Examkin

Security

390 soru

Tüm türler390Çoktan seçmeli195Çoklu seçim195
Soru 241Soru →

A developer is deploying a containerized microservice to Amazon ECS that requires access to a customer managed key in AWS KMS for encrypting and decrypting application data. The security team prohibits direct, permanent IAM policy attachments to the ECS task role for KMS access. Instead, they require that permissions to use the KMS key be granted dynamically and programmatically to specific tasks at startup, and revoked when the tasks terminate. Which approach should the developer use to meet these security requirements?

Cevabı ve açıklamayı göster

Cevap: Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.

Cevap

Call the CreateGrant API operation on the customer managed key, specifying the ECS task role as the grantee principal, and retire the grant when the task terminates.
Calling the CreateGrant API operation allows the microservice to dynamically grant the required cryptographic permissions on the customer managed key to the ECS task role at startup. The grant can then be retired programmatically using the RetireGrant operation when the task terminates, fulfilling the security requirement without permanent IAM policy attachments.

Adım Adım Çözüm

1
Analyze the requirement for dynamic, programmatically managed, and temporary KMS permissions that avoid permanent IAM policies.
Identify that AWS KMS Grants allow programmatic, temporary delegation of key usage permissions to a principal.
Grants are designed precisely for scenarios where permissions must be given dynamically (e.g., at task startup) and revoked (retired) when no longer needed.
2
Evaluate the viability of using KMS Grants.
A grant can be created via the AWS SDK calling CreateGrant with the ECS task role as the grantee, specifying operations like Decrypt and Encrypt. When the task shuts down, the grant can be retired using the RetireGrant API call.
This avoids attaching permanent policy statements to the ECS task IAM role while ensuring the task has permissions only during its lifetime.

Anahtar Kavram

AWS KMS Grants provide a flexible, programmatic mechanism to delegate temporary access to KMS keys without changing IAM policies.
Soru 242Soru →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application needs to read and write items in an Amazon DynamoDB table. According to security best practices, which two steps should the developer take to configure the required permissions? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role.; Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Role.

Cevap

Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal to assume the role, and attach the permissions policy to the ECS Task Role.
To secure an ECS task, the developer must use an ECS Task Role for application permissions (like DynamoDB access) and configure the trust policy to allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume that role.

Adım Adım Çözüm

1
Identify the entity that needs to make AWS API calls and the entity that needs permission to assume the role.
The application code running inside the ECS container needs to access DynamoDB. The ECS task service itself needs to assume the role to pass temporary credentials to the container.
This determines the trust policy requirements and the correct IAM role type to use.
2
Configure the trust relationship for the IAM role.
A trust policy is created allowing ecs-tasks.amazonaws.com to assume the role.
ECS tasks must be authorized to obtain temporary security credentials from AWS STS.
3
Associate the DynamoDB permissions with the application role.
The permissions policy is attached to the ECS Task Role.
The Task Role supplies credentials to the containerized application, allowing it to authenticate and authorize against the DynamoDB table.

Anahtar Kavram

IAM Task Roles for ECS tasks separation and configuration
Soru 243Soru →

A developer is building a mobile application that allows users to register, log in, and upload photos directly to a private Amazon S3 bucket. The developer wants to use Amazon Cognito for user management and secure access. Which TWO options represent the correct configuration of Amazon Cognito services required to meet these objectives?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools to handle user sign-up, sign-in, and authentication token issuance; Amazon Cognito Identity Pools to federate user identity and obtain temporary AWS credentials for Amazon S3 access

Cevap

Amazon Cognito User Pools are used to manage user authentication and token issuance, while Amazon Cognito Identity Pools are used to exchange these tokens for temporary AWS credentials to access AWS resources such as Amazon S3.
The correct options are the ones implementing Cognito User Pools for user authentication and directory management, and Cognito Identity Pools for exchanging the resulting tokens into temporary AWS credentials for S3 access.

Adım Adım Çözüm

1
Identify the authentication requirement.
The application needs user registration, sign-in, and token management, which is handled by Amazon Cognito User Pools.
User Pools act as the user directory and provide identity management.
2
Identify the authorization requirement for AWS resources.
The application needs to grant authenticated users access to Amazon S3 to upload files.
Accessing AWS resources directly from client apps requires temporary credentials.
3
Determine the resource that yields temporary AWS credentials.
Amazon Cognito Identity Pools (Federated Identities) can take the token from the User Pool and exchange it for temporary AWS credentials via an IAM role.
Identity Pools are designed to authorize access to AWS resources.

Anahtar Kavram

The separation of concerns between Amazon Cognito User Pools (authentication/user directory) and Identity Pools (authorization/temporary credentials).
Tahmini Süre:1m 0s
Soru 244Soru →

A smart agriculture company is developing a system where IoT field sensors and farm managers access backend microservices through an Amazon API Gateway REST API. The field sensors must securely publish telemetry data at regular intervals using IAM roles, while the farm managers must log in using an email and password to view and control irrigation systems through a web interface. The developer needs to secure both endpoints with the least administrative overhead. Which TWO actions should the developer take to configure the API Gateway security? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the telemetry endpoint to use AWS_IAM authorization, requiring the sensors to sign their HTTPS requests using Signature Version 4 (SigV4).; Configure the management endpoint to use an Amazon Cognito User Pools authorizer to authenticate and validate the JSON Web Tokens (JWTs) of the farm managers.

Cevap

To secure the REST API with the least administrative overhead, configure the telemetry endpoint to use AWS_IAM authorization, allowing sensors to sign their requests using Signature Version 4, and configure the management endpoint to use a Cognito User Pools authorizer to validate the JWTs of authenticated farm managers.
For IoT sensors configured with IAM roles, API Gateway's native AWS_IAM authorization validates calls signed with Signature Version 4 (SigV4) securely. For farm managers authenticating with a username and password, Cognito User Pools manage the user identities and generate JWTs, which API Gateway's native Cognito User Pools authorizer validates automatically without code.

Adım Adım Çözüm

1
Determine the auth mechanism for IoT sensors.
Since sensors utilize IAM roles, they can authenticate via AWS Signature Version 4 (SigV4). Thus, the telemetry endpoint should use AWS_IAM authorization.
This natively supports IAM-based authorization without custom authentication logic.
2
Determine the auth mechanism for web users.
Since users authenticate with username/password, an Amazon Cognito User Pool is suitable. To authenticate API Gateway requests, the API should use a Cognito User Pools authorizer.
The Cognito User Pools authorizer natively validates JSON Web Tokens (JWTs) directly at the API Gateway level.
3
Minimize administrative overhead.
Avoid custom Lambda authorizers or external token parsing since native integration mechanisms exist.
Native integrations reduce maintenance, billing costs, and code complexity.

Anahtar Kavram

API Gateway authorization types (IAM authorization vs Cognito User Pools authorizers vs custom Lambda authorizers)
Tahmini Süre:2m 0s
Soru 245Soru →

A developer is implementing a microservice that integrates with an external service provider. The integration requires a sensitive API key that needs to be rotated automatically every 90 days. Which AWS service should the developer use to store this API key and handle its automatic rotation?

Cevabı ve açıklamayı göster

Cevap: AWS Secrets Manager

Cevap

AWS Secrets Manager is the correct service to use because it is specifically designed to store sensitive API keys and supports automated rotation using AWS Lambda.
AWS Secrets Manager is designed to store secrets and credentials securely. It has native support for automatic rotation of secrets using built-in templates or custom AWS Lambda functions.

Adım Adım Çözüm

1
Identify the primary requirement.
The requirement is to store a sensitive API key and automatically rotate it every 90 days.
This helps determine which AWS service supports both secure storage and automatic lifecycle management.
2
Compare candidate AWS services.
AWS Secrets Manager provides built-in integration with Lambda for automatic secret rotation. Systems Manager Parameter Store does not support automated rotation out of the box. AWS KMS manages cryptographic keys, not the secret payloads themselves.
Choosing the service with native rotation capability minimizes custom development and operational overhead.

Anahtar Kavram

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on security and rotation requirements.
Tahmini Süre:45s
Soru 246Soru →

A developer is designing a secure communication channel between an internal inventory processing application running on Amazon ECS tasks and a backend Amazon API Gateway REST API in the same AWS account. The API must only accept requests originating from the ECS tasks, and unauthorized access must be blocked at the API Gateway layer before invoking any backend integration. The developer wants to implement this security control with the least administrative and custom development effort.

Which of the following authorization strategies meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.

Cevap

Configure the API Gateway method authorization to AWS_IAM, attach an IAM policy to the ECS Task Role allowing the execute-api:Invoke action, and configure the ECS application to sign requests using Signature Version 4.
The correct strategy leverages the native AWS_IAM authorization feature of Amazon API Gateway. When a REST API method is configured with AWS_IAM authorization, callers must sign their requests using AWS Signature Version 4 (SigV4). The ECS Task Role is granted permissions via an IAM policy allowing the execute-api:Invoke action. This approach meets all security requirements, enforces authorization at the API Gateway layer before invoking backend resources, and requires zero custom code or authorizer management.

Adım Adım Çözüm

1
Select the built-in AWS_IAM authorization type on the API Gateway method configuration page.
This ensures that API Gateway intercepts incoming requests and expects them to be signed using Signature Version 4 (SigV4).
Enabling native IAM authorization blocks unauthorized requests at the edge (API Gateway layer) without running backend code or custom Lambda authorizers.
2
Assign an IAM policy to the ECS Task Role with permission to execute the invoke action on the API Gateway resource.
The ECS task gains permission to call the API Gateway endpoint under the action execute-api:Invoke.
This implements the principle of least privilege, granting only the necessary permissions to the specific ECS task executing the application.
3
Configure the ECS application code to sign outgoing HTTPS requests to the API Gateway endpoint using AWS Signature Version 4.
The requests contain the necessary authorization headers (derived from the temporary ECS credentials) for API Gateway to validate.
SigV4 signing is required for any request authenticated via AWS_IAM.

Anahtar Kavram

API Gateway AWS_IAM Authorization
Soru 247Soru →

A developer is designing an application that must encrypt large payload files locally before sending them to an external storage system. The developer wants to implement client-side envelope encryption using an AWS KMS customer managed key. Which of the following actions must the developer perform to implement this encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the AWS KMS GenerateDataKey API operation using the customer managed key to retrieve a plaintext data key and a ciphertext data key.; Encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from application memory.

Cevap

To implement client-side envelope encryption, the developer must call the AWS KMS GenerateDataKey API operation to obtain a plaintext data key and a ciphertext data key, encrypt the payload locally using the plaintext data key, and then delete the plaintext data key from memory.
In envelope encryption, the developer first obtains both a plaintext and a ciphertext data key by calling the GenerateDataKey API with a customer managed key. The plaintext data key is used to encrypt the payload locally, and then the plaintext key is immediately destroyed from memory to maintain security. The ciphertext data key is stored alongside the encrypted payload.

Adım Adım Çözüm

1
Generate the data keys using AWS KMS.
Call GenerateDataKey with the identifier of the customer managed key to obtain both a plaintext data key and an encrypted ciphertext data key.
The plaintext key is needed for the local encryption process, while the ciphertext key will be stored alongside the encrypted data.
2
Perform local encryption and secure the keys.
Encrypt the payload locally using the plaintext data key, and then immediately destroy the plaintext data key from memory.
Destroying the plaintext key ensures that it cannot be retrieved from memory by unauthorized processes, while the ciphertext key can be safely stored.

Anahtar Kavram

Envelope encryption is the practice of encrypting data with a data key, and then encrypting the data key under another key (the KMS key). This workflow allows local encryption of large datasets without sending the actual data to KMS.
Soru 248Soru →

A developer is implementing a microservice on Amazon ECS that needs to decrypt application configuration data using a customer managed key stored in AWS KMS. The developer attaches an IAM policy to the ECS Task Role that grants the `kms:Decrypt` permission for the specific KMS key. However, the microservice fails to decrypt the data and receives an `AccessDeniedException`. Which of the following is the most likely explanation for this authorization failure?

Cevabı ve açıklamayı göster

Cevap: The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.

Cevap

The key policy associated with the customer managed key does not explicitly permit the ECS Task Role to perform the action, and it does not contain a statement allowing the AWS account to delegate permissions via IAM policies.
The correct answer explains that for customer managed keys, the KMS key policy is the ultimate authority. An IAM policy cannot grant access to a KMS key unless the key policy explicitly allows the principal or delegates authority to the AWS account to allow IAM-based delegation. Without this key policy configuration, KMS calls will result in an AccessDeniedException.

Adım Adım Çözüm

1
Analyze the IAM policy and the error message.
The ECS Task Role has the required IAM permission (`kms:Decrypt`), but the application receives an `AccessDeniedException` from KMS.
To determine if the issue is inside the IAM policy or elsewhere in AWS KMS authorization.
2
Recall AWS KMS evaluation logic for key policies and IAM policies.
KMS requires an explicit allowance in the KMS key policy. Unlike other services, IAM policies alone cannot grant access to a KMS key unless the key policy delegates authority to the account's IAM policies.
To identify where the missing permission configuration resides.
3
Evaluate the key policy requirements for a customer managed key.
The key policy must either explicitly list the ECS Task Role's ARN as a principal allowed to call `kms:Decrypt`, or it must delegate permission to the account root principal, which then allows IAM policies to grant the permission.
To select the correct reason for the authorization failure.

Anahtar Kavram

AWS KMS Key Policies vs IAM Policies
Soru 249Soru →

A developer is designing a web-based smart-home dashboard. Users must sign in using an external corporate OpenID Connect (OIDC) identity provider. After signing in, the dashboard client application must be able to:

1. Invoke an Amazon API Gateway REST API to retrieve telemetry data, using the user's authenticated profile to authorize the requests.
2. Download device logs directly from a private Amazon S3 bucket, where each user has access only to their own device subfolder (prefixed with their user ID).

Which TWO configurations are required to meet these requirements with the least operational overhead? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, and configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API.; Configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, and associate an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.

Cevap

The developer must configure an Amazon Cognito User Pool with the external OIDC provider as a federated identity provider, configure an Amazon API Gateway Cognito authorizer that uses this User Pool to secure the REST API, and configure an Amazon Cognito Identity Pool that integrates with the Cognito User Pool, associating an IAM role for authenticated users with a policy containing a policy variable to restrict S3 access to the user's directory prefix.
To authenticate external OIDC users and secure the API Gateway REST API, the developer should configure an Amazon Cognito User Pool with the OIDC provider as a federated identity provider, and secure the API Gateway with a built-in Cognito authorizer. To allow secure, direct S3 downloads using dynamic user-specific prefixes, the developer should configure an Amazon Cognito Identity Pool linked to the User Pool, and map authenticated users to an IAM role that uses policy variables to restrict access to their specific directory prefix.

Adım Adım Çözüm

1
Set up User Authentication
Configure an Amazon Cognito User Pool to federate with the external OIDC provider. This allows the web dashboard client to authenticate users and obtain JSON Web Tokens (JWTs) representing their identity.
Cognito User Pools serve as the identity directory and handle the OIDC handshake, token issuance, and user profile management.
2
Secure API Gateway REST API
Configure a built-in Cognito Authorizer on Amazon API Gateway REST API pointing to the User Pool. The client will pass the identity token in the authorization header.
Using the built-in Cognito Authorizer validates the JWT signature and expiration automatically, reducing operational overhead and custom code.
3
Enable Fine-Grained AWS Resource Access
Create a Cognito Identity Pool (federated identities) and configure the User Pool as an authentication provider. Map the authenticated role to an IAM role that permits S3 operations on prefixes filtered by the Cognito identity ID policy variable.
Cognito Identity Pools exchange the User Pool JWT for temporary, limited-privilege AWS credentials, allowing direct, secure S3 downloads without exposing long-lived IAM keys.

Anahtar Kavram

Cognito User Pools authenticate users and issue tokens, while Cognito Identity Pools authorize access to AWS resources by exchanging these tokens for temporary AWS credentials.
Soru 250Soru →

A serverless application running on AWS Lambda needs to retrieve configuration data. This includes a database hostname, which is a non-sensitive configuration parameter, and a database password, which is a sensitive credential that must be rotated automatically every month. Which two options describe the most secure and cost-effective locations to store these values? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Secrets Manager to store the database password; Systems Manager Parameter Store to store the database hostname

Cevap

Secrets Manager should be used to store the database password because it supports automatic rotation, while Systems Manager Parameter Store should be used to store the database hostname to optimize costs for non-sensitive configuration data.
Storing the database password in Secrets Manager satisfies the requirement for automatic rotation. Storing the database hostname in Systems Manager Parameter Store provides a cost-effective solution for non-sensitive configuration data that does not need rotation.

Adım Adım Çözüm

1
Analyze the requirements for the database password.
The password is a sensitive credential requiring automatic rotation.
Secrets Manager is selected because it manages secrets and supports automatic rotation natively.
2
Analyze the requirements for the database hostname.
The hostname is a non-sensitive configuration parameter that does not require rotation.
Systems Manager Parameter Store is selected because it is cost-effective and suited for standard configuration parameters.

Anahtar Kavram

Distinguishing between Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost-efficiency.
Tahmini Süre:1m 0s
Soru 251Soru →

A developer is configuring a custom IAM role named `ApplicationLogWriterRole` for a new AWS Lambda function that must write logs to an Amazon S3 bucket. The developer attempts to define both the trust relationship and the S3 permissions in a single policy document when creating the role. The developer applies the following JSON document as the role's trust policy (Assume Role Policy):

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": [
"sts:AssumeRole",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::app-logs-2026/*"
}
]
}

No other policies are attached to the IAM role. When the Lambda function executes and attempts to upload a log file to the S3 bucket, it receives an `AccessDenied` error. How should the developer resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.

Cevap

Modify the trust policy to only allow the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket.
The correct action is to modify the trust policy to allow only the "sts:AssumeRole" action for the Lambda service principal, and attach a separate IAM identity-based policy to the role that grants the "s3:PutObject" permission on the S3 bucket. An IAM role trust policy governs which principal is allowed to assume the role. It cannot be used to grant permissions to access other AWS resources. To grant resource access, the permissions must be attached to the role via an identity-based permission policy.

Adım Adım Çözüm

1
Isolate the role's trust relationship from the permissions.
Identify that the trust policy (Assume Role Policy) defines who can assume the role, whereas identity-based policies define what the assumed role can do.
IAM roles use two distinct types of policies: trust policies and permission policies. Combining resource access actions with assume role actions in the trust policy is invalid.
2
Correct the trust policy JSON.
Change the trust policy's Action to only allow "sts:AssumeRole", and set the Resource to "*" (as is standard for trust policies since the target is the role itself).
This allows the Lambda service principal to assume the identity of the IAM role.
3
Create and attach the identity-based permission policy.
Create a policy granting "s3:PutObject" on "arn:aws:s3:::app-logs-2026/*" and attach it directly to the IAM role.
Once the role is assumed, the temporary security credentials will carry the permissions defined in the attached identity-based policy, enabling the S3 upload.

Anahtar Kavram

Separation of Trust Policies and Permission Policies in IAM Roles
Tahmini Süre:2m 0s
Soru 252Soru →

A developer is configuring an AWS Lambda function that must run inside a private subnet of a custom VPC. The Lambda function needs to retrieve database credentials from AWS Secrets Manager without the traffic traversing the public internet, and it must also call a public API endpoint on the internet to validate transactions. Which of the following network configuration steps are required to allow the Lambda function to perform these tasks? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a NAT Gateway in a public subnet, and configure the route table of the private subnet to route outbound traffic (0.0.0.0/0) through the NAT Gateway.; Create an Interface VPC Endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC, and associate it with the private subnet.

Cevap

To securely achieve both goals, a NAT Gateway must be deployed in a public subnet to handle internet-bound validation calls, and an Interface VPC Endpoint must be created for AWS Secrets Manager to keep the secrets retrieval traffic private.
To satisfy both requirements, the developer must configure outbound internet access and private AWS service connectivity. A NAT Gateway deployed in a public subnet allows the Lambda function in the private subnet to make outbound calls to the public API. Simultaneously, an Interface VPC Endpoint (AWS PrivateLink) is required for AWS Secrets Manager to ensure that API requests for secrets retrieval do not traverse the public internet.

Adım Adım Çözüm

1
Enable internet egress for private subnet resources.
Create a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table directing all outbound internet traffic (0.0.0.0/0) to the NAT Gateway.
This allows the Lambda function inside the private subnet to connect to the public transaction validation API on the internet.
2
Enable private access to AWS Secrets Manager.
Create an Interface VPC Endpoint (AWS PrivateLink) specifically for AWS Secrets Manager, and map it to the private subnet with Private DNS enabled.
This routes the AWS Secrets Manager API calls through a private IP address within the VPC, ensuring that credentials traffic does not traverse the public internet.

Anahtar Kavram

Configuring public internet egress and private AWS service access for AWS Lambda functions running inside a private subnet of a custom VPC.
Tahmini Süre:2m 0s
Soru 253Soru →

An organization receives large, encrypted backup archives from an external partner. The partner encrypts these archives using envelope encryption with an AWS KMS customer managed key (CMK). Along with each archive, the partner provides the encrypted data key (ciphertext data key). Which sequence of actions must a developer implement in the decryption utility to retrieve the original plaintext data?

Cevabı ve açıklamayı göster

Cevap: Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.

Cevap

Send the ciphertext data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the archive locally using the plaintext data key, and then remove the plaintext data key from memory.
In envelope encryption, data is encrypted locally using a unique symmetric data key. To decrypt the data, the application sends the ciphertext data key to AWS KMS using the Decrypt API operation. AWS KMS decrypts the key using the customer managed key and returns the plaintext data key. The application then performs the decryption locally on the large archive using the plaintext key, and then deletes the plaintext key from memory to prevent security leaks.

Adım Adım Çözüm

1
Send the ciphertext data key to AWS KMS.
The AWS KMS Decrypt API decrypts the ciphertext key using the customer managed key (CMK).
Only KMS has the backing key policy and cryptographic material to decrypt the encrypted data key.
2
Receive the plaintext data key in the application memory.
The application now has the plaintext data key required for symmetric decryption.
The plaintext key is necessary to decrypt the large archive locally.
3
Decrypt the archive locally using the plaintext data key, and then zero out the key in memory.
The plaintext data is recovered, and the key is safely erased from the application's memory space.
Keeping the plaintext key in memory longer than necessary exposes it to potential memory inspection attacks.

Anahtar Kavram

AWS KMS Envelope Decryption Workflow
Tahmini Süre:1m 30s
Soru 254Soru →

An application hosted on an Amazon EC2 instance needs to securely retrieve configuration settings from an Amazon S3 bucket. A developer is tasked with setting up the necessary IAM permissions using security best practices. Which configuration steps should the developer perform to grant the application access to the S3 bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that permits the ec2.amazonaws.com service principal to assume the role.; Associate the IAM role with the EC2 instance by attaching an EC2 instance profile containing the role to the instance.

Cevap

To allow the application on the EC2 instance to access the S3 bucket, the developer must create an IAM role with a trust policy that allows the EC2 service to assume the role, and then associate the IAM role with the EC2 instance using an EC2 instance profile.
Securing access to AWS services from an Amazon EC2 instance requires creating an IAM role with a trust policy that allows the EC2 service principal to assume the role. The role must then be attached to the EC2 instance via an EC2 instance profile, enabling the application to automatically assume the role and access S3 using temporary credentials.

Adım Adım Çözüm

1
Establish trust for the EC2 service.
Create an IAM role containing a trust policy that permits the ec2.amazonaws.com service principal to call the sts:AssumeRole API action.
This enables AWS to delegate permissions to the EC2 service so it can obtain temporary credentials for the instance.
2
Associate the role with the compute resource.
Attach an EC2 instance profile containing the IAM role to the EC2 instance.
This makes the temporary credentials available to any applications or SDKs running on the EC2 instance via the instance metadata service.

Anahtar Kavram

Securing Amazon EC2 applications using IAM roles and instance profiles.
Tahmini Süre:1m 0s
Soru 255Soru →

To comply with security audits, the database password for an Amazon Aurora MySQL database must be stored securely and rotated automatically on a recurring schedule. Which AWS service should a developer use to manage this password and its automatic rotation?

Cevabı ve açıklamayı göster

Cevap: AWS Secrets Manager

Cevap

AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed for managing, retrieving, and rotating database credentials, API keys, and other secrets. It has built-in integration with Amazon RDS and Amazon Aurora to rotate database credentials automatically without requiring application redeployment.

Adım Adım Çözüm

1
Identify the primary requirement
The requirement is to securely store a database password and rotate it automatically on a schedule.
This determines which AWS service has the native capabilities to handle automated lifecycle management of secrets.
2
Evaluate the capabilities of AWS Secrets Manager versus AWS Systems Manager Parameter Store
AWS Secrets Manager offers built-in integration with RDS and Aurora databases to automatically rotate credentials using AWS Lambda, whereas Parameter Store does not support automatic rotation.
Choosing the service that supports out-of-the-box rotation minimizes custom development and operational overhead.

Anahtar Kavram

AWS Secrets Manager provides native support for the automatic rotation of database credentials, whereas AWS Systems Manager Parameter Store does not.
Tahmini Süre:45s
Soru 256Soru →

An IoT analytics platform receives telemetry batches of approximately 8 MB8\text{ MB} in size from edge gateways. The data must be encrypted client-side before it is transmitted to Amazon S3. A developer is tasked with implementing this encryption using a Customer Managed Key (CMK) in AWS KMS. Which two actions must the developer perform to successfully implement this encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the AWS KMS GenerateDataKey API specifying the Customer Managed Key to obtain both a plaintext data key and a ciphertext data key.; Encrypt the telemetry batch locally using the plaintext data key, and then discard the plaintext data key from memory.

Cevap

To encrypt payloads larger than 4 KB4\text{ KB} client-side, the developer must use envelope encryption. This is done by calling GenerateDataKey to obtain both plaintext and ciphertext data keys, encrypting the data locally with the plaintext key, and then discarding the plaintext key from memory.
For payloads larger than 4 KB4\text{ KB} (such as the 8 MB8\text{ MB} telemetry batch), direct encryption using AWS KMS is not possible. The developer must implement envelope encryption. This involves calling the `GenerateDataKey` API to get both a plaintext data key and a ciphertext data key. The plaintext data key is used to encrypt the telemetry batch locally and is then deleted from memory. The ciphertext data key is stored with the encrypted data in Amazon S3 for later decryption.

Adım Adım Çözüm

1
Generate cryptographic keys
Retrieve a plaintext data key and a ciphertext data key from AWS KMS.
Because the telemetry batch size (8 MB8\text{ MB}) exceeds the direct KMS encryption limit of 4 KB4\text{ KB}, envelope encryption is required.
2
Perform client-side encryption
Encrypt the telemetry batch using the plaintext data key locally.
This secures the data on the client side before transmission.
3
Clean up sensitive data in memory
Erase the plaintext data key from memory and store the ciphertext data key alongside the encrypted payload.
To prevent exposure of the plaintext key, and to ensure the data can be decrypted later using the ciphertext key.

Anahtar Kavram

AWS KMS envelope encryption workflow for handling large datasets.
Tahmini Süre:1m 30s
Soru 257Soru →

A developer is configuring a serverless application where an AWS Lambda function in Account A (111111111111111111111111) needs to ingest records from an Amazon Kinesis data stream located in Account B (222222222222222222222222). The Lambda function runs under the execution role `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

To accomplish this, the developer creates a role named `CrossAccountStreamReader` in Account B with the following permission policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"kinesis:DescribeStream",
"kinesis:GetShardIterator",
"kinesis:GetRecords"
],
"Resource": "arn:aws:kinesis:us-east-1:222222222222:stream/DataIngestStream"
}
]
}

The Lambda function code is written to assume this role using the AWS Security Token Service (STS) before calling Kinesis APIs. However, when executing the function, the developer receives an `AccessDenied` error during the STS `AssumeRole` API call.

Which TWO configurations are required to resolve this error? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to `LambdaExecutionRole` in Account A that allows the `sts:AssumeRole` action on `arn:aws:iam::222222222222:role/CrossAccountStreamReader`.; Configure the trust policy of the `CrossAccountStreamReader` role in Account B to allow the `sts:AssumeRole` action with the Principal set to `arn:aws:iam::111111111111:role/LambdaExecutionRole`.

Cevap

To resolve the issue, the developer must attach an IAM policy to the Lambda execution role in Account A that allows the `sts:AssumeRole` action on the target cross-account role, and configure the trust policy of the cross-account role in Account B to trust the Lambda execution role.
To successfully execute a cross-account API call using STS assume role, the permission must be allowed on both sides. The calling identity in the source account (the Lambda execution role) must have an identity-based permission policy allowing it to call the `sts:AssumeRole` action on the target role. Concurrently, the target role in the destination account must have a trust policy (resource-based policy on the role itself) that lists the caller's ARN as a trusted principal.

Adım Adım Çözüm

1
Grant permission to the Lambda function's execution role to assume the target role.
Create and attach an IAM policy to the execution role in Account A allowing the `sts:AssumeRole` action on the target role ARN (`arn:aws:iam::222222222222:role/CrossAccountStreamReader`).
By default, IAM entities do not have permission to assume roles, especially across accounts. This permission must be explicitly granted on the source side.
2
Establish the trust relationship on the target role in the destination account.
Edit the trust policy of the cross-account role in Account B to declare the execution role ARN (`arn:aws:iam::111111111111:role/LambdaExecutionRole`) as a trusted Principal.
An IAM role must explicitly define who is authorized to assume it. This prevents unauthorized identities from gaining access to resources in Account B.

Anahtar Kavram

Cross-account access via IAM roles requires a two-way authorization configuration: the calling identity must have permission to assume the role, and the target role's trust policy must trust the calling identity. Additionally, Amazon Kinesis Data Streams do not support resource-based policies, necessitating the use of cross-account IAM roles for this scenario.
Soru 258Soru →

A developer is building a new web application and needs to implement user registration, login, and profile management. The developer wants to store user profile data directly in a managed user directory and support federated sign-in through external identity providers. Which Amazon Cognito feature should the developer use?

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito user pools

Cevap

Amazon Cognito user pools
Amazon Cognito user pools act as user directories that provide sign-up and sign-in services for web and mobile applications. They store user profiles and support authentication using external identity providers.

Adım Adım Çözüm

1
Analyze the requirements for storing user profiles, managing registration/login, and supporting federated identity providers.
The requirements point to a need for a managed user directory.
Before selecting a service, the specific authentication vs. authorization needs must be identified.
2
Distinguish between the directories component and the credentials federation component of Amazon Cognito.
User Pools manage authentication and directories, while Identity Pools manage authorization and temporary AWS credentials.
This prevents mixing up the two main features of Amazon Cognito.
3
Select the component that natively matches the directory, registration, and login requirements.
Amazon Cognito user pools is the correct selection.
User Pools are specifically designed to act as the identity provider and user directory.

Anahtar Kavram

Distinction between Amazon Cognito User Pools and Identity Pools
Tahmini Süre:45s
Soru 259Soru →

A developer is building a partner portal API using an Amazon API Gateway REST API. External partner organizations will access this API using JSON Web Tokens (JWTs) issued by their own external OAuth 2.0 Identity Provider (IdP). The developer needs to secure the API so that requests are authorized only if the JWT is valid and contains a specific custom scope.

Which approach should the developer use to meet these security requirements with the least administrative and operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.

Cevap

Configure a Lambda authorizer on the REST API to validate the incoming JWT signature, parse the custom scopes, and return an IAM policy to API Gateway.
The correct approach is to configure a Lambda authorizer on the REST API. Since API Gateway REST APIs do not have a native JWT authorizer for third-party token validation (unlike HTTP APIs), a Lambda authorizer is required to run custom logic. The Lambda authorizer receives the bearer token, validates its signature against the external Identity Provider's public keys, checks the custom scopes, and returns an IAM policy that allows or denies access. This keeps the authorization logic at the API Gateway tier, protecting the backend.

Adım Adım Çözüm

1
Analyze the requirements for authorization: REST API, external OAuth 2.0 IdP issuing JWTs, custom scope check, and minimum operational overhead.
The solution must validate third-party JWT tokens at the API Gateway level before hitting the backend integration.
Securing the API at the gateway level prevents unauthorized traffic from executing backend code and consuming resources.
2
Evaluate the native authorization options in API Gateway REST APIs for third-party JWTs.
Amazon API Gateway REST APIs do not natively support third-party JWT validation (unlike HTTP APIs which support JWT authorizers). Cognito User Pool authorizers only accept tokens generated by Cognito User Pools.
This rules out native Cognito User Pool authorizers for direct validation of external JWTs.
3
Select the appropriate custom authorization mechanism.
A Lambda authorizer (custom authorizer) is the standard and recommended way to validate external JWTs in a REST API. The Lambda function verifies the token signature against the IdP's JWKS (JSON Web Key Set), checks the custom scopes, and generates an IAM policy specifying whether the client is allowed to call the API method.
This achieves security verification at the gateway boundary with minimal administrative overhead.

Anahtar Kavram

API Gateway Lambda Authorizers for Third-Party JWT Validation
Soru 260Soru →

A developer is configuring a containerized microservice deployed on AWS App Runner that needs to access a secure legacy database running on-premises and a third-party logistics API. The database credentials must be rotated automatically every 30 days using a custom rotation function that interacts with the on-premises database via an AWS Direct Connect connection. The third-party logistics API key is static, does not require automated rotation, and needs to be shared across multiple development environments cost-effectively. Which combination of steps should the developer take to manage these credentials in compliance with security best practices? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the on-premises database credentials in AWS Secrets Manager, and configure a custom rotation Lambda function associated with a VPC to rotate the password every 30 days.; Store the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter to leverage its free tier and cross-environment accessibility.

Cevap

The developer should store the on-premises database credentials in AWS Secrets Manager and configure a custom rotation Lambda function associated with a VPC to rotate the password, while storing the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database credentials require automated rotation and access to an on-premises network over Direct Connect, which is best handled by AWS Secrets Manager using a custom VPC-configured Lambda function. For the static API key that does not require automatic rotation, AWS Systems Manager Parameter Store SecureString is the most cost-effective option since standard parameters do not incur a monthly fee.

Adım Adım Çözüm

1
Analyze rotation and network requirements for the database credentials.
Since the legacy database is on-premises and requires automatic 30-day rotation, AWS Secrets Manager is selected. A custom Lambda function is required because native templates do not support on-premises targets. The Lambda function must be associated with a VPC to route traffic over AWS Direct Connect.
Secrets Manager provides native scheduling for rotation, and custom Lambda functions can be deployed inside a VPC to access private or on-premises networks.
2
Analyze rotation and cost requirements for the static API key.
Since the third-party logistics API key is static, does not require automated rotation, and needs to be shared across environments cost-effectively, AWS Systems Manager Parameter Store is selected as a SecureString parameter.
Parameter Store standard parameters are free, making it the most cost-effective choice for secrets that do not require the automatic rotation feature of Secrets Manager.
3
Ensure secure reference and deployment architectures.
Avoid embedding any credentials in the Dockerfile or application source code, and retrieve them dynamically at runtime from their respective parameter store and secrets manager locations.
This prevents credential leakage via image registries or source repositories.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation requirements, network path constraints, and cost optimization.
Tahmini Süre:2m 30s
ÖncekiSayfa 13 / 20Sonraki