Examkin

Tüm alıştırma soruları

1473 soru

Tüm türler1,473Çoktan seçmeli755Çoklu seçim693Eşleştirme25
Soru 141Soru →

An aerospace manufacturing firm is evaluating its cloud migration strategy for two specific workloads:

* Workload 1: A customized commercial off-the-shelf (COTS) HR system that is nearing its license expiration. The company has decided to retire the system and purchase a subscription to a cloud-hosted Software-as-a-Service (SaaS) platform, migrating their active user records to the new SaaS platform.
* Workload 2: A proprietary Java application running on an on-premises web server. The engineering team plans to migrate the application to AWS by containerizing it and hosting it on AWS App Runner to reduce runtime management tasks. The application code will remain unchanged, but the team will adjust the application's configuration to use environment variables for database connections.

Which of the following migration strategies describe the planned paths for Workload 1 and Workload 2? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Repurchasing for Workload 1; Replatforming for Workload 2

Cevap

Repurchasing for Workload 1 and Replatforming for Workload 2
The correct choices are Repurchasing for Workload 1 and Replatforming for Workload 2. Repurchasing is the process of moving from a legacy or commercial off-the-shelf (COTS) license model to a cloud-based Software-as-a-Service (SaaS) subscription model. Replatforming involves modifying the deployment platform (e.g., containerizing it for a managed service like AWS App Runner) to gain benefits like reduced administrative overhead, without modifying the application's core code architecture.

Adım Adım Çözüm

1
Analyze the migration plan and target destination for Workload 1.
Workload 1 is a commercial off-the-shelf (COTS) HR system that is being retired in favor of a subscription to a cloud-hosted SaaS platform.
Moving from an existing licensed application to a different cloud-hosted product (typically SaaS) is the definition of the Repurchasing strategy.
2
Analyze the migration plan and target destination for Workload 2.
Workload 2 is a Java application being containerized and moved to AWS App Runner without changing its core application code.
Deploying the workload to a managed container service to eliminate OS-level maintenance without altering its core architecture represents the Replatforming strategy (lift-tinker-and-shift).
3
Synthesize the findings to match the options.
The correct strategies are Repurchasing for Workload 1 and Replatforming for Workload 2.
This accurately reflects the chosen pathways for both workloads.

Anahtar Kavram

Cloud migration strategies (6 Rs)
Tahmini Süre:2m 0s
Soru 142Soru →

A company is setting up a new multi-department environment on AWS. The security team is defining identity and access management policies for corporate employees, applications running on Amazon EC2 instances, and administrative workflows. Which of the following are recommended AWS IAM best practices for managing access for these entities? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Assign IAM roles to Amazon EC2 instances instead of storing long-term AWS access keys within the application code.; Use AWS IAM Identity Center to federate employee identities from the company's existing identity provider for console access.

Cevap

Assigning IAM roles to Amazon EC2 instances to avoid storing hardcoded credentials, and using AWS IAM Identity Center to federate employee identities from an existing identity provider.
The correct practices are to assign IAM roles to EC2 instances so applications can access resources using temporary security credentials, and to use AWS IAM Identity Center to federate employee identities from an existing identity provider. This aligns with the principle of least privilege and avoids managing long-term static credentials.

Adım Adım Çözüm

1
Analyze the credentials requirement for applications running on Amazon EC2 instances.
Identify that applications should use temporary credentials retrieved dynamically using IAM roles, rather than storing long-term credentials in the code.
This reduces the risk of credential exposure and complies with AWS security best practices.
2
Analyze the credentials requirement for corporate employee login access.
Identify that centrally managed single sign-on using AWS IAM Identity Center federated with the existing identity provider is the recommended approach.
Federation enables centralized administration, enforces security controls like MFA, and eliminates the need to manage separate long-term IAM users.

Anahtar Kavram

AWS IAM best practices for managing credentials and access for applications and human users
Tahmini Süre:1m 30s
Soru 143Soru →

A healthcare provider is planning to migrate its applications to the AWS Cloud. The migration team has decided on the following plans for two of their systems:

- The patient scheduling application's server VMs will be moved to Amazon EC2 without changes, but its backend relational database will be migrated from a self-managed on-premises server to Amazon Aurora to reduce operational overhead without modifying the application's core code.
- The legacy custom document management system will be decommissioned, and its capabilities will be fully replaced by a third-party software-as-a-service (SaaS) solution purchased through AWS Marketplace.

Which of the following migration strategies are represented in this plan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Replatforming; Repurchasing

Cevap

The correct strategies are Replatforming and Repurchasing.
The correct answers are Replatforming and Repurchasing. Moving the database from an on-premises self-managed server to a managed service like Amazon Aurora without altering the core application code represents Replatforming. Decommissioning the custom legacy document management system and replacing it with a third-party SaaS product from AWS Marketplace represents Repurchasing.

Adım Adım Çözüm

1
Analyze the migration plan for the patient scheduling application.
The database is migrated to Amazon Aurora to reduce administrative overhead while the core code remains unchanged.
This corresponds to Replatforming (lift, tinker, and shift), where the database is optimized using a managed service without rewriting the core application.
2
Analyze the migration plan for the legacy document management system.
The legacy custom system is decommissioned and replaced by a third-party SaaS product purchased from AWS Marketplace.
This corresponds to Repurchasing (drop and shop), where an application is discarded in favor of a commercially available SaaS platform.

Anahtar Kavram

Understand the 6 Rs cloud migration strategies: Rehosting, Replatforming, Refactoring, Repurchasing, Retaining, and Retiring.
Soru 144Soru →

A gaming company is designing a global multiplayer game backend on AWS. The backend must handle highly volatile traffic spikes, process game logs for analytics, and update player profiles without causing game-play interruption if any downstream reporting service experiences an outage. The engineering team wants to strictly adhere to the AWS Cloud design principles of loose coupling and elasticity. Which of the following design choices should the company implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Implement an Amazon EventBridge event bus to route game events asynchronously to decoupled downstream services, such as analytics and leaderboards.; Deploy the game session manager using an Auto Scaling group of Amazon EC2 instances that scales dynamically based on real-time player connection metrics.

Cevap

Implementing an Amazon EventBridge event bus to route game events asynchronously to decoupled downstream services, and deploying the game session manager using an Auto Scaling group of Amazon EC2 instances that scales dynamically based on real-time player connection metrics.
The correct design choices are routing events asynchronously via Amazon EventBridge and scaling the session manager dynamically with an Auto Scaling group. Asynchronous routing decouples independent components so that a failure in one does not cascade. Dynamic scaling ensures elasticity by automatically provisioning resources to match real-time demand.

Adım Adım Çözüm

1
Analyze the architectural requirements for loose coupling to prevent downstream outages from disrupting the main gameplay loop.
Determine that communication between the core game session manager and downstream services (analytics and leaderboards) must be asynchronous and event-driven.
Asynchronous routing prevents cascading failures and decouples the services, satisfying the loose coupling principle.
2
Analyze the architectural requirements for elasticity to handle volatile traffic spikes efficiently.
Determine that compute resource capacity must scale dynamically in response to real-time load, rather than using fixed pre-provisioned assets.
Dynamic scaling aligns resource consumption and costs with actual demand, satisfying the elasticity principle.
3
Evaluate the choices to identify correct implementations and eliminate anti-patterns.
Identify Amazon EventBridge asynchronous routing and Auto Scaling group deployment as correct answers. Monolithic consolidation, synchronous writes, and fixed-capacity fleets are flagged as violations of AWS design principles.
This isolates the options that demonstrate loose coupling and elasticity.

Anahtar Kavram

AWS Cloud Design Principles: Loose Coupling and Elasticity
Soru 145Soru →

A healthcare provider wants to migrate its legacy on-premises billing system to the AWS Cloud. During the planning phase, the IT team decides to discard the existing custom-built software and instead subscribe to a fully managed, equivalent Software as a Service (SaaS) application available on the AWS Marketplace. Which cloud migration strategy does this decision represent?

Cevabı ve açıklamayı göster

Cevap: Repurchasing

Cevap

Repurchasing
Repurchasing (also known as drop-and-shop) is the strategy where a company decides to abandon its legacy system and purchase a commercial Software as a Service (SaaS) platform, often from the AWS Marketplace, to replace it.

Adım Adım Çözüm

1
Analyze the migration scenario described in the stem.
The company is abandoning its custom-built billing software and replacing it with a fully managed SaaS application from the AWS Marketplace.
Understanding the core actions of the migration helps classify it under one of the 6 Rs migration strategies.
2
Compare the scenario against the definitions of the 6 Rs migration strategies.
Repurchasing is defined as moving to a different product, typically a SaaS model, and retiring the existing system.
This matches the decision to discard the custom software and subscribe to an equivalent SaaS solution.

Anahtar Kavram

Repurchasing migration strategy
Tahmini Süre:45s
Soru 146Soru →

A municipal transit authority plans to migrate its legacy on-premises customer ticketing database to the AWS Cloud. The database currently runs on a self-managed PostgreSQL engine. To reduce operational overhead associated with patching, backups, and operating system maintenance without altering the application code or schema, the authority decides to migrate the database to Amazon Relational Database Service (Amazon RDS) for PostgreSQL. Which migration strategy is this organization employing?

Cevabı ve açıklamayı göster

Cevap: Replatforming

Cevap

Replatforming
Replatforming is the correct migration strategy because it involves taking an existing application and moving it to the cloud while introducing some level of optimization, such as using a managed service like Amazon RDS, without modifying the underlying application architecture.

Adım Adım Çözüm

1
Analyze the migration scenario details.
The transit authority is migrating an existing PostgreSQL database to Amazon RDS for PostgreSQL to reduce management tasks while keeping application code and database schema unchanged.
This establishes that the core code is not being rewritten (eliminating refactoring) and the software is not being replaced by a third-party SaaS solution (eliminating repurchasing).
2
Compare the action taken to the definitions of Rehosting and Replatforming.
Moving to Amazon RDS introduces a platform change (from self-managed to AWS-managed) to optimize operations, which is the definition of Replatforming (lift-tinker-and-shift). Rehosting would mean running the database on Amazon EC2 with no operational optimizations to the platform itself.
This confirms Replatforming as the correct strategy.

Anahtar Kavram

Replatforming Migration Strategy
Tahmini Süre:1m 0s
Soru 147Soru →

A healthcare technology company is deploying a serverless application that processes patient health records. The architecture consists of an HTTPS endpoint hosted on Amazon API Gateway, custom backend logic running in AWS Lambda, and patient data stored in Amazon DynamoDB. Under the AWS Shared Responsibility Model, which two security and operational tasks are the responsibility of the customer? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables; Defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda

Cevap

Configuring IAM execution roles and resource-based policies to restrict access between the Lambda functions and DynamoDB tables, and defining authorization mechanisms in API Gateway and securing the custom application code deployed in Lambda.
For serverless services like AWS Lambda, Amazon DynamoDB, and Amazon API Gateway, AWS assumes responsibility for the entire infrastructure stack, including physical hardware, OS patching, runtime environments, and virtualization. The customer remains responsible for data classification, configuring Identity and Access Management (IAM) execution roles and access policies, API Gateway authorization configurations, and securing the custom application code deployed to the environment.

Adım Adım Çözüm

1
Analyze the service models of the resources in the scenario.
Amazon API Gateway, AWS Lambda, and Amazon DynamoDB are fully managed, serverless (Platform as a Service) resources.
Under the Shared Responsibility Model, the boundary between customer and AWS duties shifts depending on the service category.
2
Identify AWS responsibilities for serverless resources.
AWS is responsible for physical security, hardware management, hypervisor security, operating system patching, and runtime updates.
These lower-level infrastructure tasks are fully managed and abstracted away from the customer in serverless offerings.
3
Identify customer responsibilities for serverless resources.
The customer is responsible for configurations, identity and access control (IAM), client-side encryption, API Gateway authentication, and writing secure application code.
Even in a fully managed model, the customer must control access to their data and secure the application logic.
4
Match the options to the correct responsibility boundaries.
Configuring IAM roles and setting up API authorization/securing application code are customer duties, whereas patching container runtimes, physical disk security, and hypervisor management are AWS duties.
This separates customer actions (security in the cloud) from AWS actions (security of the cloud).

Anahtar Kavram

Shared Responsibility Model for Serverless Services
Soru 148Soru →

A financial services company is planning to migrate a core application to the AWS Cloud. The application experiences predictable spikes in demand during the first three days of each month, requiring ten times the standard compute capacity. Under their current on-premises model, the company must maintain hardware provisioned for these peak loads, leading to high capital expenditures and underutilized servers for the rest of the month.

Which of the following AWS Cloud benefits directly address these operational and financial challenges? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Trading fixed expense for variable expense, allowing the company to pay only for the resources they consume instead of investing heavily in data centers and servers.; Stopping guessing capacity, ensuring the company can scale up automatically to meet the monthly three-day demand peak and scale back down during quiet periods.

Cevap

The correct benefits are trading fixed expense for variable expense and stopping guessing capacity.
The correct answers are the options describing 'Trading fixed expense for variable expense' and 'Stopping guessing capacity'. Shifting from fixed to variable expenses allows the business to pay only for resources when they are actually consumed rather than investing in physical infrastructure upfront. Stopping guessing capacity allows the company to automatically scale up to handle the month-end demand spikes and scale down during the rest of the month, eliminating resource waste.

Adım Adım Çözüm

1
Analyze the financial challenge in the scenario.
The company has high capital expenditures due to purchasing upfront physical hardware.
Identifying the root financial inefficiency is necessary to map it to the corresponding AWS benefit.
2
Map the financial challenge to the AWS Cloud benefit.
The benefit is 'trading fixed expense for variable expense' (or capital expense to variable operating expense).
This benefit directly replaces large upfront hardware investments with pay-as-you-go pricing.
3
Analyze the operational challenge in the scenario.
The company must provision for peak capacity, leading to severe resource underutilization for 90% of the month.
Identifying the capacity management inefficiency is necessary to map it to the corresponding AWS benefit.
4
Map the operational challenge to the AWS Cloud benefit.
The benefit is 'stopping guessing capacity'.
This benefit uses elasticity to scale up automatically during the 3-day spike and scale down afterward, eliminating underutilized idle capacity.

Anahtar Kavram

The benefits of AWS Cloud computing, specifically trading fixed expense for variable expense and stopping guessing capacity.
Tahmini Süre:2m 0s
Soru 149Soru →

A company is using Amazon DynamoDB to store application data. Under the AWS Shared Responsibility Model, which of the following tasks is the responsibility of the customer?

Cevabı ve açıklamayı göster

Cevap: Configuring Identity and Access Management (IAM) policies to control database access

Cevap

Configuring Identity and Access Management (IAM) policies to control database access
Configuring Identity and Access Management (IAM) policies to control database access is the correct answer. Under the Shared Responsibility Model, the customer is always responsible for managing access to their data and configuring permissions, regardless of whether the service is managed or unmanaged.

Adım Adım Çözüm

1
Identify the AWS service type in the scenario.
Amazon DynamoDB is a fully managed NoSQL database service (PaaS/Managed service).
The level of customer responsibility depends on whether the service is Infrastructure as a Service (IaaS) like Amazon EC2, or a managed service (PaaS) like Amazon DynamoDB.
2
Determine the boundary of responsibility for a managed database service.
AWS handles the physical security, hardware infrastructure, virtualization layer, operating system, and database engine software. The customer is responsible for data classification, encryption settings, and resource access control.
Applying the Shared Responsibility Model rules for managed services.
3
Evaluate the choices to identify the task that falls under the customer's control.
Configuring access policies using IAM is managed by the customer, whereas OS patching, hardware replacement, and physical security are managed by AWS.
Select the option that represents a customer responsibility.

Anahtar Kavram

Under the AWS Shared Responsibility Model, for managed services like Amazon DynamoDB, AWS handles the infrastructure layers including database software patching, operating system maintenance, and hardware management. The customer remains responsible for configuration tasks, such as managing access controls (IAM) and securing their data.
Tahmini Süre:45s
Soru 150Soru →

A software development company is migrating its monolithic API to a serverless architecture using AWS Lambda. As part of this transition, the security team is defining operational tasks under the AWS Shared Responsibility Model. Which of the following tasks remains the sole responsibility of the customer when deploying code to AWS Lambda?

Cevabı ve açıklamayı göster

Cevap: Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions

Cevap

Configuring the IAM execution roles and resource-based policies that control access to the Lambda functions
For serverless services like AWS Lambda, AWS manages the underlying physical infrastructure, virtualization layer, operating systems, and runtimes. The customer is responsible for writing secure application code and managing access control, which includes defining IAM execution roles and configuring resource-based policies to govern function access.

Adım Adım Çözüm

1
Analyze the service model of AWS Lambda
AWS Lambda is a serverless (PaaS/managed) compute service.
Understanding the service type helps define the boundary of responsibility; serverless services shift more infrastructure management tasks (like OS patching and runtime maintenance) to AWS.
2
Differentiate between customer and AWS responsibilities for Lambda
AWS manages the physical security, hardware, virtualization layer, operating system, and runtime. The customer manages application code, data, and access permissions (IAM).
This allows identifying which of the options represents a task that is managed by the customer ('security in the cloud') vs AWS ('security of the cloud').

Anahtar Kavram

Shared Responsibility Model for Serverless Services
Soru 151Soru →

A company needs to grant a newly hired security analyst access to the AWS Management Console to audit resource configurations. The analyst requires their own permanent credentials to log in. Which IAM entity should the administrator create to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: An IAM user

Cevap

An IAM user
An IAM user represents a person or service that requires permanent credentials to interact with AWS, making it the correct entity for a new employee requiring long-term console access.

Adım Adım Çözüm

1
Identify the requirement for permanent, individual console login credentials.
Determine that the employee needs a unique identity with persistent login credentials.
This helps select the appropriate credential type in AWS IAM.
2
Compare AWS IAM entities to identify the correct resource.
An IAM user provides the long-term credentials (password and access keys) needed for direct console login.
IAM roles are for temporary credentials, and root accounts should not be used for daily tasks.

Anahtar Kavram

IAM Users vs. IAM Roles and Credentials Best Practices
Tahmini Süre:45s
Soru 152Soru →

A gaming company needs to perform daily stress testing on a replica of their production environment. Instead of keeping a dedicated test environment running constantly, the team uses infrastructure as code (IaC) to dynamically provision a complete, identical copy of their environment every morning, run the automated tests, and terminate all resources at the end of the day. Which AWS Cloud design principle is this team implementing to optimize their testing process?

Cevabı ve açıklamayı göster

Cevap: Treating servers as disposable resources

Cevap

Treating servers as disposable resources
The correct answer is treating servers as disposable resources. In cloud computing, you can instantiate resources on demand, use them for the duration of a task, and then terminate them immediately. Using infrastructure as code (IaC) to dynamically deploy and tear down identical copies of production environments for testing is a primary example of this principle, preventing costs associated with running idle environments.

Adım Adım Çözüm

1
Analyze the scenario details: the team provisions replicas daily using infrastructure as code (IaC) and terminates them at the end of the day.
Identified that the servers and environments are temporary and easily replaceable.
Understanding the lifecycle of the provisioned resources helps link the practice to a specific AWS design principle.
2
Map the practice of creating and destroying temporary environments to the core AWS Cloud design principles.
Determined that treating servers as temporary, replaceable assets represents the 'disposable resources' design principle.
This mapping identifies the correct architectural principle being applied in the scenario.

Anahtar Kavram

Treating servers as disposable resources
Tahmini Süre:1m 0s
Soru 153Soru →

A software development team creates a new testing environment on AWS for every code deployment. The environment, consisting of several virtual servers and a database, is created automatically using a script, used to run automated tests, and then completely deleted as soon as the tests are completed. Which AWS Cloud design principle is directly demonstrated by this workflow?

Cevabı ve açıklamayı göster

Cevap: Disposable resources

Cevap

Disposable resources, which involves treating computing infrastructure as temporary assets that are dynamically provisioned for a task and terminated immediately when finished.
The scenario describes a workflow where resources are dynamically created for a specific purpose (testing) and then completely destroyed immediately afterward. This directly aligns with the AWS Cloud design principle of 'disposable resources', which encourages treating servers and databases as temporary assets rather than permanent, static infrastructure.

Adım Adım Çözüm

1
Analyze the lifecycle of the infrastructure described in the scenario.
The virtual servers and databases are created automatically by a script, used for testing, and completely deleted immediately after.
Understanding the timeline and purpose of the resources helps identify which design principle is being put into practice.
2
Evaluate the AWS Cloud design principles against the observed resource lifecycle.
The practice of treating infrastructure as temporary and easily replaceable rather than permanent aligns with 'disposable resources'.
This matches the definition of disposable resources, where components are launched, used, and discarded programmatically.

Anahtar Kavram

Disposable resources
Soru 154Soru →

A company plans to migrate its legacy on-premises web application to AWS. The primary goals are to minimize the operational overhead associated with infrastructure maintenance and to ensure the application remains highly available and resilient to individual hardware failures. Which of the following architectural actions align with these AWS Cloud design principles? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy the application across multiple Availability Zones and configure an Elastic Load Balancer to distribute traffic.; Replace self-managed relational databases on virtual servers with fully managed database services like Amazon RDS.

Cevap

Deploying the application across multiple Availability Zones with an Elastic Load Balancer, and replacing self-managed databases with Amazon RDS.
Deploying the application across multiple Availability Zones with an Elastic Load Balancer ensures that the architecture is resilient to localized infrastructure failures (design for failure). Replacing self-managed databases with Amazon RDS shifts administrative operational tasks such as software patching, OS updates, and physical backups to AWS (services, not servers).

Adım Adım Çözüm

1
Analyze the requirements to reduce operational maintenance overhead and ensure high availability against hardware failures.
Identify that the system should utilize managed services and built-in redundancy across different physical locations.
This points directly to 'services, not servers' (managed services) and 'design for failure' (redundancy across Availability Zones).
2
Evaluate the design options to select those that implement managed database features and high-availability load balancing.
Amazon RDS manages database operations, and multi-AZ deployment with Elastic Load Balancing automatically routes traffic away from failed zones.
Both options implement the cloud design principles requested.
3
Check the remaining options for anti-patterns or incorrect mappings under the AWS Shared Responsibility Model.
Eliminate single-instance consolidation (single point of failure), fixed-capacity sizing (lacks elasticity), and physical data center auditing (AWS responsibility).
These choices represent bad architectural practices or operational misunderstandings.

Anahtar Kavram

AWS Cloud Design Principles (Design for Failure, Services not Servers, Elasticity)
Soru 155Soru →

A developer using an IAM user in a development account (Account A) requires temporary access to perform administrative tasks on an Amazon DynamoDB table located in a production account (Account B). To adhere to AWS security best practices and the principle of least privilege, which of the following configuration steps must be implemented? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In the production account (Account B), create an IAM role with a trust policy that allows the IAM user in the development account (Account A) to assume the role.; In the development account (Account A), attach an identity-based policy to the developer's IAM user that allows the sts:AssumeRole action targeting the role in Account B.

Cevap

To establish secure cross-account access, you must create an IAM role in the production account (Account B) with a trust policy that permits the development account user to assume it, and attach an identity-based policy in the development account (Account A) allowing the user to call the sts:AssumeRole action on the production role.
The correct steps require establishing trust between the two accounts using an IAM role and granting the user permissions to assume that role. Creating an IAM role in the destination account with a trust policy defines who can assume the role. Attaching an identity-based policy in the source account allowing the sts:AssumeRole action gives the source user the ability to request the role's temporary credentials. This combination enables secure cross-account access without using permanent credentials.

Adım Adım Çözüm

1
Configure trust in the target account
An IAM role is created in the production account (Account B) with a trust policy specifying the AWS account ID or specific IAM user ARN of the development account (Account A) as the trusted principal.
This establishes that the production account trusts the development account's identity to assume the role.
2
Grant delegation permission in the source account
An IAM policy is attached to the IAM user or group in the development account (Account A) containing an 'Allow' effect for the 'sts:AssumeRole' action on the target role's ARN.
This permits the IAM user in Account A to execute the API call required to assume the role and retrieve temporary credentials.

Anahtar Kavram

Cross-account access delegation using IAM roles and temporary security credentials
Soru 156Soru →

A startup has five developers who all need the same administrative permissions to manage Amazon EC2 resources. According to AWS security best practices, which of the following is the most efficient way to manage these permissions?

Cevabı ve açıklamayı göster

Cevap: Create an IAM group, attach the required IAM policy to the group, and add the developer users to the group.

Cevap

Creating an IAM group, attaching the required policy to the group, and adding the users to the group is the recommended method to manage collective permissions.
Creating an IAM group and attaching the required policy to it is the AWS-recommended best practice for managing permissions for multiple users with the same job function. This centralized approach simplifies permission updates and ensures that new developers can quickly inherit the required permissions by simply being added to the group.

Adım Adım Çözüm

1
Analyze the scenario requirements.
Five developers require identical administrative permissions to manage Amazon EC2 resources.
To apply AWS security best practices efficiently, we need a method that scales and maintains individual user accountability.
2
Evaluate IAM features for collective permission management.
Using an IAM group allows policies to be attached once and applied to all member users.
This is the standard, secure, and low-maintenance approach recommended by AWS.

Anahtar Kavram

AWS IAM Groups and Permission Management
Soru 157Soru →

A gaming company has a mobile application that needs to securely write game state files to an Amazon S3 bucket. Millions of players will use this application, and they must not have permanent AWS credentials embedded in the app code. Which approach should the company use to grant this access?

Cevabı ve açıklamayı göster

Cevap: Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.

Cevap

Authenticate users through a public identity provider and assume an IAM role to obtain temporary security credentials.
The correct approach is to authenticate users via a public identity provider and assume an IAM role. This leverages web identity federation, allowing mobile users to obtain temporary, limited-privilege security credentials to access Amazon S3 without embedding permanent access keys in the application binary.

Adım Adım Çözüm

1
Analyze the requirement of providing access to millions of external mobile application users without embedding static credentials.
Eliminate solutions involving long-term access keys or static IAM user credentials.
Embedding static keys in client-side applications exposes them to extraction.
2
Identify the AWS mechanism designed for providing temporary credentials to external users.
Select IAM roles as the mechanism to provide temporary security credentials.
IAM roles provide short-lived, auto-rotating credentials.
3
Determine how external mobile users can be authenticated before assuming the role.
Use web identity federation with an OIDC-compatible identity provider.
This allows external users to authenticate using existing identity providers (like Google or Amazon) to assume the role.

Anahtar Kavram

Temporary security credentials via IAM roles and web identity federation
Tahmini Süre:2m 0s
Soru 158Soru →

A media streaming platform hosts its user profile service on AWS. The application is designed to store user session state locally in the memory of the individual Amazon EC2 instances that host the service. An Auto Scaling group automatically scales the number of EC2 instances out or in based on traffic demand. During off-peak hours, when the Auto Scaling group terminates underutilized instances, active users whose sessions were hosted on those specific instances are suddenly logged out and lose their progress. To align with AWS cloud design principles and prevent session loss, how should the application architecture be modified?

Cevabı ve açıklamayı göster

Cevap: Store the session state in a centralized, external data store such as Amazon ElastiCache or Amazon DynamoDB, making the web tier stateless.

Cevap

Store the session state in a centralized, external data store such as Amazon ElastiCache or Amazon DynamoDB, making the web tier stateless.
Storing the session state in a centralized, external data store (such as Amazon ElastiCache or Amazon DynamoDB) makes the web tier stateless. This aligns with AWS design principles because the EC2 instances become completely interchangeable. When instances scale in or out, or if an instance fails, users are not logged out because their session data is safely retrieved from the external database or cache.

Adım Adım Çözüm

1
Identify the cause of user logouts during scale-in events.
User session data is stored locally in the memory of individual EC2 instances, meaning terminating an instance destroys the session data hosted on it.
To pinpoint the architectural bottleneck causing state loss.
2
Select the appropriate cloud design principle to address state dependency.
The concept of statelessness (under the 'Design for failure' and 'Elasticity' principles) requires separating compute resources from session state.
Decoupling session state makes the compute instances interchangeable, allowing seamless scaling and resilience.
3
Determine the target destination for externalized state.
Use a low-latency, centralized managed storage service like Amazon ElastiCache (in-memory) or Amazon DynamoDB (NoSQL key-value store).
This allows any running EC2 instance to fetch and update the session state for any user request.

Anahtar Kavram

Statelessness and Decoupling Application State
Soru 159Soru →

A media streaming company is deploying a containerized microservice using Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The security team needs to define the operational boundaries between the company and AWS to ensure compliance. Which of the following operational tasks is the sole responsibility of the customer under the AWS Shared Responsibility Model for this architecture?

Cevabı ve açıklamayı göster

Cevap: Patching vulnerabilities within the application code and software packages packaged inside the container image

Cevap

Patching vulnerabilities within the application code and software packages packaged inside the container image
Under the AWS Shared Responsibility Model, AWS Fargate is a serverless compute engine for containers. Because the customer does not manage the underlying virtual servers or host operating systems, AWS is responsible for patching and securing the hypervisor and hosts. However, the customer is responsible for the container image itself, which includes patching the application code, runtimes, and dependencies packaged inside the image.

Adım Adım Çözüm

1
Analyze the deployment model and AWS service in use.
The application runs on Amazon ECS using the AWS Fargate launch type, which is a serverless container environment.
Establishing the platform type defines the Shared Responsibility Model boundary; serverless container services shift host management and patching to AWS.
2
Differentiate between the responsibilities of AWS and the customer for serverless container layers.
AWS secures the infrastructure, physical hosts, and hypervisors. The customer remains responsible for everything packaged inside the container image (application code, runtimes, packages) as well as access configurations (IAM roles, security groups).
This separation determines which operations the customer must perform to keep the containerized workload secure.
3
Identify the option that represents a valid, correct customer responsibility.
Securing and patching application code and libraries packaged inside the container image is the customer's responsibility. The other options are managed by AWS, conceptually incorrect, or violate policy.
Validates the correct answer and confirms the distractors are incorrect based on the model boundary.

Anahtar Kavram

AWS Shared Responsibility Model applied to serverless container services (AWS Fargate)
Tahmini Süre:1m 30s
Soru 160Soru →

A company needs to restrict its database administrators from modifying Amazon RDS instances when they are working outside of the corporate network or outside of standard business hours. Which IAM mechanism should the security team implement to enforce these specific access conditions?

Cevabı ve açıklamayı göster

Cevap: An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group

Cevap

An IAM policy containing a Condition element with aws:SourceIp and aws:CurrentTime keys attached to the database administrators' role or group
The correct answer is the option that suggests using an IAM policy with a Condition element containing the aws:SourceIp and aws:CurrentTime keys. This allows the security team to specify exactly when and from where the policy permits database administration tasks, conforming to best practices.

Adım Adım Çözüm

1
Analyze the access control requirements
Identify that the restrictions are based on network location (IP address) and request time (business hours).
This determines which variables or policy attributes must be evaluated during policy execution.
2
Evaluate the capabilities of IAM Policy elements
Determine that the 'Condition' block in IAM JSON policies allows specifying conditions under which the policy statement is in effect, using global condition keys like 'aws:SourceIp' and 'aws:CurrentTime'.
This matches the exact parameters of the requirement (network source and time constraints).
3
Apply the policy to the appropriate identity
Attach the policy containing these conditions to the IAM group or role used by database administrators.
Attaching the policy directly to the identity ensures that all administrative requests made by those users are evaluated against these rules.

Anahtar Kavram

IAM Policy Conditions
ÖncekiSayfa 8 / 74Sonraki