Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 861Soru →

A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table and write reports to an Amazon S3 bucket. To follow security best practices, the developer decides to use an IAM role. Which two configurations are required to establish this access? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with an identity-based permissions policy that grants DynamoDB read access and S3 write access.; Configure the IAM role's trust policy to allow the Amazon EC2 service to assume the role.

Cevap

An IAM role must be configured with an identity-based permissions policy that grants DynamoDB read access and S3 write access, and its trust policy must allow the Amazon EC2 service to assume the role.
To grant an EC2 instance access to other AWS services securely, two components are required. First, the trust policy of the IAM role must permit the EC2 service principal to assume the role. Second, the role's permissions policy must define the specific resource-level permissions (DynamoDB read and S3 write) that the application needs to run.

Adım Adım Çözüm

1
Define the permissions policy for the IAM role.
An identity-based permissions policy is created allowing action permissions like DynamoDB Read and S3 Write.
This determines what operations the application can perform after assuming the role.
2
Configure the trust relationship of the IAM role.
The trust policy is set to allow 'ec2.amazonaws.com' as the trusted entity.
This permits the Amazon EC2 service to assume the role and issue temporary security credentials to the instance.

Anahtar Kavram

An IAM role requires both a trust policy (specifying who can assume the role) and a permissions policy (specifying what resources and actions the role can access).
Soru 862Soru →

A media streaming company is designing a new REST API using Amazon API Gateway to serve premium video content metadata to web clients. Users log in using their corporate identities federated with an Amazon Cognito User Pool. The developer wants to restrict access to the API Gateway resources based on this authentication. The backend is implemented using AWS Lambda functions with custom integrations (non-proxy integration). The solution must validate tokens at the API Gateway boundary and pass the authenticated user's claims to the backend with minimal custom validation code. Which two steps should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a COGNITO_USER_POOLS authorizer on the API Gateway method, specify the Amazon Cognito User Pool ARN, and pass the token in the identity source header.; Configure an API Gateway integration mapping template to extract the user claims from the $context.authorizer.claims variable and inject them into the request payload sent to the Lambda function.

Cevap

Configure a COGNITO_USER_POOLS authorizer on the API Gateway method and use an API Gateway integration mapping template to map the $context.authorizer.claims variable to the Lambda function payload.
To secure the API with minimal overhead, a native Cognito User Pools authorizer must be configured. This authorizer validates JWTs at the API Gateway level before executing the backend. For Lambda custom integrations, mapping templates are required to forward claims (such as user profile and groups) stored in the $context.authorizer.claims context variable to the Lambda function input.

Adım Adım Çözüm

1
Configure the API Gateway method authentication.
Create and configure a Cognito User Pools authorizer on the API Gateway method, pointing to the User Pool ARN, to handle JWT validation natively.
This offloads token validation to API Gateway natively, ensuring unauthorized requests are rejected at the edge with zero custom code.
2
Map the authorizer context to the backend.
Define an API Gateway integration mapping template for the request integration.
Since the backend uses a custom integration (non-proxy), mapping templates are required to extract claims from the authorizer context using $context.authorizer.claims and pass them as JSON fields to the Lambda function.

Anahtar Kavram

API Gateway provides native integration with Cognito User Pools via COGNITO_USER_POOLS authorizers, which validate JWTs without custom code. When using custom (non-proxy) integrations, mapping templates are required to forward authorizer claims from API Gateway to the backend Lambda function.
Soru 863Soru →

A developer is using AWS CodeDeploy to deploy an update to an in-place application running on a fleet of Amazon EC2 instances. To minimize the risk of application failure, the developer wants to ensure that the update is applied to only a single Amazon EC2 instance at a time, keeping the rest of the fleet online and healthy. Which default CodeDeploy deployment configuration should the developer select?

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.OneAtATime

Cevap

CodeDeployDefault.OneAtATime
The default configuration for one at a time deploys the update to a single instance at a time. The deployment succeeds only if each instance is updated successfully, ensuring minimal impact if a deployment fails.

Adım Adım Çözüm

1
Identify the deployment platform and type.
The platform is Amazon EC2 and the deployment type is in-place.
This determines which default deployment configurations are compatible.
2
Evaluate the deployment constraints.
The constraint requires deploying to only one instance at a time to minimize risk and maintain maximum availability.
This specifies the target configuration behavior.
3
Match the behavior to the default CodeDeploy configurations for EC2.
The configuration that targets exactly one instance at a time is the one at a time configuration.
This identifies the correct API configuration name.

Anahtar Kavram

AWS CodeDeploy deployment configurations define how deployments progress across instances in a deployment group.
Tahmini Süre:45s
Soru 864Soru →

A developer is building a fitness tracking mobile application that uses an Amazon API Gateway REST API backed by AWS Lambda. The developer needs to secure the API so that only authenticated users can access their workout logs. The authentication system must use Amazon Cognito User Pools, and the API Gateway should directly validate the JSON Web Tokens (JWT) sent in the HTTP Authorization header without calling custom validation code. Which two configuration steps must the developer perform to implement this security control?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon API Gateway authorizer of type Cognito, referencing the Cognito User Pool ID and setting the token source header to Authorization.; Configure the REST API's resource methods to use the newly created Cognito authorizer and redeploy the API.

Cevap

To secure the API using Cognito User Pools directly at the API Gateway layer, the developer must create a Cognito authorizer associated with the Cognito User Pool ID and configure the token source header to Authorization. Additionally, they must configure the API methods to use this authorizer and deploy the API.
The correct actions are to create an API Gateway authorizer of type Cognito configured with the Cognito User Pool ID, and to bind this authorizer to the API's resource methods while deploying the API. This enables built-in validation of user pool JWT tokens at the API Gateway layer.

Adım Adım Çözüm

1
Create a Cognito User Pool authorizer in API Gateway.
API Gateway is configured with the Cognito User Pool ID to validate incoming user tokens directly.
Natively validates the identity token or access token without custom Lambda functions.
2
Configure method request settings and redeploy.
API Gateway applies the authorizer to the target endpoints and publishes the configuration to the active stage.
Method integration binds the authentication policy, and deployment makes it active.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer
Soru 865Soru →

A developer is building a serverless web application. The frontend is a Single-Page Application (SPA). Users must sign in to the application, and the application must perform two main functions:
1. Call a secure REST API hosted on Amazon API Gateway.
2. Download user-specific reports directly from a private Amazon S3 bucket.

Which combination of Amazon Cognito features and configurations should the developer use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool to manage user registration and authentication, and implement an Amazon Cognito User Pool authorizer on the API Gateway REST API.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and associate an IAM role that grants read-only permissions to the Amazon S3 bucket.

Cevap

To secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool to manage user authentication and use a User Pool authorizer on API Gateway. To allow the client to download files directly from S3, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool and associate it with an IAM role that grants S3 read access.
The correct solution involves configuring an Amazon Cognito User Pool to handle user directory, registration, and sign-in. An API Gateway Cognito User Pool Authorizer can then easily validate the ID or access token (JWT) sent by the client. For the S3 download requirement, the developer must configure an Amazon Cognito Identity Pool linked to the User Pool. The client submits the User Pool JWT to the Identity Pool, which returns temporary AWS credentials associated with an IAM role that grants read access to the S3 bucket.

Adım Adım Çözüm

1
Determine user authentication and API authorization mechanism.
Use Amazon Cognito User Pools to authenticate users and generate JWTs. Configure API Gateway to use a Cognito User Pool authorizer to validate these JWTs.
User Pools manage the user directory and authentication, and API Gateway natively integrates with them for authentication.
2
Determine client-side AWS resource access mechanism.
Configure an Amazon Cognito Identity Pool and link it to the User Pool as an authentication provider.
Identity Pools are designed to exchange authentication tokens from an identity provider (like User Pools) for temporary AWS credentials.
3
Define and associate permissions for S3 access.
Create an IAM role with S3 read permissions and configure the Identity Pool to assume this role for authenticated users.
This allows the client application to obtain temporary AWS credentials with limited access to perform S3 read operations directly.

Anahtar Kavram

Distinguishing between Amazon Cognito User Pools (authentication and API authorization) and Identity Pools (AWS resource authorization via temporary credentials).
Soru 866Soru →

An application running inside a Docker container on Amazon ECS needs to query an Amazon DynamoDB table. Which configuration should the developer specify in the task definition to grant the containerized application permissions to access DynamoDB?

Cevabı ve açıklamayı göster

Cevap: Define the permissions in the taskRoleArn parameter of the task definition

Cevap

Define the permissions in the taskRoleArn parameter of the task definition
The correct option is to define the permissions in the taskRoleArn parameter of the task definition. This assigns an IAM Task Role to the container, which is used by the application inside the container to authorize its calls to services like Amazon DynamoDB using the AWS SDK.

Adım Adım Çözüm

1
Determine which component needs to access the Amazon DynamoDB table.
The application code running inside the container needs the access.
This helps distinguish between application-level requirements and container-orchestration-level requirements.
2
Identify the correct parameter in the ECS task definition designed for container application permissions.
The taskRoleArn parameter represents the ECS Task Role.
The Task Role credentials are automatically injected into the container environment for the SDK to use.

Anahtar Kavram

ECS Task Role vs Task Execution Role
Soru 867Soru →

A developer is configuring an application running on an Amazon EC2 instance in Account A (111122223333111122223333) to write logs to an Amazon S3 bucket in Account B (444455556666444455556666) by assuming an IAM role. The EC2 instance is associated with an IAM instance profile containing a role named `AppEngineRole`. In Account B, the developer has created an IAM role named `LogWriterRole` with a permissions policy allowing `s3:PutObject` on the S3 bucket.

Currently, the application fails to write logs and receives an `AccessDenied` error. The developer reviews the existing configurations:

Account A - `AppEngineRole` Permissions Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::account-b-logs-bucket/*"
}
]
}

Account B - `LogWriterRole` Trust Policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following changes must the developer make to resolve the error and allow the application to assume the role and write to the S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Modify the permissions policy of `AppEngineRole` in Account A to allow the `sts:AssumeRole` action on `arn:aws:iam::444455556666:role/LogWriterRole`.; Modify the trust policy of `LogWriterRole` in Account B to specify the principal `"AWS": "arn:aws:iam::111122223333:role/AppEngineRole"` instead of the EC2 service principal.

Cevap

To resolve the issue, the developer must allow the `AppEngineRole` in Account A to perform the `sts:AssumeRole` action on `LogWriterRole`, and they must update the trust policy of `LogWriterRole` in Account B to trust the ARN of `AppEngineRole` rather than the EC2 service principal.
For cross-account role assumption to succeed, two configurations are required: first, the permissions policy of the calling role in Account A must grant the `sts:AssumeRole` action targeting the ARN of the role in Account B. Second, the trust policy of the target role in Account B must designate the calling role's ARN in Account A as a trusted principal. Currently, the calling role in Account A lacks the permission to call `sts:AssumeRole`, and the target role in Account B incorrectly trusts the EC2 service principal rather than the calling IAM role itself.

Adım Adım Çözüm

1
Analyze the execution environment and required IAM authorization flow.
The application runs on EC2 in Account A under the identity of `AppEngineRole` and needs to perform tasks in Account B. Direct bucket access is not configured; instead, the application must assume the `LogWriterRole` in Account B to obtain temporary credentials.
Understanding the authorization flow (role assumption across accounts) is necessary to identify the missing components.
2
Evaluate the permissions policy of the calling role (`AppEngineRole` in Account A).
The permissions policy currently grants `s3:PutObject` on the Account B bucket directly. However, to assume `LogWriterRole` in Account B, the caller must have `sts:AssumeRole` permissions on that specific role.
An IAM entity cannot assume a role unless it is explicitly permitted to call `sts:AssumeRole` on the target resource.
3
Evaluate the trust policy of the target role (`LogWriterRole` in Account B).
The trust policy currently trusts the service principal `ec2.amazonaws.com`. This configuration only allows the EC2 service to assume the role. It must be updated to trust the actual IAM role `AppEngineRole` from Account A.
For an application running on an EC2 instance to assume a cross-account role, the target role's trust policy must trust the calling IAM role's ARN, not the EC2 service principal.

Anahtar Kavram

Cross-account IAM role delegation requires a bi-directional handshake: the caller's identity-based policy must allow `sts:AssumeRole` on the target role, and the target role's trust policy must trust the caller's IAM ARN.
Soru 868Soru →

A developer is configuring an application running on AWS Elastic Beanstalk that requires access to a database. The database password must be rotated automatically every 30 days. Which solution should the developer implement to meet these security requirements?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.

Cevap

Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.
AWS Secrets Manager natively supports automatic rotation of database credentials using built-in templates, satisfying the security requirements with minimal effort.

Adım Adım Çözüm

1
Analyze the requirement to store database credentials securely with automatic rotation every 30 days.
Automatic rotation of credentials is a primary capability of AWS Secrets Manager.
Choosing a service that natively supports automatic rotation avoids custom code.
2
Evaluate and eliminate options that do not support automatic rotation natively.
AWS Systems Manager Parameter Store and Amazon S3 do not support native automatic rotation.
Eliminating options with high operational overhead narrows down the correct service.

Anahtar Kavram

AWS Secrets Manager vs Systems Manager Parameter Store for automatic secrets rotation
Tahmini Süre:45s
Soru 869Soru →

A developer is configuring a cross-account continuous delivery pipeline in AWS CodePipeline. The pipeline resides in Account A and must deploy an application to Account B. The pipeline uses an Amazon S3 bucket in Account A to store deployable artifacts, which must be encrypted using a customer managed key in AWS KMS. Arrange the steps in the correct sequence to configure the cross-account pipeline and its security components so that the deploy action in Account B can successfully access and decrypt the artifacts.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of steps to configure the cross-account pipeline is: first, create the customer managed KMS key in Account A; second, create the IAM deployment role in Account B; third, update the S3 artifact bucket policy in Account A to grant access to the Account B role; and finally, update the pipeline JSON definition in Account A to reference these resources.
The correct sequence begins with creating the KMS key in Account A to establish cross-account encryption permissions. Next, the IAM deployment role must be created in Account B so that its ARN exists. With the role created, the S3 bucket policy in Account A can then be updated to reference the role's ARN without causing validation errors. Finally, the pipeline definition is updated to tie the KMS key and the deployment role ARN into the pipeline configuration.

Adım Adım Çözüm

1
Create the customer managed KMS key in Account A.
A KMS key is generated, and its policy is updated to grant cross-account permissions to Account B.
This establishes the cryptographic foundation required for securing cross-account artifact sharing, allowing Account B to decrypt pipeline artifacts.
2
Create the IAM deployment role in Account B.
An IAM role is created with a trust policy allowing the Account A pipeline execution role to assume it.
This role is required to perform the deployment in Account B and must be created first so its ARN exists for references in other policies.
3
Update the S3 artifact bucket policy in Account A.
The S3 bucket policy is modified to allow the Account B deployment role access to the artifacts.
AWS S3 validates the existence of IAM principal ARNs when saving bucket policies. The role in Account B must already exist to prevent a validation error.
4
Update the pipeline JSON definition in Account A.
The pipeline is updated with the KMS key associated with the artifact store and the deployment role ARN specified in the deploy action.
This binds the cross-account deployment configuration together, allowing CodePipeline to assume the Account B role during the deployment stage.

Anahtar Kavram

Cross-account AWS CodePipeline deployments require a specific ordering of resource creation because IAM role ARNs are validated during the saving of resource-based policies (like S3 bucket policies), and customer managed KMS keys are required for cross-account artifact encryption.
Soru 870Soru →

A developer is implementing an AWS Lambda function that performs data enrichment. The function must query an Amazon Aurora MySQL database cluster running in a private VPC subnet. In addition, the function must invoke an external public API to retrieve conversion rates and securely access database credentials. The Lambda function is configured to run within the same private VPC subnet. Which configuration will allow the Lambda function to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Deploy the Lambda function in the private subnet. Create a NAT Gateway in a public subnet, and add a route in the private subnet's route table pointing 0.0.0.0/0 to the NAT Gateway. Store the database credentials in AWS Secrets Manager, and grant the Lambda execution role permissions to retrieve the secret.

Cevap

Deploy the Lambda function in the private subnet, configure a NAT Gateway in a public subnet for external internet traffic, and secure credentials using AWS Secrets Manager with IAM execution role permissions.
The correct configuration deploys the Lambda function in the private subnet to connect locally to the private Aurora database. To access the external API, a NAT Gateway is deployed in a public subnet, and the private subnet's route table is updated to route internet-bound traffic (0.0.0.0/0) through it. Secrets Manager securely stores the database credentials, which the Lambda execution role can retrieve using standard identity-based permissions.

Adım Adım Çözüm

1
Determine network access requirements for the Lambda function to reach the Aurora database and the external API.
The Lambda function must be placed in a VPC private subnet to access the private Aurora database. To reach the external API (public internet), it requires a NAT Gateway situated in a public subnet.
Lambda functions associated with a VPC private subnet do not have direct internet access unless outbound traffic is routed through a NAT Gateway or NAT instance.
2
Establish secure storage and access for database credentials.
Store the sensitive credentials in AWS Secrets Manager, and grant the Lambda execution role the necessary IAM permissions (secretsmanager:GetSecretValue) to retrieve them.
Storing credentials in Secrets Manager ensures encryption at rest and transit, supports rotation, and complies with security best practices.
3
Configure routing and security groups.
Add a route to the private subnet's route table directing 0.0.0.0/0 traffic to the NAT Gateway. Ensure the security groups allow outbound traffic from the Lambda function to the database and the NAT Gateway.
Proper route tables and security group rules are required to establish network paths to both local VPC resources and external services.

Anahtar Kavram

Configuring VPC routing and external API access for Lambda functions deployed inside private subnets, while securing credentials using AWS Secrets Manager.
Soru 871Soru →

A developer creates a new AWS CodeBuild project and configures a custom IAM role for the build environment. However, when attempting to run the build, the execution fails immediately before starting any phases with an error indicating that CodeBuild is unable to assume the configured service role. Which of the following is the most likely cause of this failure?

Cevabı ve açıklamayı göster

Cevap: The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.

Cevap

The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.
For AWS CodeBuild to execute a build project, it must assume the specified IAM service role. This requires the IAM role's trust policy (trust relationship) to explicitly list the CodeBuild service principal (codebuild.amazonaws.com) in the Principal block and allow the sts:AssumeRole action. If the trust policy is missing or misconfigured, CodeBuild will fail to assume the role and the build cannot start.

Adım Adım Çözüm

1
Analyze the error message regarding the inability to assume the service role.
Identify that the issue is related to the relationship between the service (AWS CodeBuild) and the IAM role.
Before any build phases can run, CodeBuild must assume the service role to obtain temporary security credentials.
2
Verify where service trust is established in AWS IAM.
Recognize that service trust is defined in the trust policy (or trust relationship) of the role, rather than its permissions policy.
The trust policy determines which entities (users, accounts, or services) are allowed to assume the role.
3
Identify the correct service principal for AWS CodeBuild.
Ensure that the principal 'codebuild.amazonaws.com' is configured to allow 'sts:AssumeRole'.
If this configuration is missing, IAM blocks CodeBuild from assuming the role, resulting in an immediate failure.

Anahtar Kavram

AWS CodeBuild IAM service role trust relationship
Soru 872Soru →

A developer is designing a containerized microservice to be deployed on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The microservice requires secure access to two configurations:
1. A database connection string that is static and changes infrequently.
2. A payment gateway API key that must be automatically rotated every 30 days.
The microservice must retrieve the rotated API key dynamically at runtime without requiring a task restart or redeployment. The developer wants to minimize costs and API call latency.

Which combination of configuration steps should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, and reference it in the ECS container definition secrets section using the ECS task execution role for decryption.; Store the payment gateway API key in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve the secret dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.

Cevap

Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, referencing it in the ECS container definition secrets section using the ECS task execution role, and store the payment gateway API key in AWS Secrets Manager, configuring automatic rotation using an AWS Lambda function, and retrieving it dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.
For static values like a database connection string, Systems Manager Parameter Store is the most cost-effective solution. Using the ECS container definition's secrets section allows the ECS agent to inject the decrypted parameter as an environment variable at startup, using the Task Execution Role. For values requiring rotation, AWS Secrets Manager is the correct service due to its native support for Lambda-based rotation. To ensure the application dynamically retrieves the rotated key without a task restart, the microservice must query Secrets Manager at runtime using the AWS SDK, leveraging permissions from the ECS Task Role.

Adım Adım Çözüm

1
Analyze secret characteristics and choose the storage service.
Determine that SSM Parameter Store is the most cost-effective choice for the static string, while AWS Secrets Manager is required for the API key to utilize built-in automatic rotation.
Standard parameters in Parameter Store have no storage cost, whereas Secrets Manager charges per secret and supports Lambda-based rotation.
2
Determine the injection mechanism for the static secret.
Reference the Parameter Store SecureString in the ECS container definition secrets section.
The ECS agent will retrieve and inject the connection string as an environment variable during container startup using permissions from the task execution role. Since the connection string is static, injecting it at startup is efficient.
3
Determine the retrieval mechanism for the rotating secret.
Use the AWS SDK inside the microservice code to retrieve the API key dynamically from Secrets Manager at runtime.
Environment variables are static once the container is running; querying the API at runtime is necessary to handle rotations dynamically without restarting tasks. The task role provides the application runtime permissions.

Anahtar Kavram

Selecting and integrating Secrets Manager vs Parameter Store based on rotation requirements and ECS role configuration.
Soru 873Soru →

A developer is creating an AWS Serverless Application Model (SAM) template to deploy a Lambda function that is triggered by an API Gateway endpoint. Which two template configurations or declarations are required to successfully define the serverless function and its API Gateway trigger?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Include the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template; Define an `Events` property of type `Api` under the `AWS::Serverless::Function` resource

Cevap

To configure the serverless function and its API Gateway trigger, the developer must include the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template and define an `Events` property of type `Api` under the `AWS::Serverless::Function` resource.
The correct configurations are including the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template to instruct CloudFormation to evaluate the SAM syntax, and defining an `Events` property of type `Api` under the `AWS::Serverless::Function` resource to set up the API Gateway trigger.

Adım Adım Çözüm

1
Identify the required header declaration for AWS SAM templates.
Adding `Transform: AWS::Serverless-2016-10-31` instructs CloudFormation to parse the template using the SAM engine.
Without the Transform declaration, CloudFormation fails to recognize shorthand SAM resource types like AWS::Serverless::Function.
2
Configure the event source to trigger the Lambda function.
Adding an `Events` property with an `Api` type under the function resource establishes the API Gateway connection.
This automatically creates and links the API Gateway resource to the function with sensible default proxy configurations.

Anahtar Kavram

AWS Serverless Application Model (SAM) Template Structure
Soru 874Soru →

A developer is configuring a deployment pipeline using AWS CodeDeploy to update an AWS Lambda function. The deployment uses the `CodeDeployDefault.LambdaCanary10Percent10Minutes` configuration, which shifts 10%10\% of the traffic to the new version for a duration of 10 minutes10\text{ minutes}. The traffic is routed through a Lambda alias named `live`. The developer wants to ensure the deployment automatically rolls back if the new function version introduces errors, while preventing false rollbacks caused by test executions on the `$LATEST` version or activity on other development aliases of the function. Which configuration should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a CloudWatch Alarm for the Lambda `Errors` metric using the `FunctionName` and `Resource` dimensions, with the `Resource` dimension set to `my-function:live`. Associate this alarm with the CodeDeploy deployment group's rollback configuration.

Cevap

Create a CloudWatch Alarm for the Lambda Errors metric using the FunctionName and Resource dimensions, with the Resource dimension set to the function name and the live alias. Associate this alarm with the CodeDeploy deployment group's rollback configuration.
The correct answer configuration monitors the specific Lambda alias (live) that is undergoing traffic shifting. Lambda publishes metrics under the Resource dimension in the format of FunctionName:AliasName. Monitoring this specific resource isolates the traffic routed to the production environment, ensuring that errors on other versions or aliases do not cause false alarms, and that any issues introduced by the new canary version are correctly detected.

Adım Adım Çözüm

1
Identify how Lambda metrics are published to CloudWatch.
Recall that Lambda emits metrics with dimensions FunctionName (aggregating all traffic) and Resource (tracking a specific version or alias, formatted as FunctionName:Alias or FunctionName:Version).
To monitor the specific deployment's health, we need to know how to filter the metrics.
2
Evaluate which dimension isolates the deployment traffic.
The alias live is being updated by CodeDeploy. Thus, monitoring the Resource dimension with my-function:live isolates all traffic routed to the alias during the deployment, capturing errors from both the new and old versions.
This allows the alarm to trigger a rollback if the new version introduces errors, without being affected by testing on other aliases or $LATEST.
3
Assess the distractors against the requirements.
Distractors using only FunctionName monitor other environments. Distractors using $LATEST miss the canary traffic. Dynamic version monitoring is not supported.
To confirm that the chosen configuration is the only viable option.

Anahtar Kavram

AWS CodeDeploy automates Lambda traffic shifting using aliases. Monitoring for automatic rollbacks must use the specific alias Resource dimension to isolate deployment-related errors and avoid false rollbacks from unrelated invocations.
Tahmini Süre:2m 0s
Soru 875Soru →

A company is developing a mobile application that allows users to record their run times. The application needs to authenticate users and then grant them secure, direct access to read and write their run history in a specific Amazon DynamoDB table and upload route maps to an Amazon S3 bucket. Which combination of Amazon Cognito features should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Use a Cognito User Pool to handle user registration and login, and exchange the resulting identity token with a Cognito Identity Pool to obtain temporary, scoped AWS credentials for accessing S3 and DynamoDB.

Cevap

Use a Cognito User Pool to handle user registration and login, and exchange the resulting identity token with a Cognito Identity Pool to obtain temporary, scoped AWS credentials for accessing S3 and DynamoDB.
The correct option correctly details the standard workflow: using a Cognito User Pool for user authentication and directory management, and a Cognito Identity Pool to exchange the ID token for temporary, scoped AWS credentials. This allows the mobile app to communicate directly with Amazon DynamoDB and Amazon S3 using temporary IAM-based access.

Adım Adım Çözüm

1
Configure a Cognito User Pool to manage user registration, authentication, and directory profiles.
The User Pool issues identity and access JSON Web Tokens (JWT) upon successful user authentication.
This establishes the identity of the user securely.
2
Configure a Cognito Identity Pool and link it to the Cognito User Pool as an authentication provider.
The Identity Pool is configured with associated authenticated and unauthenticated IAM roles.
This allows the application to exchange user identity tokens for temporary AWS credentials.
3
Use the AWS SDK in the mobile application to exchange the User Pool identity token for temporary AWS credentials via the Identity Pool, and then perform direct actions against DynamoDB and S3.
The application receives temporary credentials matching the permissions defined in the IAM role associated with the Identity Pool.
This grants secure, direct, fine-grained access to AWS services from the client without exposing permanent keys.

Anahtar Kavram

Separation of authentication and authorization using Cognito User Pools and Identity Pools
Tahmini Süre:1m 30s
Soru 876Soru →

A developer is configuring an Amazon ECS task definition to run a microservice on AWS Fargate. The containerized application must retrieve database credentials stored as SecureString parameters in Systems Manager Parameter Store and inject them as environment variables during container startup. Additionally, the application code inside the container needs to read and write items in an Amazon DynamoDB table at runtime. Which configuration of IAM roles should the developer specify in the task definition to satisfy these requirements?

Cevabı ve açıklamayı göster

Cevap: Specify a Task Execution Role containing permissions to retrieve the Parameter Store parameters, and a Task Role containing permissions to access the DynamoDB table.

Cevap

Specify a Task Execution Role containing permissions to retrieve the Parameter Store parameters, and a Task Role containing permissions to access the DynamoDB table.
The correct answer properly separates the concerns of task bootstrapping and container runtime execution. The Task Execution Role is utilized by the Amazon ECS container agent to pull secrets from Systems Manager Parameter Store and inject them into the container's environment variables before startup. The Task Role is assumed by the application code running inside the container to make AWS SDK calls to Amazon DynamoDB at runtime. Both roles must trust the ECS tasks service principal to be assumed correctly.

Adım Adım Çözüm

1
Identify the agent-level requirements during container bootstrap.
The ECS agent needs to fetch SSM Parameter Store secure parameters to inject them as environment variables before the container starts, which requires the ECS Task Execution Role.
The Task Execution Role grants the ECS container agent permissions to make AWS API calls on your behalf (such as pulling container images and pulling secrets).
2
Identify the application-level requirements at runtime.
The application code running inside the container needs to read/write to the DynamoDB table, which requires the ECS Task Role.
The Task Role grants the containerized application itself permissions to call AWS APIs at runtime.
3
Verify trust policy configurations.
Both roles must have a trust policy allowing the ecs-tasks.amazonaws.com service principal to assume the role.
Trust policies determine which entities (in this case, ECS tasks) are permitted to assume the IAM roles.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role
Tahmini Süre:1m 30s
Soru 877Soru →

A developer is building a serverless backend where users must register and sign in to access private API Gateway endpoints. The developer wants to use built-in AWS features to authenticate users and control access to the APIs with minimal custom code.

Which TWO Amazon Cognito features or configurations should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An Amazon Cognito User Pool to manage user registration, sign-in, and token generation.; An Amazon Cognito Authorizer in API Gateway to validate the JSON Web Tokens (JWTs) returned after user authentication.

Cevap

Implementing an Amazon Cognito User Pool and configuring an Amazon Cognito Authorizer in API Gateway
To authenticate users and authorize API Gateway requests with minimal overhead, a developer should use an Amazon Cognito User Pool to handle user directory services (registration and sign-in) and token issuance, and pair it with an API Gateway Cognito Authorizer to validate those tokens at the API entry point.

Adım Adım Çözüm

1
Set up user authentication and directory
Create an Amazon Cognito User Pool to serve as the user directory and handle registration, sign-in, and the issuance of JWT tokens.
This establishes the identity store and authentication mechanism for the application.
2
Configure API Gateway authorization
Configure an Amazon Cognito Authorizer on the API Gateway resource and point it to the Cognito User Pool.
This enables API Gateway to automatically intercept incoming requests, extract the JWT token from the Authorization header, and validate it against the User Pool.

Anahtar Kavram

Amazon Cognito User Pools provide authentication and issue tokens, while API Gateway Cognito Authorizers provide built-in token validation for authorization.
Soru 878Soru →

A developer is deploying a web application using AWS CloudFormation. The template configures an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The EC2 instances must install application software packages and retrieve a database password from parameter storage during startup. The database password must be rotated automatically every 30 days. Currently, the stack deployment finishes and is marked complete before the application initialization script finishes on the EC2 instances, causing the application to fail to connect to the database. How should the developer configure the CloudFormation template and startup scripts to resolve these issues in a secure and reliable manner?

Cevabı ve açıklamayı göster

Cevap: Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.

Cevap

Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.
The correct solution uses a CreationPolicy on the Auto Scaling group resource to halt the stack creation progress until a success signal is received. By placing the cfn-signal command at the end of the UserData script, the developer ensures that the signal is only sent after the software packages are fully installed and configured. Furthermore, AWS Secrets Manager is used because it natively supports the required 30-day automatic rotation, and retrieving the secret at runtime using the AWS SDK is a secure practice.

Adım Adım Çözüm

1
Configure a CreationPolicy on the Auto Scaling group resource in the CloudFormation template.
CloudFormation will pause the resource creation process and wait for a specified number of success signals before transitioning the Auto Scaling group to CREATE_COMPLETE.
This prevents CloudFormation from marking the stack creation as successful before the instances are actually ready.
2
Store the database password in AWS Secrets Manager and enable automatic rotation.
The password is secure, and Secrets Manager automatically rotates it every 30 days without manual intervention.
Systems Manager Parameter Store does not natively support automatic rotation of secrets, making Secrets Manager the correct choice for this requirement.
3
Modify the instance launch template's UserData to install the application, retrieve the password via AWS SDK, and invoke cfn-signal at the end of the script.
The instances configure themselves on startup and signal CloudFormation of success only after all initialization steps are complete.
Signaling only at the end of the script ensures the instance is fully operational before the stack transitions to success.

Anahtar Kavram

CloudFormation CreationPolicy, helper scripts (cfn-signal), and Secrets Manager integration
Tahmini Süre:2m 30s
Soru 879Soru →

A developer is building a document processing application that must client-side encrypt files up to 15 MB15\text{ MB} in size before uploading them to an Amazon S3 bucket. The application must use a customer managed key in AWS Key Management Service (AWS KMS) for this process. Which of the following actions must the developer perform to implement this client-side encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API operation using the customer managed key to receive a plaintext data key and an encrypted data key.; Encrypt the file locally using the plaintext data key, then delete the plaintext data key from memory.

Cevap

The correct actions are calling the KMS GenerateDataKey API operation to obtain the plaintext and encrypted data keys, and encrypting the file locally using the plaintext data key while discarding it from memory afterwards.
To implement client-side envelope encryption for large files (such as 15 MB15\text{ MB}), the developer must first call the KMS GenerateDataKey API operation to retrieve both a plaintext and an encrypted data key. The developer then encrypts the file locally using the plaintext key and immediately deletes the plaintext key from memory to prevent leakage, leaving only the encrypted data and the encrypted data key.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
Obtained a plaintext data key for encryption and an encrypted version of the same data key (ciphertext data key) for storage.
Because files larger than 4 KB4\text{ KB} cannot be directly encrypted using the KMS Encrypt API due to size limitations, requiring envelope encryption.
2
Encrypt the file locally.
The file is encrypted using the plaintext data key.
The client-side application must perform the bulk data encryption using a local symmetric key rather than transmitting the entire large payload over the network to AWS KMS.
3
Clean up the memory.
The plaintext data key is purged from the application memory.
To ensure security best practices are followed and the plaintext key is not exposed or leaked.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow for Large Payloads
Soru 880Soru →

A developer is creating an IAM role for an AWS Lambda function. The developer configures the permissions policy correctly but receives an authorization error stating that the function cannot assume the role. The developer inspects the role's trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification must the developer make to the trust policy to allow the Lambda function to assume the role?

Cevabı ve açıklamayı göster

Cevap: Change the Service principal in the trust policy from "ec2.amazonaws.com" to "lambda.amazonaws.com".

Cevap

Change the Service principal in the trust policy from "ec2.amazonaws.com" to "lambda.amazonaws.com".
The trust policy determines which principals can assume the role. Because the current trust policy specifies the Amazon EC2 service principal ("ec2.amazonaws.com"), only EC2 instances can assume the role. To allow AWS Lambda to assume the role, the principal must be updated to the Lambda service principal ("lambda.amazonaws.com").

Adım Adım Çözüm

1
Analyze the error message and the trust policy.
The Lambda function is unable to assume the IAM role because the trust policy only permits the "ec2.amazonaws.com" service principal.
An AWS service cannot assume an IAM role unless it is explicitly trusted in the role's trust relationship document.
2
Identify the correct service principal for AWS Lambda.
The service principal for AWS Lambda is "lambda.amazonaws.com".
Each AWS service that assumes roles has a specific service principal identifier used in IAM trust policies.
3
Update the trust policy with the correct service principal.
Changing "ec2.amazonaws.com" to "lambda.amazonaws.com" allows the Lambda service to assume the execution role.
This establishes the necessary trust relationship, allowing the function to execute with the role's permissions.

Anahtar Kavram

IAM trust policies define which principals (users, roles, accounts, or services) are authorized to assume an IAM role.
ÖncekiSayfa 44 / 78Sonraki