Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 881Soru →

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS database and an Amazon ECS service. The database credentials must be rotated automatically every 30 days. To troubleshoot an urgent connectivity issue, a system administrator manually modified the database security group rules and the database master password directly in the AWS Management Console. When the developer subsequently attempts to update the stack to deploy a new ECS task definition, the stack update fails.

Which two actions should the developer take to resolve the update failure and align the infrastructure with AWS security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run drift detection on the stack to identify the out-of-band changes, and update the CloudFormation template to match the current database security group configuration.; Store the database credentials in AWS Secrets Manager, and reference them in the CloudFormation template using dynamic references to support automatic rotation.

Cevap

Run drift detection on the stack to identify the out-of-band changes, update the CloudFormation template to match the current database security group configuration, store the database credentials in AWS Secrets Manager, and reference them in the template using dynamic references.
To resolve the CloudFormation update failure due to manual out-of-band modifications, the developer should run drift detection to identify the changes and update the template configuration to match the current physical state. To securely manage the database password and satisfy the rotation requirement, the developer should store the credentials in AWS Secrets Manager, which natively supports automatic rotation, and reference them in the CloudFormation template using dynamic references.

Adım Adım Çözüm

1
Detect drift to identify out-of-band changes.
The differences between the expected template configuration and the actual physical resource configuration of the security groups are identified.
This determines exactly what has changed manually so the template can be synchronized without overwriting intended configuration changes.
2
Update the template to match the drifted state.
The template definition of the security groups is updated to match the manually modified rules.
Aligning the template with the drifted state ensures subsequent CloudFormation updates do not fail due to configuration mismatch or attempt to overwrite the database's network access settings.
3
Migrate credentials to AWS Secrets Manager and configure dynamic references.
The database credentials are secured in Secrets Manager with automatic rotation enabled, and the template references them dynamically.
Secrets Manager provides secure storage and automatic rotation of credentials, which are referenced at runtime without hardcoding in the CloudFormation template or application configuration.

Anahtar Kavram

Handling resource drift and managing secrets securely in AWS CloudFormation.
Soru 882Soru →

A developer is selecting deployment strategies for a production web application. The application has two strict requirements: there must be zero downtime during the deployment process, and the application must be able to roll back to the previous version immediately if a failure is detected. Which of the following deployment strategies satisfy both of these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Blue/Green deployment; Canary deployment

Cevap

Blue/Green deployment and Canary deployment satisfy the requirements because they both allow traffic to be shifted between environments or versions with zero downtime, and can immediately route traffic back to the stable version if a failure occurs.
The correct strategies are Blue/Green deployment and Canary deployment. In a Blue/Green deployment, a separate environment is created, and traffic is cut over, allowing an immediate rollback by shifting traffic back if an error occurs. In a Canary deployment, traffic is shifted incrementally, and if alarms fire, traffic is immediately routed back to the old version. Both methods guarantee zero downtime and immediate rollback.

Adım Adım Çözüm

1
Identify the downtime requirements of the candidate deployment strategies.
Blue/Green and Canary strategies support zero downtime by keeping both versions of the application active. All-at-once and standard In-place strategies incur downtime.
To filter out strategies that cause application offline states.
2
Analyze the rollback capabilities of the remaining strategies.
Blue/Green and Canary strategies can roll back immediately by shifting traffic back to the original version. Rolling and All-at-once strategies require a redeployment of the previous version to roll back.
To identify which strategies meet the immediate rollback constraint.

Anahtar Kavram

Downtime and rollback trade-offs of AWS deployment strategies.
Tahmini Süre:45s
Soru 883Soru →

A developer is implementing a secure corporate portal that exposes sensitive administrative endpoints through an Amazon API Gateway REST API. The portal's frontend application authenticates users against an Amazon Cognito User Pool. The developer wants to restrict access to these REST API endpoints to authenticated users only. To comply with security best practices and keep development and operational overhead to a minimum, the developer wants to avoid writing and maintaining custom code for token verification. Which approach should the developer use to authorize these API requests?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.

Cevap

Configure an Amazon Cognito User Pool authorizer on the API Gateway resources, and verify the authorization by passing the identity JSON Web Token (JWT) in the request headers.
Configuring an Amazon Cognito User Pool authorizer is a native, built-in feature of Amazon API Gateway. It validates JSON Web Tokens (JWT) sent in the request header directly against the configured Cognito User Pool without executing custom Lambda code. This approach eliminates custom code development, reduces operational overhead, and minimizes execution costs.

Adım Adım Çözüm

1
Identify the authentication source and authorization requirements.
Users authenticate against an Amazon Cognito User Pool, and the API Gateway REST API must allow access only to these authenticated users.
Establishing the source of the identity tokens helps determine which built-in integrations are available.
2
Evaluate the constraints regarding development and operational overhead.
Custom code for token verification must be avoided.
This eliminates custom Lambda authorizers or validation within the backend Lambda function, favoring native API Gateway integrations.
3
Select the built-in, code-free API Gateway security mechanism.
Configure an Amazon Cognito User Pool authorizer on the API Gateway REST API resources.
This native feature validates the JWT signature and expiration directly at the API Gateway layer without requiring custom code or extra Lambda execution.

Anahtar Kavram

Natively securing Amazon API Gateway REST APIs using Cognito User Pool Authorizers to validate JSON Web Tokens (JWT) without custom code execution.
Soru 884Soru →

A developer is deploying a serverless application using AWS SAM. During the deployment process, AWS CloudFormation returns a validation error stating that the resource type 'AWS::Serverless::Function' could not be found or is invalid. Which of the following is the most likely cause of this error?

Cevabı ve açıklamayı göster

Cevap: The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

Cevap

The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.
The correct answer is correct because AWS SAM is an extension of AWS CloudFormation. In order for CloudFormation to recognize and parse SAM-specific resource types like AWS::Serverless::Function, the template must include the 'Transform: AWS::Serverless-2016-10-31' declaration. This declaration tells CloudFormation to run the macro that translates the SAM template into standard CloudFormation resources.

Adım Adım Çözüm

1
Analyze the CloudFormation error message.
The error indicates that the resource type 'AWS::Serverless::Function' is unrecognized or invalid.
This error occurs because CloudFormation does not natively support the AWS::Serverless namespace without a translator.
2
Identify the mechanism that enables CloudFormation to parse SAM resources.
The template must contain the 'Transform: AWS::Serverless-2016-10-31' declaration.
The Transform declaration instructs CloudFormation to invoke the SAM transform macro, which translates SAM-specific resources into standard CloudFormation resources during deployment.

Anahtar Kavram

AWS SAM templates must include the Transform declaration to translate serverless resources into standard CloudFormation resources.
Soru 885Soru →

A developer is running a local Node.js application that uses the AWS SDK to read from an Amazon S3 bucket. During local testing, the application fails to connect to AWS and throws a credential loading error. Which two actions should the developer take to resolve this issue securely? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the AWS Access Key ID and Secret Access Key in the shared AWS credentials file located at the default user profile path on the local machine.; Set the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the local shell session where the application is executed.

Cevap

Configure the credentials in the shared AWS credentials file on the local machine, or set the access keys as environment variables in the local shell session.
The correct options are configuring the credentials in the shared AWS credentials file or setting the credentials as environment variables. The AWS SDK default credential provider chain automatically searches for environment variables first, followed by the shared credentials file. Both options are standard, secure ways to provide credentials to local applications without modifying the code.

Adım Adım Çözüm

1
Identify that the AWS SDK requires valid credentials (access key ID and secret access key) to authenticate local API requests.
The application fails because no credentials are provided to the default credential provider chain.
By default, the SDK checks environment variables and local configuration files to locate credentials.
2
Apply a secure local credentials configuration method by either writing the credentials to the default shared AWS credentials file or exporting them as environment variables.
The SDK successfully loads the credentials automatically without hardcoding them in the source code.
Environment variables and the credentials file are high-priority locations checked by the default credential provider chain.

Anahtar Kavram

AWS SDK Default Credential Provider Chain and Local Authentication
Soru 886Soru →

A company's CI/CD pipeline uses AWS CodeBuild to compile a web application. The build process requires the main application source code from a primary AWS CodeCommit repository, as well as a common stylesheet template from a secondary AWS CodeCommit repository. The developer configures the CodeBuild project with multiple input sources, setting the secondary source identifier to CommonStyles. During the build, the buildspec must copy the stylesheet from the secondary source directory to the main application's public assets folder. How should the developer reference the file path of the secondary source inside the buildspec.yml file to perform this copy operation?

Cevabı ve açıklamayı göster

Cevap: Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.

Cevap

Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.
When configured with multiple input sources, AWS CodeBuild downloads the primary source to the default build directory referenced by `CODEBUILDSRCDIR‘.Foreachsecondarysource,CodeBuildcreatesaseparatedirectoryandgeneratesadedicatedenvironmentvariablenamed‘CODEBUILD_SRC_DIR`. For each secondary source, CodeBuild creates a separate directory and generates a dedicated environment variable named ` CODEBUILD_SRC_DIR_source_identifier` where `source_identifier` is the unique identifier specified in the project configuration. Therefore, referencing `$CODEBUILD_SRC_DIR_CommonStyles` provides the correct path to the secondary source repository's files.

Adım Adım Çözüm

1
Identify how AWS CodeBuild handles multiple input sources during a build execution.
The primary source is downloaded to the directory referenced by `$CODEBUILD_SRC_DIR`, while secondary sources are downloaded to separate locations.
Understanding the isolation of source directories prevents incorrect assumptions about directory nesting or relative paths.
2
Determine how CodeBuild exposes the paths of secondary sources to the build environment.
CodeBuild dynamically generates environment variables for each secondary source matching the pattern `$CODEBUILD_SRC_DIR_source_identifier`.
This allows buildspec shell commands to programmatically locate and reference files across different repositories.
3
Select the specific environment variable matching the configured source identifier CommonStyles.
The correct environment variable is `$CODEBUILD_SRC_DIR_CommonStyles`.
This environment variable contains the absolute path to the directory containing the common stylesheet template.

Anahtar Kavram

AWS CodeBuild Multiple Source Inputs
Soru 887Soru →

An asynchronous processing system utilizes an AWS Lambda function to retrieve messages from an Amazon SQS queue and perform updates on an Amazon Aurora PostgreSQL database. The database is hosted in private subnets within a custom VPC. To connect to the database, the Lambda function is associated with the same private subnets. However, the Lambda function fails to retrieve any messages from the queue and times out during execution. How should the network and endpoint configuration be adjusted to allow the function to securely poll the SQS queue?

Cevabı ve açıklamayı göster

Cevap: Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.

Cevap

Establish an Interface VPC endpoint for Amazon SQS within the private subnets, enabling private DNS hostnames for the VPC endpoint to route requests internally.
Establishing an Interface VPC endpoint for Amazon SQS inside the private VPC subnets allows the Lambda function to securely and privately access SQS over the AWS internal network. Activating private DNS hostnames ensures that the standard SQS DNS hostname automatically resolves to the private IP addresses of the endpoint network interfaces.

Adım Adım Çözüm

1
Analyze the network configuration of the Lambda function.
The Lambda function is placed in a private VPC subnet to access the private Aurora database.
By placing Lambda in a VPC subnet, it loses its default internet connectivity and can only access resources inside the VPC or via VPC gateways/endpoints.
2
Identify the destination endpoint requirements.
The Lambda function needs to communicate with Amazon SQS, which is a public AWS service.
Since the function is in a private subnet with no path to the public internet, it cannot resolve or reach the public SQS endpoint directly.
3
Determine the secure, private solution for AWS service integration.
Create an Interface VPC endpoint (powered by AWS PrivateLink) for SQS in the VPC and enable Private DNS.
This places elastic network interfaces (ENIs) inside the private subnets, allowing the Lambda function to route SQS API calls entirely within the AWS network.

Anahtar Kavram

VPC Endpoint Connectivity for Serverless Resources
Tahmini Süre:1m 30s
Soru 888Soru →

A developer is setting up a release pipeline in AWS CodePipeline that consists of a Source stage, a Build stage using AWS CodeBuild, and a Deploy stage. The developer needs to pass the build output files from the Build stage to the Deploy stage. Which configuration must the developer specify in the pipeline definition to transfer these files?

Cevabı ve açıklamayı göster

Cevap: Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.

Cevap

Configure the build action to produce an output artifact, and configure the deploy action to accept that artifact as an input artifact.
In AWS CodePipeline, files are passed between stages using input and output artifacts. The developer defines an output artifact for the CodeBuild action and references it as an input artifact in the deployment action. CodePipeline automatically manages the storage of these files in an Amazon S3 artifact bucket associated with the pipeline.

Adım Adım Çözüm

1
Identify the AWS CodePipeline mechanism for passing files between stages.
CodePipeline uses InputArtifacts and OutputArtifacts to move files between actions.
This is the native, secure, and automated way to manage flow of files in CodePipeline.
2
Assign the output artifact name in the Build stage.
The Build stage action produces an output artifact named (e.g.) BuildArtifact.
This registers the build output in CodePipeline's artifact store.
3
Reference the same artifact name as the input artifact in the Deploy stage.
The Deploy stage action consumes BuildArtifact as its input.
This tells CodePipeline to feed the build output files into the deployment step.

Anahtar Kavram

CodePipeline Artifacts
Tahmini Süre:1m 30s
Soru 889Soru →

An application deployed on Amazon EC2 instances must connect to an external database. The developer needs to store the database endpoint URL, which is non-sensitive, and the database credentials, which must be rotated automatically every 30 days. Which combination of actions should the developer take to configure these parameters in a secure and cost-effective manner? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the non-sensitive database endpoint URL as a Parameter Store parameter.; Store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Cevap

Store the non-sensitive database endpoint URL as a Parameter Store parameter, and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Storing the non-sensitive database endpoint in Systems Manager Parameter Store provides a low-cost, fully-managed configuration store. Storing the sensitive database credentials in AWS Secrets Manager provides native automated credentials rotation, which meets security requirements with minimal operational overhead.

Adım Adım Çözüm

1
Identify parameter sensitivity and rotation requirements.
The database endpoint URL is non-sensitive and does not require rotation. The database credentials are sensitive and require regular rotation.
Correct classification helps in choosing the most cost-effective and secure service.
2
Select the appropriate AWS service for each parameter class.
Use Systems Manager Parameter Store for the endpoint URL, and use AWS Secrets Manager for the database credentials.
Parameter Store offers cost-effective storage for configuration parameters, whereas Secrets Manager provides out-of-the-box automatic rotation for sensitive credentials.

Anahtar Kavram

Selecting between Systems Manager Parameter Store and AWS Secrets Manager based on credential sensitivity and automatic rotation requirements.
Soru 890Soru →

A developer is configuring a web application running on Amazon EC2 instances in an Auto Scaling group. The application must retrieve a database password to connect to an Amazon Aurora PostgreSQL DB cluster. The database password must be rotated every 30 days. Both the EC2 instances and the database cluster are deployed in private subnets within a VPC that has no internet connectivity. Which combination of steps should the developer take to meet these requirements securely with the minimum operational overhead?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.

Cevap

Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.
The correct solution uses AWS Secrets Manager, which natively supports automated rotation of RDS database credentials using pre-built Lambda templates. Since the database and EC2 instances reside in a private VPC without internet access, deploying the Lambda rotation function inside the VPC allows it to reach the database. Creating an interface VPC endpoint for Secrets Manager allows the EC2 instances and the Lambda rotation function to securely interact with Secrets Manager privately. Access is granted to the EC2 instances via an IAM instance profile, ensuring no credentials are hardcoded.

Adım Adım Çözüm

1
Store the secret in AWS Secrets Manager.
The database password is encrypted and stored securely.
AWS Secrets Manager is designed for storing secrets (like passwords and API keys) and supports native automatic rotation.
2
Enable automatic rotation using the standard RDS template and deploy the rotation Lambda function within the VPC private subnets.
Secrets Manager automatically manages password updates in both the database and the secret storage every 30 days.
Since the database has no public internet access, the Lambda function must run inside the VPC to connect to the database cluster and update the password.
3
Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
The EC2 instances and the Lambda rotation function can securely connect to Secrets Manager without internet access.
An interface VPC endpoint allows secure, private traffic routing to AWS services within a isolated VPC.
4
Attach an IAM role containing Secrets Manager read access to the EC2 instance profile.
The application retrieves the credential dynamically at runtime.
This avoids hardcoding credentials and uses temporary security credentials instead.

Anahtar Kavram

AWS Secrets Manager vs. Systems Manager Parameter Store and Private VPC Networking Integration
Soru 891Soru →

A developer is designing a secure integration for an enterprise application. While human users authenticate interactively via an Amazon Cognito User Pool, an external partner’s automated service must programmatically invoke a specific Amazon API Gateway REST API. The partner's service needs to perform machine-to-machine (M2M) communication without any user interaction. Which configuration meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.

Cevap

Configure a resource server in the Cognito User Pool and define a custom scope. Create a user pool client for the partner service, enable the Client Credentials grant flow, and configure the API Gateway method to use a Cognito authorizer that requires the custom scope.
Configuring a Cognito resource server and using the Client Credentials grant flow allows machine-to-machine clients to obtain OAuth 2.0 access tokens. API Gateway Cognito authorizers can natively validate these access tokens and restrict access based on the configured custom scopes. This requires no custom validation code or external identity pools.

Adım Adım Çözüm

1
Analyze the client interaction requirements.
The requirement calls for machine-to-machine (M2M) communication without user interaction.
This rules out interactive authorization flows like Authorization Code or Implicit, pointing towards the OAuth 2.0 Client Credentials grant flow.
2
Select the appropriate Amazon Cognito feature set.
Amazon Cognito User Pools support OAuth 2.0 resource servers, custom scopes, and client clients with the Client Credentials grant.
Using a User Pool is more lightweight than building a custom credential exchange service with Cognito Identity Pools.
3
Determine the API Gateway integration strategy.
API Gateway's built-in Cognito authorizer can validate access tokens containing custom scopes natively.
Using a native authorizer avoids writing custom Lambda code to verify JWT signatures, reducing operational overhead and request latency.

Anahtar Kavram

Amazon Cognito User Pool Resource Servers and Client Credentials Flow
Soru 892Soru →

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate in Account A (111111111111111111111111). The application must assume an IAM role named `CrossAccountDynamoDBAccess` in Account B (222222222222222222222222) to perform read operations on a DynamoDB table.

The task definition in Account A is configured with an ECS Task Role named `TaskRole` and an ECS Task Execution Role named `TaskExecutionRole`. The developer configures the trust policy for the `CrossAccountDynamoDBAccess` role in Account B as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs-tasks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the container starts, the application throws an `AccessDenied` error when calling the AWS Security Token Service (STS) `AssumeRole` API.

How should the developer modify the configuration to resolve this issue and grant the application access using the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of `CrossAccountDynamoDBAccess` in Account B to specify the principal as `"AWS": "arn:aws:iam::111111111111:role/TaskRole"`. Additionally, attach a policy to `TaskRole` in Account A that allows `sts:AssumeRole` on the `CrossAccountDynamoDBAccess` role ARN.

Cevap

Update the trust policy of the cross-account role in Account B to trust the ARN of the ECS Task Role, and attach an IAM policy to the ECS Task Role in Account A allowing it to assume the cross-account role.
The correct solution involves modifying the trust policy of the cross-account role in Account B to trust the specific IAM role associated with the running application container (the Task Role in Account A). Additionally, the Task Role in Account A must be granted permission to call the Security Token Service (STS) AssumeRole API on the role in Account B. This allows the application to assume the role using temporary credentials retrieved via the ECS Task Role, complying with the principle of least privilege.

Adım Adım Çözüm

1
Identify the role that executes the application code in ECS.
The containerized application runs using the permissions of the ECS Task Role (`TaskRole`), not the ECS Task Execution Role (`TaskExecutionRole`).
The Task Execution Role is for container agent operations (like pulling images and shipping logs), whereas the Task Role provides AWS API credentials directly to the containerized application.
2
Determine the required trust policy for the cross-account role in Account B.
The trust policy of `CrossAccountDynamoDBAccess` must trust the caller's identity: `arn:aws:iam::111111111111:role/TaskRole`.
The current trust policy incorrectly trusts the service principal `ecs-tasks.amazonaws.com`, which allows ECS to assume the TaskRole but does not allow the TaskRole to assume the cross-account role.
3
Define the required permissions policy in the source account (Account A).
Attach an IAM policy to `TaskRole` in Account A allowing `sts:AssumeRole` on `arn:aws:iam::222222222222:role/CrossAccountDynamoDBAccess`.
For cross-account role assumption to succeed, the source identity must be explicitly granted permission to perform the `sts:AssumeRole` action on the target role.

Anahtar Kavram

IAM Cross-Account Role Assumption with Amazon ECS Task Roles
Soru 893Soru →

A developer is using AWS Serverless Application Model (SAM) to deploy updates to a critical Lambda function. The deployment must satisfy the following constraints:
- Traffic must be shifted from the old version to the new version gradually, in increments of 10% every 2 minutes.
- The deployment must automatically roll back if the execution error rate or latency metrics exceed predefined thresholds.
- Integration test suites must run before traffic starts shifting, and a cleanup script must run after all traffic has shifted to the new version.

Which TWO configurations must the developer specify in the AWS SAM template to satisfy these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the AutoPublishAlias property under the Serverless Function resource to define the alias that will receive the shifted traffic.; Under DeploymentPreference, set the Type to Linear10PercentEvery2Minutes, list the rollback alarms under Alarms, and define the PreTraffic and PostTraffic lifecycle hooks.

Cevap

The developer must specify the AutoPublishAlias property under the Serverless Function resource to define the alias for traffic routing, and configure the DeploymentPreference section with Type: Linear10PercentEvery2Minutes along with the rollback alarms and the PreTraffic and PostTraffic hooks.
To perform gradual traffic shifting with AWS SAM, the function must have AutoPublishAlias enabled. In addition, the deployment strategy must be specified via DeploymentPreference with Type: Linear10PercentEvery2Minutes to shift traffic by 10% every 2 minutes. The template must also reference CloudWatch alarms for automated rollback and specify PreTraffic and PostTraffic hooks to execute validation tests and cleanup operations.

Adım Adım Çözüm

1
Enable traffic shifting support by defining an alias configuration.
Define the AutoPublishAlias property under the AWS::Serverless::Function resource.
AWS SAM cannot perform gradual deployment unless a function alias is defined to shift traffic between the old and new versions.
2
Select the correct linear deployment type configuration.
Set the Type under DeploymentPreference to Linear10PercentEvery2Minutes.
This built-in configuration matches the requirement of shifting 10% of the traffic every 2 minutes.
3
Link safety controls and lifecycle hooks for validation.
Reference the CloudWatch alarms under Alarms and the Lambda validation functions under the PreTraffic and PostTraffic hook properties.
Alarms trigger automatic rollback during the deployment, and hooks run integration tests before traffic shifting starts and cleanup after traffic shifting completes.

Anahtar Kavram

Configuring AWS SAM safe deployments (DeploymentPreference) using built-in CodeDeploy types, aliases, alarms, and lifecycle hooks.
Tahmini Süre:2m 30s
Soru 894Soru →

A developer is configuring an AWS Lambda function to run inside private subnets of a custom VPC. The Lambda function needs to read data from an Amazon Aurora PostgreSQL database located in another private subnet of the same VPC. Additionally, the Lambda function must retrieve database credentials from AWS Secrets Manager. To meet security requirements, all traffic must remain within the AWS network. Which two configurations must the developer implement to allow the Lambda function to connect to both the database and AWS Secrets Manager? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the security groups to allow outbound traffic from the Lambda function to the database, and inbound traffic to the database from the Lambda function.; Create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, and configure the Lambda function's security group to allow outbound traffic to the endpoint.

Cevap

Configure the security groups to allow outbound traffic from the Lambda function to the database (and inbound traffic to the database from the Lambda function) and create an Interface VPC Endpoint for AWS Secrets Manager in the private subnets, configuring the Lambda function's security group to allow outbound traffic to the endpoint.
To secure communications between resources, security groups must explicitly allow traffic between the Lambda function and the database. Additionally, because the Lambda function resides in a private VPC subnet and must reach AWS Secrets Manager without using the public internet, an Interface VPC Endpoint must be provisioned. This places an Elastic Network Interface in the private subnet to facilitate private communication with Secrets Manager.

Adım Adım Çözüm

1
Configure the security groups for the local database connection.
The Lambda function is allowed to initiate outbound connections to the database, and the database accepts inbound connections from the Lambda function on the PostgreSQL port.
Security groups act as stateful firewalls at the resource interface level to allow communication within the VPC.
2
Determine the endpoint type required to access AWS Secrets Manager privately.
Identify that an Interface VPC Endpoint (AWS PrivateLink) is needed for AWS Secrets Manager, as Gateway Endpoints are not supported for this service.
Interface VPC Endpoints allow resources inside private subnets to communicate securely with AWS services without leaving the Amazon network.
3
Establish the Interface VPC Endpoint and configure its security group.
The endpoint is created in the private subnets, and its security group is updated to allow inbound HTTPS traffic from the Lambda function's security group.
Interface endpoints use Elastic Network Interfaces (ENIs) which require security group configurations to permit incoming traffic from client resources.

Anahtar Kavram

AWS VPC private connectivity using Security Groups and Interface VPC Endpoints.
Soru 895Soru →

A developer is setting up an AWS CodeBuild project to compile a simple web application. The developer needs to define the build commands and pull database connection configurations securely during the build execution.

Which TWO configurations are required to support this setup? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Place the buildspec.yml file at the root of the source directory to define the build phases.; Reference sensitive database configurations from AWS Systems Manager Parameter Store or AWS Secrets Manager in the env section of the buildspec file.

Cevap

Placing the buildspec.yml file at the root of the source directory and referencing database configurations from Parameter Store or Secrets Manager in the env section of the buildspec file.
The correct options are placing the buildspec.yml file at the root of the source directory, which CodeBuild automatically locates, and referencing sensitive database configurations from Parameter Store or Secrets Manager in the env section of the buildspec to securely retrieve secrets.

Adım Adım Çözüm

1
Determine the default buildspec file placement.
CodeBuild expects the buildspec.yml file at the root of the source repository unless a custom path is specified in the build project settings.
This allows the build runner to find and execute the build steps automatically.
2
Determine the secure configuration retrieval method.
Map database configurations dynamically inside the env parameter block of the buildspec using Parameter Store or Secrets Manager.
This avoids hardcoding sensitive information in the source code.

Anahtar Kavram

AWS CodeBuild buildspec configuration and secret retrieval
Soru 896Soru →

A developer is building a web application and needs to implement user sign-up, sign-in, and password recovery features to manage the application's user directory. The application does not require users to access any AWS resources directly. Which Amazon Cognito feature should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools

Cevap

Amazon Cognito User Pools
Amazon Cognito User Pools is the correct component because it functions as a user directory that provides sign-up, sign-in, and self-service password recovery workflows out-of-the-box, which matches the application's requirement to manage end-user authentication without needing access to AWS resources.

Adım Adım Çözüm

1
Identify the primary requirement: managing a user directory with sign-up, sign-in, and password recovery capabilities for an application's end-users.
Requires an authentication directory service rather than an authorization service for AWS resources.
The scenario specifies managing sign-up, sign-in, and password recovery without needing direct access to AWS resources.
2
Compare the core functions of Cognito User Pools and Cognito Identity Pools.
User Pools provide identity provider and user directory services. Identity Pools provide temporary AWS credentials for accessing AWS resources.
This avoids the common misconception of confusing User Pools (authentication/directory) with Identity Pools (authorization/credentials).

Anahtar Kavram

Amazon Cognito User Pools provide authentication, user directories, and profile management for application users, whereas Identity Pools provide authorization to AWS resources via temporary credentials.
Tahmini Süre:45s
Soru 897Soru →

A developer is deploying a containerized microservice to Amazon ECS that requires access to a customer managed key in AWS KMS for encrypting and decrypting application data. The security team prohibits direct, permanent IAM policy attachments to the ECS task role for KMS access. Instead, they require that permissions to use the KMS key be granted dynamically and programmatically to specific tasks at startup, and revoked when the tasks terminate. Which approach should the developer use to meet these security requirements?

Cevabı ve açıklamayı göster

Cevap: Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.

Cevap

Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.
Calling the CreateGrant API operation allows the microservice to dynamically grant the required cryptographic permissions on the customer managed key to the ECS task role at startup. The grant can then be retired programmatically using the RetireGrant operation when the task terminates, fulfilling the security requirement without permanent IAM policy attachments.

Adım Adım Çözüm

1
Analyze the requirement for dynamic, programmatically managed, and temporary KMS permissions that avoid permanent IAM policies.
Identify that AWS KMS Grants allow programmatic, temporary delegation of key usage permissions to a principal.
Grants are designed precisely for scenarios where permissions must be given dynamically (e.g., at task startup) and revoked (retired) when no longer needed.
2
Evaluate the viability of using KMS Grants.
A grant can be created via the AWS SDK calling CreateGrant with the ECS task role as the grantee, specifying operations like Decrypt and Encrypt. When the task shuts down, the grant can be retired using the RetireGrant API call.
This avoids attaching permanent policy statements to the ECS task IAM role while ensuring the task has permissions only during its lifetime.

Anahtar Kavram

AWS KMS Grants provide a flexible, programmatic mechanism to delegate temporary access to KMS keys without changing IAM policies.
Soru 898Soru →

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires two configurations:
1. A database connection password that must be rotated automatically every 30 days.
2. A database connection port number, which is a non-sensitive configuration parameter.

To optimize operational efficiency, security, and cost, how should the developer store and reference these configurations in the CloudFormation template?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.

Cevap

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.
The correct approach is to store the sensitive database password in AWS Secrets Manager because it supports native automatic rotation every 30 days. To optimize costs, the non-sensitive port number should be stored in Systems Manager Parameter Store as it is free for standard parameters. Both can be securely referenced in the CloudFormation template using dynamic references without exposing plaintext values.

Adım Adım Çözüm

1
Analyze the security and rotation requirements for the database password.
Identify that AWS Secrets Manager is required because it natively supports automatic rotation (every 30 days) and secure storage of sensitive credentials.
To meet the security and compliance requirement of automated rotation.
2
Analyze the requirements for the database port number.
Identify that the port number is non-sensitive and does not require rotation or high-cost storage, making AWS Systems Manager Parameter Store the most cost-effective service.
To optimize costs and distinguish between sensitive and non-sensitive configurations.
3
Determine how to reference both configurations in the CloudFormation template securely.
Use CloudFormation dynamic references to retrieve the values at runtime without hardcoding them in the template.
To maintain infrastructure-as-code best practices and avoid credential exposure in version control.

Anahtar Kavram

AWS CloudFormation Dynamic References
Soru 899Soru →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application needs to read and write items in an Amazon DynamoDB table. According to security best practices, which two steps should the developer take to configure the required permissions? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role.; Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Role.

Cevap

Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal to assume the role, and attach the permissions policy to the ECS Task Role.
To secure an ECS task, the developer must use an ECS Task Role for application permissions (like DynamoDB access) and configure the trust policy to allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume that role.

Adım Adım Çözüm

1
Identify the entity that needs to make AWS API calls and the entity that needs permission to assume the role.
The application code running inside the ECS container needs to access DynamoDB. The ECS task service itself needs to assume the role to pass temporary credentials to the container.
This determines the trust policy requirements and the correct IAM role type to use.
2
Configure the trust relationship for the IAM role.
A trust policy is created allowing ecs-tasks.amazonaws.com to assume the role.
ECS tasks must be authorized to obtain temporary security credentials from AWS STS.
3
Associate the DynamoDB permissions with the application role.
The permissions policy is attached to the ECS Task Role.
The Task Role supplies credentials to the containerized application, allowing it to authenticate and authorize against the DynamoDB table.

Anahtar Kavram

IAM Task Roles for ECS tasks separation and configuration
Soru 900Soru →

A developer is building a mobile application that allows users to register, log in, and upload photos directly to a private Amazon S3 bucket. The developer wants to use Amazon Cognito for user management and secure access. Which TWO options represent the correct configuration of Amazon Cognito services required to meet these objectives?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuance; Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 access

Cevap

Amazon Cognito User Pools are used to manage user authentication and token issuance, while Amazon Cognito Identity Pools are used to exchange these tokens for temporary AWS credentials to access AWS resources such as Amazon S3.
The correct options are the ones implementing Cognito User Pools for user authentication and directory management, and Cognito Identity Pools for exchanging the resulting tokens into temporary AWS credentials for S3 access.

Adım Adım Çözüm

1
Identify the authentication requirement.
The application needs user registration, sign-in, and token management, which is handled by Amazon Cognito User Pools.
User Pools act as the user directory and provide identity management.
2
Identify the authorization requirement for AWS resources.
The application needs to grant authenticated users access to Amazon S3 to upload files.
Accessing AWS resources directly from client apps requires temporary credentials.
3
Determine the resource that yields temporary AWS credentials.
Amazon Cognito Identity Pools (Federated Identities) can take the token from the User Pool and exchange it for temporary AWS credentials via an IAM role.
Identity Pools are designed to authorize access to AWS resources.

Anahtar Kavram

The separation of concerns between Amazon Cognito User Pools (authentication/user directory) and Identity Pools (authorization/temporary credentials).
Tahmini Süre:1m 0s
ÖncekiSayfa 45 / 78Sonraki
Tüm alıştırma soruları — AWS Certified Developer - Associate | Examkin