Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 1001Soru →

An operations team is designing a secure privilege model for a containerized processing job running on Amazon ECS with the AWS Fargate launch type. The task definition specifies a single container built from a private Docker image in Amazon ECR. At launch, the container must have sensitive database credentials injected as environment variables from AWS Systems Manager Parameter Store using the container definition `secrets` parameter. During runtime, the application code inside the container must write processing events to an Amazon DynamoDB table and stream standard output to Amazon CloudWatch Logs. Which configuration will successfully run the container while adhering to the principle of least privilege?

Cevabı ve açıklamayı göster

Cevap: Configure an IAM task execution role with permissions for ECR image pull actions, CloudWatch log streaming actions, and SSM Parameter Store access. Configure a separate IAM task role with permissions for DynamoDB write actions. Set the trust policy of both roles to trust the `ecs-tasks.amazonaws.com` service principal.

Cevap

Configure an IAM task execution role with permissions for ECR, CloudWatch, and SSM Parameter Store, and configure an IAM task role with DynamoDB write permissions, ensuring both roles trust the ecs-tasks.amazonaws.com service principal.
The correct configuration assigns the ECS agent startup permissions (pulling the container image, setting up awslogs logging, and fetching secrets from SSM Parameter Store) to the Task Execution Role. The application runtime permissions (writing to DynamoDB) are assigned to the Task Role. Both roles must have a trust policy allowing the `ecs-tasks.amazonaws.com` service principal to assume them.

Adım Adım Çözüm

1
Determine the entity responsible for fetching container dependencies, pulling secrets via container definition properties, and setting up container log configuration.
The ECS host agent manages these lifecycle events before the container launches. Therefore, the ECR, CloudWatch, and Systems Manager Parameter Store permissions must be assigned to the ECS Task Execution Role.
Since AWS Fargate is a serverless host, the ECS agent requires these permissions to retrieve container resources and parameters on behalf of the customer.
2
Determine the entity responsible for the API calls made directly by the running application code.
The application code interacts with DynamoDB at runtime. These permissions must be assigned to the ECS Task Role.
The Task Role credentials are injected into the container's environment, allowing the AWS SDK inside the container to assume this role for application runtime calls.
3
Verify the IAM trust policy configuration required for the ECS tasks service.
Both the Task Role and Task Execution Role must trust the `ecs-tasks.amazonaws.com` service principal.
Using the wrong principal (such as `ecs.amazonaws.com`) will result in failures to assume the roles, as that principal belongs to the ECS service scheduler rather than the task execution agent.

Anahtar Kavram

Differentiating between the ECS Task Role (application runtime permissions) and the ECS Task Execution Role (ECS agent startup permissions), and configuring their trust policies.
Tahmini Süre:2m 0s
Soru 1002Soru →

A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table. The developer creates an IAM role to grant the application the required permissions. The developer wants to configure the trust policy for this IAM role.

Consider the following trust policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "<PLACEHOLDER>"
},
"Action": "sts:AssumeRole"
}
]
}

To allow the EC2 instance to assume this IAM role, which value should replace `<PLACEHOLDER>`?

Cevabı ve açıklamayı göster

Cevap: ec2.amazonaws.com

Cevap

ec2.amazonaws.com
The correct answer is the option specifying the EC2 service principal. An IAM role's trust policy defines the principals (users, roles, accounts, or services) that are allowed to assume the role. Since the application is running on an Amazon EC2 instance, the EC2 service itself must be trusted to assume the role on behalf of the instance. The service principal for EC2 is ec2.amazonaws.com.

Adım Adım Çözüm

1
Analyze the requirement of the application running on the Amazon EC2 instance.
The application runs on EC2 and needs to assume an IAM role to access DynamoDB.
Before the application can use the role, the EC2 service must be allowed to assume it.
2
Identify the purpose of a trust policy in an IAM role.
The trust policy determines which entity (Principal) is allowed to assume the role via the sts:AssumeRole action.
Only trusted entities defined in the trust policy can obtain temporary credentials for the role.
3
Determine the correct service principal for Amazon EC2.
The service principal for EC2 is ec2.amazonaws.com.
Replacing the placeholder with ec2.amazonaws.com successfully establishes trust with the EC2 service.

Anahtar Kavram

IAM role trust policies dictate which AWS services or identities can assume a role.
Tahmini Süre:45s
Soru 1003Soru →

A developer is implementing client-side envelope encryption in a containerized microservice to encrypt application configuration payloads that are approximately 2 MB2\text{ MB} in size. The developer wants to use an AWS KMS customer managed key for this process. Which of the following actions must the developer perform to encrypt the payloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.; Encrypt the configuration payload locally using the plaintext data key, and then discard the plaintext data key from memory.

Cevap

The developer must call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key, encrypt the payload locally using the plaintext data key, and then discard the plaintext data key from memory.
To perform client-side envelope encryption on payloads larger than 4 KB4\text{ KB}, the developer must first call GenerateDataKey to get both the plaintext data key (used for local encryption) and the encrypted data key (stored with the ciphertext). The developer then encrypts the payload locally using the plaintext data key and discards the plaintext data key from memory to maintain security.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
The application receives a plaintext data key and an encrypted copy of the data key.
The KMS customer managed key cannot directly encrypt payloads larger than 4 KB4\text{ KB}, so a data key is generated for local envelope encryption.
2
Encrypt the payload locally.
The payload is encrypted into ciphertext using the plaintext data key.
Local encryption using the plaintext data key is performed outside of AWS KMS to support large payloads.
3
Clean up the memory.
The plaintext data key is removed from application memory.
Discarding the plaintext key prevents unauthorized memory inspection from exposing the encryption key.

Anahtar Kavram

Client-side envelope encryption workflow with AWS KMS
Soru 1004Soru →

An application hosted on Amazon EC2 instances behind an Application Load Balancer requires a distributed, highly available session state store. The store must support low-latency read and write operations, automatically delete expired sessions to manage storage growth, and replicate data across multiple Availability Zones to ensure high availability. Which TWO solutions should a developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store session data in an Amazon DynamoDB table and enable Time to Live (TTL) on a session expiration attribute.; Store session data in an Amazon ElastiCache for Redis replication group with Multi-AZ enabled and configure key expiration on session keys.

Cevap

Storing session data in an Amazon DynamoDB table with TTL enabled, or storing session data in an Amazon ElastiCache for Redis replication group with Multi-AZ and key expiration.
The correct options are storing session data in Amazon DynamoDB with TTL enabled, and using Amazon ElastiCache for Redis with Multi-AZ and key expiration. DynamoDB natively replicates data across multiple Availability Zones, supports low-latency writes, and automatically deletes expired items based on a TTL attribute without consuming read/write capacity. Amazon ElastiCache for Redis supports high-availability replication across Availability Zones, sub-millisecond latency, and native key expiration.

Adım Adım Çözüm

1
Evaluate the architectural requirements of the session store, focusing on low-latency, multi-AZ high availability, and automatic data expiration.
Identified that the store must replicate data across AZs and clean up expired entries automatically.
This sets the criteria to filter database and caching services.
2
Assess the capabilities of Amazon DynamoDB for session storage.
DynamoDB natively replicates data across AZs, provides single-digit millisecond latency, and features automatic item deletion via Time to Live (TTL) without using RCUs/WCUs.
DynamoDB with TTL satisfies all criteria.
3
Assess the capabilities of Amazon ElastiCache for Redis for session storage.
ElastiCache for Redis replication groups support Multi-AZ replication, sub-millisecond latencies, and native key expiration commands.
ElastiCache for Redis with Multi-AZ and key expiration satisfies all criteria.

Anahtar Kavram

Implementing distributed session stores with automatic expiration using Amazon DynamoDB TTL and Amazon ElastiCache for Redis.
Soru 1005Soru →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline that consists of Source, Build, and Deploy stages. The developer needs to configure the pipeline to use a custom build specification file located in a subdirectory (build/buildspec.yml) of the source repository. Additionally, the developer must pass a dynamically generated container image tag from the Build stage (AWS CodeBuild) to the Deploy stage (AWS CloudFormation). Which two actions must the developer perform to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Specify the custom buildspec path 'build/buildspec.yml' in the AWS CodeBuild project configuration.; Define a variable namespace in the CodePipeline build action configuration, and reference the output variable in the subsequent deploy stage using the namespace syntax.

Cevap

To satisfy the requirements, the developer must specify the custom buildspec path in the CodeBuild project settings and use CodePipeline's native variable namespace feature in the build action configuration to reference output variables in the downstream deployment stage.
Specifying the custom buildspec path in the AWS CodeBuild project configuration is necessary because CodeBuild only looks at the root folder by default. Defining a variable namespace in the CodePipeline build action enables downstream stages to access values like an image tag using variable namespace interpolation.

Adım Adım Çözüm

1
Set the custom buildspec location in AWS CodeBuild.
The developer updates the CodeBuild project configuration so that it looks for the build specification file at 'build/buildspec.yml'.
By default, CodeBuild expects the buildspec.yml file to be located in the root of the source directory. Specifying the custom path prevents build initialization failures.
2
Export variables from CodeBuild to CodePipeline.
The developer configures the build action in CodePipeline with a namespace, which acts as a container for output variables generated during the build execution.
Assigning a namespace enables downstream deployment actions to consume exported variables using the namespace references.

Anahtar Kavram

AWS CodePipeline Variable Namespaces and CodeBuild Configuration
Soru 1006Soru →

A developer is setting up an AWS Lambda function that must read from an Amazon DynamoDB table. The developer creates an IAM role named AppStoreExecutionRole and attaches a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations. However, when invoking the Lambda function, it fails to execute with an authorization error because it cannot assume the role. The role's current trust policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this authorization error?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.

Cevap

Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.
The correct answer is to update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal. AWS Lambda requires that any execution role assigned to a function trusts the Lambda service principal so that AWS Lambda can assume the role when invoking the function on the developer's behalf.

Adım Adım Çözüm

1
Examine the trust policy's Principal and Action fields.
The trust policy currently delegates trust only to the root account identifier, meaning only IAM identities within account 123456789012 who have sts:AssumeRole permissions can assume it.
To identify why the AWS Lambda service is blocked from assuming the execution role.
2
Determine how the AWS Lambda service assumes roles to execute functions.
AWS Lambda requires the service principal lambda.amazonaws.com to be declared as the trusted entity in the trust policy.
The Lambda service itself, not an IAM identity inside the account, is initiating the sts:AssumeRole call.
3
Replace the AWS account principal reference with the Lambda service principal.
The trust policy is updated to permit the lambda.amazonaws.com service principal to perform sts:AssumeRole.
This allows AWS Lambda to assume the role when running the function, resolving the initialization error.

Anahtar Kavram

IAM trust policies define which principals (users, accounts, or services) are allowed to assume a role. For AWS services like Lambda to assume a role, the trust policy must explicitly grant the sts:AssumeRole action to the service's principal name (e.g., lambda.amazonaws.com).
Tahmini Süre:2m 0s
Soru 1007Soru →

A telemetry ingestion system uses an AWS Lambda function to write incoming data to an Amazon RDS PostgreSQL database instance. To optimize performance and reduce database connection overhead, the developer initializes a single database connection pool outside the Lambda handler function (in the global scope). During testing, the function runs successfully under continuous load. However, during periods of low traffic, subsequent invocations of the Lambda function fail, resulting in a `Task timed out after 15.02 seconds` error. CloudWatch logs indicate that the function hangs at the database query execution line. Which of the following is the most likely cause of this issue, and how should it be resolved?

Cevabı ve açıklamayı göster

Cevap: The database closed the idle connections during the period of inactivity, leaving stale connections in the pool. The developer should configure the connection pool to validate connection liveness before executing queries, or implement error handling to re-establish the connections.

Cevap

The database closed the idle connections during the period of inactivity, leaving stale connections in the pool. The developer should configure the connection pool to validate connection liveness before executing queries, or implement error handling to re-establish the connections.
AWS Lambda reuses execution environments for subsequent warm starts, which preserves any connection pools defined in the global scope. During low-traffic periods, the database server closes these idle connections due to its configured timeout settings. The Lambda function is unaware of this and attempts to reuse the stale connection, causing the database driver to hang indefinitely until the Lambda function's timeout is reached. The appropriate fix is to validate connection liveness before borrowing a connection from the pool, or to catch the connection error and re-establish the connection.

Adım Adım Çözüm

1
Analyze the symptom and error behavior
The Lambda function times out only during low traffic, and logs show it hangs at the database query execution step.
This indicates that network connectivity to the database is functional, but the connection being used is unresponsive.
2
Evaluate the initialization context
The connection pool is initialized in the global scope (outside the handler function).
The Lambda runtime maintains the global scope state across warm starts to optimize subsequent executions through context reuse.
3
Identify the root cause of connection failure
During periods of low traffic, connections remain idle longer than the database's idle timeout threshold, causing the database to silently close them.
Because the Lambda execution environment remains warm, the local pool still holds references to these terminated sockets, causing the application to hang when attempting to write data.
4
Select the correct mitigation strategy
Configure connection liveness testing (e.g., test-on-borrow) or handle connection drops by clearing and rebuilding the pool dynamically.
This guarantees that any stale connection is discarded and replaced before a query is executed, preventing the application from hanging.

Anahtar Kavram

Lambda execution context reuse and database connection pool management
Tahmini Süre:2m 0s
Soru 1008Soru →

A developer is troubleshooting an AWS Lambda function that processes incoming sensor telemetry. The function is configured to run inside a custom VPC and must write data to an Amazon Aurora PostgreSQL database located in a private VPC subnet. Additionally, the Lambda function must call a public HTTPS endpoint of an external device registry for validation on each invocation.

The function configuration is associated with two subnets: `subnet-0a` (a private subnet with a route to a NAT Gateway) and `subnet-0b` (a public subnet with a route to an Internet Gateway). During execution, the developer observes that connection attempts to the Aurora database succeed 100%100\% of the time. However, approximately 50%50\% of the Lambda invocations fail due to connection timeouts when the function attempts to call the external validation API.

Which of the following actions will resolve the execution timeouts while maintaining access to both the database and the external API?

Cevabı ve açıklamayı göster

Cevap: Modify the Lambda function configuration to associate only with the private subnet (subnet-0a), removing the association with the public subnet (subnet-0b).

Cevap

Modify the Lambda function configuration to associate only with the private subnet (subnet-0a), removing the association with the public subnet (subnet-0b).
The correct answer is to modify the Lambda function configuration to associate only with the private subnet and remove the association with the public subnet. When a Lambda function is configured to run inside a VPC, AWS provisions Elastic Network Interfaces (ENIs) in the specified subnets. These ENIs only receive private IP addresses. If an ENI is placed in a public subnet, outbound internet traffic is directed to the Internet Gateway, which drops the traffic because it cannot map the private IP address to a public source. By removing the public subnet and using only the private subnet associated with a NAT Gateway, all internet-bound traffic goes through the NAT Gateway, which successfully translates the private IP to a public IP and routes the traffic.

Adım Adım Çözüm

1
Analyze the network paths and routing configurations for the subnets associated with the Lambda function.
Lambda ENIs are distributed across both `subnet-0a` (private with NAT Gateway) and `subnet-0b` (public with Internet Gateway).
To determine why only 50%50\% of internet connections fail while all database connections succeed.
2
Evaluate the IP allocation behavior of Lambda ENIs within VPC subnets.
Lambda ENIs are assigned only private IP addresses. They do not receive public IP addresses even when deployed in a public subnet.
To verify if outbound traffic from the public subnet can traverse the Internet Gateway.
3
Identify the routing path for outbound traffic from each subnet.
Traffic from `subnet-0a` goes through the NAT Gateway (succeeds). Traffic from `subnet-0b` goes to the Internet Gateway with a private source IP, which is dropped (fails). Database traffic is internal to the VPC and succeeds from both subnets.
To locate the root cause of the intermittent 50%50\% packet drop.
4
Reconfigure the Lambda subnets to exclude the public subnet.
By associating the function only with the private subnet, all ENIs are created in `subnet-0a` and route outbound traffic through the NAT Gateway, achieving 100%100\% success.
To ensure consistent routing and resolve the connection timeouts.

Anahtar Kavram

Lambda VPC Networking and Outbound Internet Routing

Alternatif Yöntem

Instead of a NAT Gateway, you can configure an interface VPC Endpoint (AWS PrivateLink) for the external API if the third-party provider supports it or if it is an AWS service, which would keep the traffic entirely within the AWS network.
Tahmini Süre:3m 0s
Soru 1009Soru →

A developer is configuring a deployment for an AWS Lambda function using AWS CodeDeploy. The developer needs to define the deployment configuration and ensure CodeDeploy has the necessary permissions.

Which TWO of the following configurations or steps are required to successfully set up this deployment?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define the Resources section in the AppSpec file specifying the Lambda function name, alias, current version, and target version.; Create an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service to assume the role.

Cevap

To successfully deploy a Lambda function using CodeDeploy, the developer must define the Resources section in the AppSpec file to specify function details, and create an IAM service role for CodeDeploy with a trust policy that permits the codedeploy.amazonaws.com service to assume it.
Defining the Resources section in the AppSpec file is required for Lambda deployments to specify the target function name, alias, and versions. Additionally, CodeDeploy requires an IAM service role with a trust policy allowing the codedeploy.amazonaws.com service to assume it to perform actions on the developer's behalf.

Adım Adım Çözüm

1
Identify the target compute platform and the required AppSpec structure.
Since the target platform is AWS Lambda, the AppSpec file must use the Resources section to specify the function name, alias, current version, and target version.
This tells CodeDeploy which function and versions are involved in the deployment.
2
Determine the required IAM configuration for the deployment service.
Create an IAM service role that grants CodeDeploy permissions to interact with AWS Lambda, and ensure the trust policy allows codedeploy.amazonaws.com to assume this role.
CodeDeploy requires permission to perform traffic shifting on the Lambda function.

Anahtar Kavram

AWS CodeDeploy Lambda deployment configuration requires specifying function resources in the AppSpec file and establishing an IAM service role that trusts the CodeDeploy service.
Soru 1010Soru →

A developer is updating an AWS CloudFormation stack that manages a web application's network infrastructure. The update fails, and the stack begins to roll back. However, the rollback process fails and the stack is left in the UPDATE_ROLLBACK_FAILED state because one of the subnets was previously deleted manually via the AWS Console. How should the developer resolve this issue to return the stack to a stable state?

Cevabı ve açıklamayı göster

Cevap: Use the ContinueUpdateRollback operation and choose to skip the deleted subnet resource during the rollback process, then manually clean up any remaining resources if necessary.

Cevap

Use the ContinueUpdateRollback operation and choose to skip the deleted subnet resource during the rollback process, then manually clean up any remaining resources if necessary.
The correct approach is to run the ContinueUpdateRollback operation and specify the logical IDs of the resources to skip (in this case, the deleted subnet). CloudFormation will set the state of these resources to UPDATE_ROLLBACK_COMPLETE and continue rolling back the remaining resources in the stack. Once the stack reaches a stable state, the developer can update the template or manually recreate resources to align them.

Adım Adım Çözüm

1
Identify the cause of the rollback failure
Confirm that the stack is in the UPDATE_ROLLBACK_FAILED state due to an out-of-band deletion of the subnet resource.
Before taking corrective action, the developer must verify which resource is blocking the rollback process.
2
Initiate the ContinueUpdateRollback operation
Start the rollback continuation process using the AWS Console, AWS CLI, or CloudFormation API.
This operation is required to force CloudFormation to attempt to complete the rollback again.
3
Specify resources to skip during rollback
Select the deleted subnet resource to be skipped.
Skipping the deleted resource allows CloudFormation to set its status to rolled back without attempting to modify the non-existent resource, bringing the stack to the stable UPDATE_ROLLBACK_COMPLETE state.

Anahtar Kavram

Handling CloudFormation stack update rollback failures caused by manual out-of-band resource deletion.
Tahmini Süre:1m 30s
Soru 1011Soru →

A developer has deployed a containerized application to Amazon ECS on AWS Fargate. The application code needs to retrieve customer records from an Amazon DynamoDB table. During execution, the container logs display an AccessDeniedException when attempting to call DynamoDB API operations. The developer verifies that the ECS task execution role has an attached policy allowing the necessary DynamoDB permissions. How should the developer resolve this authorization failure?

Cevabı ve açıklamayı göster

Cevap: Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.

Cevap

Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.
The correct answer is correct because the ECS task role is designed specifically to grant AWS API permissions to the application code running inside containerized tasks. The ECS task execution role is intended for the container agent itself to pull images from Amazon ECR and push logs to CloudWatch.

Adım Adım Çözüm

1
Distinguish between ECS Task Role and ECS Task Execution Role.
Identify that the Task Role is used by the application code running inside the container, whereas the Task Execution Role is used by the ECS container agent for infrastructure tasks (like pulling ECR images and writing CloudWatch logs).
Correctly identifying which identity runs the application code is necessary to assign API permissions.
2
Review the current IAM policy attachment.
Verify that the policy permitting DynamoDB actions is attached to the Task Execution Role, which explains why the application receives an AccessDeniedException.
Locating where the permission is incorrectly applied helps determine the required fix.
3
Migrate the permission policy to the ECS Task Role.
The application code is now successfully authorized to query the DynamoDB table.
Attaching permissions to the Task Role grants the running container the access credentials it needs.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role
Soru 1012Soru →

A startup is building a new mobile application for ride-sharing. The developer needs to establish a secure user directory that manages user registration, sign-in, password recovery, and multi-factor authentication (MFA).

Which Amazon Cognito feature should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools

Cevap

Amazon Cognito User Pools
Amazon Cognito User Pools is the correct choice because it is a user directory that provides sign-up and sign-in options for web and mobile applications, including features like user directory management, password recovery, and multi-factor authentication (MFA).

Adım Adım Çözüm

1
Identify the primary requirement, which is to build a secure user directory for managing user registration, sign-in, password recovery, and multi-factor authentication (MFA).
The requirement points to a user directory management and authentication solution.
Determining whether authentication/user directory or authorization/AWS resource access is needed.
2
Compare Cognito User Pools and Cognito Identity Pools.
User Pools handle authentication, registration, and user directory management, whereas Identity Pools handle authorization by exchanging tokens for temporary AWS credentials.
Cognito User Pools is the direct match for hosting a user directory and managing user signup/signin.

Anahtar Kavram

Amazon Cognito User Pools provide authentication and user directory management, whereas Identity Pools provide authorization to AWS resources.
Soru 1013Soru →

An AWS Lambda function is configured with an execution role named `LambdaProcessingRole`. The role has the following identity-based permission policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"sns:Publish"
],
"Resource": "*"
}
]
}

Additionally, the developer has attached an IAM Permissions Boundary named `DeveloperBoundary` to the role. The policy document for the permissions boundary is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:*",
"s3:*"
],
"Resource": "*"
}
]
}

During execution, the Lambda function successfully writes items to the Amazon DynamoDB table, but attempts to publish messages to the Amazon SNS topic fail with an `AccessDeniedException` error.

Which of the following modifications is required to resolve this authorization failure?

Cevabı ve açıklamayı göster

Cevap: Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.

Cevap

Update the permissions boundary policy (DeveloperBoundary) to include the sns:Publish action.
For any IAM entity with a permissions boundary, AWS evaluates permissions based on the intersection of the identity-based policy and the boundary policy. Since the permissions boundary policy in this scenario does not allow any SNS actions, the Lambda function's execution role is denied the ability to publish to the SNS topic, even though its identity-based policy allows it. Updating the permissions boundary to allow the sns:Publish action resolves the failure.

Adım Adım Çözüm

1
Identify that the Lambda function execution role has both an identity-based policy and a permissions boundary attached.
The identity-based policy allows both DynamoDB and SNS actions, but the permissions boundary only allows DynamoDB and S3 actions.
An IAM permissions boundary limits the maximum permissions that can be granted by identity-based policies to the user or role.
2
Evaluate the intersection of allowed actions between the identity-based policy and the permissions boundary.
The intersection allows dynamodb:PutItem, but does not allow sns:Publish because sns:Publish is missing from the permissions boundary.
For an action to be authorized, it must be allowed by both policies.
3
Determine the necessary change to allow sns:Publish.
Modify the permissions boundary (DeveloperBoundary) to include the sns:Publish action.
This updates the maximum allowed permission threshold, allowing the identity-based permission policy to take effect for SNS publishing.

Anahtar Kavram

IAM Permissions Boundary evaluation logic
Soru 1014Soru →

A developer is configuring the deployment policy for a web application running on an AWS Elastic Beanstalk environment. The environment currently consists of 88 Amazon EC2 instances. To meet strict SLA requirements, the deployment must maintain 100%100\% of the current serving capacity (88 instances) at all times during the update. Additionally, the development team wants to minimize the additional infrastructure costs during the deployment process by avoiding the temporary doubling of instances or provisioning a second environment. Which Elastic Beanstalk deployment policy should the developer select?

Cevabı ve açıklamayı göster

Cevap: Rolling with additional batch

Cevap

The Rolling with additional batch deployment policy should be selected.
The 'Rolling with additional batch' policy launches a new batch of instances first to maintain 100%100\% capacity during the deployment. It then updates the remaining instances in batches. Because it only launches one batch of new instances at a time rather than a full duplicate of the environment, it is more cost-effective than the 'Immutable' policy while still preventing any capacity reduction.

Adım Adım Çözüm

1
Analyze capacity requirements
The deployment must maintain 100%100\% capacity (88 instances) at all times during the deployment process.
To prevent performance degradation and meet SLA requirements during the update.
2
Evaluate cost and resource constraints
The solution must minimize extra instance costs and avoid doubling the instance count to 1616 or setting up a secondary environment.
To satisfy the constraint of minimizing additional infrastructure costs during deployment.
3
Compare candidate Elastic Beanstalk deployment policies
Rolling reduces capacity. All-at-once causes downtime. Immutable maintains capacity but doubles the instance count. Rolling with additional batch launches only a single additional batch (e.g., 22 instances for a 25%25\% batch size) to maintain capacity, making it the most cost-effective option that meets all constraints.
To select the policy that perfectly aligns with both capacity preservation and cost optimization.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies trade-offs between capacity, cost, and rollback capability
Soru 1015Soru →

A company has an administrative backend service exposed through an Amazon API Gateway REST API. A developer needs to grant access to this API to a serverless processing application running under a specific IAM role in a different AWS account. The connection must be secure and follow the principle of least privilege without requiring the maintenance of user directories or custom code. Which two configuration steps should the developer perform to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set the authorization type of the API Gateway method to AWS_IAM.; Apply a resource policy to the API Gateway REST API that grants execute-api:Invoke permissions to the consumer IAM role ARN.

Cevap

To implement cross-account access securely under least privilege without custom code or user directories, set the API Gateway method authorization to AWS_IAM and apply an API Gateway resource policy that grants the external IAM role ARN access to execute-api:Invoke.
To secure the API for cross-account access without using custom code or user directories, AWS_IAM authorization is the native and most secure solution. By setting the authorization type of the API Gateway method to AWS_IAM, the API will require all requests to be signed using Signature Version 4 (SigV4) with credentials associated with an IAM identity. Then, using an API Gateway resource policy allows cross-account authorization by explicitly permitting the specific external IAM role ARN to execute the API method.

Adım Adım Çözüm

1
Enable IAM authentication on the API Gateway method.
The API method now requires all requests to be signed using Signature Version 4 (SigV4) with valid AWS IAM credentials.
This ensures that API Gateway natively evaluates the identity of the incoming caller using standard AWS IAM signatures.
2
Configure the REST API resource policy.
A resource policy is attached to the API Gateway that allows the principal ARN corresponding to the consumer's IAM role to invoke the 'execute-api:Invoke' action.
This permits cross-account API invocation by specifying exactly which external IAM identity is allowed access.

Anahtar Kavram

Cross-account IAM authentication and authorization for Amazon API Gateway REST APIs.
Tahmini Süre:1m 30s
Soru 1016Soru →

A developer is preparing to deploy a containerized API service to Amazon ECS using the AWS Fargate launch type. The application is packaged in a Docker image stored in a private Amazon ECR repository. During runtime, the application code must poll an Amazon SQS queue to retrieve incoming messages, and write custom metrics to Amazon CloudWatch. Additionally, the container must use the `awslogs` log driver to send standard output streams to CloudWatch Logs, and retrieve a database password securely from AWS Systems Manager Parameter Store (stored as a `SecureString` parameter) to set a container environment variable at launch. Which combination of configurations must the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an ECS Task Execution Role with permissions for `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `logs:PutLogEvents`, and `ssm:GetParameters`.; Configure an ECS Task Role with permissions for `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `cloudwatch:PutMetricData`.

Cevap

Configure the ECS Task Execution Role with permissions for pulling ECR images, writing logs, and retrieving Parameter Store parameters, and configure the ECS Task Role with permissions for SQS operations and CloudWatch metrics write actions.
The correct configurations properly separate the ECS Task Execution Role (used by the ECS container agent to prepare the container environment, pull the image from Amazon ECR, set up CloudWatch logging, and pull parameters from Systems Manager Parameter Store) and the ECS Task Role (used by the application code running inside the container to interact with AWS services, such as reading from SQS and writing custom metrics to CloudWatch).

Adım Adım Çözüm

1
Identify the entities performing the required actions.
The ECS agent pulls the ECR image, sends logs via the `awslogs` driver, and retrieves the Parameter Store secret. The application code inside the container polls SQS and writes custom metrics.
ECS distinguishes agent-level bootstrapping tasks from container-level application tasks.
2
Assign agent-level boot permissions.
Define an ECS Task Execution Role with ECR pull, CloudWatch logs write, and Systems Manager Parameter Store get parameter permissions.
The ECS agent needs these permissions before the container starts running.
3
Assign application-level execution permissions.
Define an ECS Task Role with SQS poll/delete and custom CloudWatch metrics write permissions.
The application code inside the running container assumes the Task Role to interact with other AWS services.

Anahtar Kavram

Separation of concerns between the ECS Task Execution Role and the ECS Task Role.
Soru 1017Soru →

A developer deploys a new AWS Lambda function configured with the default timeout of 33 seconds to process image uploads. During testing with larger image files, the function execution fails and logs a task timeout error. Additionally, the developer notices that no log groups or log streams are being created in Amazon CloudWatch Logs for this function. Which two configuration changes should the developer make to resolve these issues?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Increase the timeout configuration setting of the Lambda function.; Add permissions for `logs:CreateLogStream` and `logs:PutLogEvents` to the Lambda function's IAM execution role.

Cevap

To resolve these issues, the developer must increase the Lambda function's timeout setting and grant the execution role permission to write to CloudWatch Logs.
To resolve the execution failures, the developer must increase the function's timeout setting. To resolve the logging failures, the developer must add permission for log operations (specifically `logs:CreateLogStream` and `logs:PutLogEvents`) to the Lambda function's IAM execution role.

Adım Adım Çözüm

1
Analyze the timeout symptom and identify that the default limit of 33 seconds is being exceeded, requiring an increase in the function's timeout configuration.
The execution timeout is adjusted to a higher value (e.g., 3030 seconds).
This prevents premature termination during the processing of larger payloads.
2
Analyze the logging symptom and identify that the Lambda function's IAM execution role lacks permissions to write logs to CloudWatch.
The IAM policy associated with the execution role is updated.
Adding permissions for log stream creation and event delivery allows Lambda to output logs to CloudWatch.

Anahtar Kavram

AWS Lambda basic configuration limits and IAM execution role permissions
Soru 1018Soru →

An integration specialist is deploying a data ingestion service as a task on Amazon ECS with the EC2 launch type. The application code inside the container must read message payloads from an Amazon SQS queue and write processing logs to Amazon CloudWatch. During deployment, the ECS container agent successfully pulls the image and initializes the container, but the application throws an Access Denied error when attempting to poll the SQS queue. Which action should the developer take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Attach the SQS permission policy to the ECS Task Role specified by the taskRoleArn parameter, and configure its trust policy to trust ecs-tasks.amazonaws.com.

Cevap

Attach the SQS permission policy to the ECS Task Role specified by the taskRoleArn parameter, and configure its trust policy to trust ecs-tasks.amazonaws.com.
The containerized application code running inside the ECS task needs permissions to access SQS. These application-level permissions must be defined in an IAM role assigned as the Task Role (via the taskRoleArn parameter). Additionally, the IAM role must have a trust policy that allows the Amazon ECS tasks service (ecs-tasks.amazonaws.com) to assume the role. This permits the container itself to assume the role and make authorized AWS API calls.

Adım Adım Çözüm

1
Identify which component is failing to perform the action.
The application code inside the container is failing to read from SQS, while the ECS agent is succeeding in pulling the image and sending logs.
This distinguishes between task execution tasks (agent-level) and task execution itself (application-level).
2
Select the appropriate ECS IAM role for application-level AWS API calls.
The ECS Task Role (taskRoleArn) must be configured with SQS permissions, rather than the Task Execution Role (executionRoleArn).
The Task Role provides credentials directly to the containerized application.
3
Configure the trust relationship policy for the Task Role.
Add ecs-tasks.amazonaws.com as the trusted entity in the role's trust policy.
This allows the ECS service to assume the role on behalf of the task.

Anahtar Kavram

Distinguishing between Amazon ECS Task Role and Task Execution Role configurations
Tahmini Süre:1m 30s
Soru 1019Soru →

A development team has deployed a microservice using AWS Lambda. The function is associated with private subnets in a custom VPC so it can securely access an internal Amazon Aurora MySQL database. Additionally, this function must send transaction logs to a public SaaS logging endpoint. While the database operations are performing correctly, all attempts to connect to the external SaaS endpoint result in timeout errors. How can this connectivity issue be resolved?

Cevabı ve açıklamayı göster

Cevap: Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.

Cevap

Set up a NAT Gateway within a public subnet, and update the route table of the private subnets to forward traffic destined for 0.0.0.0/0 to the NAT Gateway.
For a Lambda function associated with a VPC to access the public internet, it must be placed in private subnets with a route to a NAT Gateway in a public subnet. The NAT Gateway then forwards the traffic to the Internet Gateway. This allows the Lambda function to maintain connectivity to both the internal database (via local VPC routing) and the external endpoint.

Adım Adım Çözüm

1
Analyze the network paths for the two destinations.
Database access succeeds because it is local to the VPC, but SaaS endpoint access fails because there is no route to the internet from the private subnets.
Identify if the block is due to local VPC routing or internet routing.
2
Evaluate how Lambda handles internet access inside a VPC.
Lambda requires a NAT Gateway or VPC endpoint because its network interfaces do not get public IPs, preventing direct Internet Gateway usage.
Determine the required network translation component.
3
Formulate the correct routing rules.
Place a NAT Gateway in a public subnet and route 0.0.0.0/0 from the private subnet's route table to the NAT Gateway.
Establish outbound routing for the private resources.

Anahtar Kavram

VPC networking for AWS Lambda functions requiring internet access
Soru 1020Soru →

A developer designs an AWS Lambda function to process event logs. To track processed message IDs within a test execution, the developer declares a global list variable `processed_ids = []` outside the Lambda handler function. During testing, the developer observes that subsequent invocations of the function run slower, eventually timing out, and contain data from previous invocations. Which of the following explains why this issue is occurring?

Cevabı ve açıklamayı göster

Cevap: AWS Lambda reuses the execution context for subsequent invocations, causing the global list variable to persist and continuously grow in size, consuming memory and processing time.

Cevap

AWS Lambda reuses the execution context for subsequent invocations, causing the global list variable to persist and continuously grow in size, consuming memory and processing time.
AWS Lambda optimizes performance by reusing the execution environment for subsequent invocations. Because the list is declared outside the handler, it is only initialized once (during the cold start). Warm invocations append items to the same list in memory, causing it to grow indefinitely, which leads to increased latency and timeouts.

Adım Adım Çözüm

1
Analyze the scope of the variable initialization.
The variable `processed_ids` is declared outside the handler function, making it global to the execution environment.
Variables declared outside the handler are initialized during the initialization phase (cold start) and remain in memory as long as the container is active.
2
Evaluate the behavior of AWS Lambda container reuse (warm starts).
Subsequent invocations use the same warm container to process events quickly without running the initialization code again.
Reusing the container means that the global state, including the `processed_ids` list, is preserved between executions.
3
Identify the cause of the performance degradation.
As new IDs are appended to the global list on every invocation, the list grows larger, leading to higher memory consumption and slower processing times.
Since the list is never cleared and keeps growing, the function eventually runs out of memory or times out.

Anahtar Kavram

AWS Lambda execution context reuse and its impact on global state management.
Tahmini Süre:45s
ÖncekiSayfa 51 / 78Sonraki