Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 641Soru →

A developer is deploying a web application using AWS Elastic Beanstalk. The developer wants to include custom configuration files (with a `.config` extension) to install packages and define environment properties. In which directory at the root of the application source bundle must the developer place these files to ensure they are processed during deployment?

Cevabı ve açıklamayı göster

Cevap: .ebextensions

Cevap

The `.ebextensions` directory at the root of the application source bundle.
To customize the EC2 instances in an Elastic Beanstalk environment, configuration files (ending in `.config`) must be placed in a directory named `.ebextensions` at the root of the application source bundle. Elastic Beanstalk automatically detects and applies these configurations during deployment.

Adım Adım Çözüm

1
Identify where Elastic Beanstalk looks for configuration files in the source bundle.
The platform search mechanism looks at the root of the uploaded zip source bundle.
Elastic Beanstalk needs a standard, predictable location to find customization files.
2
Determine the exact directory naming convention.
The required directory name must start with a period and be followed by 'ebextensions' (resulting in `.ebextensions`).
Omitting the leading period or using a different name will cause the deployment agent to ignore the customization files.

Anahtar Kavram

Elastic Beanstalk custom configuration via .ebextensions
Tahmini Süre:45s
Soru 642Soru →

A developer is configuring a web application for deployment on AWS Elastic Beanstalk. The application requires a runtime environment variable named 'DATABASE_URL'. Additionally, the application requires an Amazon S3 bucket for storing user uploads, and this bucket's lifecycle must be tied directly to the Elastic Beanstalk environment. Which two configuration steps should the developer perform to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Place a '.config' configuration file inside a directory named '.ebextensions' at the root of the application source bundle, defining the environment variable under the 'aws:elasticbeanstalk:application:environment' namespace.; Place a '.config' configuration file inside a directory named '.ebextensions' at the root of the application source bundle, defining the S3 bucket under the 'Resources' block using CloudFormation syntax.

Cevap

To satisfy the requirements, the developer must place a '.config' file within a '.ebextensions' directory at the root of the application source bundle. In this file, the 'DATABASE_URL' environment variable should be defined under the 'aws:elasticbeanstalk:application:environment' namespace, and the Amazon S3 bucket should be defined as a resource under the 'Resources' block using standard CloudFormation syntax.
The correct options describe placing '.config' files in a folder named '.ebextensions' at the root of the source bundle. To configure environment variables, the developer uses the 'aws:elasticbeanstalk:application:environment' namespace inside the configuration file. To provision custom resources like an S3 bucket that share the environment's lifecycle, the developer includes standard CloudFormation resource definitions under the 'Resources' key in the configuration files.

Adım Adım Çözüm

1
Identify the directory location and file extension for Elastic Beanstalk configuration files.
The files must have a '.config' extension and must be placed in a folder named '.ebextensions' (with a leading period) at the root of the source bundle.
Elastic Beanstalk only processes configuration files that reside in this specific directory path.
2
Determine the namespace for setting environment properties/variables.
The correct namespace is 'aws:elasticbeanstalk:application:environment' within the 'option_settings' block of the configuration file.
This namespace informs Elastic Beanstalk to inject the properties as environment variables accessible by the application code at runtime.
3
Define the custom resource with a lifecycle tied to the Elastic Beanstalk environment.
Add a 'Resources' block containing the Amazon S3 bucket definition using AWS CloudFormation syntax in one of the '.config' files.
Elastic Beanstalk parses the 'Resources' section of '.config' files and adds those resources directly to the environment's underlying CloudFormation stack, managing their lifecycle together.

Anahtar Kavram

AWS Elastic Beanstalk configuration files ('.ebextensions') and resource provisioning
Tahmini Süre:2m 0s
Soru 643Soru →

A software-as-a-service (SaaS) provider is exposing a REST API hosted on Amazon API Gateway to business partners. The partners need to authenticate using their own enterprise SAML 2.0 Identity Providers (IdPs). The provider wants to minimize custom authorization code and directly validate partner users before allowing them to invoke backend services. Which two configuration steps must the developer perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool.; Create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).

Cevap

Configure the external SAML 2.0 Identity Provider (IdP) as a federated provider in an Amazon Cognito User Pool, and create an Amazon API Gateway authorizer of type Cognito User Pool, reference the User Pool, and define the identity source header containing the JSON Web Token (JWT).
To authenticate external SAML 2.0 Identity Providers with Amazon API Gateway while minimizing custom code, the developer should configure the SAML IdP as a federated identity provider in an Amazon Cognito User Pool. The client application will authenticate with the User Pool and receive a JSON Web Token (JWT). The developer should then create a built-in Cognito User Pool Authorizer in API Gateway. This authorizer automatically validates the JWT passed in the specified Identity Source header without requiring any custom Lambda code.

Adım Adım Çözüm

1
Configure SAML 2.0 federation in an Amazon Cognito User Pool.
External partner users can authenticate with their own IdP, and Cognito User Pools will issue standard OIDC JSON Web Tokens (JWTs).
This establishes federation and manages user sessions without requiring custom login directories or credentials storage.
2
Configure a Cognito User Pool Authorizer on the REST API methods.
API Gateway automatically verifies the JWT signature and claims for each API call against the Cognito User Pool configuration.
This fulfills the requirement to validate user authenticity at the API Gateway edge with zero custom code.

Anahtar Kavram

Integrating Amazon API Gateway with Amazon Cognito User Pools allows federated authentication (like SAML 2.0) to be easily validated at the API edge. The built-in Cognito Authorizer handles signature verification and token validation automatically, avoiding the need for custom Lambda authorizers or manual STS credential exchange.
Soru 644Soru →

A development team is designing a highly scalable, stateless web application deployed on Amazon Elastic Container Service (ECS) tasks behind an Application Load Balancer. The application database layer is hosted on Amazon DynamoDB. The application requires:
1. Low-latency retrieval of product catalog data, which is read frequently but updated infrequently.
2. Reliable preservation of user shopping cart session state that must survive ECS task scale-in events.

Which TWO architectural configurations should the developer implement to meet these requirements? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon DynamoDB Accelerator (DAX) cluster for the catalog table, routing read operations through the DAX client SDK.; Store user session states in an Amazon ElastiCache for Redis cluster with replication enabled, and configure the application to read and write session data from the cluster.

Cevap

Configure an Amazon DynamoDB Accelerator (DAX) cluster for the catalog table and route read operations through the DAX client SDK, and store user session states in an Amazon ElastiCache for Redis cluster with replication enabled.
Utilizing Amazon ElastiCache for Redis with replication enabled ensures that user session data is durable and decoupled from the ephemeral container lifecycle of ECS tasks. Implementing Amazon DynamoDB Accelerator (DAX) ensures microsecond read latency and reduces the RCU load on the DynamoDB catalog table.

Adım Adım Çözüm

1
Analyze the requirements for product catalog data caching.
Catalog data is frequently read but rarely changed. It is stored in DynamoDB, making DynamoDB Accelerator (DAX) the ideal caching solution as it sits transparently in front of the table.
To offload read throughput and reduce latency to microseconds.
2
Analyze the requirements for user session state preservation.
User session state must be persistent, survive ECS task termination/scaling, and be accessible across multiple ECS instances. ElastiCache for Redis provides a shared, highly available cache.
Redis provides replication and failover support, making it optimal for persistent session management compared to local container storage.
3
Evaluate the non-viable options and eliminate them based on architecture design principles.
Local container caching and Lambda context reuse are ephemeral and fail persistence requirements. Scan operations are highly inefficient and should be avoided. Scaling up provisioned capacity does not address cache architecture requirements.
To ensure compliance with AWS architectural best practices.

Anahtar Kavram

Selecting appropriate caching layers (DAX vs ElastiCache Redis) and implementing externalized session stores for stateless compute workloads.
Soru 645Soru →

A developer is building a serverless web application with a single-page application (SPA) frontend. The frontend needs to access a REST API hosted on Amazon API Gateway. The developer wants to implement user registration and sign-in, and must secure the REST API so that only authenticated users can access the endpoints. To minimize latency and eliminate the operational overhead of writing custom token validation code, which solution should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool to manage user sign-up and sign-in. On the Amazon API Gateway REST API, create a Cognito user pool authorizer to automatically validate the identity or access tokens passed in the request header.

Cevap

Configure an Amazon Cognito User Pool to manage user sign-up and sign-in, and use a built-in API Gateway Cognito user pool authorizer to validate the tokens.
The correct solution involves using a Cognito User Pool to manage user authentication and the built-in API Gateway Cognito authorizer to validate JWT tokens. This satisfies the requirement of minimizing development overhead and latency, as it avoids writing and maintaining a custom Lambda function for token signature validation.

Adım Adım Çözüm

1
Identify the service needed for user authentication directory management.
Amazon Cognito User Pools is selected because it manages user directories, registration, and authentication.
Cognito Identity Pools are for authorization and temporary AWS credential vending, not user registration.
2
Determine the token verification method for API Gateway that minimizes latency and operational overhead.
The built-in API Gateway Cognito user pool authorizer is selected.
It natively validates the signature and expiration of Cognito User Pool tokens without executing custom Lambda code.

Anahtar Kavram

Using Cognito User Pools with built-in API Gateway authorizers for serverless authentication
Soru 646Soru →

A developer is designing a client-side encryption solution for a custom application. The application will use envelope encryption to secure data packets before storing them. The developer calls the AWS KMS `GenerateDataKey` API operation.

Which components does AWS KMS return to the application in the API response?

Cevabı ve açıklamayı göster

Cevap: A plaintext data key and a ciphertext data key

Cevap

A plaintext data key and a ciphertext data key
The correct option is the one stating that a plaintext data key and a ciphertext data key are returned. The `GenerateDataKey` operation is designed to support client-side envelope encryption by providing a plaintext key for immediate encryption by the client application, and a ciphertext key that can be safely stored alongside the encrypted data.

Adım Adım Çözüm

1
Analyze the request to use envelope encryption via the `GenerateDataKey` API operation.
The application needs to encrypt data locally, which requires a data key generated by AWS KMS.
Envelope encryption relies on a data key generated by a root key (KMS Customer Managed Key) to encrypt the actual data.
2
Identify the outputs returned by the `GenerateDataKey` operation.
AWS KMS returns two parts: a plaintext data key for immediate encryption, and a ciphertext data key for storage.
The plaintext key is used to encrypt the data locally and then deleted from memory. The ciphertext key is stored with the encrypted data so it can be decrypted later by calling the KMS Decrypt API.

Anahtar Kavram

AWS KMS Envelope Encryption and the GenerateDataKey API
Tahmini Süre:45s
Soru 647Soru →

A developer is building a serverless client application and needs to implement user authentication and allow authenticated users to upload files directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools to manage the user directory, registration, and authentication.; Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for accessing the Amazon S3 bucket.

Cevap

The developer should configure Amazon Cognito User Pools for user directory authentication, and Amazon Cognito Identity Pools to exchange tokens for temporary AWS credentials to access S3.
Amazon Cognito User Pools act as a user directory to manage registration and authentication, while Amazon Cognito Identity Pools authorize users by providing temporary AWS credentials for accessing AWS services like Amazon S3.

Adım Adım Çözüm

1
Configure an Amazon Cognito User Pool.
Creates a secure user directory that handles registration, login, and issues identity and access tokens upon successful authentication.
This establishes user identity and authentication capabilities for the application.
2
Configure an Amazon Cognito Identity Pool and link it to the User Pool.
Enables the application to federate the User Pool tokens to obtain temporary, limited-privilege AWS IAM credentials.
This provides authorization for the client application to interact directly with other AWS services like Amazon S3.

Anahtar Kavram

Amazon Cognito User Pools vs. Amazon Cognito Identity Pools
Tahmini Süre:1m 0s
Soru 648Soru →

A developer is configuring an AWS Lambda function to run inside a custom VPC. The function needs to retrieve database configuration parameters stored in AWS Systems Manager Parameter Store. The corporate security policy requires that no traffic to Systems Manager may traverse the public internet. During testing, the Lambda function times out whenever it attempts to call the GetParameter API. How should the developer resolve this issue while complying with the security policy?

Cevabı ve açıklamayı göster

Cevap: Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.

Cevap

Create an interface VPC endpoint for Systems Manager in the VPC, and configure the security group of the VPC endpoint to allow inbound HTTPS traffic from the Lambda function's security group.
The correct answer correctly identifies that an interface VPC endpoint (AWS PrivateLink) allows resources inside private subnets to securely connect to Systems Manager over private IP addresses. It also correctly states that the security group of the VPC endpoint must permit inbound HTTPS traffic from the Lambda function's security group.

Adım Adım Çözüm

1
Identify the root cause of the timeout.
The Lambda function inside the VPC has no path to the public Systems Manager endpoint.
By default, resources in private subnets cannot reach the public internet or public AWS services without a NAT Gateway or VPC Endpoint.
2
Apply the corporate security constraint.
Discard solutions involving NAT Gateways or Internet Gateways.
The security policy forbids traffic from traversing the public internet.
3
Select the correct private connectivity mechanism.
Determine that Systems Manager supports Interface VPC Endpoints (AWS PrivateLink).
Interface VPC Endpoints assign private IPs within the VPC to route traffic securely to the service.
4
Configure security groups for the endpoint.
Allow inbound port 443 traffic from the Lambda function's security group to the endpoint's security group.
Security groups control the traffic flow between the Lambda function's ENI and the VPC endpoint's ENI.

Anahtar Kavram

VPC Security and PrivateLink Interface Endpoints for Lambda
Soru 649Soru →

A developer needs to secure a configuration file containing sensitive application credentials that is 15 KB15\text{ KB} in size. The developer wants to implement client-side encryption using a customer managed key in AWS Key Management Service (AWS KMS) before storing the file.

Which approach should the developer take to encrypt this file?

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.

Cevap

Call the KMS GenerateDataKey API to retrieve a plaintext data key and an encrypted data key. Encrypt the configuration file locally using the plaintext data key, then delete the plaintext key from memory and store the encrypted configuration file with the encrypted data key.
The configuration file is 15 KB15\text{ KB}, which exceeds the 4 KB4\text{ KB} limit for direct encryption using the AWS KMS `Encrypt` API. Therefore, client-side envelope encryption is required. Calling `GenerateDataKey` provides both the plaintext data key to perform the local encryption and the encrypted data key to be stored alongside the ciphertext for future decryption.

Adım Adım Çözüm

1
Determine the file size and verify AWS KMS limits.
The file is 15 KB15\text{ KB}, which exceeds the 4 KB4\text{ KB} limit for direct encryption via the KMS `Encrypt` API.
To choose the correct API, the developer must recognize that envelope encryption is required due to the payload size.
2
Generate a data key using AWS KMS.
The developer calls `GenerateDataKey`, receiving a plaintext data key and an encrypted version of it.
The plaintext key is required for local encryption, and the encrypted key is required for future decryption.
3
Encrypt the data locally and clean up memory.
The file is encrypted with the plaintext data key. The plaintext data key is then deleted from memory to maintain security.
Keeping the plaintext key in memory increases the security risk of key exposure.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Soru 650Soru →

A developer is designing a serverless web application where users authenticate via an Amazon Cognito User Pool. The application must meet the following requirements:

1. Access a REST API hosted on Amazon API Gateway, where endpoints must be secured so that only authenticated users can access them with minimal validation latency and zero custom validation code.
2. Upload files directly to an Amazon S3 bucket into a user-specific prefix (s3://app-uploads/\${user_id}/) without routing the files through a backend server.

Which TWO configurations should the developer implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pool Authorizer on the API Gateway REST API, and pass the Cognito ID token in the request Authorization header.; Create an Amazon Cognito Identity Pool with the User Pool configured as an identity provider, and assign an authenticated IAM role that grants access to the S3 bucket using the \${cognito-identity.amazonaws.com:sub} policy variable.

Cevap

Configure a Cognito User Pool Authorizer on the API Gateway REST API, and create a Cognito Identity Pool to obtain temporary AWS credentials mapped to an IAM policy that uses the client's identity ID prefix.
To secure the API Gateway REST API with zero custom code and low latency, a native Cognito User Pool Authorizer is configured to inspect the Authorization header and validate the ID token locally. To authorize direct uploads to S3, a Cognito Identity Pool is required to act as the credential broker. The client exchanges the User Pool token for temporary AWS credentials. By associating the authenticated IAM role of the Identity Pool with a policy that limits access using the identity ID context variable, users are securely restricted to their own folders.

Adım Adım Çözüm

1
Select the appropriate authorization mechanism for API Gateway endpoints.
Using the native Cognito User Pool Authorizer validates tokens at the API Gateway edge, meeting the requirement of zero custom code and minimal latency.
This avoids the overhead of managing a custom Lambda authorizer or calling external Cognito APIs on every request.
2
Address the requirement for direct S3 bucket access from the client.
Since S3 does not validate Cognito User Pool JWT tokens directly, temporary AWS credentials must be obtained.
An AWS Identity Pool is required to exchange Cognito User Pool tokens for short-lived IAM credentials.
3
Implement resource isolation for S3 prefixes in the IAM policy.
Associate the authenticated role of the Identity Pool with an IAM policy that grants permission to the S3 bucket using the context variable for the Cognito identity ID.
This ensures users can only write to their own folder path using the unique identity pool subject identifier.

Anahtar Kavram

Integrating Amazon Cognito User Pools for API Gateway authentication and Cognito Identity Pools for S3 authorization.
Tahmini Süre:3m 0s
Soru 651Soru →

An AWS Lambda function is configured to run inside a private subnet of a custom VPC. The function retrieves transaction data from an internal Amazon RDS database and must then send a confirmation request to an external, public HTTP API. The database connection is successful, but the external API call times out. Which network configuration change will resolve the timeout issue?

Cevabı ve açıklamayı göster

Cevap: Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to the NAT Gateway.

Cevap

Place a NAT Gateway in a public subnet, and configure the private subnet's route table to route outbound internet traffic to the NAT Gateway.
For resources inside a private subnet to establish outbound connections to the internet, they must route traffic through a NAT Gateway. The NAT Gateway must be located in a public subnet and have a route from the private subnet's route table pointing 0.0.0.0/00.0.0.0/0 to it.

Adım Adım Çözüm

1
Analyze the network route requirements.
The Lambda function needs to communicate internally with the Amazon RDS database and externally with a public API endpoint.
Establishing both private and public paths helps determine the required VPC components.
2
Select the correct translation gateway for private subnets.
A NAT Gateway must be provisioned in a public subnet of the VPC.
A NAT Gateway maps private IP addresses to a public IP to enable outbound communication with internet resources.
3
Configure the route table.
A route is added to the private subnet's route table directing destination traffic 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
This instructs the VPC router to forward all outbound internet traffic from the private subnet through the NAT Gateway, resolving the connection timeout.

Anahtar Kavram

VPC Routing for Lambda Functions needing Public and Private Access
Tahmini Süre:55s
Soru 652Soru →

A developer is preparing a deployment package for a Python application to be deployed on AWS Elastic Beanstalk. The application requires a Linux system package to be installed on the hosting EC2 instances during deployment, and a custom database connection string environment variable to be configured. Which two configurations should the developer include in the application source bundle to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a folder named `.ebextensions` at the root of the source bundle and place a file ending with `.config` inside it to define the required Linux package.; Define the database connection string environment variable under the `aws:elasticbeanstalk:application:environment` namespace in a `.config` file within the `.ebextensions` folder.

Cevap

Create a folder named `.ebextensions` at the root of the source bundle and place a file ending with `.config` inside it to define the required Linux package; and define the database connection string environment variable under the `aws:elasticbeanstalk:application:environment` namespace in a `.config` file within the `.ebextensions` folder.
The correct configurations involve creating a `.ebextensions` folder at the root of the source bundle containing `.config` files. System packages are installed using the `packages` key, and environment variables are set using the `aws:elasticbeanstalk:application:environment` namespace within these files.

Adım Adım Çözüm

1
Identify the mechanism for custom environment configuration and package installation in AWS Elastic Beanstalk.
AWS Elastic Beanstalk uses configuration files under the `.ebextensions` directory at the root of the source bundle.
This is the native mechanism for customization of the platform and application environment during deployment.
2
Determine the correct directory naming and location rules.
The folder must be named `.ebextensions` with a leading dot and must be at the root of the zip source bundle.
Elastic Beanstalk checks this specific path; missing the dot (e.g. `ebextensions`) or using `.elasticbeanstalk` (reserved for local EB CLI) will cause configurations to be ignored.
3
Identify the standard namespace for environment variables inside the configuration files.
The namespace to define environment properties is `aws:elasticbeanstalk:application:environment`.
Specifying variables within this namespace injects them as environment variables accessible to the application code.

Anahtar Kavram

AWS Elastic Beanstalk environment customization using .ebextensions configuration files
Soru 653Soru →

A developer is designing a containerized microservice on Amazon ECS that processes and stores sensitive customer profiles. During a compliance audit, the security team mandates that any profile larger than 4 KB4\text{ KB} must be encrypted before being written to an external database. The microservice must also retrieve and decrypt these profiles. Additionally, the database credentials used by the microservice must be rotated automatically every 30 days.

Which combination of AWS services and programmatic workflows should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation. For customer profiles, implement client-side envelope encryption by calling the KMS GenerateDataKey API to obtain a plaintext data key and a ciphertext data key, encrypting the profile locally with the plaintext data key, and storing the ciphertext data key along with the encrypted profile.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation, and use client-side envelope encryption with the KMS GenerateDataKey API to encrypt and decrypt the large customer profiles.
The correct option correctly identifies AWS Secrets Manager for storing and automatically rotating database credentials. It also correctly specifies the client-side envelope encryption workflow using the KMS GenerateDataKey API to obtain both plaintext and ciphertext data keys, allowing the application to encrypt the large profile payload locally.

Adım Adım Çözüm

1
Analyze the file size constraint and encryption method.
Since customer profiles exceed the 4 KB4\text{ KB} (4096 bytes) payload limit of the KMS direct encryption APIs (such as Encrypt), client-side envelope encryption must be used.
Direct encryption with KMS is restricted to small data sizes, whereas envelope encryption allows encrypting data of any size locally using a data key generated by KMS.
2
Select the correct KMS API for generating the data key.
Call the GenerateDataKey API to receive both the plaintext data key and the ciphertext (encrypted) data key.
The application needs the plaintext key to encrypt the profile locally using a symmetric algorithm. GenerateDataKeyWithoutPlaintext only returns the ciphertext key, which cannot be used for encryption without an additional Decrypt call.
3
Determine the service and mechanism for credentials storage and rotation.
Store database credentials in AWS Secrets Manager and enable automatic rotation.
AWS Secrets Manager natively supports automatic rotation of database credentials, whereas AWS KMS manages cryptographic keys rather than credentials, and Systems Manager Parameter Store does not offer built-in automatic rotation.

Anahtar Kavram

AWS KMS envelope encryption and secrets rotation constraints
Soru 654Soru →

A developer manages a production environment deployed using an AWS CloudFormation stack. The stack contains an Amazon RDS DB instance, an Amazon EC2 instance, and an IAM role. A system administrator manually changed the security group of the RDS DB instance in the Amazon VPC Console to address a transient connection issue.

During a subsequent stack update to upgrade the database engine version and add policies to the IAM role, the update fails during the RDS DB instance modification. CloudFormation attempts to roll back the changes, but the rollback fails and remains stuck in the `UPDATE_ROLLBACK_FAILED` state because the manually modified security group configuration prevents the database rollback. The developer must complete the stack update, ensuring the new IAM policies are applied and the database is upgraded.

Which sequence of actions must the developer perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Execute `aws cloudformation continue-update-rollback` specifying the logical ID of the RDS DB instance in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Revert the manual security group modifications on the RDS DB instance in the Amazon VPC Console to align the resource's physical state with the template, and then perform a new stack update with the corrected database engine version and the updated IAM role template.

Cevap

Execute `aws cloudformation continue-update-rollback` with the `--resources-to-skip` parameter for the RDS DB instance, revert the manual security group modifications in the console, and then perform a new stack update.
The correct sequence begins by executing the `continue-update-rollback` command and specifying the logical ID of the RDS DB instance in the `--resources-to-skip` parameter. This instructs CloudFormation to set the status of the RDS DB instance to update/rollback complete (leaving its physical state unchanged) and proceed with rolling back the rest of the stack, shifting the overall stack status to `UPDATE_ROLLBACK_COMPLETE`. Because skipping the resource leaves it inconsistent with the template, the developer must manually revert the out-of-band security group changes in the VPC Console to match the template. Once reconciled, a new stack update can be run successfully to apply the database upgrade and the new IAM role policies.

Adım Adım Çözüm

1
Invoke the continue-update-rollback command with skipped resources
The command `aws cloudformation continue-update-rollback --stack-name <stack-name> --resources-to-skip <RDS-Logical-ID>` is executed, transitioning the stack to the `UPDATE_ROLLBACK_COMPLETE` state.
When a stack is stuck in `UPDATE_ROLLBACK_FAILED`, you must use `continue-update-rollback`. Specifying the failing resource in `--resources-to-skip` allows CloudFormation to bypass rolling back that specific resource and successfully roll back the rest of the stack (such as the IAM role).
2
Reconcile resource drift manually
The manual changes made to the RDS DB instance security group are reverted in the AWS Management Console to match the configuration defined in the template.
Skipping a resource leaves its physical state inconsistent with the stack template. To avoid future update failures due to drift, the physical resource must be aligned with the template before launching a new update.
3
Perform the stack update again
The stack update is executed with the corrected configuration, upgrading the database engine version and applying the new IAM policies.
With the stack in a stable state (`UPDATE_ROLLBACK_COMPLETE`) and the resources reconciled, the update can now be cleanly processed.

Anahtar Kavram

Handling AWS CloudFormation UPDATE_ROLLBACK_FAILED states by skipping resources and reconciling out-of-band drift.
Tahmini Süre:3m 0s
Soru 655Soru →

A company is building a multi-tenant REST API using Amazon API Gateway. The API must validate incoming calls from clients using a custom JSON Web Token (JWT) sent in the X-Custom-Auth header. The token validation requires checking the token's signature against a public key, verifying that the tenant_id claim matches a list of active tenants, and dynamically generating an IAM policy to restrict access to only the tenant's specific resources. The authorization decision needs to be cached for 300 seconds to optimize performance. Which solution should a developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.

Cevap

Create a Lambda authorizer of type REQUEST. Configure method.request.header.X-Custom-Auth as the identity source. In the Lambda function, validate the JWT, extract the tenant_id claim, construct an IAM policy targeting the tenant's specific resource path, and return the policy.
The correct solution uses a REQUEST-type Lambda authorizer. By defining the identity source as `method.request.header.X-Custom-Auth`, API Gateway can cache the generated IAM policy for 300 seconds. The Lambda authorizer executes code to validate the third-party JWT, check the tenant_id claim, and return a custom IAM policy that limits access to only the tenant's specific API paths, complying with least-privilege security principles.

Adım Adım Çözüm

1
Determine the appropriate authorization mechanism.
Since custom JWT verification, claim validation (tenant_id), and dynamic IAM policy generation are required, a built-in Cognito User Pool authorizer cannot be used. A Lambda authorizer is required.
Only Lambda authorizers allow running custom code to validate third-party tokens and output dynamically generated IAM policies.
2
Select the Lambda authorizer type and identity source.
Use a REQUEST-type Lambda authorizer with `method.request.header.X-Custom-Auth` configured as the identity source.
A REQUEST authorizer provides access to request headers, query parameters, and stage variables. Defining the header as the identity source allows API Gateway to cache the authorization policy for the specified 300-second TTL.
3
Implement validation and least-privilege IAM policy generation in the Lambda function.
The Lambda function verifies the signature of the token from X-Custom-Auth, decodes the payload, validates the tenant_id claim, and returns an IAM policy allowing access only to `arn:aws:execute-api:region:account-id:api-id/stage/method/tenant-resource/*`.
This guarantees security boundaries between tenants and adheres to the IAM principle of least privilege.

Anahtar Kavram

API Gateway Lambda Authorizer with Token Caching and Scoped IAM Policies
Soru 656Soru →

A developer is building a REST API using Amazon API Gateway and wants to restrict access to authenticated users from a specific Amazon Cognito User Pool. The developer wants to use the built-in integration features of API Gateway without writing custom code for authentication validation. Which two actions must the developer perform to configure a Cognito User Pools authorizer for the API? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Cognito User Pool authorizer in API Gateway and configure it with the Cognito User Pool details.; Configure the API Gateway resource method to use the newly created Cognito User Pool authorizer.

Cevap

To configure a Cognito User Pools authorizer, the developer must create the Cognito User Pool authorizer in API Gateway and then configure the API method to use that authorizer.
To secure the API using Cognito User Pools natively, the developer needs to create a Cognito User Pool authorizer in API Gateway and then assign that authorizer to the respective resource methods. This offloads authentication from backend integrations to API Gateway.

Adım Adım Çözüm

1
Set up the authorizer in API Gateway.
A Cognito User Pool authorizer is created and pointed to the appropriate User Pool.
This establishes the validation source for the incoming JWT tokens without requiring custom code.
2
Associate the authorizer with the API resource method.
The target HTTP method on the resource is configured to require authentication via the new authorizer.
This ensures that API Gateway blocks unauthorized requests before they reach the backend integration.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer
Tahmini Süre:1m 0s
Soru 657Soru →

A developer is deploying an update to a production web application hosted on AWS Elastic Beanstalk. The update must satisfy the following constraints:

* The application must maintain its full capacity of active instances throughout the deployment process to handle consistent user traffic.
* If the new version fails to deploy or pass health checks, the environment must roll back to the previous version automatically and as quickly as possible.
* The update must not require a DNS CNAME swap, as the domain name is mapped to a static resource external to the environment.
* The configuration must be managed programmatically as code inside the application source bundle.

Which configuration file path and content structure will satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: A file named `.ebextensions/deployment.config` with the following content:

yaml
option_settings:
aws:elasticbeanstalk:command:
DeploymentPolicy: Immutable

Cevap

A file named `.ebextensions/deployment.config` with the `DeploymentPolicy` set to `Immutable` under the `aws:elasticbeanstalk:command` namespace.
The correct option specifies a file inside the `.ebextensions/` directory with the `DeploymentPolicy` configured as `Immutable`. The Immutable policy meets all requirements: it maintains 100% capacity by deploying a temporary Auto Scaling group, requires no CNAME swap since it updates the existing environment, and performs an immediate, automated rollback by terminating the new Auto Scaling group if the deployment or health checks fail.

Adım Adım Çözüm

1
Analyze the capacity and rollback requirements.
The requirement to maintain 100% capacity during updates rules out All at Once and Rolling deployments. The requirement for immediate, automatic rollback rules out Rolling with Additional Batch.
Immutable deployments launch a full set of new instances in a separate Auto Scaling group, keeping the old ones at 100% capacity. If health checks fail, the new Auto Scaling group is terminated instantly.
2
Evaluate the DNS CNAME swap constraint.
The requirement to avoid DNS or CNAME swaps rules out Blue/Green deployments.
Blue/Green deployment requires swapping the CNAMEs of two separate Elastic Beanstalk environments, which violates the constraint.
3
Identify the correct configuration mechanism and folder path.
The configuration must be defined inside the `.ebextensions/` folder at the root of the source bundle.
Elastic Beanstalk configuration files must reside in the `.ebextensions/` directory (with a leading dot). Files in directories without the leading dot, such as `ebextensions/`, are ignored.

Anahtar Kavram

AWS Elastic Beanstalk Immutable deployment policy and configuration files
Soru 658Soru →

An online multiplayer gaming application uses AWS Lambda behind an Amazon API Gateway to process game lobby updates. The application stores game session states in an Amazon DynamoDB table. During peak hours, a small number of extremely popular game lobbies experience rapid, successive read and write operations (multiple updates per second), resulting in frequent 'ProvisionedThroughputExceededException' errors. How should the developer modify the architecture to resolve these throttling errors most effectively?

Cevabı ve açıklamayı göster

Cevap: Migrate the session state storage to an Amazon ElastiCache for Redis cluster, configuring the application to read and write session updates directly to the in-memory cache.

Cevap

Migrate the session state storage to an Amazon ElastiCache for Redis cluster, configuring the application to read and write session updates directly to the in-memory cache.
Migrating the session state storage to Amazon ElastiCache for Redis is the correct solution because it is designed to handle high-throughput, low-latency in-memory reads and writes. This removes the write-intensive session updates from the relational or DynamoDB database completely, resolving the hot partition bottleneck.

Adım Adım Çözüm

1
Analyze the workload characteristics and failure points.
The workload requires high-rate read and write operations (multiple updates per second) concentrated on a small subset of popular keys, resulting in DynamoDB hot partition write throttling.
Identifying that the issue involves both reads and writes on hot partition keys is crucial to selecting the correct caching layer.
2
Evaluate DynamoDB Accelerator (DAX) capability for write-heavy workloads.
DAX is write-through, meaning writes go to the cache and the database synchronously. DAX does not absorb or reduce the write load on DynamoDB.
This rules out DAX as a solution for write throttling on hot keys.
3
Evaluate DynamoDB scaling capabilities.
Scaling up WCUs or enabling auto-scaling cannot bypass the throughput limits of a single partition (1000 WCUs) when a single hot key receives concentrated traffic.
This rules out table-level scaling adjustments.
4
Select the correct caching and state management service.
Amazon ElastiCache for Redis supports high-throughput in-memory reads and writes, bypassing the database write bottleneck for active session state.
Using ElastiCache for Redis is the industry standard for fast-moving session data with high write concurrency.

Anahtar Kavram

Caching strategies and session state management for write-heavy hot-key workloads using ElastiCache vs DAX vs DynamoDB.
Soru 659Soru →

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires access to a database password that must be rotated automatically every 30 days.

Which approach should the developer use to reference this password in the CloudFormation template while meeting the security requirements?

Cevabı ve açıklamayı göster

Cevap: Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.

Cevap

Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.
The correct option is to retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager. Secrets Manager is designed specifically to handle sensitive information and provides built-in integration for automatic rotation of credentials. CloudFormation can securely fetch the current version of the secret during deployment using dynamic references.

Adım Adım Çözüm

1
Identify the rotation requirement.
The requirement specifies that the database password must be rotated automatically every 30 days.
AWS Secrets Manager natively supports automatic secrets rotation using AWS Lambda, whereas Systems Manager Parameter Store does not have a native, out-of-the-box automatic rotation feature.
2
Integrate the secret with CloudFormation.
Configure a dynamic reference pattern like '{{resolve:secretsmanager:secret-id}}' within the CloudFormation resource properties.
This allows CloudFormation to fetch the latest version of the secret at deployment time without hardcoding it or exposing it in plaintext.

Anahtar Kavram

AWS CloudFormation Dynamic References with AWS Secrets Manager
Soru 660Soru →

A developer is designing a native mobile application that requires users to authenticate. Once logged in, the application must allow users to upload files directly to their own dedicated folders in an Amazon S3 bucket. Additionally, the application must call a backend REST API hosted on Amazon API Gateway that requires user authentication. The developer wants to implement a secure solution that minimizes custom code and management overhead.

Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito Identity Pool, specify the User Pool as an identity provider, and associate an authenticated IAM role that allows access to user-specific S3 paths.; Configure a Cognito User Pool authorizer on the API Gateway REST API, and configure the application to pass the ID token in the authorization header.

Cevap

Create an Amazon Cognito Identity Pool linked to the User Pool for S3 access, and use a built-in Cognito User Pool authorizer on API Gateway.
The correct options recommend creating an Amazon Cognito Identity Pool and configuring a built-in Cognito User Pool authorizer. Amazon Cognito User Pools handle user directory services, registration, and authentication (generating JWT tokens). Amazon Cognito Identity Pools enable authorization by exchanging these JWT tokens for temporary AWS IAM credentials, which are required for direct interactions with AWS services like Amazon S3. For the REST API on Amazon API Gateway, using the built-in Cognito User Pool authorizer is the most efficient and low-overhead method to validate User Pool tokens (ID tokens) without writing custom Lambda authorizer code.

Adım Adım Çözüm

1
Differentiate between authentication and authorization requirements for direct AWS resource access vs API endpoints.
Identified that User Pools authenticate users, while Identity Pools authorize access to AWS resources (S3) by vending temporary credentials.
This establishes the necessary Cognito services to include in the architecture.
2
Select the most efficient API Gateway authorizer type for User Pool JWT tokens.
Chose the built-in Cognito User Pool Authorizer rather than a custom Lambda authorizer.
Using the built-in authorizer reduces development overhead, avoids execution costs, and simplifies configuration.
3
Configure the security policies for the IAM roles assumed via Cognito Identity Pools.
Linked the S3 access policy to the IAM permissions policy and verified that the trust relationship policy only specifies the Cognito service principal.
This ensures IAM credentials can be assumed correctly and carry the proper fine-grained access permissions.

Anahtar Kavram

Amazon Cognito User Pools vs. Identity Pools and API Gateway Authorization
Tahmini Süre:2m 0s
ÖncekiSayfa 33 / 78Sonraki
Tüm alıştırma soruları — AWS Certified Developer - Associate | Examkin