Examkin

Tüm alıştırma soruları

1542 soru

Tüm türler1,542Çoktan seçmeli782Çoklu seçim746Sıralama14
Soru 1021Soru →

A developer has enabled active tracing on an AWS Lambda function that processes incoming requests and writes data to an Amazon DynamoDB table. When viewing the traces in AWS X-Ray, the developer can see the Lambda function segment, but the downstream calls to DynamoDB are missing from the trace map. Which action should the developer take to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.

Cevap

Instrument the AWS SDK client in the Lambda function code using the AWS X-Ray SDK.
To record downstream calls to AWS services, the application code must use the AWS X-Ray SDK to wrap or instrument the AWS SDK client. For example, in Node.js, this is done by wrapping the AWS SDK with AWSXRay.captureAWS(require('aws-sdk')), or using the AWS X-Ray SDK for Java or Python equivalent. This ensures that the tracing context is propagated and downstream subsegments are created.

Adım Adım Çözüm

1
Identify the missing segment in the X-Ray trace map.
The Lambda execution segment is present, but downstream calls to DynamoDB are not captured.
This indicates that active tracing is configured on the Lambda function itself, but the downstream SDK calls are not propagating the trace context.
2
Modify the application code to wrap the AWS SDK client with the AWS X-Ray SDK.
The SDK calls are instrumented, and tracing headers are automatically generated and sent to the X-Ray daemon.
The X-Ray SDK wraps AWS SDK clients to measure downstream calls and append segment data.

Anahtar Kavram

AWS X-Ray SDK instrumentation for downstream AWS SDK calls
Soru 1022Soru →

A developer is setting up an AWS CodeBuild project that needs to upload build artifacts to an Amazon S3 bucket named `app-build-artifacts-2026`. The project fails with an authorization error during the build phase. The developer reviews the IAM role created for CodeBuild, which currently has no permissions policies attached, and has the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which two changes are required to allow the CodeBuild project to upload artifacts to the S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Update the Service principal in the trust policy to codebuild.amazonaws.com.; Attach a permissions policy to the role that allows s3:PutObject on the resource arn:aws:s3:::app-build-artifacts-2026/*.

Cevap

The correct changes are to update the Service principal in the trust policy to codebuild.amazonaws.com, and to attach a permissions policy to the role that allows s3:PutObject on the resource arn:aws:s3:::app-build-artifacts-2026/*.
Updating the Service principal to codebuild.amazonaws.com allows CodeBuild to assume the execution role. Attaching a policy allowing s3:PutObject on arn:aws:s3:::app-build-artifacts-2026/* grants the required write permissions on the bucket's objects.

Adım Adım Çözüm

1
Inspect and fix the trust relationship of the IAM role.
The Service principal is changed from ec2.amazonaws.com to codebuild.amazonaws.com, allowing CodeBuild to assume the role.
Since CodeBuild is running the build process, it needs permission to assume the IAM role associated with the project.
2
Create and attach a permissions policy for S3 write access.
A policy containing s3:PutObject for the resource arn:aws:s3:::app-build-artifacts-2026/* is attached to the role.
The role currently has no permissions policies, so it has no rights to perform S3 actions. Adding this policy permits uploading objects to the bucket.

Anahtar Kavram

An IAM role must have a trust policy allowing the executing AWS service principal to assume it, and a permissions policy granting the specific API access needed for resources.
Soru 1023Soru →

A developer is configuring a serverless application where an AWS Lambda function in AWS Account A (111111111111111111111111) needs to read objects from an Amazon S3 bucket named `company-data-shared` in AWS Account B (222222222222222222222222). The Lambda function is associated with the execution role `arn:aws:iam::111111111111:role/LambdaExecutionRole`. Currently, the Lambda function fails with an `AccessDenied` error when attempting to fetch objects from the bucket. Which configuration changes must the developer make to resolve the error while maintaining the principle of least privilege? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In Account A, attach a permission policy to the Lambda execution role that grants the `s3:GetObject` action on `arn:aws:s3:::company-data-shared/*`.; In Account B, update the bucket policy of `company-data-shared` to allow the `s3:GetObject` action on `arn:aws:s3:::company-data-shared/*` for the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

Cevap

In Account A, attach a permission policy to the Lambda execution role that grants the s3:GetObject action on the S3 bucket, and in Account B, update the bucket policy of the S3 bucket to allow s3:GetObject for the Lambda execution role principal.
For cross-account S3 access, permissions must be granted on both sides. The identity-based policy attached to the Lambda execution role in Account A must grant the `s3:GetObject` permission on the specific bucket resource in Account B. Simultaneously, the resource-based bucket policy on the S3 bucket in Account B must grant the same permission to the Lambda execution role's ARN as the principal. Without both configurations, cross-account access will be denied.

Adım Adım Çözüm

1
Configure the IAM identity-based policy in Account A.
The Lambda execution role in Account A is granted permission to perform `s3:GetObject` on the S3 bucket in Account B.
Even for cross-account resources, the requesting identity must explicitly have the permission granted in its own account's policy.
2
Configure the S3 bucket policy (resource-based policy) in Account B.
The S3 bucket permits the principal `arn:aws:iam::111111111111:role/LambdaExecutionRole` from Account A to read objects.
For cross-account access, both the identity-based policy in the source account and the resource-based policy in the destination account must explicitly allow the action.
3
Verify the configuration using the Lambda function's execution context without using hardcoded credentials.
The Lambda function uses its execution role's temporary credentials automatically provided by the AWS SDK, resolving the access issue securely.
Hardcoding credentials violates security best practices and is unnecessary because the SDK automatically uses the IAM role credentials.

Anahtar Kavram

Cross-account resource access in AWS requires authorization from both the identity-based policy (source account) and the resource-based policy (destination account).
Soru 1024Soru →

A developer is building a new web application that allows users to sign up, sign in, and download files directly from a private Amazon S3 bucket. The application must handle user directory management and authenticate users before granting them temporary access to S3. Which two Amazon Cognito resources should the developer configure to satisfy these authentication and authorization requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A Cognito User Pool to manage user registration, authentication, and the user directory.; A Cognito Identity Pool to exchange authentication tokens for temporary AWS credentials to access S3.

Cevap

To meet the requirements, the developer must configure a Cognito User Pool to handle user directory management and authentication, and a Cognito Identity Pool to authorize access and provide temporary AWS credentials for the S3 bucket.
The correct solution involves configuring both a Cognito User Pool and a Cognito Identity Pool. The User Pool manages user directory services (registration, login, password recovery), and the Identity Pool handles authorization by exchanging the authenticated user's tokens for temporary AWS IAM credentials so the application can access the S3 bucket directly.

Adım Adım Çözüm

1
Identify the authentication and directory management requirement.
Amazon Cognito User Pools must be configured because they act as the identity provider, handling registration, sign-in, and tokens.
User Pools are specifically designed to serve as a user directory and manage authentication flow.
2
Identify the authorization and AWS resource access requirement.
Amazon Cognito Identity Pools must be configured to federate the User Pool tokens.
Identity Pools are designed to exchange authentication tokens (such as OIDC tokens from a User Pool) for temporary AWS credentials via AWS STS.
3
Configure the client application to obtain S3 access.
The client app authenticates with the User Pool, sends the resulting token to the Identity Pool, receives temporary AWS credentials, and uses them to access the S3 bucket directly.
This flow leverages AWS best practices for secure web client interactions with AWS services.

Anahtar Kavram

Separation of concerns between Cognito User Pools (authentication/directory) and Cognito Identity Pools (authorization/AWS credentials).
Tahmini Süre:1m 0s
Soru 1025Soru →

A developer is managing an infrastructure deployment consisting of two separate AWS CloudFormation stacks: a network stack that exports VPC resource identifiers, and an application stack that imports these identifiers using the `Fn::ImportValue` intrinsic function. The developer needs to update the network stack's outputs to support a new subnet configuration. Which of the following are valid constraints or required actions when modifying exported outputs that are referenced by other stacks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack.; To modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.

Cevap

The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack; and to modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.
AWS CloudFormation enforces that you cannot delete a stack if its exported outputs are referenced by another stack, nor can you modify or delete any exported output value that is currently in use. To successfully change an exported value, the importing stack must first be updated to remove the reference to the export. Once the reference is removed, the exporting stack can be updated, and then the importing stack can be updated to reference the new export.

Adım Adım Çözüm

1
Identify the dependency relationship between the two stacks, noting that the application stack imports values exported by the network stack.
Confirm that the network stack is the exporting stack and the application stack is the importing stack.
This establishes that the network stack outputs cannot be modified or deleted directly due to active external references.
2
Analyze how CloudFormation handles updates to exported values that are currently in use by other stacks.
Determine that CloudFormation will block any updates to the exporting stack that attempt to modify or delete the referenced outputs.
This is a core constraint of cross-stack references in AWS CloudFormation to prevent breaking dependent resources.
3
Formulate the correct remediation sequence to modify the subnet configuration output.
The developer must first update the application stack to remove the Fn::ImportValue references (e.g., by temporarily hardcoding the values or using another sharing mechanism), then update the network stack's outputs, and finally restore the references in the application stack.
This temporarily breaks the dependency lock, allowing the network stack update to proceed successfully.

Anahtar Kavram

AWS CloudFormation cross-stack references enforce strong dependencies, preventing the deletion of exporting stacks or modification of exported values until all referencing stacks remove their imports.
Tahmini Süre:2m 0s
Soru 1026Soru →

A developer needs to run a database migration script on Amazon EC2 instances before the new application files are copied during an AWS CodeDeploy deployment. Which configuration file and lifecycle hook should the developer use to execute this script?

Cevabı ve açıklamayı göster

Cevap: An appspec.yml file in the root directory, running the script in the BeforeInstall hook

Cevap

An appspec.yml file in the root directory, running the script in the BeforeInstall hook
AWS CodeDeploy manages EC2/On-Premises deployments using the appspec.yml file located in the root of the source directory. In this file, the developer can define hooks to run scripts at specific phases. The BeforeInstall hook is the appropriate hook to execute scripts (such as database migrations or clearing temp folders) before the actual application files are copied to the instance during the installation phase.

Adım Adım Çözüm

1
Identify the service responsible for orchestrating the deployment to Amazon EC2.
The deployment is orchestrated by AWS CodeDeploy.
AWS CodeDeploy requires a configuration file named appspec.yml at the root of the source bundle to define deployment lifecycle hooks.
2
Determine the correct lifecycle hook for running tasks before files are copied.
The BeforeInstall hook is executed prior to the installation phase where files are copied to the target directory.
For EC2/On-Premises deployments, the AppSpec lifecycle sequence runs ApplicationStop -> BeforeInstall -> Install -> AfterInstall -> ApplicationStart -> ValidateService. Therefore, running a script before files are copied requires using BeforeInstall.

Anahtar Kavram

AWS CodeDeploy AppSpec lifecycle hooks for EC2 deployments
Soru 1027Soru →

A developer has a serverless application consisting of Amazon API Gateway, an AWS Lambda function, and an Amazon DynamoDB table. The developer enables active tracing on both the API Gateway stage and the Lambda function. However, when inspecting the AWS X-Ray service map, the developer notices that downstream DynamoDB service calls are missing from the trace path. Which of the following actions is required to ensure that DynamoDB calls are included in the distributed trace?

Cevabı ve açıklamayı göster

Cevap: Instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK to capture downstream calls.

Cevap

Instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK to capture downstream calls.
The correct answer is to instrument the AWS SDK client inside the Lambda function code using the AWS X-Ray SDK. Enabling active tracing on Lambda only enables tracing of the function invocation itself. To trace downstream calls to other AWS resources, the AWS SDK client must be explicitly instrumented using the AWS X-Ray SDK so that the trace context is passed and recorded.

Adım Adım Çözüm

1
Identify the missing segment in the distributed trace.
The AWS X-Ray service map shows the API Gateway and Lambda function, but not the calls made from the Lambda function to DynamoDB.
Although active tracing is enabled on the Lambda function, the Lambda runtime only records the inbound request unless the client libraries are instrumented to propagate the tracing header.
2
Add the AWS X-Ray SDK to the project dependencies and instrument the AWS SDK client.
The AWS SDK client is wrapped or instrumented (e.g., using the AWS X-Ray SDK's capture helper) before initializing the DynamoDB client.
This wrapping automatically records downstream metadata, latency, and HTTP status code details for each DynamoDB call and associates them with the parent tracing segment.
3
Deploy the Lambda function and test the API integration.
The updated traces now include the DynamoDB node on the service map and the corresponding subsegments in the trace details.
The instrumented SDK automatically extracts the tracing header from the Lambda environment and passes it along to the DynamoDB endpoint.

Anahtar Kavram

Instrumenting AWS SDK clients in code is required to trace downstream service calls in AWS X-Ray.
Soru 1028Soru →

A developer is configuring a continuous delivery pipeline in AWS CodePipeline in Account A. The pipeline is designed to deploy a web application to an Amazon ECS cluster located in Account B. The pipeline uses an Amazon S3 bucket in Account A as its artifact store. During the deployment phase, the deployment action in Account B fails with an Access Denied error when attempting to read the build artifact from the S3 bucket in Account A. Which configuration change will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS, and update both the S3 bucket policy and the KMS key policy to grant the deployment role in Account B access.

Cevap

Configure the S3 bucket in Account A to use a customer managed key (CMK) in AWS KMS, and update both the S3 bucket policy and the KMS key policy to grant the deployment role in Account B access.
The correct answer is to configure the S3 bucket in Account A with a customer managed key (CMK) and grant read and decrypt access to the Account B role. AWS CodePipeline stores artifacts in S3. For cross-account deployments, the action in the target account must read these artifacts. Since the default S3 KMS key cannot be shared across AWS accounts, the artifact bucket must be encrypted with a Customer Managed Key, and its policy must trust the target account role.

Adım Adım Çözüm

1
Identify the root cause of cross-account artifact decryption failure.
The default AWS managed S3 key (aws/s3) cannot be used for cross-account operations.
AWS managed keys cannot have their key policies modified to grant access to external accounts.
2
Create and configure a Customer Managed Key (CMK) in AWS KMS within Account A.
A CMK is created with a key policy that explicitly grants decrypt permissions to the deployment IAM role in Account B.
A customer managed key allows external accounts to be granted usage permissions.
3
Update the S3 bucket policy in Account A.
The bucket policy allows the deployment IAM role in Account B to perform GetObject operations.
Both S3 resource permissions and KMS key permissions must be satisfied for successful retrieval.

Anahtar Kavram

Cross-account artifact access in AWS CodePipeline requires using a customer managed key (CMK) in AWS KMS and granting permissions to the target account's deployment role in both the S3 bucket policy and the KMS key policy.
Soru 1029Soru →

A developer is building a Python application running on Amazon ECS that must encrypt JSON telemetry reports of approximately 80 KB80\text{ KB} each before storing them in an Amazon S3 bucket. The application must use AWS Key Management Service (AWS KMS) for encryption. Which approach should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Call the KMS `GenerateDataKey` API operation using a customer managed key to obtain a plaintext data key and an encrypted data key. Encrypt the telemetry report locally using the plaintext data key, upload both the encrypted report and the encrypted data key to the S3 bucket, and then delete the plaintext data key from memory.

Cevap

Calling the KMS `GenerateDataKey` API operation to obtain a plaintext and encrypted data key, performing local encryption with the plaintext key, storing the encrypted data and encrypted key, and deleting the plaintext key from memory.
The correct approach uses client-side envelope encryption. Since the JSON payload size is 80 KB80\text{ KB}, direct encryption via the KMS `Encrypt` API is not possible due to its 4 KB4\text{ KB} limit. By calling `GenerateDataKey` with a customer managed key, the application receives a plaintext data key to perform local encryption using a symmetric algorithm (like AES-256) and an encrypted data key. The application uploads the ciphertext data and the encrypted data key to the S3 bucket, then deletes the plaintext key from memory to prevent security leaks. Accessing KMS requires the credentials of the ECS Task Role, which is used by the application code.

Adım Adım Çözüm

1
Analyze the size of the telemetry report payload.
The telemetry report is 80 KB80\text{ KB}, which is larger than the 4 KB4\text{ KB} direct encryption limit of the KMS `Encrypt` API.
Determines that the application must use envelope encryption rather than sending the raw payload to KMS.
2
Choose the appropriate KMS API operation for envelope encryption.
The KMS `GenerateDataKey` API operation is selected to generate the plaintext and encrypted versions of the data key.
Allows the application to encrypt the 80 KB80\text{ KB} payload locally using the plaintext key and store the encrypted key with the data.
3
Verify ECS IAM configuration.
Ensure the KMS permission policy is attached to the ECS Task Role.
The application code running in the container relies on the Task Role for AWS SDK credentials, not the Task Execution Role.

Anahtar Kavram

AWS KMS Envelope Encryption and ECS IAM Roles
Soru 1030Soru →

A developer is troubleshooting a Node.js AWS Lambda function that processes events from an Amazon DynamoDB stream. The function is configured to run inside two private subnets of a custom VPC to write caching updates to an Amazon ElastiCache for Redis cluster in the same subnets. The function also makes HTTPS calls to an external third-party service to validate customer addresses. The developer observes two symptoms in Amazon CloudWatch Logs: first, the function fails to connect to the external address validation API, resulting in connection timeout errors; second, even when address validation succeeds, the function execution duration frequently runs close to the maximum configured timeout of 3030 seconds because the database connections in the connection pool remain active, preventing the Node.js event loop from exiting. Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet of the VPC, and add a route in the route tables of the Lambda function's private subnets that targets the NAT Gateway for destination 0.0.0.0/00.0.0.0/0.; Set the context.callbackWaitsForEmptyEventLoop property to false in the Lambda handler code.

Cevap

Deploy a NAT Gateway in a public subnet of the VPC and route outbound traffic from the private subnets to it. Additionally, set context.callbackWaitsForEmptyEventLoop to false in the handler code.
To resolve the API connection timeout, the Lambda function requires internet access. Since it is located in private subnets, it cannot route traffic directly to an Internet Gateway or utilize public IPs. Instead, a NAT Gateway must be set up in a public subnet, and the route tables for the private subnets must direct outbound traffic to it. To resolve the event loop timeout, the callbackWaitsForEmptyEventLoop property on the context object must be set to false. This tells the Lambda runtime to return the response immediately after the callback is invoked, frozen in state, without waiting for the connection pool to empty.

Adım Adım Çözüm

1
Diagnose the external API connection timeout issue.
Determine that the Lambda function is running in private subnets without outbound route access to the public internet.
VPC-associated Lambda functions in private subnets require a NAT Gateway or VPC endpoint to connect to public endpoints.
2
Resolve the network connectivity problem.
Create a NAT Gateway in a public subnet and add a route mapping 0.0.0.0/00.0.0.0/0 to the NAT Gateway in the private subnets' route tables.
This establishes a valid route for outbound internet traffic from the private subnets.
3
Diagnose the function timeout issue caused by open connections.
Identify that the Node.js event loop is waiting for the active database connection pool to ElastiCache to be empty before terminating the invocation.
The default behavior of Node.js in Lambda keeps the execution active until the event loop is empty.
4
Resolve the event loop delay in the handler code.
Configure context.callbackWaitsForEmptyEventLoop to false at the beginning of the handler function.
This instructs Lambda to return the callback response immediately, bypassing the empty event loop check.

Anahtar Kavram

Debugging Lambda execution context behavior and VPC routing configurations
Soru 1031Soru →

An organization is transitioning a containerized API from Amazon EC2 to Amazon ECS and implementing blue/green deployments using AWS CodeDeploy. A developer must configure the deployment to execute an AWS Lambda function named "ValidateDeployment" to run smoke tests on the replacement task set after it is provisioned but before any traffic is routed to it. The validation Lambda function must also retrieve database credentials from AWS Secrets Manager during its run. Which configuration represents the correct setup for the AppSpec file and the required IAM roles to support this deployment?

Cevabı ve açıklamayı göster

Cevap: Use an AppSpec file with capitalized Resources and Hooks sections, defining the Lambda function ARN under Hooks as `- AfterInstall: "arn:aws:lambda:us-east-1:123456789012:function:ValidateDeployment"`. Configure the AWS CodeDeploy service role with a trust policy that allows codedeploy.amazonaws.com to assume the role. Grant the validation Lambda function's execution role permission to retrieve the database credentials from AWS Secrets Manager.

Cevap

The correct configuration is to use capitalized Resources and Hooks sections in the AppSpec file, define the validation Lambda function under the AfterInstall hook, configure the AWS CodeDeploy service role to trust codedeploy.amazonaws.com, and grant the validation Lambda function's IAM execution role permission to retrieve the credentials from AWS Secrets Manager.
The correct option correctly identifies that for ECS deployments, the AppSpec file must contain capitalized Resources and Hooks sections, and the validation hook must be a Lambda function defined under a valid ECS hook like AfterInstall. It also correctly specifies that the CodeDeploy service role trust policy must trust codedeploy.amazonaws.com, and the validation Lambda function's execution role must be granted Secrets Manager permissions to retrieve database credentials.

Adım Adım Çözüm

1
Identify the AppSpec syntax requirements for ECS deployments.
The AppSpec file must use capitalized Resources and Hooks keys, and the lifecycle hooks must invoke AWS Lambda functions rather than shell scripts.
ECS and Lambda deployments in CodeDeploy utilize a different schema structure than EC2/On-Premises deployments, requiring capitalized keys and Lambda function targets.
2
Determine the correct CodeDeploy lifecycle hook for validation before traffic routing.
AfterInstall runs after the replacement task set is created but before traffic routing starts.
This ensures validation is completed before the production listener shifts traffic to the new task set.
3
Identify the required IAM configurations for CodeDeploy and the validation hook.
The CodeDeploy service role must trust codedeploy.amazonaws.com. The validation Lambda function's IAM execution role must have permissions to assume lambda.amazonaws.com and must be granted secretsmanager:GetSecretValue permissions.
CodeDeploy needs to assume its own service role to execute the deployment, and the Lambda function executes under its own role to retrieve the secrets directly.

Anahtar Kavram

AWS CodeDeploy AppSpec lifecycle hooks and IAM configuration requirements for Amazon ECS blue/green deployments.
Tahmini Süre:2m 30s
Soru 1032Soru →

A developer is configuring an Amazon Elastic Container Service (ECS) task definition for a containerized application. The application code needs to retrieve objects from an Amazon S3 bucket at runtime. Additionally, the ECS container agent requires permissions to pull the private container image from Amazon Elastic Container Registry (ECR) to launch the task. Which configuration should the developer use to grant the appropriate permissions?

Cevabı ve açıklamayı göster

Cevap: Assign an IAM role with Amazon S3 permissions to the Task Role, and assign an IAM role with Amazon ECR permissions to the Task Execution Role.

Cevap

Assign an IAM role with Amazon S3 permissions to the Task Role, and assign an IAM role with Amazon ECR permissions to the Task Execution Role.
The correct configuration requires assigning the application-specific permissions (Amazon S3 access) to the ECS Task Role so the containerized application code can access S3 at runtime. The container agent itself requires permissions to pull images from Amazon ECR, which must be assigned to the ECS Task Execution Role.

Adım Adım Çözüm

1
Identify the resource-access requirements for the containerized application.
The application code itself needs to access Amazon S3 at runtime.
Application-level permissions must be mapped to the ECS Task Role.
2
Identify the resource-access requirements for the ECS container agent.
The ECS agent needs to pull the Docker image from Amazon ECR before the container starts.
Agent-level infrastructure permissions must be mapped to the ECS Task Execution Role.
3
Combine the configurations in the ECS task definition.
Assign S3 permissions to the Task Role and ECR permissions to the Task Execution Role.
This setup aligns with the principle of least privilege and ensures correct authorization separation.

Anahtar Kavram

ECS Task Role vs Task Execution Role
Tahmini Süre:1m 0s
Soru 1033Soru →

An organization is migrating a legacy system to AWS and exposing its services through an Amazon API Gateway REST API. The client applications authenticate using custom JWTs issued by a proprietary on-premises identity provider that cannot be integrated with Amazon Cognito. The API Gateway must validate these tokens and extract custom claims to authorize requests before forwarding them to the backend microservices. Which authorization strategy should the developer implement to secure this API with the least operational complexity?

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda authorizer on the API Gateway to decode and validate the incoming JWT, and return an IAM policy that grants or denies access to the API methods.

Cevap

Configure a Lambda authorizer on the API Gateway to decode and validate the incoming JWT, and return an IAM policy that grants or denies access to the API methods.
The correct strategy is to use a Lambda authorizer on the API Gateway. This allows the API Gateway to execute a custom Lambda function to validate the incoming proprietary JWT and return a cached IAM policy that controls access to the API methods, securing the API at the perimeter.

Adım Adım Çözüm

1
Analyze the token source and integration requirements.
The clients use custom JWTs from a proprietary on-premises provider that cannot integrate with Amazon Cognito.
This rules out native Amazon Cognito User Pool authorizers since the tokens are not Cognito-native.
2
Evaluate where token validation and authorization should occur.
Validation should occur at the API Gateway boundary rather than in the backend proxy integration.
Performing checks at the gateway prevents unauthorized invocations of backend services, optimizing cost and security.
3
Select the correct API Gateway custom authentication mechanism.
Configure a Lambda authorizer.
Lambda authorizers are designed to parse custom tokens, validate them against custom logic, and return an IAM policy representing permissions.

Anahtar Kavram

Lambda Authorizers for Custom Token Validation
Tahmini Süre:1m 30s
Soru 1034Soru →

An API designed with Amazon API Gateway and AWS Lambda retrieves product details from an Amazon DynamoDB table. The product data changes infrequently, but sudden traffic spikes occasionally cause throttling on the DynamoDB table. The developer wants to implement a caching solution at the API Gateway layer to minimize Lambda invocations and DynamoDB read load. Additionally, client applications must be able to occasionally bypass this cache to retrieve the most up-to-date data when a user manually refreshes the page. Which approach should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Enable API Gateway caching for the stage. Configure the API Gateway policy to allow cache invalidation, and instruct client applications to include the Cache-Control: max-age=0 header in their requests.

Cevap

Enable API Gateway caching for the stage. Configure the API Gateway policy to allow cache invalidation, and instruct client applications to include the Cache-Control: max-age=0 header in their requests.
The correct option addresses the requirement to cache at the API Gateway layer to prevent Lambda invocations and DynamoDB reads. It leverages the native API Gateway caching feature and allows authorized clients to bypass the cache by passing the Cache-Control: max-age=0 header, which triggers a backend fetch.

Adım Adım Çözüm

1
Enable caching at the API Gateway stage level.
Requests are cached at the API Gateway layer, which reduces downstream Lambda invocations and DynamoDB read operations.
This directly targets the objective of caching at the entry point of the API, minimizing processing costs and backend resource consumption.
2
Configure permissions for cache invalidation.
API Gateway is configured to accept cache invalidation requests from authorized clients.
Security controls are necessary to prevent unauthorized clients from causing a denial-of-service (DoS) attack by constantly bypassing the cache.
3
Pass the Cache-Control: max-age=0 header in client requests.
The client request bypasses the API Gateway cache and fetches the fresh data from the backend.
The Cache-Control: max-age=0 header is the standard HTTP mechanism to request cache invalidation and retrieve live backend data.

Anahtar Kavram

API Gateway Caching and Cache Invalidation
Tahmini Süre:1m 30s
Soru 1035Soru →

A developer is configuring an Amazon API Gateway REST API to write execution logs to Amazon CloudWatch Logs. The developer creates an IAM role for API Gateway to assume and configures the following trust policy on the role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "apigateway.amazonaws.com"
},
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
}
]
}

However, when testing the API Gateway REST API, the developer notices that no execution logs are appearing in CloudWatch. How should the developer correct this configuration?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy's Action to "sts:AssumeRole", and attach a separate IAM permissions policy to the role that grants the CloudWatch Logs actions.

Cevap

Update the trust policy's Action to "sts:AssumeRole", and attach a separate IAM permissions policy to the role that grants the CloudWatch Logs actions.
The correct option is to update the trust policy's Action to "sts:AssumeRole" and attach a separate permissions policy to the role. In AWS IAM, a role has two types of policies: a trust policy (which defines which principal is trusted to assume the role) and a permissions policy (which defines what the identity assuming the role can do). A trust policy must specify "Action": "sts:AssumeRole". The functional permissions for CloudWatch Logs (such as logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents) must be attached to the role via an identity-based permissions policy, not specified in the trust policy.

Adım Adım Çözüm

1
Analyze the IAM role's trust policy.
The current trust policy specifies logging actions directly in the Action block of the trust relationship, which is invalid.
An IAM role's trust policy (trust relationship) is only used to define which principals can assume the role. The only action it should grant is 'sts:AssumeRole'.
2
Separate trust relationships from permissions policies.
Modify the trust policy's Action to 'sts:AssumeRole' for the service principal 'apigateway.amazonaws.com'. Create a separate IAM permissions policy containing 'logs:CreateLogGroup', 'logs:CreateLogStream', and 'logs:PutLogEvents', and attach it to the role.
This establishes a valid trust relationship allowing API Gateway to assume the role, and grants the assumed role the necessary permissions to write to CloudWatch Logs.

Anahtar Kavram

IAM Trust Policies vs. Permissions Policies
Soru 1036Soru →

A developer is designing a web application that will run on a fleet of Amazon EC2 instances. The application requires a session state store that can scale horizontally, support high-frequency reads and writes, and maintain low latency. The developer chooses to use Amazon DynamoDB to store the user session data. Which implementation strategy provides the most performant and cost-effective solution for retrieving session records?

Cevabı ve açıklamayı göster

Cevap: Create a DynamoDB table with the session ID as the partition key, and use the GetItem API operation to retrieve session documents.

Cevap

Create a DynamoDB table with the session ID as the partition key, and use the GetItem API operation to retrieve session documents.
The correct option specifies using the session ID as the partition key and retrieving the session data via the GetItem API operation. This pattern allows DynamoDB to route the request directly to the partition containing the target item, achieving single-digit millisecond latency and minimizing read capacity unit consumption. This is the recommended best practice for high-throughput session state management.

Adım Adım Çözüm

1
Identify the requirements of the session state store.
The store must scale horizontally, support high-frequency reads and writes, and maintain low latency.
This establishes the constraints for database lookup operations.
2
Evaluate DynamoDB key design and access patterns.
A unique session ID partition key allows direct item lookup via GetItem, whereas a low-entropy partition key causes hot partitions, and a Scan operation reads the entire table.
Selecting the right partition key and API call minimizes both latency and consumed read capacity units.
3
Select the optimal architectural pattern.
Retrieve session records using GetItem with a session ID partition key, avoiding inappropriate stores like Parameter Store.
This satisfies all performance, cost, and scalability requirements.

Anahtar Kavram

Session State Management using Amazon DynamoDB
Soru 1037Soru →

A developer is configuring a rolling update deployment for an application hosted on an Amazon Elastic Container Service (Amazon ECS) cluster using the EC2 launch type. The service runs with a desired task count of 44. Due to strict memory constraints on the container instances, the cluster cannot run more than 66 tasks simultaneously. Additionally, the application must maintain at least 50%50\% of its desired capacity (22 tasks) at all times to handle incoming baseline traffic.

Which two parameters should the developer configure in the ECS service definition to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Set `minimumHealthyPercent` to 5050.; Set `maximumPercent` to 150150.

Cevap

Setting the minimum healthy percent to 5050 and the maximum percent to 150150 in the ECS service definition deployment configuration.
To satisfy the requirements, the developer must configure the deployment parameters of the ECS service relative to the desired task count of 44. The minimum healthy percent represents the lower limit of healthy tasks that must remain running during a deployment, calculated as 24×100%=50%\frac{2}{4} \times 100\% = 50\%. The maximum percent represents the upper limit of tasks that can be running, calculated as 64×100%=150%\frac{6}{4} \times 100\% = 150\%. Together, these parameters allow the ECS service to perform a rolling update by launching up to 22 new tasks before terminating old ones, while never dropping below 22 active tasks or exceeding 66 total tasks.

Adım Adım Çözüm

1
Calculate the required minimum healthy percent from the capacity constraint.
The minimum required active capacity is 22 tasks out of a desired count of 44. Expressed as a percentage: 24×100%=50%\frac{2}{4} \times 100\% = 50\%. Therefore, the minimum healthy percent must be set to 5050.
This guarantees that ECS will not terminate tasks below the 50%50\% threshold (22 tasks) during the rolling update.
2
Calculate the required maximum percent from the resource constraints.
The maximum allowed concurrent capacity is 66 tasks out of a desired count of 44. Expressed as a percentage: 64×100%=150%\frac{6}{4} \times 100\% = 150\%. Therefore, the maximum percent must be set to 150150.
This configuration allows ECS to start up to 22 new tasks of the new version before terminating any old tasks, while ensuring the cluster memory limit is not exceeded.

Anahtar Kavram

Amazon ECS Rolling Update Deployment Parameters
Tahmini Süre:1m 30s
Soru 1038Soru →

A reporting service executes an AWS Lambda function residing in private VPC subnets to generate PDF documents. The function must fetch raw data from an Amazon S3 bucket, compile the PDF, and then register the document ID by making an HTTPS request to an external registry API. Under the current configuration, the Lambda function consistently fails to connect to both Amazon S3 and the external registry API, resulting in connection timeout errors.

Which two network modifications should the developer implement to enable successful execution? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets.; Provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic (0.0.0.0/0) to the NAT Gateway.

Cevap

Create a Gateway VPC Endpoint for Amazon S3 in the VPC and associate it with the route tables of the Lambda function's subnets, and provision a NAT Gateway in a public subnet, and add a route in the private subnet route tables that directs Internet-bound traffic to the NAT Gateway.
To allow a Lambda function running inside private VPC subnets to reach public resources, proper routing must be configured. For Amazon S3, configuring a Gateway VPC Endpoint enables the function to access S3 privately through the AWS network. For the external HTTP registry API, the function's traffic must be routed via a NAT Gateway located in a public subnet, which translates the private IP addresses of the Lambda ENIs to a public IP to enable internet access.

Adım Adım Çözüm

1
Analyze the destination of the outbound traffic.
The Lambda function needs to connect to Amazon S3 (a public AWS service) and an external third-party registry API over the internet.
Identifying the distinct destinations allows for mapping the required VPC routing configurations.
2
Configure routing for Amazon S3.
A Gateway VPC Endpoint for S3 is configured, and route tables are updated to direct S3 traffic (via prefix lists) through the endpoint.
This establishes a private, cost-effective route to Amazon S3 without requiring internet access.
3
Configure routing for the external HTTPS API.
A NAT Gateway is deployed in a public subnet, and the private subnet route tables are updated to point default traffic (0.0.0.0/0) to the NAT Gateway.
Because Lambda ENIs only have private IP addresses, they require a NAT Gateway to perform network address translation and reach external endpoints.

Anahtar Kavram

VPC routing requirements for AWS Lambda functions executing in private subnets needing S3 and public internet access
Tahmini Süre:2m 0s
Soru 1039Soru →

An enterprise web application requires users to sign in using their corporate Identity Provider (IdP) via SAML 2.0. After successful authentication, the web application must access tenant-specific folders in an Amazon S3 bucket directly from the browser. Additionally, the application must make authorized calls to a backend REST API hosted on Amazon API Gateway. The developer wants to minimize custom coding for token validation and credential exchange. Which architecture configuration satisfies these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs. Configure an Amazon Cognito Identity Pool that uses the User Pool as an identity provider to obtain temporary IAM credentials for S3 access. Secure the REST API using an API Gateway Cognito Authorizer that validates the User Pool tokens.

Cevap

Configure an Amazon Cognito User Pool integrated with the SAML IdP to authenticate users and issue JWTs, use an Amazon Cognito Identity Pool to obtain temporary IAM credentials for S3 access, and secure the REST API using an API Gateway Cognito Authorizer that validates User Pool tokens.
The correct option correctly uses Cognito User Pools to handle federation and authentication via SAML 2.0, Cognito Identity Pools to exchange user identity for temporary IAM credentials for S3 access, and the native API Gateway Cognito Authorizer to secure backend API requests. This aligns perfectly with the responsibilities of each Cognito component and achieves the requirements with the least operational and development overhead.

Adım Adım Çözüm

1
Configure SAML federation in Cognito User Pool
Users can authenticate against the corporate IdP via SAML 2.0, and Cognito User Pool issues ID, access, and refresh tokens.
This establishes user identity and directory management using the existing corporate IdP.
2
Integrate Cognito Identity Pool with the User Pool
The application can exchange the Cognito User Pool ID token for temporary AWS IAM credentials.
This enables secure, direct access to S3 without exposing static AWS credentials or routing S3 uploads through a backend proxy.
3
Configure API Gateway with a Cognito User Pool Authorizer
API Gateway automatically validates incoming Cognito User Pool tokens to authorize REST API requests.
This secures the REST API using built-in platform capabilities, avoiding the overhead of custom Lambda validation code.

Anahtar Kavram

Integration of Cognito User Pools (authentication & token issuance), Cognito Identity Pools (temporary AWS credentials for direct resource access), and API Gateway Cognito Authorizers (token-based API security).
Soru 1040Soru →

An e-commerce application uses Amazon API Gateway to trigger an AWS Lambda function that processes checkout requests. Although API Gateway and Lambda have active tracing enabled, the downstream calls made by the Lambda function using the AWS SDK for Python (Boto3) to an Amazon DynamoDB table are missing from the trace map in AWS X-Ray. What should the developer do to ensure downstream DynamoDB calls are included in the trace?

Cevabı ve açıklamayı göster

Cevap: Import the `patch_all` function from the `aws_xray_sdk.core` package and call it during the function's initialization to automatically instrument the AWS SDK client.

Cevap

Import the `patch_all` function from the `aws_xray_sdk.core` package and call it during the function's initialization to automatically instrument the AWS SDK client.
Calling `patch_all` from the AWS X-Ray SDK for Python automatically instruments supported libraries, including Boto3. This enables the X-Ray SDK to intercept downstream DynamoDB API calls, create subsegments, and automatically propagate the tracing context without manual header manipulation.

Adım Adım Çözüm

1
Analyze the missing component of the trace map.
The Lambda function is successfully traced, but calls to DynamoDB using the Boto3 library do not generate downstream segments, indicating a client-side instrumentation issue.
By default, enabling active tracing on Lambda only traces the Lambda service and function execution, not the library calls within the code.
2
Select the correct instrumentation method for Python's Boto3 SDK.
Identify that the AWS X-Ray SDK for Python provides patch functions (such as `patch_all` or `patch`) to intercept calls made by Boto3.
Patching Boto3 is the standard way to hook into the client request lifecycle and automatically generate subsegments for downstream AWS services.
3
Implement the patch function at the initialization phase.
Place the `patch_all()` call at the top of the Lambda function file, before Boto3 clients are instantiated.
Calling `patch_all()` before creating clients ensures all subsequent clients are properly wrapped and instrumented for distributed tracing.

Anahtar Kavram

AWS SDK client instrumentation in Python using the AWS X-Ray SDK is required to capture and trace downstream AWS service calls.
ÖncekiSayfa 52 / 78Sonraki