Examkin

Security

390 soru

Tüm türler390Çoktan seçmeli195Çoklu seçim195
Soru 261Soru →

A developer is deploying an AWS Lambda function that processes transaction requests. The function is configured to run within the private subnets of a custom VPC. The Lambda function must connect to a private Amazon RDS PostgreSQL database cluster in the same VPC, call a public API endpoint of an external payment provider, and retrieve parameters from AWS Systems Manager Parameter Store. Which two network and security configurations should the developer implement to enable this connectivity? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the RDS database security group to allow inbound TCP traffic on port 54325432 from the security group associated with the Lambda function.; Configure a route in the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to a NAT Gateway deployed in a public subnet.

Cevap

To enable connectivity, the developer must allow inbound TCP traffic on port 54325432 from the Lambda function's security group in the RDS database's security group, and configure a route in the private subnet route table directing outbound internet traffic (0.0.0.0/00.0.0.0/0) to a NAT Gateway deployed in a public subnet.
To connect the Lambda function to the RDS database, the database security group must explicitly allow inbound traffic from the security group associated with the Lambda function. Additionally, since the Lambda function runs in a private VPC subnet, it cannot access external endpoints directly. Configuring a route pointing to a NAT Gateway in a public subnet allows the Lambda function to route traffic to the external payment API and Systems Manager Parameter Store.

Adım Adım Çözüm

1
Configure the security group of the destination database to permit inbound traffic from the source.
The RDS database cluster security group is updated with a rule allowing inbound TCP traffic on port 54325432 from the Lambda function's security group.
Since both resources reside within the same VPC, communication is routed locally but must be explicitly permitted by the database's security group.
2
Configure outbound routing for external internet endpoints and public AWS services.
A route is added to the private subnet route table directing 0.0.0.0/00.0.0.0/0 traffic to a NAT Gateway deployed in a public subnet.
Lambda functions inside private VPC subnets do not have public IP addresses and cannot connect directly to an Internet Gateway. A NAT Gateway translates their addresses and forwards traffic to the public internet, enabling access to the payment provider API and Systems Manager Parameter Store.

Anahtar Kavram

VPC security group rules and routing configurations for Lambda functions in private subnets.
Soru 262Soru →

A company is developing a client-side web application where users need to log in to their accounts and then upload profile images directly to a private Amazon S3 bucket. Which Amazon Cognito features should the developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools to manage user registration, authentication, and directory services.; Amazon Cognito Identity Pools to authorize users and retrieve temporary AWS credentials for S3 bucket access.

Cevap

To authenticate users and obtain temporary AWS credentials for S3 uploads, the developer should use Amazon Cognito User Pools for user directory management, and Amazon Cognito Identity Pools to authorize and obtain temporary AWS credentials.
The correct solution involves using Amazon Cognito User Pools to authenticate the users and manage their directory, combined with Amazon Cognito Identity Pools to exchange the authentication tokens for temporary AWS credentials that allow the client application to upload files to the S3 bucket directly.

Adım Adım Çözüm

1
Select the component for user directory management and authentication.
Use Amazon Cognito User Pools.
Cognito User Pools provide sign-up and sign-in services for web and mobile application users.
2
Select the component to exchange identity tokens for temporary AWS security credentials.
Use Amazon Cognito Identity Pools (Federated Identities).
Cognito Identity Pools enable you to grant authenticated users temporary AWS credentials to access AWS services such as Amazon S3 directly.

Anahtar Kavram

The separation of concerns between Amazon Cognito User Pools (authentication) and Amazon Cognito Identity Pools (authorization and temporary AWS credentials).
Soru 263Soru →

A developer is configuring the following trust policy for an IAM role to be used by an AWS Lambda function:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which of the following describes the purpose of this trust policy?

Cevabı ve açıklamayı göster

Cevap: It allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.

Cevap

The correct answer states that the policy allows the AWS Lambda service to assume the IAM role and obtain temporary security credentials.
The trust policy (or trust relationship) of an IAM role defines the trusted entities (principals) that can assume the role. Specifying the service principal 'lambda.amazonaws.com' and the action 'sts:AssumeRole' allows the Lambda service to assume the role and request temporary security credentials on behalf of the function execution context.

Adım Adım Çözüm

1
Analyze the JSON structure of the policy.
The document contains a 'Principal' element specifying 'lambda.amazonaws.com' and an 'Action' of 'sts:AssumeRole'.
This shows the policy is a trust policy designed to establish a trust relationship with a specific AWS service.
2
Determine the effect of the 'sts:AssumeRole' action on the service principal.
The trust policy grants the AWS Lambda service authorization to assume the IAM role.
When assumed, the role provides temporary, short-lived security credentials for the Lambda execution context.

Anahtar Kavram

IAM Role Trust Policies vs. Permissions Policies
Tahmini Süre:45s
Soru 264Soru →

A developer is building a mobile fitness tracking app. The app requires users to create an account, sign in with a username and password, and manage their profile data. The application does not need to access other AWS services directly from the mobile client. Which Amazon Cognito feature should the developer implement to provide the user directory and authentication services?

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools

Cevap

Amazon Cognito User Pools
Amazon Cognito User Pools provide a fully managed user directory that handles user registration, authentication (sign-up/sign-in), and profile management. Since the application does not require direct access to other AWS services from the mobile client, a User Pool alone satisfies the requirements.

Adım Adım Çözüm

1
Analyze the requirements for user authentication, registration, and directory management in the mobile application context.
The application needs a secure user directory to store profile data, along with registration (sign-up) and login (sign-in) flows.
This identifies that the core need is authentication (AuthN) and user management, not AWS resource authorization (AuthZ).
2
Evaluate the role of Amazon Cognito User Pools for this requirement.
Amazon Cognito User Pools act as the identity provider, containing the user directory, sign-up, sign-in, and account recovery features out-of-the-box.
Since the app only needs to authenticate users and manage their profiles without accessing other AWS resources directly, a User Pool is the correct and complete solution.
3
Distinguish from Cognito Identity Pools and other security configurations.
Cognito Identity Pools are for granting temporary credentials for AWS resources, which is not needed. Custom Lambda Authorizers control API Gateway access, and hardcoded IAM keys violate security best practices.
This rules out the incorrect options and confirms that a Cognito User Pool is the most appropriate and secure architecture.

Anahtar Kavram

Cognito User Pools vs. Identity Pools
Tahmini Süre:45s
Soru 265Soru →

A company is building a financial transactions API where an AWS Lambda function, attached to private subnets in a custom VPC, must query a private Amazon Aurora MySQL database. The function also needs to retrieve database credentials from AWS Systems Manager Parameter Store and dispatch transaction receipts to an external payment gateway. Security policies mandate that database traffic and credentials retrieval must not traverse the public internet. Which combination of network configurations and security settings will allow the function to perform all required tasks?

Cevabı ve açıklamayı göster

Cevap: Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.

Cevap

Associate the Lambda function with the private subnets. Create an interface VPC endpoint for Systems Manager in the private subnets. Deploy a NAT Gateway in a public subnet, and configure the private subnets' route table with a route for 0.0.0.0/00.0.0.0/0 pointing to the NAT Gateway.
The correct configuration establishes private connectivity to AWS Systems Manager Parameter Store using an Interface VPC Endpoint, avoiding the public internet. At the same time, it uses a NAT Gateway in a public subnet to allow the Lambda function to securely route outbound internet traffic to the external payment gateway.

Adım Adım Çözüm

1
Determine the routing requirements for each destination endpoint.
Database traffic must remain local within the VPC; AWS Systems Manager Parameter Store must be accessed privately within the AWS network; the external payment gateway requires routing to the public internet.
Understanding where traffic needs to route is critical for designing the correct VPC components.
2
Configure the private endpoint for Systems Manager Parameter Store.
Provision an Interface VPC Endpoint (PrivateLink) for Systems Manager (ssm) inside the private subnets.
This routes Parameter Store requests entirely within the AWS network, fulfilling the security requirement that credentials retrieval does not traverse the public internet.
3
Configure outbound routing for external internet access.
Deploy a NAT Gateway in a public subnet (which has a route to the Internet Gateway) and add a route in the private subnets' route table pointing 0.0.0.0/00.0.0.0/0 to the NAT Gateway.
Because Lambda functions inside private subnets lack public IP addresses, they must use a NAT Gateway to send traffic to external endpoints like the payment gateway.

Anahtar Kavram

VPC endpoints allow private access to supported AWS services, whereas resources inside private subnets must use a NAT Gateway in a public subnet to communicate with external internet services.
Tahmini Süre:2m 0s
Soru 266Soru →

A developer is building a mobile fitness application that integrates with an Amazon API Gateway REST API backed by AWS Lambda. The application requires users to sign in using their corporate Google Workspace accounts via OpenID Connect (OIDC). Once authenticated, the mobile client must send a secure token with every API request. The API Gateway must validate this token before forwarding the request to the Lambda function. Additionally, the Lambda function needs to access the user's Cognito group memberships to enforce fine-grained access control.

Which solution meets these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool with Google as an identity provider. Secure the API Gateway REST API using an API Gateway Cognito User Pool authorizer, and configure the API Gateway to use Lambda proxy integration. In the Lambda function, inspect the requestContext.authorizer.claims object to retrieve the user's groups.

Cevap

Configure an Amazon Cognito User Pool with Google as an identity provider, secure the API Gateway using a built-in Cognito User Pool authorizer with Lambda proxy integration, and inspect the requestContext.authorizer.claims object in the Lambda function.
The correct solution utilizes an Amazon Cognito User Pool to manage authentication with the OIDC provider (Google) and secures the API Gateway REST API using the native Cognito User Pool authorizer. This authorizer validates incoming JSON Web Tokens (JWTs) automatically without writing custom code. Using a Lambda proxy integration ensures that all claims, including user groups, are parsed and passed in the requestContext.authorizer.claims object of the Lambda event payload, minimizing operational overhead.

Adım Adım Çözüm

1
Determine the correct Cognito pool type for directory authentication and federation.
Cognito User Pool is selected because it acts as the user directory and supports OIDC/SAML federation, whereas Identity Pools are used for authorization and vending temporary AWS credentials.
The scenario requires users to sign in and authenticate via Google Workspace before accessing custom API endpoints.
2
Select the appropriate API Gateway authorization mechanism to validate the token with minimal overhead.
API Gateway Cognito User Pool Authorizer is selected instead of a custom Lambda Authorizer.
API Gateway native Cognito authorizers validate JWTs automatically without writing or maintaining custom code, reducing latency and operational overhead.
3
Configure the API Gateway integration and access token claims in the backend Lambda function.
Configure API Gateway with Lambda proxy integration. Retrieve the groups from the event's requestContext.authorizer.claims context object.
Lambda proxy integration automatically populates validated token claims in the event payload, allowing the backend function to perform fine-grained authorization using trusted group data.

Anahtar Kavram

Amazon Cognito User Pool Authorizer integration with Amazon API Gateway and Lambda proxy integration.
Soru 267Soru →

A developer is implementing client-side envelope encryption in a custom application to encrypt large payload files (greater than 10 MB10\text{ MB}) before uploading them to Amazon S3. The application needs to perform the encryption locally using a customer managed key stored in AWS KMS.

Which sequence of AWS SDK operations should the developer use to perform this client-side encryption?

Cevabı ve açıklamayı göster

Cevap: Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.

Cevap

Call GenerateDataKey to retrieve both a plaintext and a ciphertext version of a data key. Use the plaintext key to encrypt the payload locally, discard the plaintext key from memory, and store the ciphertext key with the encrypted payload.
The correct approach is to call the GenerateDataKey API to obtain both a plaintext data key (for local cryptographic operations) and a ciphertext data key (for safe storage). The plaintext key is used to encrypt the payload locally and must be removed from memory immediately afterward to ensure security.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
Call the GenerateDataKey API passing the identifier of the customer managed key, which returns both a plaintext data key and a ciphertext data key.
The application needs the plaintext key to perform the local cryptographic operation, and the ciphertext key to store with the data for future decryption.
2
Perform local encryption.
Encrypt the 10 MB10\text{ MB} payload locally using the plaintext data key and a local encryption algorithm (e.g., AES-256).
Encrypting the data locally avoids sending large payloads over the network to AWS KMS, which has a strict 4 KB4\text{ KB} limit for direct encryption.
3
Clean up memory and persist metadata.
Wipe the plaintext data key from memory and upload the encrypted payload along with the ciphertext data key to Amazon S3.
Discarding the plaintext key ensures security, while saving the ciphertext key ensures that the data can be decrypted later by calling the Decrypt API with KMS.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Tahmini Süre:1m 30s
Soru 268Soru →

A developer is building a document search portal. The portal must support user registration and sign-in. Once authenticated, users must be able to call an Amazon API Gateway REST API to search for document metadata, and then download the corresponding PDF files directly from a private Amazon S3 bucket. Which TWO actions should the developer take to implement the authentication and authorization for this portal?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool to handle user registration and login, and use a Cognito Authorizer on the API Gateway REST API.; Configure an Amazon Cognito Identity Pool to exchange authentication tokens from the user pool for temporary AWS IAM credentials that allow read access to the Amazon S3 bucket.

Cevap

To secure the portal, the developer must configure an Amazon Cognito User Pool to handle user registration and authentication, utilizing a Cognito Authorizer on the API Gateway REST API. The developer must also configure an Amazon Cognito Identity Pool to exchange user tokens for temporary AWS IAM credentials allowing direct S3 access.
The correct strategy leverages the Amazon Cognito User Pool to manage authentication and user profiles, paired with a Cognito Authorizer on API Gateway to validate the resulting tokens. The Amazon Cognito Identity Pool is then utilized to exchange these tokens for temporary AWS credentials so the client can safely read objects from S3 without passing static credentials or routing file payloads through API Gateway.

Adım Adım Çözüm

1
Configure user authentication and API protection.
Amazon Cognito User Pool is created, and the API Gateway API is configured with a Cognito Authorizer.
This establishes a user directory for registration/sign-in and allows API Gateway to validate user tokens natively.
2
Configure direct S3 access authorization.
Amazon Cognito Identity Pool is created, linked to the User Pool, and mapped to an IAM role with S3 read permissions.
This enables clients to exchange their User Pool tokens for temporary AWS IAM credentials to retrieve files directly from S3.

Anahtar Kavram

Distinction between Amazon Cognito User Pools for authentication and Amazon Cognito Identity Pools for authorization of AWS resource access.
Soru 269Soru →

A company is building a mobile travel application where users authenticate via a client interface and receive a JSON Web Token (JWT). The application's backend services are exposed through an Amazon API Gateway REST API. The developer needs to secure the API endpoints so that only authenticated users can access them, verifying the JWT signature on each request. Which of the following is the most operationally efficient method to implement this security requirement with the least development effort?

Cevabı ve açıklamayı göster

Cevap: Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.

Cevap

Configure a Cognito User Pools authorizer on the API Gateway method to validate the incoming tokens automatically.
Using a Cognito User Pools authorizer is the most operationally efficient approach. It leverages API Gateway's built-in capability to automatically validate incoming JSON Web Tokens (JWTs) without requiring custom code or additional Lambda executions for validation, lowering development effort and ongoing maintenance.

Adım Adım Çözüm

1
Identify the token type and authentication provider.
The application uses JSON Web Tokens (JWT) generated by a Cognito User Pool for user authentication.
Knowing the token format helps choose between native integrations and custom authorization logic.
2
Compare native integration versus custom code solutions.
API Gateway offers a built-in Cognito User Pools authorizer, whereas custom Lambda authorizers require writing token verification code.
Evaluating options based on developer effort and operational efficiency helps identify the best option with the least overhead.
3
Select the built-in Cognito User Pools authorizer.
API Gateway automatically verifies the JWT signature and expiration, allowing only valid requests to reach the backend.
This satisfies the requirement of validating tokens with minimal custom code and maximum operational efficiency.

Anahtar Kavram

Amazon API Gateway Cognito User Pools Authorizer
Tahmini Süre:1m 30s
Soru 270Soru →

A developer is building a compliance utility that runs on an Amazon EC2 instance. The utility must encrypt database backup files of approximately 250 MB250\text{ MB} client-side before sending them to an external partner's storage server. The developer wants to use envelope encryption with a Customer Managed Key (CMK) stored in AWS KMS.

Which TWO actions must the developer perform in the application code to implement this client-side encryption workflow? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API operation of AWS KMS, specifying the Customer Managed Key, to retrieve both a plaintext data key and an encrypted copy of the data key.; Encrypt the backup file locally using the plaintext data key, immediately delete the plaintext data key from memory, and package the encrypted data key alongside the encrypted backup file.

Cevap

Calling the GenerateDataKey API to obtain both the plaintext and encrypted data keys, encrypting the backup file locally with the plaintext key, and then deleting the plaintext key from memory while storing the encrypted key with the ciphertext.
For client-side envelope encryption, the developer must call the GenerateDataKey API to obtain both the plaintext data key and the encrypted version of the data key. The plaintext key is used to perform the actual local encryption of the large 250 MB250\text{ MB} backup file. Once the encryption completes, the plaintext data key must be discarded from the system memory. The encrypted data key is then stored or sent alongside the ciphertext so that it can be used for decryption in the future.

Adım Adım Çözüm

1
Generate the data keys using AWS KMS.
The application calls the GenerateDataKey API with the CMK. KMS returns a plaintext data key and an encrypted data key.
This establishes the unique keys needed for local symmetric encryption without sending large payloads to KMS.
2
Perform local symmetric encryption.
The application encrypts the 250 MB250\text{ MB} database backup file using the plaintext data key with a standard library (e.g., AES-256).
Symmetric encryption handles large datasets efficiently and keeps data secure before transit.
3
Clean up memory and prepare the payload.
The plaintext data key is deleted from the application memory. The encrypted backup file and the encrypted data key are packaged together.
Removing the plaintext key from memory prevents unauthorized access. The encrypted data key is required later to decrypt the file.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Soru 271Soru →

A developer is designing a new web application and needs to implement user sign-up, sign-in, and directory management capabilities. Which Amazon Cognito component should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools

Cevap

Amazon Cognito User Pools
The correct answer is Amazon Cognito User Pools because they function natively as a user directory, offering built-in workflows for user registration, user authentication, password recovery, and directory management.

Adım Adım Çözüm

1
Analyze the core requirements of the application: user sign-up, sign-in, and user directory management.
The application needs an identity provider that can store user credentials, manage user profiles, and issue identity tokens.
This establishes that the task is authentication and identity management.
2
Compare Cognito features against these requirements.
Cognito User Pools provide a serverless user directory, host registration/authentication pages, and issue tokens (ID, access, refresh). Cognito Identity Pools, conversely, provide temporary credentials to access AWS resources.
This clarifies the distinction between user authentication (directories) and resource authorization (credentials).
3
Select the correct component.
Amazon Cognito User Pools satisfies all requirements with minimal configuration.
It matches the target use case perfectly, leaving other components for authorization or custom integration.

Anahtar Kavram

Amazon Cognito User Pools are user directories used for authentication (sign-up, sign-in, password reset), whereas Cognito Identity Pools are used for authorization (granting temporary AWS credentials).
Soru 272Soru →

A developer is configuring an application running on an Amazon EC2 instance that needs to read items from an Amazon DynamoDB table. The developer has created the following trust policy for an IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which TWO steps must the developer complete to enable the application on the EC2 instance to securely access the DynamoDB table without hardcoding credentials?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach a permissions policy to the IAM role that grants the necessary DynamoDB permissions (such as dynamodb:GetItem).; Associate the IAM role with an IAM instance profile and attach the instance profile to the EC2 instance.

Cevap

To securely grant access, the developer must attach a permissions policy with DynamoDB access to the IAM role, and then associate the IAM role with an IAM instance profile and attach it to the EC2 instance.
The correct steps are to attach a permissions policy containing the required DynamoDB permissions to the IAM role, and to associate the role with an IAM instance profile and attach it to the EC2 instance. This combination allows the application on the EC2 instance to assume the role and gain the necessary permissions to read DynamoDB data securely.

Adım Adım Çözüm

1
Analyze the trust policy.
The trust policy currently allows the Amazon EC2 service principal to assume the IAM role.
This establishes the trust relationship allowing EC2 instances to use the role.
2
Define and attach the permissions policy.
Create an IAM policy that grants DynamoDB permissions and attach it to the IAM role.
An IAM role must have a permissions policy to define what actions are allowed on resources.
3
Associate the role with the EC2 instance.
Create an IAM instance profile, associate the role with it, and attach the instance profile to the EC2 instance.
EC2 instances cannot assume IAM roles directly; they must do so via an IAM instance profile.

Anahtar Kavram

Granting EC2 instances permissions to access AWS services using IAM roles and instance profiles.
Tahmini Süre:1m 30s
Soru 273Soru →

An engineering team is developing a document management application. The application's frontend is a single-page application (SPA). The backend APIs are deployed on Amazon API Gateway (REST API) with AWS Lambda integrations. The application uses an Amazon Cognito User Pool for user authentication, which includes federated identity providers. The backend Lambda functions must receive the authenticated user's custom department attribute ('custom:department') to authorize document access at the application layer. The developers want to implement a highly performant and secure authorization mechanism that minimizes API calls and operational overhead.

Which solution should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon API Gateway Cognito User Pool Authorizer. Configure the frontend to send the Cognito ID token in the Authorization header of API requests. Access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].

Cevap

Configure an Amazon API Gateway Cognito User Pool Authorizer, configure the frontend to send the Cognito ID token in the Authorization header of API requests, and access the department attribute in the backend Lambda function via the event parameter at event.requestContext.authorizer.claims['custom:department'].
The correct solution uses the built-in API Gateway Cognito User Pool Authorizer along with the Cognito ID token. The ID token natively carries user profile attributes, including the custom department attribute. Once validated by the authorizer, API Gateway automatically injects these claims into the Lambda integration context under the path 'event.requestContext.authorizer.claims'. This fulfills the security and functional requirements without requiring any custom validation code, downstream API queries, or Cognito Identity Pool credential exchanges, thereby minimizing execution latency and operational overhead.

Adım Adım Çözüm

1
Select the appropriate Amazon Cognito token type.
Cognito ID tokens contain user identity claims, including custom attributes such as 'custom:department', whereas standard Access tokens do not contain these user-specific directory attributes by default.
Choosing the ID token ensures that the required custom user attributes are sent to the gateway without requiring back-channel API requests to retrieve them.
2
Configure the API Gateway Authorizer.
Create a built-in Cognito User Pool Authorizer on API Gateway and associate it with the REST API resource methods. Set the Authorization header as the token source.
Using the built-in Cognito Authorizer offloads token signature verification and expiration checks to API Gateway, avoiding the operational overhead of managing custom authorizer functions.
3
Extract claims inside the backend Lambda function.
In the backend Lambda handler, read the custom attribute from 'event.requestContext.authorizer.claims["custom:department"]'.
When using a Cognito User Pool Authorizer with API Gateway Lambda proxy integration, the gateway automatically populates the claims from the validated ID token into the request context, allowing the backend to retrieve the attribute with zero database or API lookups.

Anahtar Kavram

Amazon API Gateway Cognito User Pool Authorizers natively validate ID tokens and inject user claims, including custom attributes, into the backend Lambda context, avoiding the latency and cost of custom authorizers or downstream user lookup APIs.
Tahmini Süre:2m 0s
Soru 274Soru →

A developer is configuring an AWS Lambda function that needs to retrieve files from an Amazon S3 bucket. Which two IAM configurations are required to allow the Lambda function to assume its execution role and read the objects from the bucket? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A trust policy on the IAM role that grants the "sts:AssumeRole" action to the "lambda.amazonaws.com" service principal.; An IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket resource.

Cevap

The correct configurations are: a trust policy on the IAM role that grants the "sts:AssumeRole" action to the Lambda service principal, and an IAM permissions policy attached to the IAM role that grants the "s3:GetObject" action on the target S3 bucket.
The correct options state that a trust policy must grant the "sts:AssumeRole" action to the Lambda service principal, and that a permissions policy must grant the "s3:GetObject" action on the target S3 bucket. Together, these allow the Lambda service to assume the execution role and grant that role the specific permissions needed to retrieve S3 objects.

Adım Adım Çözüm

1
Identify the AWS service principal executing the function code.
The service principal is "lambda.amazonaws.com".
This principal must be permitted to assume the execution role via the trust policy.
2
Determine the necessary data access actions and resource boundaries.
The action is "s3:GetObject" and the resource is the specific Amazon S3 bucket ARN.
A permissions policy must be created to grant the role read access to the S3 bucket.
3
Attach both policies to the Lambda execution role.
The trust policy establishes trust with AWS Lambda, and the permissions policy grants S3 read access to the role.
Both policies must be present for the Lambda function to safely execute and access the S3 objects under the security envelope of the role.

Anahtar Kavram

IAM execution roles require a trust policy to define the assuming principal (who) and permissions policies to define the allowed actions and resources (what).
Tahmini Süre:1m 0s
Soru 275Soru →

An application downloads a 150 KB150\text{ KB} encrypted payload and its corresponding encrypted data key from an Amazon S3 bucket. The payload was encrypted client-side using envelope encryption with an AWS KMS customer managed key. Which of the following workflows should the developer implement in the application code to decrypt the payload?

Cevabı ve açıklamayı göster

Cevap: Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.

Cevap

Send the encrypted data key to the AWS KMS Decrypt API operation to retrieve the plaintext data key, decrypt the payload locally using the plaintext key, and then delete the plaintext key from memory.
The correct workflow involves calling the KMS Decrypt API operation with the encrypted data key. Because direct KMS cryptographic operations are capped at 4096 bytes4096\text{ bytes} (4 KB4\text{ KB}), a 150 KB150\text{ KB} payload cannot be decrypted directly by KMS. Instead, the application must delegate the decryption of the small data key to KMS. Once the plaintext data key is returned, the actual data payload is decrypted locally using cryptographic libraries in the application code, and the plaintext data key is discarded from memory.

Adım Adım Çözüm

1
Call the AWS KMS Decrypt API passing the encrypted data key.
AWS KMS decrypts the data key and returns the plaintext data key along with the KMS key ARN.
The ciphertext payload is too large (150 KB150\text{ KB}) to be decrypted directly by KMS, which has a limit of 4 KB4\text{ KB} for direct operations.
2
Use the plaintext data key to decrypt the payload locally in memory.
The plaintext version of the 150 KB150\text{ KB} payload is recovered.
Client-side decryption must occur locally using the symmetric key (the plaintext data key) generated during the initial encryption process.
3
Erase the plaintext data key from memory as soon as decryption is complete.
The plaintext data key is destroyed.
This is a security best practice to prevent the plaintext key from remaining in application memory longer than necessary.

Anahtar Kavram

KMS Envelope Decryption Workflow
Tahmini Süre:1m 30s
Soru 276Soru →

A developer is building a serverless web application that allows users to sign in and upload files directly to an Amazon S3 bucket. The application must support user registration and sign-in, and provide temporary AWS credentials to authenticated users for S3 uploads. Which two Amazon Cognito features should the developer configure to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Amazon Cognito User Pools to manage user registration, authentication, and directory services; Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access

Cevap

Amazon Cognito User Pools to manage user registration, authentication, and directory services, and Amazon Cognito Identity Pools to authorize users and obtain temporary AWS credentials for S3 access.
To support user sign-up and authentication, a Cognito User Pool is required. To authorize the users and grant temporary AWS credentials for direct S3 upload access, a Cognito Identity Pool is required.

Adım Adım Çözüm

1
Determine the service needed for user authentication and directory management.
Amazon Cognito User Pools provides the directory and authentication features required for user registration and sign-in.
User Pools handle authentication and act as the identity provider.
2
Determine the service needed to access AWS resources directly from the client.
Amazon Cognito Identity Pools (federated identities) allows exchanging authentication tokens for temporary AWS IAM credentials.
Identity Pools manage authorization and provide credentials for AWS resources like Amazon S3.

Anahtar Kavram

Cognito User Pools authenticate users and manage directories, while Cognito Identity Pools authorize users to access AWS resources by issuing temporary credentials.
Soru 277Soru →

A developer is implementing authorization for an Amazon API Gateway REST API. The API serves as the backend for a web application where users register and log in directly using Amazon Cognito. The developer needs to validate the JSON Web Tokens (JWT) sent in the HTTP authorization header for each request. The solution should minimize both custom development effort and operational overhead. Which of the following approaches should the developer choose to secure the API?

Cevabı ve açıklamayı göster

Cevap: Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.

Cevap

Deploy a native Amazon Cognito authorizer on the API Gateway REST API resources to validate the incoming tokens.
Deploying a native Amazon Cognito authorizer is the correct approach. API Gateway provides built-in integration with Cognito User Pools. By configuring a Cognito authorizer, API Gateway automatically validates the signature and expiration of the JWT before forwarding the request to the integration backend. This requires zero custom code, minimizes developer effort, and lowers latency and costs.

Adım Adım Çözüm

1
Identify the authentication source
The identity source is Amazon Cognito User Pools, which issues standard JSON Web Tokens (JWT) upon successful authentication.
This determines which authorization methods are compatible with the token type.
2
Evaluate the architectural constraints
The solution must minimize custom development effort and operational overhead.
This rules out options that require writing custom authorizer code or backend validation logic.
3
Select the native API Gateway capability
API Gateway has a built-in Cognito User Pools authorizer that handles JWT validation natively.
A native authorizer requires no custom code, lowering operational overhead and automatically rejecting unauthorized requests before they reach backend integrations.

Anahtar Kavram

Amazon API Gateway Cognito User Pools Authorizer
Tahmini Süre:1m 30s
Soru 278Soru →

A developer is deploying an application on an Amazon EC2 instance that needs to read data from an Amazon DynamoDB table. The developer creates an IAM role to grant the application the required permissions. The developer wants to configure the trust policy for this IAM role.

Consider the following trust policy document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "<PLACEHOLDER>"
},
"Action": "sts:AssumeRole"
}
]
}

To allow the EC2 instance to assume this IAM role, which value should replace `<PLACEHOLDER>`?

Cevabı ve açıklamayı göster

Cevap: ec2.amazonaws.com

Cevap

ec2.amazonaws.com
The correct answer is the option specifying the EC2 service principal. An IAM role's trust policy defines the principals (users, roles, accounts, or services) that are allowed to assume the role. Since the application is running on an Amazon EC2 instance, the EC2 service itself must be trusted to assume the role on behalf of the instance. The service principal for EC2 is ec2.amazonaws.com.

Adım Adım Çözüm

1
Analyze the requirement of the application running on the Amazon EC2 instance.
The application runs on EC2 and needs to assume an IAM role to access DynamoDB.
Before the application can use the role, the EC2 service must be allowed to assume it.
2
Identify the purpose of a trust policy in an IAM role.
The trust policy determines which entity (Principal) is allowed to assume the role via the sts:AssumeRole action.
Only trusted entities defined in the trust policy can obtain temporary credentials for the role.
3
Determine the correct service principal for Amazon EC2.
The service principal for EC2 is ec2.amazonaws.com.
Replacing the placeholder with ec2.amazonaws.com successfully establishes trust with the EC2 service.

Anahtar Kavram

IAM role trust policies dictate which AWS services or identities can assume a role.
Tahmini Süre:45s
Soru 279Soru →

A developer is implementing client-side envelope encryption in a containerized microservice to encrypt application configuration payloads that are approximately 2 MB2\text{ MB} in size. The developer wants to use an AWS KMS customer managed key for this process. Which of the following actions must the developer perform to encrypt the payloads? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key.; Encrypt the configuration payload locally using the plaintext data key, and then discard the plaintext data key from memory.

Cevap

The developer must call the KMS GenerateDataKey API operation to retrieve a plaintext data key and an encrypted data key, encrypt the payload locally using the plaintext data key, and then discard the plaintext data key from memory.
To perform client-side envelope encryption on payloads larger than 4 KB4\text{ KB}, the developer must first call GenerateDataKey to get both the plaintext data key (used for local encryption) and the encrypted data key (stored with the ciphertext). The developer then encrypts the payload locally using the plaintext data key and discards the plaintext data key from memory to maintain security.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
The application receives a plaintext data key and an encrypted copy of the data key.
The KMS customer managed key cannot directly encrypt payloads larger than 4 KB4\text{ KB}, so a data key is generated for local envelope encryption.
2
Encrypt the payload locally.
The payload is encrypted into ciphertext using the plaintext data key.
Local encryption using the plaintext data key is performed outside of AWS KMS to support large payloads.
3
Clean up the memory.
The plaintext data key is removed from application memory.
Discarding the plaintext key prevents unauthorized memory inspection from exposing the encryption key.

Anahtar Kavram

Client-side envelope encryption workflow with AWS KMS
Soru 280Soru →

A developer is setting up an AWS Lambda function that must read from an Amazon DynamoDB table. The developer creates an IAM role named AppStoreExecutionRole and attaches a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations. However, when invoking the Lambda function, it fails to execute with an authorization error because it cannot assume the role. The role's current trust policy is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::123456789012:root"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this authorization error?

Cevabı ve açıklamayı göster

Cevap: Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.

Cevap

Update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal.
The correct answer is to update the trust policy's Principal block to specify the AWS service principal lambda.amazonaws.com instead of the account principal. AWS Lambda requires that any execution role assigned to a function trusts the Lambda service principal so that AWS Lambda can assume the role when invoking the function on the developer's behalf.

Adım Adım Çözüm

1
Examine the trust policy's Principal and Action fields.
The trust policy currently delegates trust only to the root account identifier, meaning only IAM identities within account 123456789012 who have sts:AssumeRole permissions can assume it.
To identify why the AWS Lambda service is blocked from assuming the execution role.
2
Determine how the AWS Lambda service assumes roles to execute functions.
AWS Lambda requires the service principal lambda.amazonaws.com to be declared as the trusted entity in the trust policy.
The Lambda service itself, not an IAM identity inside the account, is initiating the sts:AssumeRole call.
3
Replace the AWS account principal reference with the Lambda service principal.
The trust policy is updated to permit the lambda.amazonaws.com service principal to perform sts:AssumeRole.
This allows AWS Lambda to assume the role when running the function, resolving the initialization error.

Anahtar Kavram

IAM trust policies define which principals (users, accounts, or services) are allowed to assume a role. For AWS services like Lambda to assume a role, the trust policy must explicitly grant the sts:AssumeRole action to the service's principal name (e.g., lambda.amazonaws.com).
Tahmini Süre:2m 0s
ÖncekiSayfa 14 / 20Sonraki
Security Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 14 | Examkin