Security
Free AWS Certified Developer - Associate practice — 6 questions on Security, with explanations. No sign-up. Full 12-question mixed test →
A SaaS vendor's application assumes an IAM role in each customer's AWS account by calling sts:AssumeRole against a role ARN the customer creates. Security review flags a potential 'confused deputy' risk: if the role ARN or trust relationship is guessed or misconfigured, the vendor's application could be tricked into assuming a role belonging to a different customer than intended. What should the vendor implement to mitigate this risk?
The ExternalId condition is AWS's documented mechanism specifically for the third-party/confused deputy problem: the trust policy requires sts:ExternalId to match a customer-specific secret value, so even if a role ARN leaks or is guessed, AssumeRole fails without the correct ExternalId tied to that specific customer relationship.
A mobile app authenticates users against an Amazon Cognito User Pool and receives an ID token and access token (JWTs) after login. The app must now call S3 PutObject directly from the device using temporary AWS credentials scoped to that user via IAM. Which additional Cognito component is required to obtain those temporary AWS credentials?
User Pools handle authentication and issue JWTs, but they do not grant AWS credentials. An Identity Pool (Federated Identity) is required to exchange the User Pool's ID token for temporary IAM credentials via STS, allowing the app to call AWS services like S3 directly.
A developer needs to encrypt a 500 MB file client-side using AWS KMS before uploading it to S3. The KMS Encrypt API has a data size limit that makes it unsuitable for encrypting the file directly. What is the correct envelope encryption workflow using the AWS Encryption SDK or SDK KMS calls?
This is the standard envelope encryption pattern: GenerateDataKey returns both a plaintext data key (used locally for fast symmetric encryption of large data) and a KMS-encrypted copy of that key. The plaintext key must be discarded from memory after use, and only the encrypted data key is persisted with the ciphertext, to be decrypted later via KMS Decrypt.
A financial services company's compliance policy states that AWS must never generate, store, or manage the master encryption key material used to protect a specific S3 bucket's objects — the customer's own key management system must retain full custody of the key at all times, while S3 still performs the actual server-side encrypt/decrypt operation on upload and download. Which S3 encryption option satisfies this requirement?
With SSE-C, the customer supplies the encryption key with every PutObject/GetObject request over HTTPS. S3 uses that key to perform the server-side encryption/decryption but does not store the key itself — it is discarded immediately after the operation completes, satisfying the requirement that S3/KMS never retains custody of key material.
An application stores an RDS MySQL database credential and requires it to rotate automatically every 30 days with zero application downtime, without any code redeployment when the password changes. Which approach correctly satisfies this requirement?
Secrets Manager natively supports automatic rotation with prebuilt Lambda rotation functions for RDS (single-user and multi-user rotation templates), managing the AWSCURRENT/AWSPENDING version staging so the database and secret stay in sync with zero downtime. As long as the app always retrieves the secret via GetSecretValue rather than caching it indefinitely, no redeploy is needed.
A company wants to require that a highly privileged 'ProductionAdmin' IAM role can only be assumed by users who have authenticated with multi-factor authentication (MFA) in their current session. Which trust policy configuration correctly enforces this?
The trust policy (the resource-based policy attached to the role, which defines who can assume it) supports condition keys like aws:MultiFactorAuthPresent. Setting this condition to 'true' on the sts:AssumeRole action ensures STS only issues temporary credentials for the role when the calling principal's session was established with MFA.
Ready for the real thing?
The full course: two full-length practice tests, video lessons for every exam domain, hands-on labs and detailed explanations.
$109.99 $34.99 with code FREETEST33 — valid through September 19.
Get my $34.99 deal →