Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 721Soru →

A developer needs to update a web application running on AWS Elastic Beanstalk. The deployment must meet the following constraints:
- The application must have zero downtime during the update.
- The deployment must maintain 100% of the active instance capacity at all times.
- The update must be performed within the existing Elastic Beanstalk environment.

Which of the following Elastic Beanstalk deployment policies satisfy these constraints? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Rolling with additional batch; Immutable

Cevap

The Rolling with additional batch and Immutable deployment policies meet all the constraints.
The Rolling with additional batch policy launches a new batch of instances first to maintain the original capacity before rolling out the update to existing instances. The Immutable policy launches a temporary Auto Scaling group to deploy the new version alongside the existing group. Both methods ensure 100% of active instance capacity is maintained, have zero downtime, and operate within the existing environment.

Adım Adım Çözüm

1
Evaluate the requirement for zero downtime and 100% capacity maintenance within a single Elastic Beanstalk environment.
The policies that do not temporarily reduce capacity (like Rolling) or take the entire environment offline (like All-at-once) must be selected.
This filters out All-at-once and Rolling.
2
Evaluate the requirement to perform the update within the existing Elastic Beanstalk environment.
The Blue/Green deployment method is ruled out because it requires launching a separate, new environment and swapping URLs.
This filters out Blue/Green.
3
Identify the remaining valid Elastic Beanstalk deployment policies.
Rolling with additional batch and Immutable deployment policies both maintain 100% capacity, ensure zero downtime, and run within the existing environment.
These policies fulfill all stated requirements.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, downtime, and cost.
Soru 722Soru →

A developer is designing a serverless backend using AWS Lambda that connects to an Amazon RDS for PostgreSQL database. The application security policy requires that database passwords be rotated automatically every 30 days. Additionally, the Lambda function needs to retrieve non-sensitive configuration parameters, such as logging levels and external API endpoints. Which combination of actions should the developer take to implement these requirements securely and cost-effectively? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.; Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Cevap

Storing the database credentials in AWS Secrets Manager with built-in automatic rotation enabled, and storing the non-sensitive configurations in AWS Systems Manager Parameter Store as Standard parameters.
AWS Secrets Manager is designed for managing secrets such as database credentials and supports automated rotation out of the box, specifically with integrations for Amazon RDS. AWS Systems Manager Parameter Store is ideal for general, non-sensitive configuration parameters because Standard parameters are free, making it the most cost-effective choice for configurations that do not require rotation or encryption.

Adım Adım Çözüm

1
Identify the storage and rotation requirements for the database credentials.
Database credentials are sensitive and require automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in rotation integration with Amazon RDS.
Parameter Store does not natively support automatic rotation, so using Parameter Store would require writing custom rotation logic.
2
Identify the storage and cost requirements for non-sensitive configurations.
Non-sensitive configurations (like logging levels) do not require rotation or encryption. Storing them in Parameter Store as Standard parameters is free and meets the cost-effectiveness requirement.
Storing non-sensitive config in Secrets Manager would incur unnecessary monthly costs per secret.

Anahtar Kavram

Distinguishing between AWS Secrets Manager and AWS Systems Manager Parameter Store features and cost profiles.
Soru 723Soru →

A developer is designing a secure mobile banking application. The application uses Amazon API Gateway for its backend REST APIs and stores user documents in an Amazon S3 bucket. The security requirements are:

1. Access to the API Gateway APIs must be restricted to authenticated users. The API Gateway must natively validate the users' JSON Web Tokens (JWTs) without invoking a custom function.
2. Users must be able to upload documents directly to their own folder within the S3 bucket using temporary AWS credentials, ensuring least-privilege access.

Which two configurations should the developer implement to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate the JSON Web Tokens (JWTs) provided by the client application.; Associate the Cognito User Pool with a Cognito Identity Pool to exchange authenticated tokens for temporary AWS IAM credentials, and assign an IAM policy with resource-level permissions for S3 folder access.

Cevap

To meet the requirements, the developer should configure a Cognito User Pool Authorizer on the API Gateway REST API to natively validate user tokens, and associate the Cognito User Pool with a Cognito Identity Pool to issue temporary AWS IAM credentials with policies that grant restricted folder access to the S3 bucket.
The correct configurations involve using a Cognito User Pool Authorizer to validate JWT tokens natively at the API Gateway level, and utilizing a Cognito Identity Pool in conjunction with the User Pool to provide authenticated users with temporary AWS IAM credentials. This enables secure, direct document uploads to specific S3 folders using IAM policies containing user identity variables.

Adım Adım Çözüm

1
Configure the native authentication mechanism at API Gateway.
Create and deploy a Cognito User Pool Authorizer on the REST API methods. This offloads the token signature and expiration verification directly to API Gateway.
This meets the requirement of natively validating JWTs without writing and invoking custom Lambda functions.
2
Establish federated identity for AWS resource authorization.
Create an Amazon Cognito Identity Pool and configure the Cognito User Pool as an authentication provider.
This allows the client application to exchange the ID token received during user login for temporary AWS IAM credentials.
3
Enforce least-privilege direct access on the S3 bucket.
Attach an IAM policy to the Identity Pool's authenticated role that grants s3:PutObject permissions to paths matching the user's specific identity ID using the policy variable ${cognito-identity.amazonaws.com:sub}.
This allows authenticated mobile users to upload files directly to their personal folders on S3 without passing through backend servers, complying with the principle of least privilege.

Anahtar Kavram

Combining Cognito User Pools for native API Gateway authorization and Cognito Identity Pools for exchanging authentication tokens for temporary AWS credentials to access S3 directly under least privilege.
Tahmini Süre:2m 0s
Soru 724Soru →

A developer needs to encrypt a configuration file containing sensitive database credentials. The file size is 2 KB2\text{ KB}, and the developer decides to use direct encryption with an AWS Key Management Service (AWS KMS) customer managed key before uploading the file to Amazon S3. Which of the following actions must be taken to successfully encrypt this file? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the `Encrypt` API operation, passing the plaintext configuration data and the customer managed key identifier.; Configure the KMS key policy of the customer managed key to grant the application's IAM role permission to perform the `kms:Encrypt` action.

Cevap

The configuration file can be encrypted by calling the KMS `Encrypt` API operation directly, and the application's IAM role must have the `kms:Encrypt` permission allowed in the customer managed key's key policy.
Direct encryption using the KMS `Encrypt` API operation is suitable for data payloads up to 4 KB4\text{ KB}. To perform this action, the caller's IAM role must be granted permissions in the customer managed key's key policy.

Adım Adım Çözüm

1
Determine the size of the payload to be encrypted.
The file size is 2 KB2\text{ KB}, which is under the 4 KB4\text{ KB} limit for direct KMS encryption.
Knowing the payload size helps determine whether direct encryption or envelope encryption is appropriate.
2
Verify key policy permissions.
Ensure the KMS key policy allows the IAM role to call `kms:Encrypt`.
KMS key policies must explicitly grant usage permissions even if the IAM policy allows it.
3
Perform the encryption using the SDK.
Call the `Encrypt` API with the plaintext payload and the key ID.
This generates the ciphertext directly without generating local data keys.

Anahtar Kavram

Direct encryption with AWS KMS using the Encrypt API operation is suitable for small payloads up to 4 KB4\text{ KB}, provided that appropriate key policy permissions are configured.
Tahmini Süre:1m 30s
Soru 725Soru →

A developer is configuring a standard release pipeline in AWS CodePipeline to automate deployment. The pipeline must pull source code from an AWS CodeCommit repository, run tests and compile the code using AWS CodeBuild, require a manual sign-off from the quality assurance team, and finally deploy the application to AWS Elastic Beanstalk.

Arrange the actions in the correct sequence of execution from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of actions in the pipeline is: Source action (AWS CodeCommit), Build action (AWS CodeBuild), Manual approval action, and Deploy action (AWS Elastic Beanstalk).
AWS CodePipeline processes stages sequentially. The pipeline must first fetch the source code, compile and test it in the build phase, pause for manual verification, and finally deploy the verified package.

Adım Adım Çözüm

1
Retrieve the source code from AWS CodeCommit.
The latest revision of the source code is retrieved and package artifacts are created.
Subsequent stages require the source code to perform builds and deployments.
2
Trigger the AWS CodeBuild environment to compile the application and run unit tests.
The application code is verified and a deployment package is generated.
Building the application generates the necessary artifacts that need to be reviewed and deployed.
3
Halt the pipeline for a Manual Approval action.
The pipeline execution pauses, and a notification is sent to the QA team for review.
This guarantees that the built artifacts are verified and approved before they reach the production environment.
4
Deploy the application using the AWS Elastic Beanstalk deployment action.
The verified application version is deployed to the Elastic Beanstalk environment.
Deploying is the final step in the pipeline after the application has been built and approved.

Anahtar Kavram

AWS CodePipeline action execution order
Soru 726Soru →

An application currently stores session data in the memory of individual web servers, which prevents the application tier from scaling horizontally. A developer needs to refactor the application to store session states externally with sub-millisecond to single-digit millisecond latency. Which TWO solutions should the developer use to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon ElastiCache for Redis; Amazon DynamoDB

Cevap

Amazon ElastiCache for Redis and Amazon DynamoDB
Amazon ElastiCache for Redis and Amazon DynamoDB are correct because they are managed, external services that offer the low-latency (sub-millisecond to single-digit millisecond) and high-throughput capabilities required for distributed session state storage.

Adım Adım Çözüm

1
Identify the requirement for horizontal scalability and low latency for storing session states externally.
The solution must support high-throughput, low-latency reads and writes, and be accessible globally by all application servers.
Storing sessions locally prevents horizontal scaling because user requests must be pinned to a specific server (session stickiness).
2
Evaluate the AWS services designed for low-latency, scalable key-value storage.
Amazon ElastiCache for Redis (in-memory data store) and Amazon DynamoDB (NoSQL database) both provide fast, scalable, and external state management.
These services decouple session state from the compute tier, enabling stateless application servers to scale out.

Anahtar Kavram

Decoupling session state to external stores like ElastiCache or DynamoDB to enable stateless, horizontally scalable application tiers.
Soru 727Soru →

An application's secure ingestion service receives files and needs to prepare them for later encryption by a separate worker service running in a restricted environment. The ingestion service must generate an encrypted data key and store it alongside each file's metadata in a database. To minimize the attack surface, the security architecture requires that the ingestion service must never have access to the plaintext version of the data key. Which AWS KMS API operation should the developer call in the ingestion service to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: GenerateDataKeyWithoutPlaintext

Cevap

GenerateDataKeyWithoutPlaintext
The GenerateDataKeyWithoutPlaintext operation generates a unique symmetric data key under a specified KMS key and returns only the encrypted ciphertext representation of that data key. This prevents the ingestion service from exposing or holding the plaintext data key in memory, satisfying the security policy.

Adım Adım Çözüm

1
Analyze the security constraints and envelope encryption requirements.
The ingestion service needs an encrypted data key to store but must not access the plaintext data key.
This determines the specific KMS API call needed to omit the plaintext data key from the response.
2
Identify the KMS API operation that generates data keys without returning the plaintext component.
GenerateDataKeyWithoutPlaintext is identified as the operation that returns only the ciphertext data key.
Unlike GenerateDataKey, which returns both plaintext and ciphertext, GenerateDataKeyWithoutPlaintext satisfies the zero-plaintext exposure constraint.

Anahtar Kavram

AWS KMS Envelope Encryption API operations
Soru 728Soru →

A developer is building a client-facing web application and needs to restrict access to a REST API hosted on Amazon API Gateway. The application's users will sign in using an Amazon Cognito User Pool. The developer wants to secure the API Gateway endpoints by validating the identity tokens issued to users upon login, with the least amount of development effort and custom code. Which authorization method should the developer configure on the API Gateway resources?

Cevabı ve açıklamayı göster

Cevap: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.

Cevap

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway resources.
Using the built-in Amazon Cognito User Pools authorizer is the most efficient method because Amazon API Gateway natively validates tokens issued by Amazon Cognito. This eliminates the need to develop, test, and maintain custom Lambda authorizer code, which minimizes development effort and operational overhead.

Adım Adım Çözüm

1
Identify the authentication provider and the development constraints.
The application uses Amazon Cognito User Pools for user sign-in and token issuance, and requires token validation with the least development effort.
This establishes that we need a solution that integrates natively with Cognito User Pools tokens without custom code.
2
Evaluate API Gateway security integration types.
Amazon API Gateway offers a built-in Cognito User Pools authorizer that automatically validates the signature and expiration of Cognito JSON Web Tokens (JWTs).
Choosing a native authorizer avoids the need to write and maintain custom validation logic inside a Lambda function.

Anahtar Kavram

Built-in Cognito User Pools Authorizer in Amazon API Gateway
Soru 729Soru →

A developer is preparing a Java application package for deployment to an AWS Elastic Beanstalk environment. The application requires a custom system-level utility, `htop`, to be installed on the underlying Amazon EC2 instances. Additionally, the application requires an environment variable named `DB_HOST` to be accessible at runtime. Which two actions should the developer take to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a configuration file ending with `.config` inside a directory named `.ebextensions` at the root of the application source bundle, and use the `packages` section to define the `htop` installation.; Configure the `DB_HOST` environment variable in the Environment Properties section of the Elastic Beanstalk environment configuration.

Cevap

Create a configuration file ending with `.config` in a folder named `.ebextensions` at the root of the application source bundle to install the package, and configure the environment variable in the Environment Properties section under the Elastic Beanstalk environment configuration.
The correct solution involves leveraging `.ebextensions` at the root of the source bundle to configure package dependencies and using the Environment Properties configuration setting to handle variable values, satisfying both host-level and application-level requirements.

Adım Adım Çözüm

1
Determine how to run custom package installations on the host instance during Elastic Beanstalk deployment.
Identify that the `.ebextensions` directory must be located at the root of the source bundle and contain a `.config` file with a `packages` block.
This directory is read by the Elastic Beanstalk platform agent to apply customizations before the application starts.
2
Determine how to provide configuration settings to the application environment at runtime.
Identify that Elastic Beanstalk supports Environment Properties for injecting variables into the execution context.
Setting these properties ensures they are parsed by the OS and available to the Java application code via system environment checks.

Anahtar Kavram

AWS Elastic Beanstalk instance customization via `.ebextensions` configuration files and runtime environment variable configuration.
Soru 730Soru →

A developer is configuring a deployment pipeline in AWS CodePipeline to deploy a serverless application across two AWS accounts. The pipeline resides in Account A, and the application must be deployed to Account B using an AWS CloudFormation action in the deploy stage. The pipeline execution fails at the deploy stage with an access denied error when attempting to assume the deployment IAM role created in Account B.

How should the developer configure the IAM policies to successfully allow the pipeline in Account A to assume the deployment role in Account B?

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.

Cevap

Configure the trust policy of the deployment role in Account B to allow the sts:AssumeRole action from the CodePipeline service role in Account A, and grant the CodePipeline service role in Account A permission to call sts:AssumeRole on the deployment role in Account B.
The correct option correctly establishes two-way trust for cross-account role assumption. The trust policy of the target role in Account B must trust the CodePipeline service role in Account A, and the CodePipeline service role must have an identity-based policy allowing it to assume the target role in Account B.

Adım Adım Çözüm

1
Configure the trust policy in the target account (Account B)
The deployment IAM role in Account B is updated to list the AWS CodePipeline service role ARN from Account A as a trusted principal that can perform sts:AssumeRole.
Establishing trust in the target account's role is mandatory for any cross-account access to succeed.
2
Configure the permissions policy in the source account (Account A)
An identity-based policy is attached to the CodePipeline service role in Account A allowing the sts:AssumeRole action on Account B's deployment role ARN.
The source principal must have explicit permission to assume the external role.
3
Reference the target role in the pipeline configuration
The pipeline deploy stage action configuration is updated with the roleArn parameter pointing to the target deployment role in Account B.
This instructs CodePipeline to assume the cross-account role when executing the CloudFormation action.

Anahtar Kavram

Cross-account role assumption in AWS CodePipeline
Soru 731Soru →

A developer is writing a backend application hosted on AWS Lambda that needs to decrypt a sensitive database connection string. The connection string was previously encrypted directly using an AWS KMS customer managed key (CMK). The Lambda function's IAM execution role has been granted permissions to use the key. Which AWS KMS API action must the developer invoke within the application code to retrieve the plaintext connection string?

Cevabı ve açıklamayı göster

Cevap: Decrypt

Cevap

Decrypt
The Decrypt API operation is the correct action to call because it decrypts ciphertext that was encrypted directly using an AWS KMS key, returning the decrypted plaintext to the application.

Adım Adım Çözüm

1
Identify the source of encryption and the desired output.
The database connection string was encrypted directly using an AWS KMS customer managed key, and the application needs to retrieve the plaintext string.
This establishes that we are dealing with direct decryption of KMS ciphertext rather than local envelope encryption or retrieving a secret from a secret store.
2
Select the correct AWS KMS API operation for direct decryption.
The Decrypt operation is selected.
The Decrypt API operation takes ciphertext encrypted under a KMS key and returns the decrypted plaintext, which matches the application's requirement.

Anahtar Kavram

Direct decryption using AWS KMS API
Soru 732Soru →

A developer is configuring an AWS CodeBuild project that must run within a private subnet of a VPC to perform integration tests against a private Amazon RDS PostgreSQL database. The build process needs to retrieve an encrypted database password from AWS Systems Manager Parameter Store and pull a base image from a private Amazon ECR repository located in a shared-services AWS account. During the build execution, the build fails in the early phases with connection timeouts and permission errors. Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Ensure the CodeBuild project is associated with private subnets that route outbound traffic through a NAT Gateway, or configure Interface VPC endpoints within the VPC for Systems Manager and Amazon ECR.; Grant the CodeBuild service role the ssm:GetParameters and kms:Decrypt permissions for the parameter and its custom KMS key, and retrieve the password using the env: parameter-store block in the buildspec.

Cevap

Configure private subnets with a NAT Gateway or VPC endpoints to establish connectivity, and retrieve the SecureString parameter via the env: parameter-store block while granting the service role both ssm:GetParameters and kms:Decrypt permissions.
For CodeBuild to communicate with AWS services when running inside a VPC, it requires route paths either via a NAT Gateway inside private subnets or Interface VPC endpoints. For SecureString parameters, the parameters must be retrieved using the env: parameter-store block, and the service role must be granted ssm:GetParameters and kms:Decrypt permissions.

Adım Adım Çözüm

1
Diagnose the network timeout error during the early build phases.
Identify that CodeBuild containers launched inside a VPC do not have route paths to external AWS service public endpoints (like Systems Manager or Amazon ECR) by default.
Establishing outbound paths via a NAT Gateway or using local Interface VPC Endpoints inside the VPC is required for VPC-enabled CodeBuild projects to access external resources.
2
Address the Systems Manager Parameter Store access configuration.
Map the parameter inside the env: parameter-store section of the buildspec file rather than env: variables.
Only env: parameter-store triggers CodeBuild to retrieve and decrypt SecureString values from Systems Manager Parameter Store during the build lifecycle.
3
Grant the necessary IAM permissions to the CodeBuild service role.
Ensure the role has ssm:GetParameters and kms:Decrypt permissions for the custom KMS customer managed key (CMK) used to encrypt the password.
AWS-managed default KMS keys cannot be shared across accounts if cross-account access is needed, and accessing custom keys requires explicit ssm and kms permissions.

Anahtar Kavram

Configuring AWS CodeBuild VPC connectivity, ECR access, and IAM service role permissions to decrypt SecureString parameters in a buildspec.
Tahmini Süre:3m 0s
Soru 733Soru →

A developer is deploying a microservice on Amazon ECS that processes sensitive configurations. A configuration file of size 150 KB150\text{ KB} is encrypted client-side using envelope encryption with an AWS KMS customer managed key (CMK). During deployment, the application container fails to start because it cannot decrypt the configuration file.

The current configuration is as follows:
- The `kms:Decrypt` permission is granted to the ECS task execution role.
- The application code attempts to decrypt the entire configuration file by calling the `kms:Decrypt` API directly with the encrypted file content.

Which combination of actions will resolve the decryption failure and allow the application to start up successfully?

Cevabı ve açıklamayı göster

Cevap: Associate the `kms:Decrypt` permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the `kms:Decrypt` API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.

Cevap

Associate the kms:Decrypt permission with the ECS Task Role instead of the ECS Task Execution Role. Update the application code to pass only the encrypted data key to the kms:Decrypt API to retrieve the plaintext data key, then decrypt the configuration file locally using the plaintext data key.
The correct answer correctly identifies that application code running inside an ECS container must use the ECS Task Role for runtime authorization to call KMS APIs. Additionally, in envelope encryption, the actual payload is encrypted locally with a data key, and only the encrypted data key is sent to AWS KMS for decryption. This bypasses the 4 KB4\text{ KB} payload size limit of the `kms:Decrypt` API.

Adım Adım Çözüm

1
Identify the correct IAM role for containerized application execution.
Determine that the ECS Task Role must be configured with `kms:Decrypt` permissions rather than the ECS Task Execution Role.
The ECS Task Execution Role is used by the ECS agent, not the application itself. The ECS Task Role is required for the application container to access AWS services at runtime.
2
Identify the limitations of the KMS Decrypt API.
Determine that the configuration file size of 150 KB150\text{ KB} exceeds the 4 KB4\text{ KB} size limit of the `kms:Decrypt` API.
Direct decryption using KMS is limited to small payloads under 4 KB4\text{ KB}, necessitating envelope encryption.
3
Apply the correct envelope decryption workflow.
Update the code to send only the encrypted data key to KMS, receive the plaintext data key, and decrypt the file locally.
This is the standard envelope encryption pattern, which avoids sending large payloads over the network and bypasses API limits.

Anahtar Kavram

AWS KMS Envelope Decryption and ECS IAM Roles
Tahmini Süre:2m 0s
Soru 734Soru →

A developer is planning to update a non-critical internal application deployed on AWS Elastic Beanstalk. The update will be performed during off-peak hours over the weekend. To stay within budget, the deployment must not provision any additional EC2 instances. The company accepts that the application will be temporarily offline during the deployment process.

Which deployment strategy meets these requirements?

Cevabı ve açıklamayı göster

Cevap: All at once

Cevap

All at once
The 'All at once' strategy is the only Elastic Beanstalk deployment policy that does not provision any additional EC2 instances during the update. It applies the deployment package to all existing instances at the same time. While this causes a short period of downtime (unavailability) during which the application is offline, this aligns with the company's acceptance of weekend downtime and satisfies the strict budget constraint of zero additional instances.

Adım Adım Çözüm

1
Analyze the scenario constraints.
The deployment must not provision any additional EC2 instances (minimal cost) and can tolerate downtime (offline during the weekend).
This establishes the boundaries for acceptable deployment strategies.
2
Evaluate the resource provisioning behavior of each strategy.
Rolling with additional batch, Immutable, and Traffic splitting all require provisioning new instances during the deployment. Only the All at once strategy deploys directly to existing instances without launching new ones.
This filters out strategies that violate the zero-additional-instance cost constraint.
3
Select the strategy that allows downtime and uses only existing instances.
The All at once strategy is selected as it updates all instances simultaneously, causing downtime but requiring no additional resource costs.
This matches all criteria described in the scenario.

Anahtar Kavram

AWS Elastic Beanstalk deployment strategy tradeoffs regarding cost and capacity.
Tahmini Süre:45s
Soru 735Soru →

A developer is building a serverless web application where users authenticate using an Amazon Cognito User Pool. The backend REST API is hosted on Amazon API Gateway with an AWS Lambda integration. The developer wants to restrict access to the `/premium-features` endpoint so that only users who belong to the 'PremiumGroup' in the User Pool can access it. Which approach implements this access control with the least latency and administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.

Cevap

Configure the API Gateway method to use an Amazon Cognito User Pool Authorizer. In the backend Lambda function, check the cognito:groups claim in the request context to verify membership before returning the premium content.
The correct solution uses an Amazon Cognito User Pool Authorizer on API Gateway. When a user authenticates, Cognito issues a JWT (ID or Access token) containing claims about the user, including group membership in the cognito:groups claim. API Gateway automatically validates the token and passes these claims to the backend Lambda integration in the event object. The Lambda function can then inspect the cognito:groups claim to enforce group-based authorization. This approach requires no external database queries or additional API calls, minimizing execution latency.

Adım Adım Çözüm

1
Integrate API Gateway with the Cognito User Pool.
API Gateway automatically validates the incoming JSON Web Token (JWT) sent by the client.
This offloads token validation from the application code and utilizes built-in AWS functionality.
2
Verify group membership inside the backend Lambda integration.
The Lambda function receives the decoded JWT claims in the request context (under the authorizer object) and inspects the cognito:groups claim.
Since the group information is already present in the JWT, checking it in the Lambda function avoids making external network calls to Cognito, keeping latency low.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer integration and JWT claims evaluation
Tahmini Süre:1m 30s
Soru 736Soru →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application code needs to read objects from an Amazon S3 bucket.

Which of the following IAM configurations is required to allow the application code to access the S3 bucket?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Cevap

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.
Configuring an IAM role with Amazon S3 read permissions and assigning it as the Task Role (taskRoleArn) in the ECS task definition is correct. The Task Role is designed to grant application code running inside the ECS container permissions to call AWS APIs.

Adım Adım Çözüm

1
Identify which role is responsible for providing IAM permissions to application code running inside the container.
The Task Role (taskRoleArn) is identified as the role providing permissions directly to the application.
Differentiating between Task Role (application level) and Task Execution Role (ECS agent level) is critical for configuring correct permissions.
2
Formulate the IAM role policy for S3 access.
An IAM policy allowing S3 Read actions is created and attached to the Task Role.
This grants the application code the exact permissions needed to read objects from the S3 bucket.
3
Verify the trust policy of the IAM role.
The trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.
This ensures that Amazon ECS can successfully assign the role to the container at launch.

Anahtar Kavram

Distinction between ECS Task Role and Task Execution Role
Soru 737Soru →

A developer is building a serverless integration service. An AWS Lambda function is configured to run inside a custom VPC to process sensitive data. The function must poll messages from an Amazon SQS queue, store the processed data in an Amazon Aurora PostgreSQL database located in a private database subnet, and send a confirmation payload to an external HTTP webhook API on the public internet.

Which two configurations are required to ensure the Lambda function has the necessary network paths and security settings?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda function to run in the private subnets of the VPC, and configure a route in the subnet route tables directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway located in a public subnet.; Configure the Security Group of the Aurora PostgreSQL database to allow inbound traffic on port 54325432 from the Security Group associated with the Lambda function.

Cevap

Configure the Lambda function to run in private subnets with a route to a NAT Gateway, and configure the database's Security Group to allow inbound traffic from the Lambda function's Security Group.
To allow the Lambda function to connect to the private database, the database security group must authorize inbound traffic on port 54325432 from the Lambda function's security group. To allow the function to reach the external HTTP webhook on the public internet, the Lambda function must run in private subnets with a route directing outbound traffic to a NAT Gateway in a public subnet.

Adım Adım Çözüm

1
Analyze database connectivity requirements
The Lambda function needs to connect to Aurora PostgreSQL on port 54325432. The database's security group must authorize inbound traffic on port 54325432 originating from the security group assigned to the Lambda function.
Security groups act as firewalls at the instance/resource level and must be configured for stateful communication.
2
Analyze internet connectivity requirements
The Lambda function needs to call an external webhook. A VPC-enabled Lambda function must be placed in private subnets with a route directing 0.0.0.0/00.0.0.0/0 to a NAT Gateway.
VPC-enabled Lambda functions do not receive public IP addresses and cannot connect directly to the internet from a public subnet.
3
Evaluate SQS connectivity requirements
SQS traffic can flow either via the NAT Gateway or through an Interface VPC Endpoint. SQS does not support Gateway VPC Endpoints.
Only Amazon S3 and DynamoDB support Gateway VPC Endpoints; all other supported services use Interface VPC Endpoints.

Anahtar Kavram

VPC networking configurations for AWS Lambda, including NAT Gateway routing, security groups, and VPC endpoint types.
Soru 738Soru →

A developer is configuring a deployment strategy for a multi-instance AWS Elastic Beanstalk environment. The deployment must satisfy the following constraints:

* The application must maintain 100% of its capacity at all times during the deployment.
* There must be zero downtime.
* The update must be deployed to the entire fleet without splitting production traffic or performing canary testing.

Which of the following Elastic Beanstalk deployment strategies will satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Immutable; Rolling with additional batch

Cevap

The Immutable and Rolling with additional batch deployment strategies are correct because they both maintain 100% capacity throughout the deployment and ensure zero downtime without splitting production traffic.
The Immutable strategy creates a full set of new instances in a separate Auto Scaling group, ensuring full capacity is maintained on the old group until cutover. The Rolling with additional batch strategy launches a temporary batch of new instances before starting the deployment to maintain 100% capacity during the rolling process. Neither strategy splits live production traffic for evaluation purposes.

Adım Adım Çözüm

1
Analyze the constraint of maintaining 100% capacity during deployment.
This eliminates the standard Rolling strategy (which reduces capacity during updates) and the All-at-once strategy (which causes downtime).
We must identify strategies that launch temporary additional instances to offset the ones being upgraded.
2
Analyze the constraint of zero downtime.
This confirms that All-at-once is incorrect as it takes all instances offline at the same time.
Downtime must be avoided completely.
3
Analyze the constraint of not splitting production traffic or performing canary testing.
This eliminates the Traffic splitting strategy, which is designed to route a small percentage of production traffic to the new version for verification.
Traffic splitting acts as a canary deployment and violates the requirement.

Anahtar Kavram

AWS Elastic Beanstalk deployment strategies and their capacity, downtime, and traffic-routing trade-offs.
Tahmini Süre:1m 0s
Soru 739Soru →

A developer is securing a REST API hosted on Amazon API Gateway for a serverless application. External third-party partner systems must programmatically access this API using a machine-to-machine authentication flow. The partner systems do not have AWS accounts and support only the OAuth 2.0 Client Credentials grant flow. The developer wants to enforce authorization at the API Gateway layer with minimal custom code and low maintenance overhead. Which configuration should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.

Cevap

Configure a Cognito User Pool with a resource server and custom scopes. Define an app client for the partner systems with the Client Credentials grant flow enabled. In API Gateway, create a Cognito User Pool authorizer to validate the access tokens, and configure the API method to require the authorizer and custom scopes.
The correct configuration leverages Amazon Cognito User Pools with a Resource Server to support the OAuth 2.0 Client Credentials flow. External partner systems can obtain an access token and pass it to API Gateway. The built-in Cognito User Pool authorizer natively validates these access tokens and checks for the required custom scopes. This requires zero custom code and operates at the API Gateway layer, minimizing maintenance overhead and execution cost.

Adım Adım Çözüm

1
Set up the Cognito User Pool acting as an OAuth 2.0 authorization server.
A Resource Server is defined in the Cognito User Pool with custom scopes representing API permissions. An App Client is created with the client credentials flow enabled.
This allows third-party clients to request OAuth 2.0 access tokens by authenticating directly with the Cognito token endpoint using client credentials, without needing AWS accounts or user logins.
2
Configure the Cognito Authorizer on Amazon API Gateway.
API Gateway is configured with a built-in Cognito User Pool authorizer pointing to the user pool.
This enables API Gateway to automatically fetch the JSON Web Key Set (JWKS) from Cognito, verify the token signatures, and extract the claims at the gateway level.
3
Apply the authorizer and custom scopes to the API methods.
The target API methods are associated with the Cognito Authorizer and the required custom scopes from the resource server.
This enforces that only requests presenting valid access tokens with the required scopes are authorized, filtering out unauthorized requests before they reach the backend integrations.

Anahtar Kavram

Using built-in Cognito User Pool authorizers with OAuth 2.0 Client Credentials flow for machine-to-machine API authorization.
Soru 740Soru →

A developer is migrating a containerized web application from Amazon EC2 instances to Amazon ECS. The deployment process is managed by AWS CodeDeploy using a Blue/Green deployment configuration. Before production traffic is shifted to the replacement task set, the deployment must execute a database migration script. This script retrieves a database password that must be automatically rotated every 30 days.

The developer writes the following `appspec.yaml` file for the Amazon ECS service:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:111122223333:task-definition/my-app:1"
LoadBalancerInfo: ContainerName: "web"
ContainerPort: 80
Hooks:
- AfterInstall:
- location: "scripts/migrate.sh"
timeout: 600

Which set of actions must the developer perform to ensure the database migration runs successfully and complies with the rotation requirement?

Cevabı ve açıklamayı göster

Cevap: Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.

Cevap

Package the database migration script into an AWS Lambda function, update the `AfterInstall` hook to reference its ARN, store the password in AWS Secrets Manager with automatic rotation, and allow the Lambda execution role to retrieve the secret.
The correct answer correctly identifies that Amazon ECS AppSpec files require lifecycle hooks to point to AWS Lambda functions rather than local shell scripts. It also correctly chooses AWS Secrets Manager over Systems Manager Parameter Store because Secrets Manager features native, built-in support for rotating credentials automatically.

Adım Adım Çözüm

1
Analyze the AppSpec file hooks syntax for Amazon ECS.
Identify that the `location` parameter and shell script execution are only supported for EC2/On-Premises deployments. ECS deployments require hooks to point directly to AWS Lambda functions.
To ensure CodeDeploy can execute the database migration hook on the ECS compute platform.
2
Evaluate the database password rotation requirement.
Determine that AWS Secrets Manager provides built-in, out-of-the-box automatic rotation for database secrets, whereas AWS Systems Manager Parameter Store does not support native rotation.
To meet the compliance requirement of rotating the database password every 30 days with minimal administrative overhead.
3
Configure the Lambda function's IAM permissions.
Create an IAM execution role for the Lambda function and attach a policy allowing the `secretsmanager:GetSecretValue` action.
To allow the migration Lambda function to securely retrieve the database credentials during execution.

Anahtar Kavram

AWS CodeDeploy AppSpec configuration for Amazon ECS and Secrets Management integration
Tahmini Süre:3m 0s
ÖncekiSayfa 37 / 78Sonraki
Tüm alıştırma soruları — AWS Certified Developer - Associate | Examkin