Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 61Soru →

A developer is securing a REST API in Amazon API Gateway for a social media application. Users authenticate via a web frontend using Amazon Cognito. The developer needs to restrict access to the API Gateway resources to authenticated users only and pass the user's username and email to the backend AWS Lambda function for auditing. The solution must minimize custom code and use built-in API Gateway features. Which two steps must the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods.; In the backend Lambda function, extract the user's identity details from the event.requestContext.authorizer.claims context object.

Cevap

Configure an API Gateway Cognito User Pool Authorizer and associate it with the API methods, and extract the user's identity details from the event.requestContext.authorizer.claims context object in the backend Lambda function.
To secure the API with minimal custom code, the developer should configure an API Gateway Cognito User Pool Authorizer. This built-in authorizer natively validates JSON Web Tokens (JWTs) issued by Cognito User Pools. Once validated, API Gateway automatically propagates the user's token claims (including email and username) to the backend integration, where they can be extracted directly from the requestContext.authorizer.claims context variable inside the Lambda function.

Adım Adım Çözüm

1
Select the built-in Cognito User Pool Authorizer in API Gateway.
API Gateway is configured to automatically validate the JWT tokens sent by the client frontend.
This avoids writing custom validation code and utilizes AWS managed capabilities.
2
Associate the authorizer with the specific HTTP/REST methods on the API Gateway resource.
Unauthenticated requests are blocked at the gateway level with a 401 Unauthorized response, protecting the backend.
This secures the endpoints before requests reach the backend Lambda function.
3
Access the user claims within the Lambda handler using the integration event object.
The Lambda function receives the username and email in the event object without performing additional decoding or verification.
API Gateway automatically populates the claims under requestContext.authorizer.claims when the Cognito authorizer successfully validates the token.

Anahtar Kavram

API Gateway Cognito User Pools Integration
Soru 62Soru →

A developer is designing a secure REST API using Amazon API Gateway that will be consumed by external client applications. The clients authenticate against a third-party Identity Provider (IdP) that is not compatible with Amazon Cognito, receiving a custom JSON Web Token (JWT) that includes specific scopes in the payload. The REST API must authorize access to resources based on these scopes and forward the verified user identity metadata to a backend Lambda function using a Lambda proxy integration. The developer wants to implement a solution that minimizes both authorization latency and cost. Which configuration should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.

Cevap

Configure a Lambda authorizer in API Gateway to validate the custom JWT. In the authorizer's response, include the allowed route permissions in the IAM policy document, and map the user identity metadata to the context object. Enable authorization caching by defining an Identity Source, and retrieve the metadata from the requestContext.authorizer object in the backend Lambda function.
The correct solution uses an API Gateway Lambda authorizer to validate the third-party JWT. Because the token is not issued by Amazon Cognito, a built-in Cognito authorizer cannot be used. By setting an Identity Source (such as the Authorization header), API Gateway caches the generated IAM policy, preventing downstream invocations of the authorizer Lambda function on subsequent calls with the same token. Additionally, return values in the context object from the authorizer are forwarded to the backend Lambda function under requestContext.authorizer, satisfying the requirement to pass user metadata securely while keeping backend processing optimized.

Adım Adım Çözüm

1
Create and deploy a Lambda authorizer function that receives the third-party JWT, validates its cryptographic signature against the IdP's public keys, and inspects the payload claims for valid scopes.
The Lambda function is ready to return an IAM policy document and a custom context object containing user metadata.
API Gateway requires a custom Lambda authorizer to inspect and validate third-party tokens since built-in Cognito authorizers only validate Cognito-issued tokens.
2
Configure the API Gateway REST API to use the Lambda authorizer, set the authorization caching TTL, and specify the Identity Source (such as method.request.header.Authorization).
API Gateway caches the policy document returned by the authorizer for matching tokens, avoiding repeated invocations of the authorizer function.
Caching reduces API latency and reduces the cost of running the authorizer Lambda function on every API request.
3
Map the required user identity claims to the context object returned by the Lambda authorizer, and use Lambda Proxy Integration for the backend integration.
The backend Lambda function receives the mapped metadata in the requestContext.authorizer object of the incoming event.
Using the context object allows passing validated client metadata to the backend Lambda function securely without requiring the backend function to parse or re-validate the token.

Anahtar Kavram

Using API Gateway Lambda authorizers to validate third-party JSON Web Tokens (JWTs) and caching the authorization policy response to minimize backend invocations.
Tahmini Süre:2m 0s
Soru 63Soru →

A developer manages a production application stack deployed via AWS CloudFormation. The stack consists of an Amazon RDS DB instance and an Auto Scaling group of Amazon EC2 instances. During a recent deployment, a stack update failed while attempting to modify the DB instance parameters, and the subsequent automatic rollback also failed, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to update the launch template of the Auto Scaling group to apply a critical security patch immediately without deleting the existing stack or losing DB instance data. How can the developer successfully apply the launch template update to the stack?

Cevabı ve açıklamayı göster

Cevap: Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.

Cevap

Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.
The correct answer is to run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. When a CloudFormation stack update fails and the rollback also fails, the stack enters the `UPDATE_ROLLBACK_FAILED` state. To perform further updates, the developer must get the stack into a stable state. By continuing the update rollback and skipping the failing DB instance resource, CloudFormation can successfully roll back the rest of the stack, transitioning it to the `UPDATE_ROLLBACK_COMPLETE` state. Once in this stable state, the developer can initiate the stack update for the Auto Scaling group.

Adım Adım Çözüm

1
Identify the resource causing the rollback failure (the Amazon RDS DB instance) and execute the `continue-update-rollback` command (or use the console equivalent).
The stack bypasses the failed rollback of the DB instance and rolls back the other resources successfully.
This is necessary because a stack in the `UPDATE_ROLLBACK_FAILED` state cannot be updated directly; it must first reach a stable state.
2
Wait for the stack status to transition from `UPDATE_ROLLBACK_FAILED` to `UPDATE_ROLLBACK_COMPLETE`.
The stack enters a stable, updatable state.
CloudFormation only allows stack updates when the stack is in a stable status such as `UPDATE_ROLLBACK_COMPLETE` or `CREATE_COMPLETE`.
3
Perform the stack update using the template containing the modified launch template configuration for the Auto Scaling group.
The Auto Scaling group is updated successfully with the critical security patch.
This applies the required changes to the Auto Scaling group now that the stack is in an updatable state.

Anahtar Kavram

Handling CloudFormation stack updates and failures by using the ContinueUpdateRollback action to skip failing resources and return the stack to a stable state.
Soru 64Soru →

An enterprise application utilizes a release pipeline in AWS CodePipeline to automate deployments. The pipeline has a source stage in a development AWS account and must deploy a containerized application to an Amazon ECS cluster located in a separate production AWS account. During execution, the Deploy stage fails when trying to invoke the deployment action in the production account, returning an access denied error when attempting to assume the target role.

Which configuration is necessary to successfully authorize this cross-account deployment?

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.

Cevap

Modify the trust policy of the IAM role in the production account to allow the IAM role executing the pipeline in the development account to perform the sts:AssumeRole action.
For AWS CodePipeline to perform deployments in a separate AWS account, it must assume an IAM role inside that target account. For the role assumption to succeed, the trust policy (assume role policy) of the target IAM role must be configured to trust the pipeline's IAM role in the source account, granting it the sts:AssumeRole permission.

Adım Adım Çözüm

1
Identify the authentication failure context.
The failure occurs during a cross-account deployment stage when the source account's CodePipeline attempts to assume the target IAM role in the production account.
AWS CodePipeline requires cross-account role delegation using AWS Security Token Service (STS) to deploy across accounts.
2
Determine where the delegation of trust is configured.
The trust must be established on the target resource (the production IAM role) to allow assumption by the source entity.
An IAM role's trust policy dictates which external AWS accounts or IAM principals are permitted to assume it.
3
Modify the target role's trust policy.
Add the ARN of the development pipeline's IAM role (or the development account root) to the principal element of the production role's trust policy with the sts:AssumeRole action.
This establishes a secure cryptographic trust chain between the two AWS accounts.

Anahtar Kavram

Cross-Account Access in AWS CodePipeline via STS AssumeRole
Soru 65Soru →

A developer is configuring an AWS Step Functions state machine to orchestrate a serverless workflow. The state machine needs to invoke an AWS Lambda function and publish execution status updates to an Amazon SNS topic. During testing, the state machine execution fails with an IAM authorization error. Which of the following configurations are required to resolve this issue and grant the state machine the necessary permissions? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM role to the Step Functions state machine with a trust policy that allows the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Attach a permissions policy to the Step Functions execution role that allows the `lambda:InvokeFunction` action on the Lambda function's ARN and the `sns:Publish` action on the SNS topic's ARN.

Cevap

To resolve the authorization issue, you must configure a trust policy on the Step Functions execution role allowing the `states.amazonaws.com` service principal to perform `sts:AssumeRole`, and attach a permissions policy to that execution role that allows the `lambda:InvokeFunction` and `sns:Publish` actions on the target resource ARNs.
AWS Step Functions must assume an IAM role to perform tasks like invoking Lambda functions or publishing messages to SNS. For the service to assume this role, the trust policy must explicitly allow the `states.amazonaws.com` service principal to perform the `sts:AssumeRole` action. Additionally, the role itself must be granted permissions via an attached permissions policy to perform `lambda:InvokeFunction` and `sns:Publish` on the specific resources.

Adım Adım Çözüm

1
Determine the executing principal that requires access.
The executing principal is the AWS Step Functions service (`states.amazonaws.com`).
Step Functions requires an IAM execution role to make API calls to other AWS resources on behalf of the user.
2
Establish the trust relationship for the execution role.
Add a trust policy to the role allowing `states.amazonaws.com` to call `sts:AssumeRole`.
Without this trust policy, the Step Functions service cannot assume the role to retrieve temporary security credentials.
3
Define the resource permissions for the execution role.
Attach an identity-based permissions policy granting `lambda:InvokeFunction` and `sns:Publish` on the respective ARNs.
Once the role is assumed, Step Functions must have the explicit authorization to perform the required actions on the target resources.

Anahtar Kavram

Configuring IAM execution roles requires establishing a trust policy that permits the calling service principal to assume the role, combined with a permissions policy that grants the role access to perform actions on specific resources.
Soru 66Soru →

A developer is building a classroom management application that tracks student assignment submissions. The application stores submission records in an Amazon DynamoDB table. The base table has a partition key of `ClassId` and a sort key of `StudentId_AssignmentId`. The developer needs to retrieve all submissions for a specific class that were submitted after a certain date, sorted by submission date, while minimizing Read Capacity Unit (RCU) consumption.

Which TWO actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a local secondary index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key.; Use the Query operation on the local secondary index (LSI) with a key condition expression for ClassId and SubmissionTimestamp.

Cevap

To retrieve submissions efficiently while minimizing RCU consumption, the developer should create a local secondary index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key, and then use the Query operation on this index with a key condition expression specifying both ClassId and SubmissionTimestamp.
Creating a local secondary index (LSI) sharing the same partition key (ClassId) but using SubmissionTimestamp as the sort key allows the application to perform a Query operation. By querying the LSI with a key condition expression for the class and the timestamp range, DynamoDB only reads the matching items, minimizing the Read Capacity Units (RCUs) consumed and returning the results pre-sorted by the sort key.

Adım Adım Çözüm

1
Analyze the access pattern and base table schema.
The base table partition key is ClassId and the sort key is StudentId_AssignmentId. Querying by ClassId alone requires reading all student assignments for that class, which is inefficient when only filtering by date.
To minimize RCU consumption, we must ensure we only read the records that match our filter criteria.
2
Identify the indexing strategy to support the date query.
Since we need to query within a specific ClassId (the partition key), we can create a Local Secondary Index (LSI) with ClassId as the partition key and SubmissionTimestamp as the sort key.
An LSI allows us to use the same partition key as the base table but sort and query by a different attribute.
3
Select the appropriate DynamoDB operation to retrieve the data.
Perform a Query operation on the LSI using a key condition expression specifying ClassId and a comparison operator on SubmissionTimestamp.
Query operations on indexes with key condition expressions only read and consume RCUs for the items that meet the criteria, unlike Scan operations or post-query filters.

Anahtar Kavram

Optimizing DynamoDB retrieval using Local Secondary Indexes (LSI) and Query operations instead of Scan or filter expressions on non-key attributes.
Tahmini Süre:1m 30s
Soru 67Soru →

A developer is configuring a backend microservice running on AWS Lambda within a custom VPC. The Lambda function must connect to a private Amazon Aurora PostgreSQL database in the same VPC and retrieve secure configurations from AWS Systems Manager Parameter Store. The company's security policy strictly prohibits internet gateways and NAT gateways. The developer sets up an Interface VPC Endpoint for Systems Manager. Which two configurations must the developer implement to secure this traffic and establish connectivity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the database's security group to allow inbound TCP traffic on port 54325432 from the security group assigned to the Lambda function.; Configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port 443443) traffic from the security group assigned to the Lambda function.

Cevap

Configure the database's security group to allow inbound TCP traffic on port 54325432 from the security group assigned to the Lambda function, and configure the security group of the Systems Manager Interface VPC Endpoint to allow inbound HTTPS (port 443443) traffic from the security group assigned to the Lambda function.
The database security group must allow inbound PostgreSQL traffic (port 54325432) from the Lambda function's security group. Interface VPC endpoints use security groups to control incoming traffic; therefore, the Systems Manager endpoint's security group must permit inbound HTTPS (port 443443) traffic from the Lambda function's security group. Since security groups are stateful, configuring these inbound rules automatically allows the corresponding outbound/return traffic.

Adım Adım Çözüm

1
Analyze database connectivity requirements.
Identify that the Lambda function must connect to Aurora PostgreSQL on port 54325432.
To authorize this traffic, the database's security group must permit inbound traffic from the source (the Lambda function's security group).
2
Analyze Systems Manager Parameter Store connectivity requirements.
Identify that the Lambda function must connect to Systems Manager via an Interface VPC Endpoint using HTTPS on port 443443.
To authorize this traffic, the endpoint's security group must allow inbound traffic from the Lambda function's security group.
3
Evaluate security group statefulness.
Recognize that because security groups are stateful, return traffic is automatically allowed once the inbound/outbound connection is established.
This eliminates the need to configure ephemeral port rules on the security groups.

Anahtar Kavram

VPC security controls (Security Groups, NACLs, and Interface VPC Endpoints) for private AWS service integrations.
Tahmini Süre:2m 30s
Soru 68Soru →

A company is developing a fitness tracking mobile application. The application needs to access a REST API hosted on Amazon API Gateway to retrieve user workout histories. The development team wants to implement an authorization mechanism that allows users to authenticate using their existing email and password credentials, validates their JSON Web Tokens (JWTs) directly at the API Gateway level without invoking a custom Lambda function, and extracts user identity claims for backend processing. Which configuration should the developer implement to meet these requirements with the lowest latency and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.

Cevap

Configure a built-in Amazon Cognito User Pools authorizer on the API Gateway REST API.
The correct configuration is to use the built-in Amazon Cognito User Pools authorizer. This option integrates directly with the user pool to authenticate and validate the signature of incoming JWT tokens without invoking custom Lambda code. Once validated, user claims are automatically populated into the request context and sent to the backend integration, providing a highly optimized, low-overhead solution.

Adım Adım Çözüm

1
Analyze the requirements for user authentication, token validation, and latency control.
The solution requires user directory authentication (username/password), token validation at the API Gateway edge without executing custom code, and access to identity claims in backend integrations.
This establishes that the solution must use a native API Gateway mechanism rather than custom authorizer code.
2
Select the appropriate Amazon Cognito feature for user directories.
Cognito User Pools provides the directory and authentication flow, returning JWT tokens containing claims.
Cognito Identity Pools provides temporary AWS credentials instead of user authentication directory features.
3
Configure the native API Gateway authorizer that integrates directly with the Cognito User Pool.
Configuring a Cognito User Pools authorizer on the API Gateway REST API allows native verification of the JWT signature and expiration, and automatically passes the claims via the integration request context.
This provides the lowest latency and requires no custom code maintenance, satisfying all requirements.

Anahtar Kavram

API Gateway Cognito User Pools Authorizer
Soru 69Soru →

A developer is deploying a microservice on Amazon ECS using AWS Fargate that connects to an Amazon Aurora PostgreSQL database. The application must retrieve a database endpoint (non-sensitive configuration) and a database password (sensitive credential). The database password must be automatically rotated every 30 days. The microservice handles a very high volume of requests, so the developer must design a solution that prevents database connection failures after rotation, avoids API throttling errors, and minimizes costs. Which approach should the developer take to retrieve and manage these configurations?

Cevabı ve açıklamayı göster

Cevap: Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Cevap

Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.
The correct strategy combines Systems Manager Parameter Store for non-sensitive configurations and AWS Secrets Manager for sensitive credentials that need automatic rotation. Under high-throughput environments, fetching credentials on every request will cause API throttling. Caching values locally with a Time-to-Live (TTL) ensures low latency and avoids API rate limiting, while the TTL expiration guarantees that the microservice eventually fetches the new password after an automatic rotation, avoiding database connection issues.

Adım Adım Çözüm

1
Determine the appropriate storage service for each configuration type.
The database endpoint is non-sensitive configuration data, which is most cost-effective to store in Systems Manager Parameter Store. The database password is a sensitive credential requiring automatic rotation, making AWS Secrets Manager the correct choice.
Parameter Store does not charge for standard parameters, while Secrets Manager charges $0.40 per secret per month but supports automatic rotation natively.
2
Configure the rotation mechanism for the database password.
Enable automatic rotation in Secrets Manager, which uses an AWS Lambda function to update the database password in both Secrets Manager and the Aurora database.
This ensures the credentials remain secure without manual intervention.
3
Implement a caching strategy inside the microservice application code.
Use the AWS SDK to retrieve the parameters, and cache the values in memory with a reasonable Time-to-Live (TTL). When the TTL expires, the microservice makes a fresh call to the AWS APIs to refresh the cache.
Caching avoids API throttling (ProvisionedThroughputExceededException) and minimizes retrieval latency. The TTL ensures that warm containers periodically refresh their cached credentials, preventing connection failures after a rotation occurs.

Anahtar Kavram

Selecting and integrating AWS Secrets Manager and Systems Manager Parameter Store with caching to support credentials rotation in high-throughput applications.
Soru 70Soru →

A developer is planning the deployment strategy for a critical web application hosted on AWS Elastic Beanstalk. The application is highly sensitive to performance degradation, so the deployment process must maintain 100%100\% of the existing instance capacity at all times. Additionally, if the new version fails post-deployment tests, the developer must be able to roll back to the previous version almost instantly. Which two Elastic Beanstalk deployment strategies or methods will satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Immutable deployment; Blue/Green deployment via environment URL swap

Cevap

Immutable deployment and Blue/Green deployment via environment URL swap
Immutable deployments and Blue/Green deployments via environment URL swapping both maintain 100%100\% of the existing application capacity during deployment. They also provide a rapid rollback path: immutable deployments roll back by terminating the new Auto Scaling group, while Blue/Green deployments roll back by swapping the CNAME records back.

Adım Adım Çözüm

1
Analyze the capacity requirement.
The application must maintain 100%100\% of its existing capacity during the deployment. This eliminates strategies that take instances offline without replacing them first, such as rolling and all-at-once.
To prevent performance degradation during the deployment window.
2
Evaluate the rollback requirements.
The deployment must support a rapid, near-instant rollback in case of failure. This rules out rolling with additional batch, which requires a new rolling deployment of the older version to revert.
To minimize the duration of any potential outage or failure.
3
Identify the compliant strategies.
Immutable deployments maintain capacity by launching a parallel Auto Scaling group and roll back instantly by terminating it. Blue/Green deployments maintain capacity in a separate environment and roll back instantly by swapping the CNAMEs back.
Both strategies meet the full capacity and near-instant rollback constraints.

Anahtar Kavram

Evaluating Elastic Beanstalk deployment policies based on capacity and rollback speed trade-offs.
Tahmini Süre:1m 30s
Soru 71Soru →

A developer is deploying a containerized API to AWS App Runner. The application needs to retrieve credentials for a backend Amazon Aurora MySQL database, which must be rotated automatically every 45 days. Additionally, the application requires access to 50 non-sensitive configuration parameters, such as service endpoints and logging levels, which are updated frequently. The developer wants to implement a secure, cost-effective architecture.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.; Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Cevap

The correct combination is to store the database credentials in AWS Secrets Manager with built-in Lambda automatic rotation, and store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as standard parameters.
The correct solution uses AWS Secrets Manager for the database credentials because Secrets Manager natively supports automatic rotation using built-in Lambda templates. It uses AWS Systems Manager Parameter Store (standard parameters) for the non-sensitive parameters because standard parameters are free, ensuring the overall architecture is cost-effective.

Adım Adım Çözüm

1
Analyze credential security and rotation requirements.
Identify that the Aurora database credentials require security and automated rotation every 45 days. AWS Secrets Manager is the optimal service here because it offers out-of-the-box rotation support using Lambda templates specifically integrated with RDS/Aurora.
Ensures credentials are secure and rotated without custom scripting overhead.
2
Analyze non-sensitive configuration requirements and cost constraints.
Identify that logging levels and service endpoints are non-sensitive and numerous (50 parameters). Storing them in AWS Systems Manager Parameter Store as standard parameters is free, satisfying the cost-efficiency constraint.
Minimizes unnecessary Secrets Manager charges for non-sensitive data.

Anahtar Kavram

Secrets Manager vs Systems Manager Parameter Store
Tahmini Süre:2m 0s
Soru 72Soru →

A developer is designing a microservice that processes sensitive transaction payloads of approximately 1.5 MB1.5\text{ MB} each. The microservice must encrypt these payloads before storing them in an on-premises database. The encryption keys must be managed in AWS KMS. Which approach should the developer use to perform the encryption in a secure and efficient manner?

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.

Cevap

Call the GenerateDataKey API operation to obtain a plaintext data key and an encrypted copy of the data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the encrypted payload alongside the encrypted data key.
For data larger than 4 KB4\text{ KB}, developers must use envelope encryption. Calling the GenerateDataKey API provides a plaintext data key to perform local symmetric encryption of the 1.5 MB1.5\text{ MB} payload and an encrypted copy of the data key. Once encryption is complete, the plaintext data key is discarded from memory, and the encrypted payload is stored alongside the encrypted data key. The encrypted data key can later be sent to KMS Decrypt to retrieve the plaintext key for decryption.

Adım Adım Çözüm

1
Identify the size limit of the direct KMS Encrypt API and compare it to the transaction payload size.
The transaction payload is 1.5 MB1.5\text{ MB}, which exceeds the 4 KB4\text{ KB} limit of the direct KMS Encrypt API.
KMS direct encryption cannot process payloads larger than 4 KB4\text{ KB}, requiring the use of envelope encryption.
2
Evaluate the options for envelope encryption using AWS KMS APIs.
Calling GenerateDataKey provides both the plaintext data key for local encryption and the encrypted data key for storage.
GenerateDataKey generates the keys locally without transmitting the actual data payload to KMS, which is highly efficient.
3
Complete the envelope encryption workflow locally on the client.
The plaintext key encrypts the payload, is removed from memory, and the encrypted payload is stored with the encrypted data key.
This ensures the plaintext key is not exposed and the data can be decrypted later by decrypting the data key with KMS.

Anahtar Kavram

KMS Envelope Encryption and API Limits
Soru 73Soru →

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline is hosted in Account A and is designed to deploy a serverless application to Account B using AWS CloudFormation. The pipeline uses an Amazon S3 bucket in Account A to store pipeline artifacts. The deployment action in the Deploy stage fails with an error indicating that the CloudFormation role in Account B cannot access the deployment artifacts in the S3 bucket in Account A. The S3 bucket is currently encrypted using the default AWS managed key (aws/s3). Which configuration change is required to resolve this issue and allow successful deployment?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.

Cevap

Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS. Update the KMS key policy and the S3 bucket policy in Account A to grant read permissions to the CloudFormation execution role in Account B, and grant the role permissions to decrypt the KMS key.
For cross-account deployments in AWS CodePipeline, the deployment action in the target account must access the artifact S3 bucket in the source account. When using KMS encryption for the S3 bucket, you cannot use the default AWS-managed key (aws/s3) because its key policy cannot be modified to grant access to external accounts. A Customer Managed Key (CMK) must be created in the source account, and its key policy, along with the S3 bucket policy, must grant permissions to the target account's deployment role. The target role must also have permission to decrypt using that KMS key.

Adım Adım Çözüm

1
Identify the cause of the cross-account S3 access failure.
The S3 bucket uses the default AWS-managed key (aws/s3) for encryption, which cannot be shared across different AWS accounts.
AWS-managed KMS keys do not allow modifications to their key policies to trust other AWS accounts.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS.
A CMK is created in Account A with a key policy that allows the CloudFormation execution role in Account B to perform kms:Decrypt actions.
A Customer Managed Key allows policy customization, making it possible to grant cross-account decryption capabilities.
3
Update the S3 bucket policy and associate the CMK with the S3 bucket.
The S3 bucket in Account A is configured to use the new CMK, and its bucket policy is updated to allow S3 read actions (s3:GetObject, s3:GetBucketLocation) from the CloudFormation role in Account B.
Both the KMS key policy and the S3 bucket policy must allow cross-account access for the target role to successfully retrieve the artifacts.

Anahtar Kavram

Cross-account AWS CodePipeline S3 artifact access using KMS Customer Managed Keys (CMK)
Soru 74Soru →

A developer is designing a secure serverless backend where a single-page application (SPA) needs to access a REST API hosted on Amazon API Gateway. Users authenticate using Amazon Cognito User Pools. The developer needs to implement authorization such that standard users can only invoke the GET methods on /items resources, while administrative users (members of the 'Admins' Cognito group) can invoke any method on /items and /admin resources. Which two configuration steps should the developer perform to implement this authorization model?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enable AWS_IAM authorization on the API Gateway resources. Integrate the Amazon Cognito User Pool with an Amazon Cognito Identity Pool, configure group-based role mapping to associate the 'Admins' group with a high-privilege IAM role, and have the client application sign API requests using temporary AWS credentials via Signature Version 4.; Configure an API Gateway Lambda Authorizer. In the authorizer function, verify the signature of the JSON Web Token (JWT) provided by the Cognito User Pool, inspect the 'cognito:groups' claim in the payload, and dynamically generate an IAM policy that allows or denies access to the specific resource paths.

Cevap

To implement group-based authorization on API Gateway with Cognito User Pools, the developer can either use AWS_IAM authorization with Cognito Identity Pools and group-to-role mapping, or implement a Lambda Authorizer that inspects the 'cognito:groups' claim in the JWT and dynamically generates an IAM policy.
The correct options represent the two main architectures for implementing group-based access control in API Gateway. Using AWS_IAM authorization with Cognito Identity Pools maps User Pool groups to distinct IAM roles, letting API Gateway natively enforce authorization via SigV4 signed requests. Using a Lambda Authorizer allows developers to decode the JWT, inspect the 'cognito:groups' claim, and dynamically return an IAM policy allowing or denying access to specific routes.

Adım Adım Çözüm

1
Identify the authorization requirements.
The system needs to restrict API access based on Cognito groups, which requires mapping groups to specific API paths and methods.
This establishes the scope and logic needed for the authorization policy.
2
Evaluate the AWS_IAM and Cognito Identity Pool approach.
By mapping user groups to different IAM roles via Cognito Identity Pools, the client can sign requests with SigV4, allowing API Gateway to evaluate permissions natively via IAM policies.
This offloads authorization logic to native AWS features, minimizing custom development.
3
Evaluate the custom Lambda Authorizer approach.
A Lambda Authorizer can verify the Cognito JWT signature, parse the 'cognito:groups' claim, and dynamically generate an IAM policy based on group membership.
This is standard when the client uses bearer tokens and avoids SigV4 request signing.

Anahtar Kavram

Fine-grained API Gateway authorization using Cognito groups, IAM policies, and Lambda Authorizers
Soru 75Soru →

A developer is preparing a source bundle to deploy a web application to AWS Elastic Beanstalk. The developer wants to include configuration files that install additional software packages and define system environment variables. In which directory must these configuration files be placed to ensure Elastic Beanstalk processes them during deployment?

Cevabı ve açıklamayı göster

Cevap: A folder named .ebextensions at the root level of the application source bundle

Cevap

A folder named .ebextensions at the root level of the application source bundle
The correct answer specifies placing files in a directory named .ebextensions at the root level of the application source bundle. AWS Elastic Beanstalk automatically looks for configuration files with a .config extension inside this directory during deployment to customize the environment's resource configuration.

Adım Adım Çözüm

1
Identify the mechanism Elastic Beanstalk uses for custom configuration files.
Elastic Beanstalk relies on YAML or JSON configuration files (ending in .config) to configure the environment.
This allows developers to define packages, services, files, and commands to run on the EC2 instances.
2
Determine the required naming convention and location for these files.
The configuration files must be stored within a directory named .ebextensions, which must be located at the root of the application source bundle.
Elastic Beanstalk only parses configuration files that are situated in this specific root folder.

Anahtar Kavram

AWS Elastic Beanstalk Custom Configurations (.ebextensions)
Soru 76Soru →

A developer is designing a security architecture for a native mobile application. The application must support user authentication using a corporate SAML 2.0 Identity Provider (IdP). Once authenticated, the application needs to:

1. Upload documents directly to a tenant-specific folder in an Amazon S3 bucket, where the folder name corresponds to the user's Cognito identity ID.
2. Invoke an Amazon API Gateway REST API, where access must be restricted based on the user's group membership (such as 'Finance' or 'Engineering') mapped from the corporate IdP. The authorization decision must be evaluated at the API Gateway layer without invoking a custom AWS Lambda function for token validation, to minimize latency and operational overhead.

Which architectural design meets these requirements while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.

Cevap

Configure an Amazon Cognito User Pool federated with the SAML IdP, mapping group claims to Cognito groups. Set up an Amazon Cognito Identity Pool with the User Pool as the provider, configured to resolve the IAM role from the user's token. Secure the API Gateway REST API with AWS_IAM authorization, and configure the client to sign requests using temporary credentials obtained from the Identity Pool.
The correct solution leverages Cognito User Pools for federating the SAML IdP and mapping group claims, and uses Cognito Identity Pools to assign distinct IAM roles based on those groups. By securing API Gateway with AWS_IAM, the mobile client signs requests using SigV4 credentials, allowing API Gateway to perform native IAM evaluation without invoking a custom Lambda function. This approach satisfies both the S3 upload requirement and the low-latency API authorization requirement while adhering to least-privilege principles.

Adım Adım Çözüm

1
Authenticate users via the Amazon Cognito User Pool federated with the corporate SAML IdP.
The user is authenticated and the mobile client receives a Cognito User Pool ID token containing SAML group attributes mapped to Cognito groups.
Allows integration with the corporate identity store while standardizing identity tokens.
2
Exchange the ID token for temporary AWS credentials using the Cognito Identity Pool.
The Identity Pool evaluates the user's group to the corresponding IAM role (such as Finance or Engineering) based on token claims and returns temporary credentials.
Enables fine-grained AWS role mapping and authorizes direct S3 bucket folder uploads using the identity ID context.
3
Secure the API Gateway REST API with AWS_IAM authorization and configure the client to sign API requests.
API Gateway natively evaluates the permissions policy attached to the caller's assumed IAM role without calling custom authorization code.
Provides low-latency, zero-custom-code authorization at the gateway layer.

Anahtar Kavram

Integrating Amazon Cognito User Pools, Cognito Identity Pools, and AWS IAM to achieve secure role-based access control and fine-grained authorization for S3 and API Gateway.
Tahmini Süre:3m 0s
Soru 77Soru →

A developer is designing a cross-platform client application that requires user sign-up, sign-in, and group-based access control. The backend services are hosted on Amazon ECS tasks running behind an Application Load Balancer (ALB). The developer wants to authenticate users and offload the verification of authentication tokens from the ECS tasks to the ALB. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership.; Configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.

Cevap

Configure an Amazon Cognito User Pool to manage user registration, sign-in, and group membership, and configure a listener rule on the Application Load Balancer with an authenticate-cognito action to validate user tokens and forward user claims to the target group.
To authenticate application users and offload token verification from Amazon ECS tasks to the Application Load Balancer, the developer must set up an Amazon Cognito User Pool for managing identities and configure the ALB listener rule to authenticate requests using Cognito. The ALB handles the authentication flow with the User Pool natively and forwards the user information in headers, securing the backend application without custom authentication logic.

Adım Adım Çözüm

1
Set up the user directory and authentication flow.
An Amazon Cognito User Pool is created to handle user sign-up, sign-in, and manage user groups.
Cognito User Pools serve as the identity provider for authentication.
2
Configure the ALB listener to intercept and validate user traffic.
The Application Load Balancer listener rule is configured with an authenticate-cognito action pointing to the Cognito User Pool.
This offloads token verification from the ECS backend tasks to the load balancer, which then forwards user identity claims to the target ECS containers.

Anahtar Kavram

Offloading user authentication and validation to an Application Load Balancer using Amazon Cognito User Pools.
Soru 78Soru →

An application running on Amazon ECS container instances in Account A needs to decrypt sensitive data files stored in an Amazon S3 bucket. The files are encrypted using an AWS KMS Customer Managed Key (CMK) located in Account B. The developer needs to configure the permissions to allow the application to decrypt these files.

Which of the following actions must be taken to grant the application the required permissions? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A.; In Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.

Cevap

In Account B, update the KMS key policy of the CMK to grant the kms:Decrypt action to the application's IAM task role in Account A; and in Account A, attach an IAM policy to the application's IAM task role that allows the kms:Decrypt action on the KMS key ARN in Account B.
Cross-account access to KMS keys requires validation at both the resource level and the identity level. First, the key policy of the Customer Managed Key in Account B must be configured to trust the external account or role. Second, the IAM policy in the application's account (Account A) must grant the application's IAM role permission to call the KMS API. Because the application logic runs within ECS containers, these permissions must be applied to the ECS Task Role.

Adım Adım Çözüm

1
Differentiate between the ECS task role and the ECS task execution role.
Identify that the application container uses the ECS Task Role for application-level AWS API calls (such as KMS decryption), whereas the Task Execution Role is for container agent operations.
This prevents assigning permissions to the wrong IAM role.
2
Configure the key-level permissions in the KMS key owner's account (Account B).
Update the KMS key policy in Account B to delegate decrypt permissions to the IAM task role ARN from Account A.
AWS KMS requires the key policy to explicitly allow cross-account access, as identity-based IAM policies in the external account are not sufficient on their own.
3
Configure the identity-level permissions in the application's account (Account A).
Attach an IAM policy to the ECS Task Role in Account A allowing the kms:Decrypt action on the target KMS key ARN.
For cross-account access, permissions must be allowed on both the resource policy (key policy) and the identity policy (IAM policy).

Anahtar Kavram

Cross-Account KMS Key Access and ECS Task Roles
Tahmini Süre:2m 0s
Soru 79Soru →

A developer is deploying an AWS Lambda function that must connect to an Amazon ElastiCache (Redis OSS) cluster. The ElastiCache cluster is running in the private subnets of a custom VPC. The Lambda function does not need access to the public internet or external APIs. Which of the following configuration steps must the developer perform to establish secure network connectivity between the Lambda function and the ElastiCache cluster? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group.; Configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.

Cevap

Configure the Lambda function to run inside the custom VPC by specifying the target private subnets and a security group, and configure the inbound rules of the ElastiCache cluster's security group to allow TCP traffic on port 6379 from the security group of the Lambda function.
To allow the Lambda function to reach the ElastiCache cluster, the Lambda function must first be attached to the same VPC. This is done by configuring VPC access on the Lambda function, which deploys ENIs in the specified private subnets. Second, since security groups are stateful and deny all inbound traffic by default, the ElastiCache security group must be updated to allow inbound TCP traffic on the Redis port from the security group associated with the Lambda function.

Adım Adım Çözüm

1
Enable VPC access for the Lambda function.
The Lambda function is assigned Elastic Network Interfaces (ENIs) in the specified private subnets, enabling it to reach resources inside the VPC.
By default, Lambda functions run in an AWS-managed network that cannot directly communicate with private subnets inside a custom VPC.
2
Configure the database security group.
The stateful firewall allows incoming network connections from the Lambda function's security group on the specific Redis database port.
Security groups deny all inbound traffic by default, so you must explicitly authorize access from the client's security group.

Anahtar Kavram

To enable secure communication between an AWS Lambda function and an internal VPC resource (like ElastiCache), the Lambda function must be associated with the private subnets of the VPC, and the destination security group must explicitly allow inbound traffic from the Lambda function's security group. Internal VPC communication uses local routes and does not require a NAT Gateway.
Soru 80Soru →

A developer is building a multi-region active-active web application deployed across `us-east-1` and `us-west-2` using AWS Lambda. The application must securely retrieve a database credential that requires automatic rotation every 3030 days, as well as a region-specific database connection endpoint URL that is non-sensitive. The solution must minimize cross-region latency for credential retrieval and optimize cost. Which combination of services and configuration should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.

Cevap

Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.
Storing the database credential in AWS Secrets Manager meets the requirement for automatic rotation, and replication to the secondary region ensures low-latency local access. Utilizing Systems Manager Parameter Store for the connection endpoint is cost-effective, and storing it as a regional parameter in each region eliminates cross-region latency.

Adım Adım Çözüm

1
Analyze credential requirements
Database credentials require security, automatic rotation, and cross-region availability with minimum latency.
AWS Secrets Manager is designed for managing sensitive secrets, supporting automated rotation and built-in cross-region replication.
2
Analyze non-sensitive configuration requirements
The connection endpoint is region-specific, non-sensitive, and needs to be retrieved cost-effectively.
AWS Systems Manager Parameter Store is ideal and cost-effective for storing non-sensitive config parameters, and storing them as regional parameters avoids cross-region latency.
3
Assess IAM and replication configurations
Identify the solution that avoids custom replication code and hardcoded credentials.
Native Secrets Manager replication handles cross-region secret syncing automatically, and using Lambda execution roles avoids hardcoding credentials.

Anahtar Kavram

Selecting the correct secret and parameter management service based on sensitivity, replication, rotation, and cost constraints.
Tahmini Süre:2m 0s
ÖncekiSayfa 4 / 78Sonraki