Examkin

Security

390 soru

Tüm türler390Çoktan seçmeli195Çoklu seçim195
Soru 301Soru →

A developer is building a serverless e-learning application where students log in using an Amazon Cognito User Pool. The application's frontend client needs to access course content through an Amazon API Gateway REST API. The developer needs to secure the API so that only authenticated students can access the resource, verifying their identity directly via their login session tokens. Which solution should the developer implement to meet these requirements with the least operational overhead?

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito User Pool authorizer in API Gateway, configure it with the student User Pool, and set the API method authorization to use this authorizer.

Cevap

Create an Amazon Cognito User Pool authorizer in API Gateway, configure it with the student User Pool, and set the API method authorization to use this authorizer.
API Gateway natively supports Amazon Cognito User Pools authorizers, allowing developers to secure REST APIs by validating user identity tokens directly against the configured User Pool. This requires zero custom code, minimizing development and operational overhead.

Adım Adım Çözüm

1
Analyze the authentication provider and target API structure.
The application uses Amazon Cognito User Pools for directory management and login token generation, and accesses resources via an API Gateway REST API.
Understanding the source of credentials is critical to choosing the correct authorization path.
2
Evaluate native verification capabilities of API Gateway.
API Gateway natively supports Cognito User Pools authorizers, which validate JSON Web Tokens (JWTs) automatically.
Using a native feature eliminates the need to develop, test, and pay for custom code execution.
3
Select the option that configures the native authorizer on API Gateway.
Configuring the API method to use the Cognito User Pools authorizer meets the security requirement with the least operational overhead.
This avoids custom Lambda code or the credential exchange overhead associated with Cognito Identity Pools.

Anahtar Kavram

API Gateway native Cognito User Pool authorizer integration
Soru 302Soru →

A developer is creating an IAM role for an AWS Lambda function that needs to write logs to an Amazon S3 bucket named "my-app-logs-bucket". The developer has written the following permissions policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::my-app-logs-bucket/*"
}
]
}

Which two configuration steps must the developer perform to ensure the Lambda function has the necessary permissions to write to the S3 bucket?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of the IAM role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.; Attach the S3 permissions policy to the IAM role that is associated with the Lambda function.

Cevap

Configure the trust policy of the IAM role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action, and attach the permissions policy to the IAM role associated with the Lambda function.
To allow an AWS Lambda function to access S3 resources using an IAM role, two components are required: a permissions policy attached to the role that allows the s3:PutObject action, and a trust policy configured on the role that allows the Lambda service (lambda.amazonaws.com) to assume the role (sts:AssumeRole).

Adım Adım Çözüm

1
Identify the entity assuming the role.
The Lambda service principal (lambda.amazonaws.com) needs to run the function and obtain temporary credentials.
This determines the trust policy configuration allowing sts:AssumeRole.
2
Identify where permissions are attached.
The permissions policy allowing s3:PutObject must be attached to the execution role.
This grants the assumed role the authority to write to the S3 bucket.

Anahtar Kavram

IAM execution roles require both a trust policy allowing the service to assume the role and permissions policies granting access to destination resources.
Soru 303Soru →

A developer is deploying a Python application to AWS Elastic Beanstalk. The application needs to retrieve two values: a connection string password for a self-hosted PostgreSQL database running on an Amazon EC2 instance (which must be rotated every 45 days), and a payment gateway API endpoint URL (which is non-sensitive and static). To meet these requirements with the lowest cost and operational effort, which two configuration steps should the developer perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure an AWS Lambda function to rotate the database credential on a 45-day schedule.; Store the payment gateway API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Cevap

Store the database password in AWS Secrets Manager with a Lambda rotation function, and store the non-sensitive payment gateway URL in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive data like database passwords and supports automatic rotation using AWS Lambda. On the other hand, Systems Manager Parameter Store is a cost-effective service for storing non-sensitive configuration data such as API endpoint URLs, which do not change frequently and do not require rotation.

Adım Adım Çözüm

1
Analyze the security and rotation requirements for the database password.
The password is a sensitive credential and must be rotated automatically every 45 days. AWS Secrets Manager is the appropriate service because it supports automatic rotation schedules and integration with Lambda for rotating self-hosted databases.
Parameter Store does not natively support automatic rotation schedules.
2
Analyze the storage requirements for the payment gateway API endpoint URL.
The URL is non-sensitive and static. AWS Systems Manager Parameter Store is the most cost-effective and appropriate service for storing simple, non-sensitive configuration data.
Secrets Manager is more expensive and unnecessary for non-sensitive data.
3
Combine the decisions into the correct configuration steps.
Store the database password in Secrets Manager with Lambda rotation, and store the API URL in Parameter Store.
This combination ensures security compliance for the password and cost-efficiency for the configuration data.

Anahtar Kavram

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on secrets rotation requirements and cost-efficiency.
Soru 304Soru →

A developer is building a high-throughput microservice that must encrypt data payloads (each approximately 2 MB2\text{ MB} in size) locally before storing them in an database. To implement envelope encryption efficiently and minimize network latency, the service needs to obtain a new symmetric key that contains both a plaintext version for immediate encryption and an encrypted version for storage alongside the data. Which AWS KMS API operation should the service call to receive both versions in a single request?

Cevabı ve açıklamayı göster

Cevap: GenerateDataKey

Cevap

GenerateDataKey
The GenerateDataKey operation is designed for envelope encryption. It generates a unique data key and returns both a plaintext copy and an encrypted copy in a single response, matching the requirement to minimize network latency.

Adım Adım Çözüm

1
Analyze the requirement to perform local envelope encryption on payloads of size 2 MB2\text{ MB} while minimizing network calls.
Determine that the application needs both a plaintext key to encrypt the payload locally and an encrypted version of that key to store with the data.
Since KMS cannot directly encrypt payloads larger than 4 KB4\text{ KB}, envelope encryption is required.
2
Evaluate the AWS KMS APIs for generating data keys.
Identify that GenerateDataKey returns both plaintext and ciphertext key representations, whereas GenerateDataKeyWithoutPlaintext returns only the ciphertext representation.
Choosing the correct API prevents unnecessary network roundtrips to decrypt the key.

Anahtar Kavram

AWS KMS Envelope Encryption Key Generation
Soru 305Soru →

A developer is building a single-page web application (SPA) that will allow users to authenticate using Amazon Cognito User Pools and access backend services through Amazon API Gateway. Since the SPA runs entirely in the user's browser, the client credentials cannot be kept secure. The developer wants to implement a secure authentication flow using the authorization code grant with Proof Key for Code Exchange (PKCE) and validate access at the API Gateway layer. Which TWO steps should the developer take to implement this architecture?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Amazon Cognito User Pool app client with client secret generation disabled, and enable the Authorization Code Grant OAuth flow.; Create an Amazon API Gateway Cognito User Pool authorizer to validate the signature and expiration of the identity or access tokens passed in the Request header.

Cevap

The correct steps are to configure the user pool app client without a client secret while enabling the authorization code grant flow, and to create an API Gateway Cognito User Pool authorizer to validate incoming tokens.
The correct options state that the Cognito User Pool app client must be configured with client secret generation disabled while enabling the authorization code grant flow, and that a built-in API Gateway Cognito User Pool authorizer should be created to validate the tokens. For public clients like single-page applications running in the browser, exposing a client secret is a security risk. Therefore, client secret generation is disabled, and PKCE is utilized to secure the authorization code grant. API Gateway's native Cognito authorizer can automatically validate the JWT signature, issuer, and expiration locally using public keys from the User Pool's JSON Web Key Set (JWKS), minimizing overhead.

Adım Adım Çözüm

1
Disable client secret generation for the app client.
The client application (SPA) can safely initiate the authentication flow without needing to store or protect a secret.
Single-page applications run entirely in the browser, making it impossible to protect client secrets. Using the authorization code grant with PKCE mitigates the need for a client secret.
2
Enable the Authorization Code Grant flow in the Cognito app client settings.
Cognito is configured to exchange authorization codes for access and identity tokens securely.
This OAuth grant type, combined with PKCE, is the industry standard for securing public web applications.
3
Configure an Amazon API Gateway Cognito User Pool authorizer.
API Gateway automatically intercepts requests, validates the signature and expiration of the JWTs, and permits or denies access.
This native integration validates JSON Web Tokens (JWTs) locally using Cognito's public key set, removing the need for a custom Lambda authorizer and reducing latency.

Anahtar Kavram

Securing public clients and verifying tokens using Amazon Cognito User Pools and API Gateway native authorizers.
Soru 306Soru →

A developer is implementing a mobile application that uses an Amazon Cognito identity pool to grant users temporary AWS credentials for uploading files to an Amazon S3 bucket. The developer has created an IAM role for authenticated users, but when the mobile application attempts to exchange the Cognito identity token for temporary credentials, the request fails with an access denied error. The developer reviews the trust policy currently attached to the IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "cognito-identity.amazonaws.com"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"cognito-identity.amazonaws.com:aud": "us-east-1:12345678-1234-1234-1234-1234567890ab"
},
"ForAnyValue:StringLike": {
"cognito-identity.amazonaws.com:amr": "authenticated"
}
}
}
]
}

Which modification to the trust policy will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Change the Principal key to Federated and set its value to cognito-identity.amazonaws.com, and change the Action to sts:AssumeRoleWithWebIdentity.

Cevap

Change the Principal key to Federated and set its value to cognito-identity.amazonaws.com, and change the Action to sts:AssumeRoleWithWebIdentity.
The correct option correctly adjusts both the Principal to Federated and the Action to sts:AssumeRoleWithWebIdentity. Amazon Cognito Identity Pools act as a web identity federation provider. Therefore, any IAM role intended for authentication via Cognito must allow the federated identity 'cognito-identity.amazonaws.com' as the Principal, and it must permit the 'sts:AssumeRoleWithWebIdentity' API action to facilitate exchanging the Cognito token for temporary AWS credentials.

Adım Adım Çözüm

1
Identify the authentication source in the scenario.
Amazon Cognito Identity Pools acts as an external federated OpenID Connect (OIDC) provider, not a native internal AWS service.
Understanding the source dictates which Principal type and STS action are required in the trust policy.
2
Correct the Principal definition in the trust policy.
Change 'Service' to 'Federated' with the value 'cognito-identity.amazonaws.com'.
Federated identity providers require the Federated key rather than the Service key in IAM trust policy statements.
3
Correct the permitted Action in the trust policy.
Change the Action from 'sts:AssumeRole' to 'sts:AssumeRoleWithWebIdentity'.
Exchanging OIDC or web identity federation tokens for temporary AWS credentials requires authorization for the AssumeRoleWithWebIdentity API call.

Anahtar Kavram

IAM Trust Policies for Web Identity Federation
Soru 307Soru →

A developer is creating an IAM role that will be used by an AWS Lambda function to access other AWS resources. The developer needs to ensure that the AWS Lambda service itself is authorized to assume this role. Which type of policy must the developer configure to define which service principal can assume the role?

Cevabı ve açıklamayı göster

Cevap: An IAM trust policy

Cevap

An IAM trust policy
An IAM trust policy (also known as an assume role policy document) defines the trust relationship for an IAM role. It is a resource-based policy attached to the role itself that specifies which security principals (such as the AWS Lambda service principal, 'lambda.amazonaws.com') are allowed to assume the role using the STS AssumeRole API.

Adım Adım Çözüm

1
Identify the goal: granting permission for a service principal (AWS Lambda) to assume an IAM role.
The configuration required is a delegation of trust to a service.
Before a service can act on behalf of a user, it must be trusted to assume the execution role.
2
Differentiate between policy types: trust policies versus permissions policies.
Trust policies specify the principal (who can assume the role), while permissions policies specify the actions and resources (what the role can do).
An IAM role contains both a trust policy and permissions policies.
3
Select the policy type that governs the assume role action.
The trust policy contains the 'AssumeRole' action and designates 'lambda.amazonaws.com' as the trusted principal.
This configuration allows AWS Lambda to assume the execution role and obtain temporary security credentials.

Anahtar Kavram

IAM Trust Policies vs. Permissions Policies
Soru 308Soru →

A developer is configuring a containerized application running on Amazon ECS that needs to access two settings: a public API endpoint URL (non-sensitive configuration) and a database password for an Amazon RDS database. The database password must be rotated automatically every 30 days. To ensure the design is both secure and cost-effective, which configuration should the developer implement?

Cevabı ve açıklamayı göster

Cevap: Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.

Cevap

Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.
The correct configuration uses AWS Systems Manager Parameter Store for non-sensitive parameters like the API endpoint URL, which minimizes costs. It uses AWS Secrets Manager for the database password because Secrets Manager supports native integration with Amazon RDS to automatically rotate the password, fulfilling the security requirement without requiring custom rotation logic.

Adım Adım Çözüm

1
Analyze the sensitivity and lifecycle requirements of both configuration settings.
The API endpoint URL is non-sensitive, static configuration, while the database password is highly sensitive and requires automated rotation every 30 days.
This determines which AWS service is best suited for each parameter to optimize for cost and operational efficiency.
2
Select the appropriate storage service for the non-sensitive configuration.
AWS Systems Manager Parameter Store (String parameter) is selected.
Parameter Store standard parameters are free and ideal for non-sensitive configurations, making this the most cost-effective choice.
3
Select the appropriate storage service and rotation mechanism for the database password.
AWS Secrets Manager is selected, configured with the built-in RDS automatic rotation.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS for automated password rotation, meeting the security and rotation requirements with minimal operational overhead.

Anahtar Kavram

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on sensitivity, automatic rotation requirements, and cost-effectiveness.
Soru 309Soru →

A developer is building a sensitive medical telemetry ingestion application. The application receives health records (each approximately 120 KB120\text{ KB} in size) that must be encrypted client-side using envelope encryption before being stored in Amazon DynamoDB. The developer needs to implement this workflow using the AWS SDK and a customer managed key in AWS KMS.

Which two steps must the developer perform to encrypt and store each health record? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the AWS KMS GenerateDataKey API using the customer managed key to receive both a plaintext data key and an encrypted data key.; Encrypt the health record payload locally using the plaintext data key, erase the plaintext key from memory, and store the encrypted payload along with the encrypted data key in DynamoDB.

Cevap

To secure the payloads, the developer must call the GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the health record locally, and then it is discarded from memory. The encrypted payload and the encrypted data key are then stored together in DynamoDB.
The correct workflow for client-side envelope encryption requires obtaining both a plaintext key and an encrypted key via the GenerateDataKey API. The plaintext key is used to perform the local encryption of the health record, and then it is immediately discarded from memory to prevent exposure. The encrypted data key and the encrypted payload are stored together in the database, allowing authorized users to decrypt the payload by first decrypting the key via KMS.

Adım Adım Çözüm

1
Request a data key from AWS KMS.
The GenerateDataKey API returns a plaintext data key and an encrypted data key (ciphertext).
The plaintext key is required for local encryption, while the encrypted key is stored alongside the encrypted data for future decryption.
2
Encrypt the payload locally and clean up memory.
The 120 KB120\text{ KB} payload is encrypted using the plaintext data key, and the plaintext key is deleted from the application's memory.
This implements client-side envelope encryption and ensures that plaintext keys do not persist in memory, minimizing exposure risk.
3
Save the encrypted assets to Amazon DynamoDB.
The ciphertext payload and the encrypted data key are written to the database.
During decryption, the encrypted data key can be sent back to AWS KMS to retrieve the plaintext key needed to decrypt the payload.

Anahtar Kavram

AWS KMS Envelope Encryption
Tahmini Süre:1m 30s
Soru 310Soru →

A developer is designing a serverless data ingestion application on AWS Lambda. The application requires access to a third-party service API key that must be rotated automatically every 30 days, as well as a non-sensitive database port number that does not change. To minimize cost and operational overhead, which two actions should the developer take to store and manage these parameters? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the API key in AWS Secrets Manager and configure a Lambda function to handle the rotation.; Store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.

Cevap

Store the API key in AWS Secrets Manager with a Lambda rotation function, and store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.
The correct options are to store the API key in AWS Secrets Manager with a Lambda rotation function, and to store the database port in AWS Systems Manager Parameter Store as a Standard parameter. AWS Secrets Manager is appropriate because it supports automatic rotation out-of-the-box. Systems Manager Parameter Store Standard parameters are the correct choice for non-sensitive data because they do not incur a monthly configuration cost.

Adım Adım Çözüm

1
Analyze the requirements for the API key
The API key is highly sensitive and requires automatic rotation every 30 days.
AWS Secrets Manager is designed for storing secrets and provides native integration with AWS Lambda to rotate secrets automatically.
2
Analyze the requirements for the database port number
The database port is non-sensitive and static.
AWS Systems Manager Parameter Store is ideal for storing non-sensitive configuration parameters. Standard parameters are free of charge, helping minimize costs.
3
Select the optimal combination of services to minimize cost and overhead
Use Secrets Manager for the API key to handle automatic rotation, and Parameter Store for the port number to avoid Secrets Manager costs.
This separation aligns with the AWS well-architected best practices of cost optimization and security.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on cost, sensitivity, and automatic rotation requirements.
Soru 311Soru →

An enterprise application running on Amazon EC2 instances in Account A must retrieve database archives from an Amazon S3 bucket located in Account B. The bucket, named `corporate-db-archives`, uses a customer managed key (CMK) in AWS KMS for server-side encryption. The EC2 instances are associated with an IAM role in Account A named `ArchiveReaderRole`. A developer has already attached a permissions policy to `ArchiveReaderRole` that permits S3 read operations on the bucket and KMS decrypt operations on the CMK. Which two resource-based policies in Account B must be updated to successfully authorize this cross-account read operation? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The S3 bucket policy of `corporate-db-archives` to grant S3 read permissions to the IAM role `ArchiveReaderRole` in Account A; The KMS key policy of the CMK to grant decrypt permissions to the IAM role `ArchiveReaderRole` in Account A

Cevap

The correct resource-based policies to update are the S3 bucket policy of the S3 bucket and the KMS key policy of the customer managed key in Account B to grant access to the IAM role in Account A.
For cross-account access to encrypted S3 resources, the resource-based policies in the destination account (Account B) must explicitly authorize the external principal from the source account (Account A). Thus, both the S3 bucket policy must allow the read operations and the KMS key policy must allow the decrypt operations for the external IAM role.

Adım Adım Çözüm

1
Analyze cross-account authorization requirements.
Identify that cross-account access requires explicit permission in both the caller's identity policy and the target resource's resource-based policies.
Unlike same-account access where an identity policy or a resource policy is sufficient, cross-account access requires evaluation and approval from both sides.
2
Determine S3 resource-based policy changes.
Update the S3 bucket policy in Account B to allow the role `ArchiveReaderRole` from Account A to execute read actions.
The bucket policy must authorize the external principal since default cross-account access is denied.
3
Determine KMS key policy changes.
Update the KMS key policy in Account B to allow the role `ArchiveReaderRole` from Account A to perform decrypt operations.
Since the bucket uses a customer managed KMS key for encryption, the caller needs explicit permission on the key policy to decrypt the objects during retrieval.

Anahtar Kavram

Cross-account IAM delegation requires explicit resource-based policy alignment (S3 bucket and KMS key policies) to authorize external principals.
Soru 312Soru →

A developer is implementing a microservice in AWS Account A that needs to securely access a database credential managed in a centralized security AWS Account B. The microservice must access the credential directly without assuming an IAM role in Account B. Which approach should the developer use to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.

Cevap

Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.
The correct approach is to store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret to allow Account A's role to retrieve it, and use a customer managed KMS key that grants cross-account decryption permissions. AWS Secrets Manager supports resource-based policies, enabling direct access from another account without assuming a role. Additionally, default AWS managed KMS keys cannot be shared across accounts, necessitating a customer managed key.

Adım Adım Çözüm

1
Determine the correct service that supports cross-account sharing via resource-based policies.
AWS Secrets Manager is chosen because Systems Manager Parameter Store does not support resource-based policies for cross-account access.
The requirement is to access the credential directly without assuming an IAM role, which requires resource-based authorization on the secret itself.
2
Establish encryption requirements for cross-account access using AWS KMS.
An AWS KMS customer managed key must be used instead of the default AWS managed key (aws/secretsmanager).
Default AWS managed KMS keys cannot be shared across accounts. A customer managed key is required so its key policy can be modified to grant decryption access to the IAM role in Account A.
3
Configure the resource-based policy on the secret.
Attach a resource policy to the Secrets Manager secret allowing the principal from Account A to perform the GetSecretValue action.
This allows the microservice's execution role in Account A to retrieve the secret payload directly.

Anahtar Kavram

Cross-account access capabilities and encryption configurations in AWS Secrets Manager versus Systems Manager Parameter Store.
Soru 313Soru →

A developer is deploying an application to a fleet of Amazon EC2 instances in an Auto Scaling group. The application needs to retrieve two configuration settings: a database password for an Amazon Aurora PostgreSQL database that must be rotated automatically every 30 days, and a non-sensitive external API endpoint URL. The developer wants to minimize operational overhead and cost. Which combination of actions should the developer take to store these configurations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.

Cevap

Store the database password in AWS Secrets Manager with Lambda-based automatic rotation, and store the non-sensitive external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.
Storing the database password in AWS Secrets Manager allows the developer to easily schedule and automate rotation using AWS Lambda. Storing the non-sensitive API endpoint URL as a Standard parameter in Systems Manager Parameter Store is the most cost-effective approach since Parameter Store's Standard tier does not charge for storage or API interactions under normal limits, whereas Secrets Manager charges per secret.

Adım Adım Çözüm

1
Determine the storage for the sensitive database credentials that require rotation.
AWS Secrets Manager is selected because it natively integrates with Amazon Aurora and supports automated rotation through AWS Lambda.
Systems Manager Parameter Store lacks native rotation scheduling.
2
Determine the storage for the non-sensitive configuration endpoint URL.
AWS Systems Manager Parameter Store (Standard tier) is selected.
Standard parameters in Parameter Store have no storage cost, making it the most cost-effective solution for non-sensitive data.

Anahtar Kavram

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation requirements and cost-efficiency.
Tahmini Süre:1m 30s
Soru 314Soru →

A developer is implementing a client-side decryption module for a batch processing application. The application downloads encrypted data archives (each approximately 18 MB18\text{ MB} in size) from an Amazon S3 bucket. Each archive was previously encrypted using envelope encryption with a customer managed key (CMK) in AWS KMS. The encrypted data key is stored alongside the archive in the Amazon S3 object metadata. What sequence of operations must the developer implement in the application to decrypt each archive?

Cevabı ve açıklamayı göster

Cevap: Call the AWS KMS `Decrypt` API passing the encrypted data key to obtain the plaintext data key, use the plaintext data key to decrypt the archive locally, and then erase the plaintext key from memory.

Cevap

Call the AWS KMS Decrypt API passing the encrypted data key to obtain the plaintext data key, use the plaintext data key to decrypt the archive locally, and then erase the plaintext key from memory.
The correct approach is the envelope decryption workflow. The application sends the encrypted data key to the AWS KMS `Decrypt` API. KMS decrypts it and returns the plaintext data key. The application then uses this plaintext key to decrypt the 18 MB18\text{ MB} file locally, and subsequently deletes the plaintext key from memory to minimize security risks.

Adım Adım Çözüm

1
Retrieve the encrypted data key from the S3 object metadata.
The application obtains the encrypted data key needed for decryption.
The encrypted data key is required to be passed as an input to the AWS KMS Decrypt API.
2
Call the `Decrypt` API of AWS KMS, passing the encrypted data key as the CiphertextBlob parameter.
AWS KMS decrypts the key and returns the plaintext data key in the response payload.
Only AWS KMS has the primary key (CMK) necessary to decrypt the encrypted data key.
3
Use the returned plaintext data key to decrypt the 18 MB18\text{ MB} archive locally using a symmetric encryption library.
The archive is successfully decrypted to its plaintext form.
AWS KMS direct operations are limited to 4 KB4\text{ KB}; the actual payload decryption must occur client-side.
4
Erase the plaintext data key from the application memory.
The plaintext key is cleared from the RAM.
This is a critical security best practice to prevent potential memory leaks or exposure of cryptographic keys.

Anahtar Kavram

AWS KMS Envelope Decryption Workflow
Tahmini Süre:1m 30s
Soru 315Soru →

A developer is writing an application that must encrypt a 250 KB250\text{ KB} application configuration file client-side before uploading it to an Amazon S3 bucket. The security policy requires using envelope encryption with an AWS KMS Customer Managed Key (CMK).

Which of the following workflows should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, destroy the plaintext key from memory, and upload the encrypted file along with the encrypted data key to Amazon S3.

Cevap

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key. Use the plaintext data key to encrypt the file locally, destroy the plaintext key from memory, and upload the encrypted file along with the encrypted data key to Amazon S3.
The correct workflow is to call the KMS GenerateDataKey API to retrieve both the plaintext and encrypted data keys. The plaintext key is used to encrypt the 250 KB250\text{ KB} file client-side, after which it is deleted from memory. The encrypted data key is stored alongside the encrypted file in Amazon S3 for future decryption.

Adım Adım Çözüm

1
Generate a unique data key using the Customer Managed Key (CMK) via the AWS KMS GenerateDataKey API.
AWS KMS returns a plaintext data key and a ciphertext data key encrypted by the CMK.
This establishes the cryptographic key material needed for client-side envelope encryption without passing the large file payload over the network to KMS.
2
Encrypt the 250 KB250\text{ KB} configuration file locally using the plaintext data key and a symmetric algorithm (e.g., AES-256), then securely delete the plaintext data key from memory.
The file is encrypted into ciphertext, and the plaintext data key is no longer in local memory.
Encrypting locally handles the large file size which exceeds the KMS direct encryption limit of 4 KB4\text{ KB}, and clearing the plaintext key reduces memory exposure risk.
3
Upload the encrypted configuration file and the ciphertext data key to the Amazon S3 bucket.
Both the encrypted file and the encrypted data key are stored in S3.
Storing the encrypted data key alongside the encrypted file ensures the application can later retrieve the encrypted key and request KMS to decrypt it when reading the file.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow
Tahmini Süre:1m 30s
Soru 316Soru →

A developer is deploying a microservice to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The microservice needs to connect to an Amazon Aurora MySQL database. The database credentials must be rotated automatically every 30 days to comply with organizational security policies. The developer needs to implement a solution that retrieves these credentials securely without hardcoding them or causing application downtime during rotation.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager and enable automatic rotation using the built-in rotation function for Amazon RDS.; Associate an IAM policy that allows the secretsmanager:GetSecretValue action to the ECS Task Role, and retrieve the credentials dynamically using the AWS SDK in the application code.

Cevap

Store the database credentials in AWS Secrets Manager with automatic RDS rotation enabled, and retrieve the credentials dynamically using the AWS SDK in the application code with permissions granted by the ECS Task Role.
To securely manage and rotate database credentials without causing downtime, the credentials should be stored in AWS Secrets Manager. Secrets Manager offers native integration with Amazon RDS to rotate secrets automatically. To access the secret from the container, the application code must query Secrets Manager using the AWS SDK, which requires assigning permissions to the ECS Task Role. Since rotation happens every 30 days, retrieving the credentials dynamically ensures that the application always uses the most current password without requiring task restarts.

Adım Adım Çözüm

1
Choose the correct secrets storage service.
AWS Secrets Manager is selected because the database credentials require automatic rotation and direct RDS integration, which are features native to Secrets Manager and not natively supported by Systems Manager Parameter Store.
This satisfies the security requirement for automatic 30-day rotation without complex custom Lambda logic.
2
Configure the application to retrieve credentials dynamically.
The application code is configured to use the AWS SDK to retrieve the database credentials from Secrets Manager at runtime rather than injecting them via environment variables at startup.
This prevents application downtime and stale credentials when rotation occurs.
3
Assign the appropriate IAM role and policy to the ECS container.
An IAM policy granting the secretsmanager:GetSecretValue permission is attached to the ECS Task Role.
The ECS Task Role is the identity assumed by the application code running inside the container to make AWS SDK calls.

Anahtar Kavram

AWS Secrets Manager vs Systems Manager Parameter Store, and ECS Task Roles vs Task Execution Roles.
Soru 317Soru →

A developer is deploying a containerized application on Amazon ECS using the AWS Fargate launch type. The application is designed to poll an Amazon SQS queue and process incoming messages. The task definition uses the awslogs log driver to send container logs to Amazon CloudWatch Logs. During deployment, the task fails to launch, and the AWS Management Console displays the following error:

ResourceInitializationError: unable to pull secrets or registry auth: execution role does not have permissions to pull from ECR

The developer verifies that two IAM roles are associated with the task definition: ApplicationTaskExecutionRole and ApplicationTaskRole.

Which action must the developer take to resolve the container startup failure and ensure the application can poll the SQS queue once running?

Cevabı ve açıklamayı göster

Cevap: Attach a policy allowing ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to the ApplicationTaskExecutionRole, and attach a policy allowing sqs:ReceiveMessage and sqs:DeleteMessage to the ApplicationTaskRole.

Cevap

Attach ECR pull permissions to the ApplicationTaskExecutionRole, and attach SQS permissions to the ApplicationTaskRole.
The Task Execution Role is utilized by the ECS container agent to perform actions on behalf of the task before the container starts, such as pulling the image from Amazon ECR and writing logs to CloudWatch. The Task Role is assumed by the application running inside the container to make AWS SDK calls, such as polling the Amazon SQS queue. Therefore, ECR permissions must be attached to the Task Execution Role, and SQS permissions must be attached to the Task Role.

Adım Adım Çözüm

1
Analyze the error message from the ECS console.
The error shows that the ECS agent failed to pull the image from ECR due to insufficient permissions on the execution role.
The ECS Task Execution Role is responsible for task lifecycle operations managed by the ECS agent before the containerized application starts.
2
Identify the role needed for application-level AWS API calls.
The application container needs to poll the SQS queue at runtime, which requires SQS permissions.
The ECS Task Role is the role assumed by the containerized application at runtime to make calls to AWS services.
3
Determine the correct permission assignments.
Attach ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to the ApplicationTaskExecutionRole, and sqs:ReceiveMessage/sqs:DeleteMessage to the ApplicationTaskRole.
This adheres to the principle of least privilege and correctly separates container execution agent credentials from runtime application credentials.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role
Tahmini Süre:2m 0s
Soru 318Soru →

An e-commerce backend running on AWS Lambda needs to store sensitive customer profile data in an Amazon RDS database. Due to compliance requirements, the application must encrypt the profile data client-side before sending it to the database. The size of each profile is approximately 350 KB350\text{ KB}.

Which of the following steps must the developer perform in the application code to implement this client-side encryption? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key.; Encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.

Cevap

Call the KMS GenerateDataKey API using a customer managed key to obtain a plaintext data key and an encrypted data key, and encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from memory.
For payloads larger than 4 KB, such as a 350 KB customer profile, developers must use envelope encryption. This involves calling the KMS GenerateDataKey API to obtain both a plaintext data key and an encrypted data key. The plaintext key is used to encrypt the data locally in the application, and is then immediately deleted from memory for security. The encrypted data key is stored alongside the encrypted data.

Adım Adım Çözüm

1
Evaluate payload size limits.
The profile data size is 350 KB. Because this exceeds the 4 KB limit of the KMS Encrypt API, client-side envelope encryption must be used.
Direct KMS encryption APIs are designed for small payloads (under 4 KB).
2
Generate data keys using KMS.
Invoke the KMS GenerateDataKey API, specifying the customer managed key. KMS returns a plaintext data key and an encrypted data key.
The plaintext key is required for local encryption, and the encrypted data key is saved to allow future decryption.
3
Perform local encryption and cleanup.
Encrypt the customer profile data locally using the plaintext data key, and then delete the plaintext data key from application memory.
Encrypting locally secures the data before database transit, and removing the plaintext key from memory protects against memory exposure.

Anahtar Kavram

AWS KMS Envelope Encryption
Tahmini Süre:1m 30s
Soru 319Soru →

A developer is designing a data archival application that needs to encrypt database export files that are approximately 45 MB45\text{ MB} in size before uploading them to an Amazon S3 bucket. The security policy requires client-side envelope encryption using an AWS KMS customer managed key.

Which of the following application workflows satisfies these requirements with the minimum number of AWS KMS API requests?

Cevabı ve açıklamayı göster

Cevap: Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted copy of the data key. Encrypt the database export file using the plaintext data key, discard the plaintext data key from memory, and upload the encrypted file along with the encrypted data key to S3.

Cevap

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted copy of the data key. Encrypt the database export file using the plaintext data key, discard the plaintext data key from memory, and upload the encrypted file along with the encrypted data key to S3.
The correct workflow involves calling the KMS GenerateDataKey API, which returns both the plaintext data key and the encrypted data key in a single API call. The plaintext key is used to encrypt the 45 MB45\text{ MB} file client-side, and then it is immediately discarded from memory for security. The encrypted data key is uploaded to Amazon S3 alongside the encrypted file so that authorized users can decrypt it later by calling the KMS Decrypt API.

Adım Adım Çözüm

1
Determine the file size constraint and the appropriate encryption method.
Since the database export file is 45 MB45\text{ MB}, it exceeds the 4 KB4\text{ KB} limit of the KMS Encrypt API, requiring client-side envelope encryption.
KMS has direct payload limits, meaning large files must be encrypted locally using a symmetric data key generated by KMS.
2
Select the KMS API call that generates both the plaintext and encrypted keys in one request.
GenerateDataKey returns both the plaintext key and the ciphertext key in a single API call.
This minimizes the number of KMS API calls compared to calling GenerateDataKeyWithoutPlaintext followed by Decrypt.
3
Define the client-side encryption and storage workflow.
Encrypt the file with the plaintext key, delete the plaintext key from memory, and upload the encrypted file and encrypted key together.
This ensures the plaintext key is not exposed after encryption, and the encrypted key is available for future decryption operations.

Anahtar Kavram

AWS KMS Envelope Encryption Workflow and API Selection
Tahmini Süre:1m 30s
Soru 320Soru →

A developer is deploying a containerized application to Amazon Elastic Kubernetes Service (Amazon EKS). The application requires access to a database password for an Amazon RDS DB instance and an API key for a third-party service. The database password must be rotated every 30 days. The third-party API key changes infrequently, and the developer wants to access it with minimum latency and cost. Which combination of steps should the developer take to retrieve these configurations securely and cost-effectively? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store and retrieve it via the application.

Cevap

Store the database password in AWS Secrets Manager with Lambda rotation, and store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store.
The correct combination involves storing the database password in AWS Secrets Manager because it natively supports automatic rotation via Lambda, and storing the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter because standard parameters are free and ideal for infrequently changing secrets.

Adım Adım Çözüm

1
Analyze requirements for the database password.
The database password requires automatic rotation every 30 days. AWS Secrets Manager natively supports automatic rotation (using an AWS Lambda function) and is the correct choice.
Parameter Store does not support automated secret rotation natively.
2
Analyze requirements for the third-party API key.
The API key changes infrequently, does not require automated rotation, and must be accessed with minimal cost. AWS Systems Manager Parameter Store (specifically standard SecureString parameters) is free of charge and provides low latency.
Using Secrets Manager for this key would incur unnecessary monthly fees.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation, cost, and lifecycle requirements.
ÖncekiSayfa 16 / 20Sonraki
Security Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 16 | Examkin