Tüm alıştırma soruları

1542 soru

Tüm türler1,542 Çoktan seçmeli782 Çoklu seçim746 Sıralama14

A developer is configuring a serverless application where an AWS Lambda function processes messages from an Amazon SQS queue. The Lambda function must also query an Amazon RDS PostgreSQL database located in a private subnet of a VPC.

During testing, the developer observes two issues:
1. Messages are occasionally processed multiple times by the Lambda function, even though the executions complete successfully. The Lambda function's timeout is set to 60 seconds, and the SQS queue's visibility timeout is set to 30 seconds.
2. The Lambda function fails to establish a connection to the RDS database, resulting in connection timeout errors.

Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.

Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Configure the Lambda function to run in the public subnets of the VPC and associate a public IP address with the function's execution role.

Decrease the Lambda function's timeout to 15 seconds so that it completes execution before the SQS visibility timeout expires.

Enable SQS FIFO queue deduplication on the existing standard SQS queue to eliminate duplicate messages.

Cevabı ve açıklamayı göster

Cevap: Increase the visibility timeout of the Amazon SQS queue to at least 360 seconds.; Configure the Lambda function to connect to the VPC using the private subnets, and ensure that the Lambda function's security group allows outbound traffic to the database's security group.

Cevap

To resolve the issues, increase the visibility timeout of the Amazon SQS queue to at least 360 seconds, and configure the Lambda function to connect to the VPC using the private subnets while ensuring the security group allows outbound traffic to the database's security group.

To resolve the duplicate processing issue, the visibility timeout of the SQS queue must be increased. AWS recommends setting it to at least 6 times the Lambda function's timeout (which is 60 seconds, so at least 360 seconds) to ensure that the message remains invisible to other consumers while Lambda processes it. To resolve the database connectivity issue, the Lambda function must be configured with VPC access using private subnets, and its security group must allow outbound traffic to the database's security group.

Adım Adım Çözüm

Address the SQS message visibility timeout mismatch by increasing the visibility timeout of the queue to at least 360 seconds (6 times the Lambda function timeout of 60 seconds) to prevent messages from returning to the queue while Lambda is still processing them.

This resolves the issue of messages being processed multiple times due to the function execution duration exceeding the queue's visibility window.

AWS best practices dictate that the SQS visibility timeout should be configured to at least 6 times the Lambda function timeout to avoid duplicate processing and allow for retries.

Address the database connection timeout by configuring the Lambda function to access the VPC.

The Lambda function is associated with the private subnets of the VPC and receives Elastic Network Interfaces (ENIs).

To connect to resources in a private VPC subnet like RDS, the Lambda function must be configured with VPC access pointing to private subnets within that VPC.

Configure the security groups to allow communication between the Lambda function and the RDS instance.

The Lambda function's security group is allowed outbound access, and the RDS database's security group is configured to allow inbound traffic from the Lambda function's security group.

Network traffic must be explicitly allowed by security groups at both the source (Lambda) and destination (RDS) to establish a successful database connection.

Anahtar Kavram

AWS Lambda integration with Amazon SQS and VPC resources requires proper alignment of SQS visibility timeouts with Lambda timeouts, as well as correct VPC and security group configuration.

Soru 2Soru →

A developer is building a logistics tracking application that stores package delivery status updates in an Amazon DynamoDB table. The table has a partition key of `PackageID` and a sort key of `StatusTimestamp`. The application needs to retrieve all delivery status updates for a specific `PackageID` that occurred within the last $24$ hours. The results must be returned starting with the most recent update first.

Which two actions should the developer take to meet these requirements with the lowest latency and minimal Read Capacity Unit (RCU) consumption? (Select TWO.)

Geçerli olan tümünü seçin

Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.

Set the `ScanIndexForward` parameter to `false` in the API request.

Use the `Scan` API operation with a filter expression specifying the `PackageID` and `StatusTimestamp`.

Hardcode AWS credentials directly in the application's SDK client configuration to minimize authorization latency.

Increase the provisioned read capacity units (RCUs) for the table to prevent throttling when sorting the retrieved dataset.

Cevabı ve açıklamayı göster

Cevap: Use the `Query` API operation with a key condition expression specifying the `PackageID` and a range comparison on `StatusTimestamp`.; Set the `ScanIndexForward` parameter to `false` in the API request.

Cevap

Use the `Query` API operation with a key condition expression on the partition key and sort key, and set the `ScanIndexForward` parameter to `false` in the API request.

To retrieve items sharing the same partition key (`PackageID`) efficiently, the `Query` API operation should be used. The query can filter results by the sort key (`StatusTimestamp`) directly in the key condition expression, which consumes Read Capacity Units (RCUs) only for the items that match the criteria. By default, DynamoDB returns query results in ascending order of the sort key. Setting the `ScanIndexForward` parameter to `false` reverses this order, returning the most recent updates first.

Adım Adım Çözüm

Determine the appropriate API operation for retrieving data with a known partition key.

Select the `Query` API operation rather than `Scan`.

A `Query` operation directly accesses the partition and filters by sort key efficiently, minimizing RCU consumption, whereas a `Scan` reads the entire table.

Configure the sorting order of the returned items.

Set the `ScanIndexForward` parameter to `false`.

DynamoDB sorts query results in ascending order of the sort key by default. Setting `ScanIndexForward` to `false` reverses the order to descending, returning the most recent items first.

Anahtar Kavram

Optimizing read operations in Amazon DynamoDB using Query instead of Scan and controlling sort order via ScanIndexForward.

Soru 3Soru →

A healthcare startup collects continuous heart rate data from thousands of wearable medical patches. The patches stream telemetry data to an Amazon Kinesis Data Stream that has $12$ shards. The stream is experiencing periodic `ProvisionedThroughputExceededException` errors during peak hours, and analysis reveals that a single shard is receiving over $80\%$ of the traffic because the developer chose `device_manufacturer` as the partition key. Which of the following changes to the partition key should the developer implement to resolve the throttling and distribute the load evenly across all shards?

Change the partition key to a high-entropy value such as a combination of device_id and the telemetry timestamp.

Change the partition key to a static string value like heart_rate_telemetry to group all incoming records.

Replace the Kinesis stream with an Amazon SQS queue and reduce the message visibility timeout below the average message processing time.

Move the processing Lambda function to a private VPC subnet without configuring a NAT Gateway or VPC endpoint.

Cevabı ve açıklamayı göster

Cevap: Change the partition key to a high-entropy value such as a combination of device_id and the telemetry timestamp.

Cevap

Change the partition key to a high-entropy value such as a combination of device_id and the telemetry timestamp.

The correct answer resolves partition hotness by switching to a key with high entropy. By combining the unique device identifier with the event timestamp, the developer ensures a uniform distribution of hashed keys across the

12

shards, mitigating ProvisionedThroughputExceededException errors.

Adım Adım Çözüm

Analyze the distribution of records across the Kinesis shards.

Identify that the current key (device_manufacturer) has low entropy, resulting in a hot shard receiving

80\%

of the data stream traffic.

Uneven write distribution is the primary cause of ProvisionedThroughputExceededException errors when overall capacity is sufficient but partition key cardinality is low.

Select a partition key strategy with high cardinality.

Choose a key combining device_id and the telemetry timestamp, which provides high entropy.

A high-entropy partition key ensures that the MD5 hashing algorithm evenly hashes payloads across the

12

available shards, maximizing write throughput.

Anahtar Kavram

Selecting high-entropy partition keys to prevent hot shards in Kinesis Data Streams.

Alternatif Yöntem

Using an explicit hash key (ExplicitHashKey) in the PutRecord/PutRecords API calls to directly assign records to specific shards.

Tahmini Süre:1m 30s

Soru 4Soru →

A developer is building a video streaming application that publishes user engagement events to an Amazon Kinesis Data Stream. An AWS Lambda function processes these events in batches. For specific events, such as 'UpgradeAccount', the Lambda function must publish a message to an Amazon EventBridge custom event bus to trigger downstream provisioning workflows.

During high-load testing, the developer observes two issues:
1. The Lambda function frequently runs out of time while processing batches of events.
2. The Lambda function fails to publish events to the EventBridge custom event bus, receiving an AccessDeniedException.

Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.

Modify the producer to use a static string as the partition key for all Kinesis records to ensure sequential processing and prevent Lambda concurrency issues.

Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Modify the trust policy of the EventBridge custom event bus to allow the lambda.amazonaws.com service principal to assume the EventBridge role.

Configure the Lambda function to run inside a private VPC subnet without a NAT Gateway or an EventBridge VPC endpoint to isolate the traffic and bypass EventBridge resource policies.

Cevabı ve açıklamayı göster

Cevap: Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately.; Attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

Cevap

Decrease the BatchSize parameter of the Lambda event source mapping and ensure the Lambda function's timeout is set appropriately; and attach an IAM policy to the Lambda function's execution role that grants the events:PutEvents permission for the EventBridge event bus resource.

To resolve the batch timeout, decreasing the BatchSize limits the payload volume per invocation, ensuring the Lambda function can complete execution within its timeout limits. To resolve the AccessDeniedException, the Lambda function's execution role must be granted the events:PutEvents permission, enabling it to write messages to the EventBridge custom event bus.

Adım Adım Çözüm

Address the Lambda batch execution timeout.

By reducing the BatchSize parameter in the Event Source Mapping, the Lambda function receives fewer records per invocation. This directly reduces the processing time per batch, preventing execution timeouts.

Kinesis streams push batches of records to Lambda, and processing too many large records in a single invocation can exceed the configured Lambda timeout.

Resolve the EventBridge AccessDeniedException authorization error.

An IAM policy must be attached to the Lambda execution role granting 'events:PutEvents' for the target EventBridge custom event bus.

AWS services interact using IAM. The Lambda function acts as the caller and requires explicit permissions to call the PutEvents API on the destination EventBridge event bus.

Anahtar Kavram

Stream processing tuning with Lambda batch settings and secure event routing to EventBridge via IAM permissions.

Tahmini Süre:2m 0s

Soru 5Soru →

A developer is designing a flight booking platform where reservation records are stored in an Amazon DynamoDB table. The table's partition key is `ReservationID`. The application needs to retrieve all reservations for a specific `FlightID` that currently have a `ReservationStatus` of 'Pending'. The solution must be highly efficient, minimize read latency, and avoid unnecessary read capacity consumption. Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.

Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Perform a Scan operation on the base table using a FilterExpression to filter items where the FlightID and ReservationStatus match.

Increase the base table's provisioned Read Capacity Units (RCUs) to mitigate ProvisionedThroughputExceededException errors when performing the daily full table Scan.

Initialize the AWS SDK client inside the application code by hardcoding the access keys of an IAM user that has read access to the table.

Cevabı ve açıklamayı göster

Cevap: Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.; Perform a Query operation on the GSI using a key condition expression to specify the FlightID and ReservationStatus.

Cevap

To retrieve the pending reservations efficiently, the developer must create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key, and then perform a Query operation on this GSI.

To retrieve items efficiently using attributes other than the base table's partition key, a Global Secondary Index (GSI) must be created. Setting FlightID as the partition key and ReservationStatus as the sort key of the GSI allows direct querying. Performing a Query operation on this GSI with a key condition expression retrieves only the matching items, minimizing latency and RCU consumption.

Adım Adım Çözüm

Analyze the table's primary key and the query requirements.

The table's partition key is ReservationID, but the query requires filtering by FlightID and ReservationStatus, which are non-key attributes in the base table.

DynamoDB does not allow direct Query operations on non-key attributes without an index.

Select the appropriate indexing strategy.

Create a Global Secondary Index (GSI) with FlightID as the partition key and ReservationStatus as the sort key.

A GSI allows querying across partition keys different from the base table, enabling direct lookups by FlightID.

Execute the retrieval operation.

Perform a Query operation on the GSI with a key condition expression.

Querying is more efficient than scanning because it only consumes capacity units for the matching items.

Anahtar Kavram

Using Global Secondary Indexes (GSIs) to perform efficient Query operations instead of Scan operations on non-key attributes in Amazon DynamoDB.

Tahmini Süre:2m 0s

Soru 6Soru →

A developer is designing a real-time multiplayer game event processor. The game client sends player match telemetry (including player ID, match ID, action type, and score) to an Amazon Kinesis Data Stream. The developer must ensure that events for the same match are processed in the strict order they occurred by the consumer. In addition, the consumer, an AWS Lambda function running in a virtual private cloud (VPC), must query an external SaaS security endpoint over the internet to check for anomalous player behavior.

Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

Use a static partition key like 'game_event' for all records to guarantee that all match events are sent to the same shard for sequential processing.

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.

Deploy the Lambda function in the public subnets of the VPC and assign it a public IP address to allow outbound communication to the external SaaS endpoint.

Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Configure the Lambda function's execution timeout to 15 minutes to ensure that execution context and database connection pools are preserved across all processed matches.

Cevabı ve açıklamayı göster

Cevap: Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream.; Deploy the Lambda function in the private subnets of the VPC, and route outbound internet traffic through a NAT Gateway located in a public subnet.

Cevap

Use the match ID as the partition key when publishing events to the Amazon Kinesis Data Stream, and deploy the Lambda function in the private subnets of the VPC, routing outbound internet traffic through a NAT Gateway located in a public subnet.

To achieve strict event ordering for each match, the events must be sent to the same shard of the Kinesis Data Stream. This is done by selecting a partition key with sufficient cardinality that groups related events, such as the match ID. For the Lambda consumer in a VPC to access an external SaaS endpoint over the internet, it must be placed in private subnets, with its outbound traffic routed to a NAT Gateway in a public subnet. Lambda functions inside a VPC cannot directly use an Internet Gateway or a public IP address.

Adım Adım Çözüm

Ensure in-order processing of match events by using the match ID as the partition key.

Events with the same match ID are hashed to the same shard of the Kinesis Data Stream, preserving their relative ordering during consumption.

Kinesis guarantees order preservation only within a single shard. Assigning the match ID as the partition key maps all events of that match to the same shard.

Configure the Lambda function inside private subnets of the VPC and set up a NAT Gateway in a public subnet.

The Lambda function can communicate with the external SaaS security endpoint over the internet.

Lambda functions deployed in a VPC do not receive public IP addresses. To access the internet, their traffic must be routed from private subnets through a NAT Gateway in a public subnet that has an Internet Gateway route.

Anahtar Kavram

Configuring partition keys in Kinesis Data Streams for order preservation and setting up NAT Gateways for Lambda VPC outbound connectivity.

Tahmini Süre:1m 30s

Soru 7Soru →

A developer is deploying a Java application to an Amazon ECS cluster running on AWS Fargate. The application uses the AWS SDK for Java to write logs to an Amazon CloudWatch Logs group. The ECS task is configured with an IAM task role that has the necessary permissions to write to CloudWatch. However, the container definition also contains the environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, which contain temporary credentials used during a previous CI/CD test run. When the application runs, it fails to write logs and throws an ExpiredTokenException. Which action should the developer take to resolve this issue?

Modify the application code to initialize the CloudWatch Logs client using a StaticCredentialsProvider with access keys passed as constructor arguments.

Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.

Update the ECS task role's trust policy to include a Statement block that grants the logs:PutLogEvents action to the task execution role.

Store a new set of active access keys in AWS Systems Manager Parameter Store as a SecureString, and update the application code to retrieve them using the Parameter Store API on startup.

Cevabı ve açıklamayı göster

Cevap: Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.

Cevap

Remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition.

The correct answer is to remove the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables from the ECS container definition. In the AWS SDK default credential provider chain, environment variables have higher precedence than ECS container credentials. If these environment variables are set (even with expired credentials), the SDK will attempt to use them, resulting in an ExpiredTokenException. Removing them allows the SDK chain to fall back to the ECS container credentials provider, which retrieves the credentials associated with the ECS task role.

Adım Adım Çözüm

Analyze the AWS SDK default credential provider chain precedence.

The SDK checks environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) before it checks the container credentials provider.

Understanding the order of precedence in the SDK is necessary to identify why the expired credentials in the environment variables are being selected over the valid task role.

Identify the root cause of the ExpiredTokenException.

The environment variables contain expired temporary credentials, which block the SDK from reaching the container credentials provider.

Since the environment variables are set, the SDK uses them and fails immediately rather than falling back to the task role credentials.

Determine the resolution method.

Remove the expired credential environment variables from the container configuration.

By removing these environment variables, the default credential provider chain will successfully fall back to the ECS task role credentials retrieved from the container metadata URI.

Anahtar Kavram

AWS SDK Default Credential Provider Chain Precedence

Soru 8Soru →

A developer is configuring an AWS Lambda function inside a private subnet of a custom VPC to process messages from an Amazon SQS queue. The Lambda function must read database credentials from AWS Secrets Manager and write the processed results to an Amazon DynamoDB table. To satisfy security requirements, the VPC has no internet access, and all traffic must remain within the AWS network.

The developer creates a Gateway VPC endpoint for DynamoDB and an Interface VPC endpoint for Secrets Manager. However, when the Lambda function runs, it fails with connection timeout errors when attempting to access both DynamoDB and Secrets Manager.

Which combination of actions will resolve these connection timeouts? (Select two.)

Geçerli olan tümünü seçin

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.

Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Configure the security group associated with the Lambda function to allow inbound HTTPS traffic on port 443 from the Secrets Manager Interface VPC endpoint.

Add a route to the route table of the Lambda function's private subnet that routes all traffic to the Secrets Manager Interface VPC endpoint as the target.

Increase the visibility timeout of the SQS queue to be greater than the Lambda function's timeout, and configure the Lambda function's concurrency limit to match the SQS queue's batch size.

Cevabı ve açıklamayı göster

Cevap: Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list.; Modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

Cevap

Update the route table associated with the Lambda function's private subnet to include a route that targets the DynamoDB Gateway VPC endpoint for the DynamoDB prefix list, and modify the security group associated with the Secrets Manager Interface VPC endpoint to allow inbound HTTPS traffic on port 443 from the security group associated with the Lambda function.

To resolve connection timeouts inside a private VPC with no internet access, the developer must properly configure the networking and security rules for the VPC endpoints. For the DynamoDB Gateway endpoint, a route must be added to the subnet's route table targeting the DynamoDB prefix list. For the Secrets Manager Interface endpoint, which uses ENIs, the endpoint's security group must be configured to accept inbound HTTPS (port 443) connections from the Lambda function's security group.

Adım Adım Çözüm

Identify the cause of the DynamoDB timeout.

Determine that DynamoDB is accessed via a Gateway VPC endpoint.

Gateway endpoints require explicit routes in the subnet's route table to direct traffic to the service.

Resolve the DynamoDB configuration issue.

Add a route in the private subnet's route table pointing to the DynamoDB prefix list with the Gateway endpoint ID as the target.

This enables the VPC router to forward DynamoDB-bound traffic through the Gateway endpoint.

Identify the cause of the Secrets Manager timeout.

Determine that Secrets Manager is accessed via an Interface VPC endpoint.

Interface endpoints use Elastic Network Interfaces (ENIs) with security groups, which require appropriate inbound permissions.

Resolve the Secrets Manager configuration issue.

Configure the security group of the Secrets Manager Interface endpoint to allow inbound HTTPS (port 443) traffic from the security group of the Lambda function.

This allows the inbound connection from the Lambda function's ENI to the endpoint's ENI.

Anahtar Kavram

AWS Lambda VPC networking using Gateway and Interface VPC endpoints

Tahmini Süre:3m 0s

Soru 9Soru →

A developer is migrating a backend AWS Lambda function from a Lambda custom (non-proxy) integration to a Lambda proxy integration on an Amazon API Gateway REST API. Under the custom integration, the Lambda function received a pre-mapped JSON payload containing query parameters and headers, and it returned a simple JSON object:

`{ "status": "success", "data": { "userId": 101 } }`

After configuring the API Gateway to use Lambda Proxy Integration, clients receive a 502 Bad Gateway error on all API requests. Additionally, the Lambda function execution logs show errors indicating that the incoming event format is unexpected.

Which of the following modifications must the developer make to resolve these errors?

Modify the Lambda function to parse the incoming request body from the event.body property, and update the function's return statement to return a JSON object with statusCode and a stringified JSON body.

Define an Integration Request mapping template in API Gateway to map the client request to the Lambda input event, and define an Integration Response to map the Lambda return payload to a Method Response.

Configure a Lambda authorizer for the API Gateway method to authenticate the client request and inject the required request context before invoking the backend Lambda function.

Add Access-Control-Allow-Origin headers to the API Gateway Method Response configuration and configure API Gateway to automatically convert the Lambda output string into a 502 status code.

Cevabı ve açıklamayı göster

Cevap: Modify the Lambda function to parse the incoming request body from the event.body property, and update the function's return statement to return a JSON object with statusCode and a stringified JSON body.

Cevap

The correct option is to modify the Lambda function to parse the incoming request body from the event.body property and return a JSON object with statusCode and a stringified JSON body. This is because Lambda proxy integration passes the entire HTTP request wrapper where the request body is stringified, and requires the response to conform strictly to a response format containing statusCode and body fields.

Adım Adım Çözüm

Understand the difference between Lambda custom integration and Lambda proxy integration input events.

In custom integrations, API Gateway maps parameters and payload before invoking Lambda. In proxy integrations, API Gateway passes the raw request inside an event object, where the body is a stringified JSON in the event.body property.

This explains why the Lambda function logged unexpected event format errors after the integration type was changed to proxy.

Understand the difference in response expectations for Lambda proxy integration.

Lambda proxy integration requires the backend function to return a specific JSON response containing at least statusCode (an integer) and body (a string representing the response payload).

If the backend returns a custom JSON object or a raw string instead of this expected format, API Gateway cannot parse it and yields a 502 Bad Gateway error.

Implement code changes in the Lambda function to parse the input and format the output correctly.

The function parses event.body for incoming parameters and returns an object such as { statusCode: 200, body: JSON.stringify({ status: 'success', data: { userId: 101 } }) }.

This matches the input and output requirements for Lambda proxy integration and resolves both the execution logs error and the 502 Bad Gateway response.

Anahtar Kavram

The primary difference in payload structure and response contract between API Gateway Lambda Proxy and Lambda Custom (non-proxy) integrations.

Tahmini Süre:2m 0s

Soru 10Soru →

A developer is building a document processing application that must secure sensitive PDF documents before uploading them to a third-party storage service. The average size of each document is $15\text{ MB}$ . To meet security requirements, the developer must encrypt the documents client-side using an AWS KMS Customer Managed Key (CMK) while minimizing latency and network overhead. Which approach should the developer implement to encrypt these documents securely and efficiently?

Call the KMS Encrypt API directly, passing the raw document binary as the plaintext parameter along with the CMK ARN, and store the returned ciphertext.

Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Call the KMS GenerateDataKeyWithoutPlaintext API to retrieve an encrypted data key. Send the encrypted data key to the KMS Decrypt API to get the plaintext key, encrypt the document locally, and store the encrypted data key with the document.

Retrieve a pre-generated symmetric key stored in AWS Systems Manager Parameter Store as a SecureString parameter using the GetParameter API. Encrypt the document locally with this key and discard the retrieved parameter value.

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API with the CMK to obtain a plaintext data key and an encrypted data key. Encrypt the document locally using the plaintext data key, delete the plaintext key from memory, and store the encrypted data key alongside the encrypted document.

Cevap

The correct approach is to call the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the document locally, and is then discarded from memory. The encrypted data key is stored alongside the encrypted document so that it can be decrypted later using the Decrypt API. This utilizes envelope encryption, which is necessary because the documents exceed the size limit of the direct KMS Encrypt API.

Adım Adım Çözüm

Evaluate the file size (

15\text{ MB}

) against AWS KMS direct encryption payload limits.

Since the direct KMS Encrypt API has a strict limit of

4\text{ KB}

, direct encryption is not possible. Envelope encryption must be used.

To select the appropriate KMS workflow based on payload size constraints.

Determine the most efficient API call for obtaining data keys for client-side envelope encryption.

GenerateDataKey returns both the plaintext key (for local encryption) and the encrypted key (for storage) in a single network request.

To minimize latency and network calls during document upload processing.

Validate security best practices for handling the generated plaintext data key.

Once the document is encrypted locally with the plaintext key, the plaintext key is deleted from application memory, and the encrypted key is packaged with the ciphertext.

To ensure the plaintext key is not exposed or leaked.

Anahtar Kavram

Client-side envelope encryption workflow using AWS KMS GenerateDataKey API

Tahmini Süre:2m 0s

Soru 11Soru →

A company is developing a desktop-based administration client that must allow authenticated internal users to upload system logs directly to a secure Amazon S3 bucket. The developer wants to manage user registration, sign-in, and password recovery natively within the client, while ensuring that the desktop application receives temporary, limited-privilege AWS credentials to perform the S3 uploads without embedding long-term AWS access keys.

Which architecture should the developer implement to meet these requirements?

Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.

Use an Amazon Cognito Identity Pool to manage user registration and directory management, and configure an AWS Lambda post-confirmation trigger to return temporary AWS credentials directly to the client.

Use an Amazon Cognito User Pool to authenticate users, and configure an Amazon API Gateway REST API with a Cognito Authorizer to generate and return temporary AWS credentials to the desktop client.

Use an Amazon Cognito User Pool to authenticate users, and configure an IAM User with a resource-based trust policy that allows the desktop application to assume the user identity based on client IP addresses.

Cevabı ve açıklamayı göster

Cevap: Use an Amazon Cognito User Pool to manage user authentication, and use an Amazon Cognito Identity Pool to exchange the User Pool identity tokens for temporary AWS IAM credentials that authorize writing to the Amazon S3 bucket.

Cevap

The correct architecture uses a Cognito User Pool to authenticate the desktop client users (handling registration, login, etc.) and generate JWT identity tokens. The client then passes this token to a Cognito Identity Pool, which validates it and returns temporary, restricted AWS IAM credentials. The desktop client can then use these credentials to upload files directly to S3.

Adım Adım Çözüm

Configure an Amazon Cognito User Pool.

Creates a user directory that handles user sign-up, sign-in, password reset, and produces JWT tokens (ID, Access, and Refresh tokens) upon successful authentication.

Required to handle native user authentication and directory management.

Configure an Amazon Cognito Identity Pool (Federated Identities) and associate it with the User Pool as an identity provider.

Allows the application to exchange the ID token issued by the User Pool for temporary AWS credentials.

Provides the mechanism to federate Cognito User Pool users into AWS IAM roles.

Define an IAM Role for authenticated users with a trust policy for Cognito Identity Pools and a permissions policy allowing S3 put-object actions.

Ensures that users mapped by the Identity Pool receive credentials scoped strictly to write to the designated S3 bucket.

Enforces least-privilege access for the S3 bucket operations.

Anahtar Kavram

Amazon Cognito User Pools vs Identity Pools

Soru 12Soru →

A developer is implementing an AWS Lambda function in Account A ( $111111111111$ ) that needs to retrieve database credentials stored as a secure parameter in the Systems Manager Parameter Store in Account B ( $222222222222$ ). The parameter is encrypted using an AWS KMS customer managed key (CMK) in Account B. The developer intends to use the AWS Security Token Service (STS) to assume an IAM role named `DbConfigReaderRole` in Account B.

The Lambda function is associated with an execution role named `LambdaExecutionRole` in Account A.

Which of the following configuration steps must be performed to allow the Lambda function to retrieve the configuration parameter? (Select TWO.)

Geçerli olan tümünü seçin

In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.

In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

In Account B, attach an identity-based permission policy to `DbConfigReaderRole` that grants `sts:AssumeRole` permissions to the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

In the Lambda function code, configure the AWS SDK client to initialize credentials by hardcoding the access keys of an IAM user in Account B that has permissions to read the parameter.

In Account B, attach a resource-based policy directly to the Systems Manager Parameter that grants `ssm:GetParameter` permissions to the `LambdaExecutionRole` in Account A.

Cevabı ve açıklamayı göster

Cevap: In Account B, configure the trust policy for `DbConfigReaderRole` to allow the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` to perform the `sts:AssumeRole` action.; In Account A, attach a policy to `LambdaExecutionRole` that grants `sts:AssumeRole` permissions on the resource `arn:aws:iam::222222222222:role/DbConfigReaderRole`.

Cevap

The configuration requires adding the calling role as a trusted principal in the trust policy of the target role in Account B, and granting permission to assume the target role in the identity-based policy of the caller's role in Account A.

For cross-account access via STS, two distinct components are required: the target role's trust policy must list the source principal as a trusted entity, and the source identity's permissions policy must permit the call to assume the target role.

Adım Adım Çözüm

Identify the cross-account trust requirement.

The target role `DbConfigReaderRole` in Account B (

222222222222

) must explicitly trust the Lambda execution role in Account A (

111111111111

) via its trust policy.

Without this trust relationship, STS will deny the assume role request from Account A's principal.

Identify the delegation permission requirement.

The source execution role `LambdaExecutionRole` in Account A must be granted permission to perform the `sts:AssumeRole` action on the target role's ARN in Account B.

By default, IAM execution roles do not have permission to assume arbitrary external roles; this must be explicitly allowed.

Differentiate trust policies from identity-based policies and resource-based policies.

Confirm that trust relationships are defined in trust policies (not identity-based policies) and that Systems Manager Parameter Store does not support resource policies.

This rules out the incorrect options that attempt to configure trust in permissions policies or use non-existent parameter resource policies.

Anahtar Kavram

IAM Policies and Roles

Tahmini Süre:2m 0s

Soru 13Soru →

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application needs to retrieve data from an Amazon DynamoDB table. The developer creates an IAM role named AppDynamoDBRole with a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations, and configures the task definition's taskRoleArn parameter to point to this role. The trust policy for AppDynamoDBRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the containerized application runs, it fails to authenticate with DynamoDB, and the container logs show an authorization error when attempting to assume the task role. Which of the following modifications to the configuration will resolve this issue?

Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

Change the taskRoleArn configuration in the task definition to executionRoleArn, and attach the DynamoDB permissions to the task execution role.

Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.

Add the ecs:StartTask permission to the executionRoleArn to authorize the containers to initiate the assume role action.

Cevabı ve açıklamayı göster

Cevap: Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

Cevap

Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.

The correct option is changing the Service principal to ecs-tasks.amazonaws.com. When configuring an ECS task definition, the taskRoleArn parameter allows containerized applications to make authorized AWS API calls. To enable this, the ECS agent must assume the designated IAM role. The trust relationship policy of the IAM role must explicitly allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to perform the sts:AssumeRole action.

Adım Adım Çözüm

Examine the trust policy of the IAM role to determine who is permitted to assume it.

The current trust policy permits the ecs.amazonaws.com service principal to assume the role.

This determines if the correct AWS service or identity has been granted trust.

Identify the service principal responsible for launching and executing ECS tasks.

ECS tasks run under the ecs-tasks.amazonaws.com service principal, whereas service-level control plane operations run under ecs.amazonaws.com.

The correct service principal must match the specific entity requesting the sts:AssumeRole action.

Update the trust policy to authorize the ecs-tasks.amazonaws.com service principal.

The ECS agent can now successfully assume the AppDynamoDBRole on behalf of the containerized application.

This establishes a valid trust relationship, resolving the authorization error.

Anahtar Kavram

IAM trust policies for Amazon ECS tasks must trust the ecs-tasks.amazonaws.com service principal to allow the ECS agent to assume the task role on behalf of containers.

Tahmini Süre:2m 0s

Soru 14Soru →

A developer is building a serverless client-side web application. Users will log in using an Amazon Cognito User Pool. Once authenticated, the application must interact directly with AWS services from the browser to download user-specific documents from an Amazon S3 bucket, restricted to the path `documents/${cognito-identity.amazonaws.com:sub}/*`, and write application usage telemetry directly to an Amazon Kinesis Data Stream. The developer wants to implement this with the least operational overhead and without managing any backend API or compute resources. Which TWO actions should the developer take to configure this solution?

Geçerli olan tümünü seçin

Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Configure the client application to pass the Cognito User Pool Access token directly in the Authorization header of the requests to the Amazon S3 and Kinesis Data Streams endpoints.

Deploy an Amazon API Gateway REST API with a Cognito User Pool Authorizer, and route the client requests through the API to access S3 and Kinesis.

Generate long-term IAM User access keys with the required S3 and Kinesis permissions, and embed them in the client application code.

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito Identity Pool, configure the Cognito User Pool as an identity provider, and associate an authenticated IAM role that permits `s3:GetObject` on the prefix `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.; Configure the client application to exchange the Cognito User Pool ID token for temporary AWS credentials using the Cognito Identity Pool.

Cevap

The developer should create an Amazon Cognito Identity Pool configured with the User Pool as an identity provider, assigning an authenticated IAM role that permits Kinesis and user-restricted S3 access. Additionally, the client application must exchange the Cognito User Pool ID token for temporary AWS credentials using the Identity Pool.

To interact directly with AWS services like Amazon S3 and Amazon Kinesis from a client-side application, temporary AWS credentials are required. By creating a Cognito Identity Pool and configuring the User Pool as an identity provider, you can exchange the User Pool ID token for temporary AWS IAM credentials. The authenticated IAM role associated with the Identity Pool can restrict S3 access to user-specific folders using the `${cognito-identity.amazonaws.com:sub}` policy variable and grant write permissions to the Kinesis stream, ensuring secure and direct access with minimal operational overhead.

Adım Adım Çözüm

Configure the user directory and federation.

An Amazon Cognito User Pool is set up for authentication, and an Identity Pool is created with the User Pool configured as an identity provider.

This establishes a trust relationship where successful authentication in the User Pool allows the client to request credentials from the Identity Pool.

Define the permissions using an IAM policy on the Identity Pool's authenticated role.

The authenticated IAM role is assigned a policy allowing `s3:GetObject` on `arn:aws:s3:::my-bucket/documents/${cognito-identity.amazonaws.com:sub}/*` and `kinesis:PutRecord` on the stream.

The `${cognito-identity.amazonaws.com:sub}` variable represents the user's Cognito Identity ID, ensuring users can only access their own documents, while Kinesis access allows direct telemetry ingestion.

Exchange tokens for credentials in the client application.

The client authenticates with the User Pool, obtains an ID token, and calls the Identity Pool to get temporary AWS credentials.

These credentials are used by the AWS SDK in the browser to sign requests directly to S3 and Kinesis using Signature Version 4.

Anahtar Kavram

Amazon Cognito Identity Pools enable client-side applications to obtain temporary, limited-privilege AWS credentials by federating identity providers like Cognito User Pools.

Soru 15Soru →

A developer is configuring an AWS CodeDeploy deployment group for an in-place deployment of a web application to Amazon EC2 instances. The deployment must automatically revert to the last known successful version if the new deployment fails or if application error rates exceed a specific threshold. Additionally, the developer needs to ensure that any temporary files left by a failed deployment are cleaned up during the rollback process.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.

Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Add a Rollback hook to the hooks section of the appspec.yml file to execute a script that automatically deletes temporary files when a rollback is initiated.

Attach a service role to the CodeDeploy agent on the EC2 instances with a trust policy that permits the sns:Publish action for rollback alerts.

Store the cleanup script in AWS Systems Manager Parameter Store as a secure parameter, and reference it under the resources section of the appspec.yml file.

Cevabı ve açıklamayı göster

Cevap: Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.; Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Cevap

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures and CloudWatch alarm states, and implement cleanup logic in the BeforeInstall hook of the AppSpec file because CodeDeploy performs a rollback by initiating a new deployment of the last successful revision.

The correct configurations are to enable automatic rollbacks in the CodeDeploy deployment group for both deployment failures and when a configured CloudWatch alarm (tracking error rates) goes into the ALARM state. Furthermore, because CodeDeploy executes a rollback by initiating a new deployment of the last successful revision, the cleanup logic must be placed in a standard lifecycle hook such as BeforeInstall of that revision to ensure any leftover artifacts from the failed deployment are deleted before files are copied.

Adım Adım Çözüm

Configure rollback behaviors on the deployment group

Automatic rollbacks are enabled for deployment failures and CloudWatch alarms monitoring error rate thresholds.

This natively automates the rollback process when a failure is detected or when application metrics degrade.

Analyze how CodeDeploy executes rollbacks

CodeDeploy handles rollbacks by running a brand new deployment of the previous successful revision.

Understanding this flow reveals that there is no custom Rollback hook; instead, standard deployment hooks in the target revision will run.

Place the cleanup script in the correct lifecycle hook of the AppSpec file

The cleanup script is mapped to the BeforeInstall hook of the AppSpec file.

When the rollback deployment starts, the BeforeInstall hook runs before new files are copied, clearing out remnants of the failed deployment.

Anahtar Kavram

AWS CodeDeploy rollbacks are executed as new deployments of the last known successful revision, which run the standard AppSpec lifecycle hooks of that revision rather than a dedicated rollback hook.

Soru 16Soru →

An application running on AWS Fargate generates monthly audit reports (each approximately $8\text{ MB}$ in size) that must be encrypted client-side before they are stored in an external third-party storage system. The developer wants to use AWS Key Management Service (AWS KMS) with a customer managed key to secure these reports.

Which of the following actions must the developer take to implement this client-side encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.

Call the Encrypt API of AWS KMS to encrypt the audit report directly.

Call the GenerateDataKeyWithoutPlaintext API of AWS KMS to obtain an encrypted data key, and use it to encrypt the audit report locally.

Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Store the plaintext data key in AWS Systems Manager Parameter Store as a SecureString to reuse it for subsequent audit reports.

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API of AWS KMS using the customer managed key identifier to retrieve a plaintext data key and an encrypted data key.; Encrypt the audit report locally using the plaintext data key, store the encrypted data key alongside the encrypted report, and then delete the plaintext data key from memory.

Cevap

To encrypt a file larger than

4\text{ KB}

client-side, the developer must generate a data key by calling the GenerateDataKey API, use the returned plaintext data key to encrypt the report locally, discard the plaintext key from memory, and store the encrypted data key alongside the encrypted audit report.

To encrypt a large file client-side using AWS KMS, the developer must implement envelope encryption. This involves calling the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext data key is used to encrypt the audit report locally, after which the plaintext key is discarded from memory. The encrypted data key is then stored with the encrypted report so that it can be decrypted later by calling the Decrypt API to recover the plaintext key.

Adım Adım Çözüm

Generate a unique data key.

The GenerateDataKey API is called, which returns a plaintext data key and an encrypted data key.

Since the file exceeds the direct encryption limit of AWS KMS, envelope encryption is required. The plaintext key is needed to perform the encryption, and the encrypted key is saved for future decryption.

Encrypt the data locally.

The Fargate container encrypts the

8\text{ MB}

report using the plaintext data key.

This performs the actual cryptographic operation locally without sending the large file to AWS KMS.

Clean up memory and store metadata.

The plaintext key is cleared from the container's memory, and the encrypted data key is written alongside the encrypted report.

Holding the plaintext key longer than necessary in memory presents a security risk, and the encrypted data key is the only way to recover the plaintext key during decryption.

Anahtar Kavram

AWS KMS client-side envelope encryption workflow for objects exceeding the direct encryption size limits.

Soru 17Soru →

A developer is testing a Go microservice locally. The microservice uses the AWS SDK for Go v2 to retrieve parameter configurations from Amazon Systems Manager (SSM) Parameter Store using the following initialization code:

go
// WARNING: Do not hardcode credentials in production.
// This code relies on the default credential provider chain.
cfg, err := config.LoadDefaultConfig(context.TODO())
if err != nil {
log.Fatalf("unable to load SDK config, %v", err)
}
client := ssm.NewFromConfig(cfg)

The application runs inside a local Docker container as a non-root user `appuser` (home directory `/home/appuser`). To supply AWS credentials to the container, the developer ran the container with the environment variable `AWS_PROFILE=dev-profile` and mounted the host's `~/.aws/credentials` file to `/home/appuser/.aws/credentials`.

On the host machine, the AWS CLI configurations are:

`~/.aws/config`:
ini
[profile dev-profile]
role_arn = arn:aws:iam::123456789012:role/DevDeveloperRole
source_profile = base-profile

`~/.aws/credentials` (using placeholder credentials for security):
ini
[base-profile]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

When the application runs in the container, it fails with the error `operation error SSM: GetParameter, failed to resolve credentials`. However, running `aws ssm get-parameter --name /app/config --profile dev-profile` directly on the host machine succeeds.

Which of the following is the root cause of this credential resolution failure?

The AWS SDK for Go v2 default credential chain does not support containerized environments, requiring the developer to pass the raw credentials directly into the `config.LoadDefaultConfig` function parameters in the application code.

The IAM role trust policy for `DevDeveloperRole` does not authorize the service principal `ecs-tasks.amazonaws.com` to assume the role, causing the STS assume-role operation to fail when initiated from the container environment.

The `dev-profile` profile relies on a role assumption chain defined in the host's `~/.aws/config` file, which was not mounted into the container, preventing the SDK from locating the profile configuration.

The Go SDK requires the application to retrieve credentials from AWS Systems Manager Parameter Store or AWS Secrets Manager rather than reading profile configurations from the local filesystem.

Cevabı ve açıklamayı göster

Cevap: The `dev-profile` profile relies on a role assumption chain defined in the host's `~/.aws/config` file, which was not mounted into the container, preventing the SDK from locating the profile configuration.

Cevap

The credential resolution failure is caused by the missing configuration file inside the container. The profile `dev-profile` is defined in the host's `~/.aws/config` file (which references `role_arn` and `source_profile`). Because only the `~/.aws/credentials` file was mounted to the container, the AWS SDK inside the container could not locate the definition for `dev-profile` and therefore could not resolve the credentials.

The correct answer points out that the profile configuration (`dev-profile`) specifying role-chaining parameters (`role_arn` and `source_profile`) resides in the host's `~/.aws/config` file. If only the `~/.aws/credentials` file is mounted to the container, the SDK cannot resolve the `dev-profile` name to its role assumption configuration, causing credential resolution to fail.

Adım Adım Çözüm

Analyze how the AWS SDK for Go v2 resolves credentials.

The SDK looks at environment variables like `AWS_PROFILE` and then checks the shared configuration file (`~/.aws/config`) and credentials file (`~/.aws/credentials`) in the user's home directory.

Understanding the credential resolution chain helps pinpoint where the lookup breaks.

Examine the volume mounts defined for the Docker container.

Only `~/.aws/credentials` is mounted to `/home/appuser/.aws/credentials`. The `~/.aws/config` file is not mounted.

This shows that the containerized SDK only has access to the credentials file and not the configuration file.

Evaluate the profile configuration structure.

The target profile `dev-profile` is configured in `~/.aws/config` using `role_arn` and `source_profile`. The credentials for `base-profile` are in `~/.aws/credentials`.

Because the SDK in the container lacks the config file, it cannot read the definition for `dev-profile`, preventing it from understanding that it must assume a role using the `base-profile` credentials.

Anahtar Kavram

Credential File vs Configuration File in AWS SDK Profile Resolution

Alternatif Yöntem

Instead of mounting individual files, the developer can mount the entire `~/.aws` directory to `/home/appuser/.aws` in the container. This ensures both `config` and `credentials` files are accessible, permitting the SDK to chain profiles successfully.

Tahmini Süre:2m 30s

Soru 18Soru →

A developer is instrumenting a Go-based microservice running on Amazon ECS with the EC2 launch type to trace incoming HTTP requests, downstream HTTP client calls, and calls to Amazon DynamoDB using AWS X-Ray. The X-Ray daemon is already running on the container host instances. Which of the following actions must the developer take to instrument the application and ensure downstream traces are recorded? (Select TWO.)

Geçerli olan tümünü seçin

Instrument the AWS SDK clients using the X-Ray SDK for Go and wrap the HTTP client's transport with the X-Ray RoundTripper.

Pass the Go context containing the active segment to downstream AWS SDK operations and HTTP client calls.

Hardcode temporary AWS IAM credentials within the application's SDK client configuration to authorize calls to the X-Ray daemon.

Configure the AWS SDK clients without passing the Go context object, as the Go X-Ray SDK automatically registers a global listener that intercepts and correlates all downstream calls.

Configure the Amazon SQS queue's visibility timeout to be shorter than the database processing time to force X-Ray to flush trace segments.

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK clients using the X-Ray SDK for Go and wrap the HTTP client's transport with the X-Ray RoundTripper.; Pass the Go context containing the active segment to downstream AWS SDK operations and HTTP client calls.

Cevap

To instrument the Go application for AWS X-Ray, the developer must instrument the AWS SDK clients and HTTP client transport, and explicitly pass the Go context containing the active segment to all downstream calls.

Instrumenting the SDK clients and HTTP transport with X-Ray SDK helpers enables subsegment generation for outgoing requests. Since Go lacks thread-local storage, context must be explicitly passed to propagate the active trace segment.

Adım Adım Çözüm

Wrap the HTTP client transport with the X-Ray RoundTripper and initialize the AWS SDK clients with X-Ray instrumentation helper functions.

The application code is prepared to intercept outgoing AWS SDK and HTTP requests to generate X-Ray subsegments.

This establishes the handlers and interceptors required by the X-Ray SDK to record outgoing service details.

Ensure that the Go context.Context object representing the active request segment is passed into all downstream SDK calls and HTTP requests.

The trace ID and segment hierarchy are successfully propagated down the call chain.

Go does not have thread-local storage; therefore, trace context propagation relies entirely on passing context variables down the call stack.

Anahtar Kavram

Go X-Ray SDK Instrumentation and Context Propagation

Soru 19Soru →

A developer is managing an AWS CloudFormation stack for a production application. After a failed update to an Amazon RDS database instance, the stack is stuck in the UPDATE_ROLLBACK_FAILED state. The developer discovers that another team member had previously made manual, out-of-band configuration changes to the database instance directly in the AWS Console. How should the developer resolve this situation and successfully perform the stack update?

Manually delete the database instance via the Amazon RDS console, manually recreate a new database instance with the target configuration, and then run drift detection to automatically reconcile the stack.

Directly run the update-stack CLI command with the updated template and a --force-update flag to override the failed rollback state and apply the new configuration.

Identify the manual changes, use the CloudFormation console or CLI to run the ContinueUpdateRollback action to return the stack to a stable state, update the template to reflect the actual resource configuration, and then perform the update.

Create a new Systems Manager Parameter Store parameter of type String to store the database password, and update the template to reference it using the {{resolve:ssm:parameter_name}} dynamic reference.

Cevabı ve açıklamayı göster

Cevap: Identify the manual changes, use the CloudFormation console or CLI to run the ContinueUpdateRollback action to return the stack to a stable state, update the template to reflect the actual resource configuration, and then perform the update.

Cevap

To resolve an UPDATE_ROLLBACK_FAILED state caused by out-of-band changes, the developer must run the ContinueUpdateRollback action to stabilize the stack, align the template with the actual resource state, and then perform the update.

Executing the ContinueUpdateRollback action is the standard AWS procedure to recover a stack from the UPDATE_ROLLBACK_FAILED state. Once the stack is stabilized to UPDATE_ROLLBACK_COMPLETE, the developer can align the template with the actual drifted state of the database and safely run the update.

Adım Adım Çözüm

Identify manual configuration changes that caused the rollback failure.

Find the drift or discrepancy between the template and the actual resource state.

Manual out-of-band changes prevent CloudFormation from rolling back resources to their expected state.

Execute the ContinueUpdateRollback operation via the CLI or AWS Console.

The stack transitions from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE.

This action bypasses or retries the failed rollback step, bringing the stack back to a stable state where updates are permitted.

Align the template with the actual configuration of the resources and redeploy.

The stack is successfully updated with no configuration drift.

Ensuring the template matches the real-world state prevents future update or rollback failures.

Anahtar Kavram

Resolving CloudFormation stack update rollback failures caused by resource drift

Tahmini Süre:1m 30s

Soru 20Soru →

A developer is setting up an AWS CodeBuild project to compile a Java application and upload the build artifacts to an Amazon S3 bucket. During the first build execution, CodeBuild fails to upload the artifacts, returning an Access Denied error. Additionally, the developer wants the project to use a custom build specification file named build-config.yml located in the config directory of the repository, rather than using the default root-level buildspec.yml file.

Which configuration steps must the developer perform to resolve the upload failure and use the custom build specification? (Select TWO.)

Geçerli olan tümünü seçin

Update the buildspec path in the CodeBuild project settings to config/build-config.yml.

Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Define the custom build specification contents within a Systems Manager Parameter Store parameter and pass the parameter name in the buildspec.

Create a default buildspec.yml file in the repository root and define a redirect block under the install phase pointing to config/build-config.yml.

Modify the IAM trust policy of the Amazon ECS task execution role to allow the codebuild.amazonaws.com service principal to assume it.

Cevabı ve açıklamayı göster

Cevap: Update the buildspec path in the CodeBuild project settings to config/build-config.yml.; Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Cevap

The correct steps are to update the buildspec path in the CodeBuild project settings to point to the custom path, and to modify the CodeBuild service role permissions policy to allow writing objects to the S3 bucket.

To use a custom build specification file that is not in the root directory or has a different name, the developer must configure the file path in the project settings. Additionally, since the build environment failed to upload the artifacts to Amazon S3 with an Access Denied error, the CodeBuild service role must be updated with a policy that allows the write action on the target S3 bucket.

Adım Adım Çözüm

Determine how CodeBuild locates a non-standard buildspec file name and path.

A custom buildspec path like config/build-config.yml must be configured directly within the CodeBuild project settings.

By default, CodeBuild expects buildspec.yml in the root directory. Any custom path or name must be specified in the project configuration.

Analyze the cause of the Access Denied error during artifact upload.

The CodeBuild build container runs under an IAM role (the service role). It requires explicit permissions to write objects to the S3 bucket where artifacts are stored.

Without s3:PutObject permissions attached to the CodeBuild service role, the upload will fail with an authorization error.

Anahtar Kavram

AWS CodeBuild custom buildspecs and permissions

Sayfa 1 / 78Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Alternatif Yöntem

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Alternatif Yöntem

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap