Examkin

Security

390 soru

Tüm türler390Çoktan seçmeli195Çoklu seçim195
Soru 61Soru →

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. The application needs to perform read and write operations on an Amazon DynamoDB table. Additionally, the ECS agent must pull the container image from a private Amazon ECR repository and send container startup logs to Amazon CloudWatch Logs.

To satisfy these security requirements using the principle of least privilege, how should the developer configure the IAM roles?

Cevabı ve açıklamayı göster

Cevap: Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.

Cevap

Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.
The correct configuration uses two distinct roles to enforce the principle of least privilege. The ECS Task Role is designated for credentials needed by the application itself running inside the container (e.g., calling DynamoDB APIs). The ECS Task Execution Role is designated for actions performed by the Amazon ECS container agent (e.g., pulling the Docker image from Amazon ECR and sending container logs to Amazon CloudWatch). Specifying both correctly in the task definition allows the containerized workload to execute securely.

Adım Adım Çözüm

1
Analyze the container application permissions needs.
The application inside the container makes API requests to write and read from DynamoDB.
These application-level permissions must be mapped to the ECS Task Role.
2
Analyze the infrastructure and agent permissions needs.
The ECS Fargate agent needs to pull images from ECR and write system/startup logs to CloudWatch.
These agent-level infrastructure permissions must be mapped to the ECS Task Execution Role.
3
Map roles to the ECS task definition parameters.
Assign the DynamoDB role to taskRoleArn, and the ECR/CloudWatch role to executionRoleArn.
This separation follows AWS security best practices for container permissions.

Anahtar Kavram

ECS Task Role vs ECS Task Execution Role separation of duties
Soru 62Soru →

A developer is setting up an Amazon EventBridge rule to route custom application events to an Amazon Kinesis Data Firehose delivery stream. The developer creates an IAM role named `EventBridgeToFirehoseRole` to allow EventBridge to put records into the delivery stream. The IAM role has the following trust policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "firehose.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

The permissions policy attached to the role is:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"firehose:PutRecord",
"firehose:PutRecordBatch"
],
"Resource": "arn:aws:firehose:us-east-1:123456789012:deliverystream/my-stream"
}
]
}

However, when events are triggered, EventBridge fails to send the events to the delivery stream. Which of the following changes will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.

Cevap

Update the IAM role trust policy to list events.amazonaws.com as the service principal instead of firehose.amazonaws.com.
The correct option is to update the trust policy because Amazon EventBridge is the service initiating the action and needs to assume the IAM role to put records into the Kinesis Data Firehose delivery stream. The trust policy governs which security principal is allowed to assume the role. Listing firehose.amazonaws.com in the trust policy is a common mistake that incorrectly trusts the destination service instead of the invoking service.

Adım Adım Çözüm

1
Identify which AWS service principal needs to assume the role to perform the action.
Amazon EventBridge (events.amazonaws.com) is the service triggering the rule and needs to write to the Firehose delivery stream.
The service invoking the target must be the one granted permission to assume the execution role.
2
Inspect the role's trust policy to verify the trusted entity.
The current trust policy lists firehose.amazonaws.com as the trusted entity.
A misconfigured trust policy will prevent the calling service (EventBridge) from assuming the role to perform downstream tasks.
3
Modify the trust policy to trust the correct calling service principal.
Change the principal service from firehose.amazonaws.com to events.amazonaws.com.
This allows EventBridge to assume the role and use the permissions granted in the permissions policy to write to Kinesis Firehose.

Anahtar Kavram

IAM Trust Policies vs. Permissions Policies
Soru 63Soru →

A developer is deploying an AWS Lambda function that reads incoming user data from an Amazon Kinesis data stream. The developer creates an IAM role with a permissions policy allowing the necessary Kinesis read actions. However, the Lambda function fails to retrieve data, and the logs indicate that the Lambda service is unauthorized to assume the configured execution role.

The trust policy attached to the IAM role is shown below:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "kinesis.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

How should the developer resolve this issue to allow the Lambda function to execute and read from the stream?

Cevabı ve açıklamayı göster

Cevap: Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.

Cevap

Change the service principal in the trust policy to "lambda.amazonaws.com" to allow the Lambda service to assume the execution role.
To resolve the assumption failure, the trust policy of the execution role must specify lambda.amazonaws.com as the trusted service principal. This grants the AWS Lambda service the permission to assume the role and perform actions on behalf of the function.

Adım Adım Çözüm

1
Analyze the error logs and trust policy of the execution role.
The log states the Lambda service is unauthorized to assume the role, and the trust policy lists 'kinesis.amazonaws.com' as the service principal.
Understanding why the assumption failed requires verifying the trust relationship configuration.
2
Identify the service principal that needs to assume the role.
The Lambda service itself ('lambda.amazonaws.com') is responsible for assuming the execution role and running the function code.
The trust policy must grant the service running the resource the permission to call 'sts:AssumeRole'.
3
Update the trust policy's principal block.
Change 'kinesis.amazonaws.com' to 'lambda.amazonaws.com'.
This grants the Lambda service the permission to assume the execution role natively.

Anahtar Kavram

IAM trust policies define which entities (accounts, users, or AWS services) are trusted to assume an IAM role, while IAM permissions policies define what actions the assumed role can perform.
Soru 64Soru →

A developer is configuring an AWS Lambda function in Account A (123456789012123456789012) to write data to an Amazon DynamoDB table in Account B (210987654321210987654321). The developer wants to use a cross-account IAM role named `DynamoDBWriterRole` in Account B to perform the DynamoDB operations. The Lambda function runs under an execution role named `LambdaExecutionRole` in Account A. Which two configurations are required to establish this cross-account trust and allow the Lambda function to write to the table? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A trust policy attached to the role in Account B that specifies the Lambda execution role in Account A as the principal and allows the sts:AssumeRole action.; An IAM permissions policy attached to the Lambda execution role in Account A that allows the sts:AssumeRole action on the Amazon Resource Name (ARN) of the role in Account B.

Cevap

To configure cross-account access, the developer must attach a trust policy to the role in Account B that lists the Lambda execution role in Account A as a principal and allows the sts:AssumeRole action. In addition, the developer must attach an IAM permissions policy to the Lambda execution role in Account A allowing the sts:AssumeRole action on the target role's ARN in Account B.
Establishing cross-account delegation requires both sides to agree: the target role's trust policy in Account B must trust the calling IAM entity in Account A, and the calling identity in Account A must be granted permission in its identity policy to assume that target role.

Adım Adım Çözüm

1
Configure the trust relationship on the target role in Account B.
The target role (DynamoDBWriterRole) trust policy is updated to permit the Lambda execution role ARN in Account A to perform sts:AssumeRole.
This establishes that the role in Account B trusts the specific entity in Account A to assume it.
2
Add permissions to the source Lambda execution role in Account A.
The Lambda execution role in Account A is granted identity-based permissions to call sts:AssumeRole on the ARN of DynamoDBWriterRole.
The entity in the source account must have permissions to initiate the AssumeRole call.
3
Implement the sts:AssumeRole API call in the Lambda function code.
The Lambda function uses the AWS SDK to retrieve temporary security credentials and uses them to write to the DynamoDB table.
This allows the function to execute operations with the authorization level of the target role in Account B.

Anahtar Kavram

Cross-account IAM Role Delegation
Tahmini Süre:2m 0s
Soru 65Soru →

A developer is configuring an AWS CodeBuild project in Account 111111111111111111111111 that must retrieve database configuration credentials from AWS Systems Manager Parameter Store in Account 222222222222222222222222. The developer creates an IAM role named CrossAccountParamReaderRole in Account 222222222222222222222222 with permission to read the parameters.

The CodeBuild project's service role in Account 111111111111111111111111 has permissions to assume CrossAccountParamReaderRole. However, during the build phase, the CodeBuild build fails with an AccessDenied error when executing the assume-role CLI command.

The trust policy for CrossAccountParamReaderRole in Account 222222222222222222222222 is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "codebuild.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy in Account 222222222222222222222222 will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.

Cevap

Update the Principal block of the trust policy to reference Account 111111111111111111111111 or the specific CodeBuild service role ARN instead of the CodeBuild service principal.
To allow an IAM identity (such as a role or user) from another AWS account to assume an IAM role, the target role's trust policy must specify that external account or the specific IAM identity as a trusted principal. The original trust policy only trusts the regional AWS CodeBuild service principal within the same account (Account 222222222222222222222222). Updating the Principal block to trust Account 111111111111111111111111 (or the specific CodeBuild service role in Account 111111111111111111111111) permits the STS AssumeRole request to succeed.

Adım Adım Çözüm

1
Identify the type of policy configuration error.
The current trust policy only trusts the regional 'codebuild.amazonaws.com' service within its own account (Account 222222222222222222222222).
For cross-account access, a trust policy must explicitly trust the external account or the specific identity attempting to assume the role.
2
Select the correct Principal modification.
Changing the Principal to target Account 111111111111111111111111 or the specific CodeBuild service role ARN allows the delegation of authority.
This establishes the trust boundary between the two AWS accounts so that sts:AssumeRole calls from Account 111111111111111111111111 are accepted.

Anahtar Kavram

IAM trust policies vs identity-based policies in cross-account access
Soru 66Soru →

A developer is configuring a local application to access an Amazon DynamoDB table in an AWS account. To comply with security best practices, the application must run locally by assuming an IAM role named DbAccessRole using temporary credentials. The developer has a local AWS CLI profile named dev-user configured with IAM user credentials.

Which two actions must the developer take to configure the application to assume the role?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user.; Configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.

Cevap

Define a new profile in the local ~/.aws/config file, specifying the role_arn of DbAccessRole and setting the source_profile to dev-user. Also, configure the trust policy of DbAccessRole to allow the sts:AssumeRole action for the ARN of the dev-user IAM user.
The correct configuration requires both configuring the target role to trust the specific IAM user, and setting up the local CLI configuration to chain the profiles. Specifying the role_arn and source_profile in ~/.aws/config tells the AWS SDK or CLI to use the credentials from the source profile to call sts:AssumeRole for the target role. The target role's trust policy must list the IAM user as a principal and allow the sts:AssumeRole action.

Adım Adım Çözüm

1
Configure the IAM role trust relationship.
The role DbAccessRole is configured to trust the dev-user IAM user.
Before any principal can assume an IAM role, that principal must be explicitly trusted by the role's trust policy via the sts:AssumeRole action.
2
Configure the local AWS configuration profile.
A profile in ~/.aws/config is created that links the credentials profile to the target role.
Using the ~/.aws/config profile chaining mechanism allows the AWS CLI and SDKs to automatically handle the sts:AssumeRole API call and manage the lifecycle of temporary credentials without hardcoding secrets.

Anahtar Kavram

IAM role assumption requires a trust policy specifying the trusted principal, and client applications can use profile chaining in the local configuration to automatically retrieve temporary credentials.
Soru 67Soru →

A developer is configuring an AWS Lambda function to process messages from an Amazon SQS queue using an event source mapping. The Lambda function has an execution role with the following permissions policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"sqs:ReceiveMessage",
"sqs:DeleteMessage"
],
"Resource": "arn:aws:sqs:us-east-1:123456789012:ProcessQueue"
}
]
}

When the developer attempts to create the event source mapping, the operation fails with an error indicating that the Lambda function does not have sufficient permissions to read from the queue.

Which of the following actions should the developer take to successfully configure the event source mapping?

Cevabı ve açıklamayı göster

Cevap: Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.

Cevap

Add the "sqs:GetQueueAttributes" action to the statement in the Lambda execution role's permissions policy.
The correct answer is correct because AWS Lambda requires the `sqs:GetQueueAttributes` permission in addition to `sqs:ReceiveMessage` and `sqs:DeleteMessage` to set up and manage an SQS event source mapping successfully. This permission allows Lambda to read parameters such as the visibility timeout and approximate message count.

Adım Adım Çözüm

1
Analyze the error and permissions required for SQS event source mapping.
Identify that Lambda requires three permissions to poll SQS: ReceiveMessage, DeleteMessage, and GetQueueAttributes.
The Lambda service needs to query the queue parameters to scale polling and read messages properly.
2
Compare the current policy with the required permissions list.
The current permissions policy allows only sqs:ReceiveMessage and sqs:DeleteMessage, and is missing sqs:GetQueueAttributes.
This comparison identifies the missing permission cause of the configuration failure.
3
Select the resolution to append the missing permission.
Add the 'sqs:GetQueueAttributes' action to the existing IAM policy attached to the Lambda execution role.
This updates the permissions policy to grant all necessary access for the event source mapping.

Anahtar Kavram

Permissions required for SQS event source mappings in Lambda execution roles
Tahmini Süre:1m 30s
Soru 68Soru →

A developer is configuring an AWS Lambda function with the execution role `arn:aws:iam::123456789012:role/MyLambdaExecutionRole`. The Lambda function needs to temporarily assume a different IAM role named `arn:aws:iam::123456789012:role/TargetReportingRole` to perform analytical reporting. During execution, the Lambda function code calls the AWS Security Token Service (AWS STS) `AssumeRole` API but fails with an `AccessDenied` error. Which of the following configurations are required to successfully allow this role assumption? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A permission policy attached to MyLambdaExecutionRole that allows the sts:AssumeRole action on the TargetReportingRole resource; A trust policy on TargetReportingRole that allows the principal MyLambdaExecutionRole to perform the sts:AssumeRole action

Cevap

To allow the Lambda function to assume the target role, you must attach a permission policy to the Lambda execution role allowing the sts:AssumeRole action on the target role's ARN, and configure the target role's trust policy to trust the Lambda execution role.
For an IAM entity to assume an IAM role, two conditions must be met: the caller's identity-based policy must explicitly allow the sts:AssumeRole action on the target role's resource ARN, and the target role's trust policy must list the caller's role ARN as a trusted principal for the sts:AssumeRole action.

Adım Adım Çözüm

1
Authorize the caller (Lambda execution role)
The Lambda execution role is granted identity-based permissions to call the sts:AssumeRole action targeting the TargetReportingRole ARN.
The entity initiating the role assumption must be permitted by its own policies to perform the assumption action.
2
Configure trust on the destination (TargetReportingRole)
The trust policy of TargetReportingRole is modified to list the Lambda execution role ARN as a trusted principal for the sts:AssumeRole action.
An IAM role must explicitly define and trust the identities that are permitted to assume it.

Anahtar Kavram

IAM role assumption requires a two-way configuration: permissions on the caller (identity-based policy) and trust on the receiver (trust policy).
Soru 69Soru →

A developer is designing a secure file upload utility for a containerized microservice. The utility must encrypt files up to 100 MB100\text{ MB} locally before uploading them to an Amazon S3 bucket named `my-app-data`. To comply with strict security and auditing guidelines, the solution must satisfy the following requirements:

1. Ensure that plaintext data keys are never persisted or stored in any AWS service.
2. Prevent unauthorized decryption if the encrypted files are copied to a different S3 bucket.
3. Minimize AWS KMS API calls to avoid rate-limiting/throttling and control costs.
4. Record all cryptographic key usage in AWS CloudTrail for auditing.

Which KMS API workflow and architecture meets these requirements?

Cevabı ve açıklamayı göster

Cevap: Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.

Cevap

Call the KMS `GenerateDataKey` API using the Customer Managed Key (CMK), passing `{"Bucket": "my-app-data"}` as the `EncryptionContext`. Use the returned plaintext data key to encrypt the file locally using a symmetric encryption library, immediately delete the plaintext key from memory, and upload the encrypted file to S3 with the ciphertext data key stored in the object's user-defined metadata.
The correct workflow uses `GenerateDataKey` with an `EncryptionContext` of the target bucket. This generates both the plaintext key (needed to perform the encryption locally) and the ciphertext key. The plaintext key is used to encrypt the payload and is immediately discarded. The ciphertext key is stored in the object's S3 metadata. Binding the bucket name via `EncryptionContext` ensures that if the object is copied to another bucket, decryption will fail because the context won't match the new bucket name.

Adım Adım Çözüm

1
Request a data key from KMS with bucket context.
Receive both a plaintext data key and a ciphertext data key cryptographically bound to the bucket name via `EncryptionContext`.
This establishes the client-side envelope encryption workflow and enforces the security boundary constraint.
2
Encrypt the file payload locally.
The file is encrypted using a local symmetric library (like AES-GCM) with the plaintext data key.
This keeps encryption client-side, handles payloads larger than the KMS 4 KB direct encryption limit, and reduces network latency.
3
Secure memory and prepare metadata.
The plaintext data key is purged from the application's memory, leaving only the ciphertext data key.
This minimizes the lifetime of the plaintext key in memory, satisfying the security requirements.
4
Upload the encrypted file and metadata.
The encrypted file is uploaded to the S3 bucket, with the ciphertext data key stored in S3 metadata.
This keeps the encrypted payload and its decryptable key together, allowing decryption later only if the exact bucket context is provided to the KMS Decrypt API.

Anahtar Kavram

AWS KMS Client-Side Envelope Encryption and EncryptionContext Bindings
Tahmini Süre:3m 0s
Soru 70Soru →

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API must authenticate users who are managed in an external identity provider that supports OpenID Connect (OIDC). The requirements specify that the solution must minimize custom code, validate the JSON Web Token (JWT) at the API Gateway layer, and securely pass user attributes—such as custom groups—to the backend Lambda function for fine-grained authorization. Additionally, the client application must not need to manage or sign requests with temporary AWS credentials.

Which architecture should the developer implement to meet these requirements with the least administrative effort?

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito User Pool federated with the external OIDC provider. Set up an API Gateway Cognito Authorizer that points to the Cognito User Pool. In the API Gateway Method Request, set the Authorization header. In the backend Lambda function, extract the user attributes from the request's context event under the authorizer claims.

Cevap

Configure an Amazon Cognito User Pool federated with the external OIDC provider, set up an API Gateway Cognito Authorizer pointing to the user pool, and extract the user attributes from the request's context event under the authorizer claims in the backend Lambda function.
The correct solution uses an Amazon Cognito User Pool federated with the external OIDC provider. This configuration allows API Gateway to leverage the built-in Cognito Authorizer, which handles token validation at the gateway edge. Verified claims are automatically passed to the Lambda function in the request context event, eliminating custom validation code and client-side request signing.

Adım Adım Çözüm

1
Analyze the token validation requirements and identity source.
The identity source is an external OIDC provider, and token validation must happen at the API Gateway layer.
This establishes that the API Gateway layer should handle validation, narrowing options to authorizers that natively validate OIDC/JWT tokens.
2
Evaluate native authorization options versus client-side overhead.
Using a Cognito Identity Pool requires IAM authorization and Signature Version 4 signing by the client, which violates the requirement to avoid client-side credentials management.
A Cognito User Pool with a Cognito Authorizer validates OIDC-derived tokens natively at the API Gateway edge, avoiding client-side request signing.
3
Verify custom code and claim transmission constraints.
A custom Lambda authorizer requires manual signature validation and parsing, violating the goal to minimize custom code. In contrast, the Cognito Authorizer automatically passes validated claims to the backend Lambda integration's request context.
This confirms that a federated Cognito User Pool combined with a native Cognito Authorizer is the most efficient, low-code solution.

Anahtar Kavram

API Gateway Cognito User Pool Authorizer integration for federated OIDC authentication.
Soru 71Soru →

A developer is deploying a containerized application to Amazon ECS on AWS Fargate using the following task definition snippet:

{
"containerDefinitions": [
{
"name": "app-container",
"image": "111122223333.dkr.ecr.us-east-1.amazonaws.com/my-app:latest",
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/my-app",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
}
}
],
"taskRoleArn": "arn:aws:iam::111122223333:role/MyTaskRole",
"executionRoleArn": "arn:aws:iam::111122223333:role/MyExecutionRole"
}

The application code inside the container must read and delete messages from an Amazon SQS queue. The ECS agent must pull the private container image from Amazon ECR and send container logs to Amazon CloudWatch Logs.

Which of the following configurations must the developer perform to grant the necessary permissions? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyTaskRole role.; Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyExecutionRole role.

Cevap

Attach SQS permissions to the task role (MyTaskRole) and attach ECR and CloudWatch Logs permissions to the task execution role (MyExecutionRole).
The configuration attaching SQS permissions to the task role is correct because the application code inside the container runs under the task role's context. The configuration attaching ECR and CloudWatch permissions to the task execution role is correct because the ECS agent needs these permissions to pull the image and send logs before/during the container runtime.

Adım Adım Çözüm

1
Analyze the permission requirements of the application code running inside the container.
The application code reads and deletes SQS messages, which means it requires permissions for `sqs:ReceiveMessage` and `sqs:DeleteMessage` attached to the role that the application container assumes, which is the ECS Task Role (`taskRoleArn`).
The Task Role provides AWS credentials directly to the containerized application.
2
Analyze the permission requirements of the Amazon ECS container agent.
The ECS agent needs to authenticate with ECR, pull container images, and write logs to CloudWatch Logs. This requires `ecr:GetAuthorizationToken`, `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, and `logs:PutLogEvents` permissions attached to the ECS Task Execution Role (`executionRoleArn`).
The Task Execution Role provides AWS credentials to the ECS container agent to perform infrastructure/management tasks on behalf of the container.
3
Evaluate the correct service principal for the trust relationship of the roles.
Both the Task Role and Task Execution Role must trust the `ecs-tasks.amazonaws.com` service principal so that the ECS container agent can assume these roles.
Using `ecs.amazonaws.com` is incorrect as it is for the ECS service scheduler, not individual tasks.

Anahtar Kavram

Division of responsibility between ECS Task Role and ECS Task Execution Role
Soru 72Soru →

A software developer is writing a data reconciliation script that runs on AWS Lambda. The script must retrieve credentials from AWS Secrets Manager and query a PostgreSQL database hosted on an Amazon RDS instance that resides in the private subnets of a custom VPC. The Lambda function must run inside the custom VPC to connect to the database. Security policies require that all network traffic between the Lambda function, the database, and AWS Secrets Manager remains entirely within the VPC.

Which of the following actions should the developer take to establish secure and functional network connectivity for the Lambda function? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the Lambda function to connect to the private subnets of the VPC, and create an Interface VPC Endpoint for AWS Secrets Manager with Private DNS enabled.; Configure the security group of the Amazon RDS instance to allow inbound database traffic from the security group assigned to the Lambda function.

Cevap

The correct actions are: configuring the Lambda function to connect to the private subnets of the VPC while creating an Interface VPC Endpoint for AWS Secrets Manager, and configuring the security group of the Amazon RDS instance to allow inbound traffic from the Lambda function's security group.
To connect the Lambda function to the database securely, the function must reside in the same VPC private subnets. An Interface VPC Endpoint (PrivateLink) for AWS Secrets Manager is required to allow the function to call Secrets Manager APIs over private IP addresses. Additionally, the RDS security group must explicitly allow inbound traffic from the security group associated with the Lambda function.

Adım Adım Çözüm

1
Determine the network placement for the Lambda function.
The Lambda function must be associated with the private subnets of the VPC to route traffic to the RDS instance in the same private subnets.
VPC-connected Lambda functions need to be in subnets that have a network path to the resources they need to access.
2
Set up secure connection to AWS Secrets Manager.
Create an Interface VPC Endpoint (AWS PrivateLink) for Secrets Manager in the VPC subnets with Private DNS enabled.
This allows the Lambda function to resolve the Secrets Manager DNS name to a private IP within the VPC, ensuring traffic does not traverse the public internet.
3
Configure Security Group rules for RDS.
Add an inbound rule to the RDS security group that permits traffic on the database port (e.g., port 5432 for PostgreSQL) from the security group attached to the Lambda function.
Security groups act as a firewall at the resource level, and this rule is required to permit the inbound connection from the Lambda function.

Anahtar Kavram

VPC Security for Developers
Tahmini Süre:2m 30s
Soru 73Soru →

A development team is building a mobile application for a bicycle-sharing service. The app allows users to log in using their social media accounts. The backend services expose a REST API hosted on Amazon API Gateway, backed by AWS Lambda. Additionally, the mobile app needs to upload user-generated profile photos directly to a private Amazon S3 bucket without routing the files through the application's backend.

Which two architectural steps should the developer take to implement authentication, API authorization, and secure S3 uploads with the least amount of custom code?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints.; Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.

Cevap

Establish a user directory using Cognito User Pools, and deploy a built-in Cognito Authorizer on the API Gateway to secure the endpoints. Link a Cognito Identity Pool to the user directory to obtain temporary AWS credentials, enabling the mobile client to upload photos to the S3 bucket.
The correct solution uses Cognito User Pools for user authentication and secures the API Gateway REST API with the built-in Cognito Authorizer to minimize custom code. It then utilizes a Cognito Identity Pool linked to the User Pool to vend temporary AWS credentials, allowing the mobile application to upload profile photos directly to the private S3 bucket without passing through backend servers.

Adım Adım Çözüm

1
Set up a user directory with Cognito User Pools to manage social identity federation and authentication.
Users are authenticated, and the mobile client receives identity and access tokens (JWTs).
This establishes user identities and allows built-in integration with external social providers.
2
Configure a built-in Cognito Authorizer on the API Gateway REST API.
API Gateway automatically validates the JWT signature and expiration before allowing requests to proceed to the Lambda backend.
This secures the API endpoints with minimal custom code by leveraging native API Gateway integrations.
3
Deploy a Cognito Identity Pool and link it to the User Pool as an identity provider, granting authenticated users an IAM role with write permissions to the S3 bucket.
The mobile app can exchange User Pool tokens for temporary AWS IAM credentials, allowing direct and secure uploads to S3.
This satisfies the requirement to write directly to S3 without routing files through backend servers.

Anahtar Kavram

Combining Cognito User Pools for user authentication/API authorization with Cognito Identity Pools for AWS resource access (S3 direct upload).
Soru 74Soru →

A developer is configuring a containerized application running in AWS Batch. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL database that must be rotated every 30 days, and an API key for a partner service that is static and does not require rotation. The developer wants to minimize costs while maintaining high security.

Which actions should the developer take to configure the storage for these secrets? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager and enable automatic rotation using the built-in AWS Lambda rotation template for Amazon Aurora.; Store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.

Cevap

Store the database password in AWS Secrets Manager with automatic rotation enabled, and store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database password requires automatic rotation, which is a native feature of AWS Secrets Manager. The partner API key is static and does not require rotation, making Systems Manager Parameter Store (SecureString) the most cost-effective and secure choice.

Adım Adım Çözüm

1
Identify the rotation requirement for the database password.
Since the Aurora PostgreSQL database password requires automatic rotation every 30 days, AWS Secrets Manager should be selected because it natively supports automatic rotation via built-in AWS Lambda templates for RDS.
AWS Systems Manager Parameter Store does not support native automatic rotation.
2
Identify the rotation and cost requirements for the partner API key.
Since the partner API key is static, does not require rotation, and the goal is to minimize costs, AWS Systems Manager Parameter Store (specifically a SecureString parameter) should be selected.
AWS Secrets Manager charges a monthly fee per secret, making it less cost-effective than Parameter Store for static configurations, while SecureString parameters provide the same level of encryption.

Anahtar Kavram

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs and cost efficiency.
Tahmini Süre:1m 0s
Soru 75Soru →

A developer is configuring an AWS Lambda function in AWS account 987654321098987654321098 to retrieve data from an Amazon S3 bucket. The function is assigned an IAM role named `LambdaS3ReaderRole`. The developer has already attached a permissions policy to this role that allows `s3:GetObject` on the target bucket. However, when the Lambda function runs, it fails with an authorization error indicating that the AWS Lambda service is not authorized to assume the role.

The developer inspects the trust policy of `LambdaS3ReaderRole` and finds the following configuration:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::my-app-data-bucket/*"
}
]
}

Which modification to the trust policy is required to resolve this error?

Cevabı ve açıklamayı göster

Cevap: Change the Action element to "sts:AssumeRole" and remove the Resource element.

Cevap

Change the Action element to "sts:AssumeRole" and remove the Resource element.
Changing the Action element to "sts:AssumeRole" and removing the Resource element is correct because an IAM role's trust policy governs who is trusted to assume the role. It must use the "sts:AssumeRole" action with the trusted service principal ("lambda.amazonaws.com") as the principal. The specific resource actions (such as "s3:GetObject") must be defined in the permissions policy attached to the role, not the trust policy.

Adım Adım Çözüm

1
Analyze the error message and the current trust policy structure.
The Lambda service cannot assume the execution role because the trust policy's Action is set to "s3:GetObject" instead of a valid STS assume role action.
An IAM role's trust policy must specify an action that allows trust delegation (specifically "sts:AssumeRole" for AWS services).
2
Differentiate between the role's trust policy and its permissions policy.
The trust policy determines who can assume the role (the Lambda service principal), while the permissions policy determines what actions the assumed role can perform (S3 object retrieval).
Mixing permission actions like "s3:GetObject" and resource restrictions into the trust policy prevents the role from being assumed and violates the structural constraints of trust documents.
3
Correct the trust policy elements.
The Action element is updated to "sts:AssumeRole" and the Resource element is removed (since trust policies do not target external resources like S3 buckets).
This establishes the necessary trust link between the AWS Lambda service and the execution role, allowing execution to succeed.

Anahtar Kavram

Distinction between IAM Trust Policies and Permissions Policies
Tahmini Süre:2m 0s
Soru 76Soru →

A developer is configuring a backend application running on an Amazon EC2 instance to send application logs to Amazon CloudWatch Logs. The developer creates an IAM role named `EC2LoggingRole` with the following permissions policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "arn:aws:logs:us-east-1:123456789012:log-group:AppServerLogs:*"
}
]
}

During testing, the application fails to write to CloudWatch Logs with authorization errors. Which two configuration steps must the developer perform to resolve this issue and securely grant permissions to the application? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure the trust policy of `EC2LoggingRole` to allow the `ec2.amazonaws.com` service principal to perform the `sts:AssumeRole` action.; Create an IAM instance profile, add `EC2LoggingRole` to it, and attach the instance profile to the EC2 instance.

Cevap

Configure the trust policy of the IAM role to allow the Amazon EC2 service principal to assume it, and associate the role with the instance by using an IAM instance profile.
The correct configuration requires defining a trust policy that permits the EC2 service principal to assume the role via the `sts:AssumeRole` action. Additionally, an IAM instance profile must be created to link the IAM role to the EC2 instance, allowing the AWS SDK on the instance to automatically retrieve temporary credentials from the Instance Metadata Service (IMDS).

Adım Adım Çözüm

1
Configure the trust relationship of the IAM role.
The IAM role's trust policy is updated to explicitly trust the EC2 service principal (`ec2.amazonaws.com`).
This allows the Amazon EC2 service to assume the IAM role and obtain temporary credentials on behalf of the application.
2
Create and attach an IAM instance profile.
An IAM instance profile containing the role is attached to the EC2 instance.
Unlike other services such as Lambda, EC2 instances require an intermediate container (the instance profile) to deliver temporary credentials to the instance metadata service (IMDS).

Anahtar Kavram

To grant AWS resource access to applications running on Amazon EC2 instances, you must configure a trust relationship on the IAM role for the EC2 service principal (`ec2.amazonaws.com`) and attach the role via an IAM instance profile.
Soru 77Soru →

A developer is writing an AWS Lambda function that programmatically launches an Amazon EC2 instance using the AWS SDK. The EC2 instance requires an IAM role to access an Amazon S3 bucket. The developer has created the EC2 IAM role `EC2AccessS3Role` and an associated instance profile.

The Lambda function runs under an execution role with the following identity-based policy:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"ec2:RunInstances",
"ec2:DescribeInstances"
],
"Resource": "*"
}
]
}

When the Lambda function executes the code to launch the instance with the instance profile, the API call fails with a `Client.UnauthorizedOperation` error.

Which of the following actions will resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Add the `iam:PassRole` permission to the Lambda function's execution role policy, specifying the ARN of the `EC2AccessS3Role` as the resource.

Cevap

The developer should add the `iam:PassRole` permission to the Lambda function's execution role, specifying the ARN of the EC2 IAM role as the resource.
The correct answer is to add the `iam:PassRole` permission to the Lambda execution role. To associate an IAM role with an EC2 instance during launch, the calling identity (the Lambda function) must have the `iam:PassRole` permission for the specific role being passed. This ensures that the user or service cannot escalate privileges by passing a role they are not authorized to use.

Adım Adım Çözüm

1
Identify the action being performed when the error occurs.
The Lambda function is calling `ec2:RunInstances` and passing an IAM role (via an instance profile) to the EC2 instance.
The Lambda execution role has permission to run instances but fails with an unauthorized error when attempting to associate the role.
2
Apply the concept of delegation of permissions in AWS.
When an AWS service or user passes an IAM role to an AWS service, it requires the `iam:PassRole` permission.
AWS enforces the `iam:PassRole` permission to prevent users/services from passing roles with higher privileges than they themselves possess.
3
Configure the IAM policy.
Add an inline or managed policy to the Lambda execution role that allows `iam:PassRole` on the ARN of the EC2 role.
This allows the Lambda function's execution role to successfully delegate the EC2 role to the newly created EC2 instance.

Anahtar Kavram

IAM PassRole Permission
Soru 78Soru →

A developer is building a web application that uses Amazon Cognito User Pools for user authentication and Amazon API Gateway REST APIs for the backend. The developer needs to restrict access to a specific API resource so that only users who have a custom user attribute `custom:membership` set to `Gold` can access it. The client application must be able to call the API by passing the Cognito ID token in the `Authorization` header, without having to sign the requests using AWS Signature Version 4. Which solution should the developer implement to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.

Cevap

Create a custom API Gateway Lambda authorizer that decodes the Cognito ID token, verifies its signature, validates the custom membership claim value, and returns an IAM policy to allow or deny the request.
The correct solution uses a custom API Gateway Lambda authorizer to decode the Cognito ID token, verify its signature, and inspect the custom membership claim value. Because Cognito ID tokens are JSON Web Tokens (JWTs) that carry custom user attributes in their payload, the Lambda authorizer can perform this check offline without calling Cognito APIs, and then return the appropriate IAM policy to allow or deny access. This achieves the desired authorization logic without requiring the client to perform Signature Version 4 signing.

Adım Adım Çözüm

1
Select the API Gateway Lambda authorizer pattern over the built-in Cognito User Pool authorizer.
Enables inspection of custom claims such as custom attributes, which the built-in Cognito authorizer cannot evaluate for custom routing logic.
Built-in Cognito authorizers are limited to token validation and scope checks, making them unsuitable for fine-grained authorization based on custom attributes.
2
Configure the Lambda authorizer to decode and validate the token locally.
Ensures the token is authentic by checking the signature against Cognito's public keys, verifying expiration, and extracting user attributes directly from the payload.
Decoding the token locally prevents slow and rate-limited API calls (like AdminGetUser) to Cognito, optimizing performance and avoiding throttling.
3
Generate and return an IAM policy based on the custom membership claim value.
Returns an IAM Allow policy if the claim value is Gold, or Deny policy otherwise.
API Gateway uses the returned IAM policy to permit or block access to the backend integration.

Anahtar Kavram

Fine-grained API Gateway authorization using Cognito ID token claims with a custom Lambda Authorizer.
Soru 79Soru →

A developer is building a containerized microservice deployed on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The microservice requires access to:

1. A sensitive API key for a third-party SaaS service that requires scheduled rotation every 3030 days.
2. A non-sensitive log level configuration setting (e.g., INFO, DEBUG) that varies between development and production environments.

Which combination of actions should the developer take to configure these parameters securely and cost-effectively? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic.; Store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.

Cevap

Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic, and store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.
For the sensitive third-party API key, storing it in AWS Secrets Manager allows the developer to configure an AWS Lambda function to handle the required custom 3030-day rotation logic. For the non-sensitive log level configuration, AWS Systems Manager Parameter Store is a cost-effective and simple solution that avoids unnecessary Secrets Manager costs.

Adım Adım Çözüm

1
Analyze secret rotation requirements
Identify that the third-party API key requires automated rotation every 3030 days, which is a native feature of AWS Secrets Manager using a custom AWS Lambda function.
Parameter Store does not offer built-in secret rotation schedules, making Secrets Manager the appropriate choice for the API key.
2
Analyze non-sensitive configuration requirements
Identify that the log level setting is non-sensitive and varies per environment, which maps perfectly to AWS Systems Manager Parameter Store String parameters.
Using Parameter Store for non-sensitive data is cost-effective (no cost for standard parameters) compared to AWS Secrets Manager.

Anahtar Kavram

Selecting between AWS Secrets Manager and AWS Systems Manager Parameter Store based on sensitivity and rotation requirements.
Soru 80Soru →

A developer is building a multi-tenant SaaS administration portal. The portal must allow enterprise users to authenticate via their corporate SAML Identity Provider (IdP). Once authenticated, the portal needs to make authorized REST API calls to Amazon API Gateway, where access is controlled based on the user's groups. Additionally, the portal must allow the client application to directly upload diagnostic log files to a tenant-specific folder in a private Amazon S3 bucket.

Which TWO actions should the developer take to implement authentication and authorization for this portal?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Create an Amazon Cognito User Pool integrated with the SAML IdP to manage user authentication, and configure an Amazon API Gateway Cognito authorizer to secure the REST API using the ID token.; Create an Amazon Cognito Identity Pool associated with the User Pool, and map the authenticated user identity to an IAM role that grants write permissions to the tenant-specific S3 folder.

Cevap

To implement authentication and authorization, the developer must create a User Pool integrated with the SAML IdP and use an API Gateway Cognito authorizer, while also using an Identity Pool to obtain temporary credentials for S3 uploads.
The correct architecture uses a Cognito User Pool for federating with the SAML IdP and managing user login. The ID tokens issued by the User Pool are verified by the API Gateway Cognito authorizer to protect the API. The Identity Pool then exchanges the User Pool tokens for temporary, scoped IAM credentials, enabling the client application to directly upload logs to Amazon S3 securely.

Adım Adım Çözüm

1
Configure the authentication layer by creating an Amazon Cognito User Pool.
Allows integration with the external corporate SAML Identity Provider (IdP) to authenticate users and generate standard OIDC tokens (ID and access tokens).
This establishes the identity directory and federates corporate authentication.
2
Secure the Amazon API Gateway REST API endpoints using the Cognito User Pool.
Configuring a Cognito authorizer on the REST API resources validates the ID token passed in the Authorization header.
This enforces API authorization based on Cognito groups and claims without custom Lambda code.
3
Set up the authorization layer for external AWS resources by creating an Amazon Cognito Identity Pool.
Links the Identity Pool to the User Pool as an authentication provider, mapping users to specific IAM roles.
This generates temporary AWS credentials required for direct S3 API interaction from the client web application.

Anahtar Kavram

Amazon Cognito User Pools vs Identity Pools integration with API Gateway and S3
ÖncekiSayfa 4 / 20Sonraki
Security Alıştırma Soruları — AWS Certified Developer - Associate — Sayfa 4 | Examkin