials flow enabled.

This allows third-party clients to request OAuth 2.0 access tokens by authenticating directly with the Cognito token endpoint using client credentials, without needing AWS accounts or user logins.

Configure the Cognito Authorizer on Amazon API Gateway.

API Gateway is configured with a built-in Cognito User Pool authorizer pointing to the user pool.

This enables API Gateway to automatically fetch the JSON Web Key Set (JWKS) from Cognito, verify the token signatures, and extract the claims at the gateway level.

Apply the authorizer and custom scopes to the API methods.

The target API methods are associated with the Cognito Authorizer and the required custom scopes from the resource server.

This enforces that only requests presenting valid access tokens with the required scopes are authorized, filtering out unauthorized requests before they reach the backend integrations.

Key Concept

Using built-in Cognito User Pool authorizers with OAuth 2.0 Client Credentials flow for machine-to-machine API authorization.

Question 178Question →

A developer is configuring security for an Amazon API Gateway REST API that serves a client web portal. The portal users authenticate using an external, non-AWS identity provider that issues JSON Web Tokens (JWT). The developer wants to validate these tokens at the API Gateway boundary before requests are forwarded to a backend integration. Which API Gateway authorization method should the developer use to validate the tokens with the least operational complexity?

Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Configure an Amazon Cognito User Pool authorizer to validate the third-party JWT directly at the API Gateway level.

Configure an Amazon Cognito Identity Pool authorizer to validate the JWT and generate temporary AWS credentials to sign the request.

Configure a Lambda proxy integration and perform token validation inside the backend integration Lambda function.

Show answer & explanation

Answer: Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Answer

Configure a Lambda authorizer to validate the JWT directly against the external identity provider's public keys.

Configuring a Lambda authorizer allows API Gateway to call a custom Lambda function to validate bearer tokens (like JWTs) issued by any third-party identity provider. The function verifies the token signature against the provider's public keys and returns an IAM policy to allow or deny the request, securing the API at the boundary.

Step-by-Step Solution

Analyze the token source and type.

The token is a JSON Web Token (JWT) issued by an external, non-AWS identity provider.

Understanding the token source determines which native and custom integration options are compatible.

Evaluate native API Gateway authorizers.

Amazon Cognito User Pool authorizers cannot directly validate external JWTs without a Cognito User Pool wrapping them, and IAM authorization requires Signature Version 4 signatures.

This rules out native authorizers that require specific token issuers or request signing mechanisms.

Select the correct custom authorization method.

A Lambda authorizer (custom authorizer) is the appropriate choice as it runs custom code to validate external JWTs and return the required IAM policy.

Using a Lambda authorizer enforces security validation at the API Gateway boundary rather than letting unauthorized traffic reach backend integrations.

Key Concept

API Gateway Lambda Authorizers for external identity providers

Estimated Time:1m 30s

Question 179Question →

A developer is writing an AWS Lambda function that receives customer registration data payloads of approximately $50\text{ KB}$ each. The security policy requires this data to be encrypted client-side using a Customer Managed Key (CMK) in AWS KMS before it is written to an Amazon DynamoDB table. Which of the following steps must the developer perform to encrypt the payload and store it in DynamoDB? (Select TWO.)

Select all that apply

Call the GenerateDataKey API operation on AWS KMS using the Customer Managed Key to receive both a plaintext data key and an encrypted data key.

Encrypt the payload locally using the plaintext data key, store both the encrypted payload and the encrypted data key in the DynamoDB table, and erase the plaintext data key from memory.

Call the Encrypt API operation on AWS KMS directly, passing the entire

50\text{ KB}

payload and the Customer Managed Key identifier.

Call the GenerateDataKeyWithoutPlaintext API operation on AWS KMS to get an encrypted data key, decrypt the key locally using the AWS SDK offline utilities, and encrypt the payload.

Encrypt the payload locally using the plaintext data key, and store the plaintext data key in AWS Systems Manager Parameter Store with a secure string type for later decryption.

Show answer & explanation

Answer: Call the GenerateDataKey API operation on AWS KMS using the Customer Managed Key to receive both a plaintext data key and an encrypted data key.; Encrypt the payload locally using the plaintext data key, store both the encrypted payload and the encrypted data key in the DynamoDB table, and erase the plaintext data key from memory.

Answer

The developer must call the GenerateDataKey API operation to obtain the plaintext and encrypted data keys, encrypt the data locally, store the encrypted payload and the encrypted data key in DynamoDB, and immediately purge the plaintext data key from memory.

Because the payload (

50\text{ KB}

) is larger than the

4\text{ KB}

maximum allowed by the direct AWS KMS Encrypt API, envelope encryption is required. The developer calls GenerateDataKey to obtain both the plaintext data key (for local encryption) and the encrypted data key. After local encryption, the plaintext key is discarded from memory, and the encrypted data key is stored alongside the encrypted payload in DynamoDB.

Step-by-Step Solution

Determine the encryption strategy based on payload size.

Since the

50\text{ KB}

payload exceeds the

4\text{ KB}

direct encryption limit of AWS KMS, client-side envelope encryption must be used.

Direct KMS Encrypt/Decrypt APIs cannot handle payloads larger than

4096

bytes.

Request a data key from AWS KMS.

Invoke the GenerateDataKey API using the Customer Managed Key identifier to receive both the plaintext data key and the encrypted data key.

This provides the required cryptographic material for local encryption and safe storage of the key.

Encrypt the data locally and manage the keys.

Encrypt the data using the plaintext key, erase the plaintext key from memory, and write the encrypted payload along with the encrypted data key to DynamoDB.

This secures the payload client-side while ensuring the plaintext key is never stored, complying with security best practices.

Key Concept

KMS Client-Side Envelope Encryption and Payload Size Limits

Estimated Time:1m 30s

Question 180Question →

A developer is configuring security for a new REST API in Amazon API Gateway. The API must restrict access to only those clients who authenticate via an Amazon Cognito User Pool. Which of the following steps must the developer perform to implement this authorization? (Select TWO.)

Select all that apply

Create an Amazon Cognito User Pool authorizer in the API Gateway console.

Configure the API methods to use the Cognito User Pool authorizer in the Method Request settings.

Create a custom Lambda authorizer to manually decode and validate the JSON Web Tokens (JWTs) from the Cognito User Pool.

Configure an Amazon Cognito Identity Pool to authenticate users and generate temporary AWS IAM credentials for API Gateway.

Enable Lambda proxy integration and implement JWT validation logic inside the backend AWS Lambda function.

Show answer & explanation

Answer: Create an Amazon Cognito User Pool authorizer in the API Gateway console.; Configure the API methods to use the Cognito User Pool authorizer in the Method Request settings.

Answer

To configure authorization via a Cognito User Pool, the developer must create a Cognito User Pool authorizer in API Gateway and update the Method Request settings of the API methods to use this authorizer.

To authenticate API clients against an Amazon Cognito User Pool natively, the developer must first define a Cognito User Pool authorizer at the API Gateway level. Once the authorizer is defined, the developer must configure the specific REST API methods to use this authorizer under Method Request settings, ensuring that incoming requests are automatically validated.

Step-by-Step Solution

Create the Amazon Cognito User Pool authorizer.

The authorizer is successfully configured and linked to the target Amazon Cognito User Pool.

This registers the User Pool with API Gateway so it can perform token verification.

Update the API method settings.

The method's authorization is set to the newly created Cognito authorizer.

This ensures that API Gateway actively protects the method, requiring clients to provide a valid token.

Key Concept

Amazon API Gateway Cognito User Pool Authorizer

PreviousPage 9 / 20Next

Security

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept