AWS Certified Developer – Associate — All Questions

An application needs to let thousands of end users sign in with email or their Google account and then call AWS APIs with scoped permissions. Which combination is appropriate?

• a.Create one IAM user per end user
• b.Use an IAM role shared by all users with wildcard permissions
• c.Embed root account credentials in the app
• d.Amazon Cognito user pools for sign-in plus identity pools to obtain temporary IAM credentials✓

Cognito user pools handle sign-up and sign-in (including social federation) and issue tokens; identity pools exchange those tokens for temporary, scoped IAM credentials. Creating an IAM user per person does not scale, a shared wildcard role violates least privilege, and root credentials must never be embedded.

A developer wants every use of an encryption key to be auditable in CloudTrail and to control the key's rotation policy. Which S3 encryption option meets this?

• a.SSE-KMS with a customer managed key✓
• b.SSE-S3 with Amazon S3 managed keys
• c.Client-side encryption with a static hard-coded key
• d.No encryption with a restrictive bucket policy

A customer managed KMS key lets you set rotation and key policies and logs each encrypt/decrypt call in CloudTrail. SSE-S3 encrypts data but exposes no control or visibility over the key. A bucket policy does not encrypt data, and a hard-coded static key is insecure and unauditable.

A Lambda function returns AccessDenied when writing to a DynamoDB table. Assuming the table exists, what is the most likely cause?

• a.The function timeout is too low
• b.DynamoDB is in a different Availability Zone
• c.The function memory is undersized
• d.The execution role lacks a policy granting dynamodb:PutItem on the table✓

AccessDenied indicates the execution role does not grant the required action (for example dynamodb:PutItem) on the table's ARN. Timeout and memory affect performance, not authorization, and DynamoDB is a regional service, so Availability Zones are not a factor.

How should a developer protect data in transit between a client and an API hosted on API Gateway?

• a.Use a self-signed certificate over HTTP
• b.Rely on security groups only
• c.Disable encryption to reduce latency
• d.Require HTTPS/TLS so traffic is encrypted end to end✓

Requiring HTTPS/TLS encrypts data in transit and is the standard for protecting API traffic; API Gateway endpoints use TLS by default. Disabling encryption or using plain HTTP exposes data, and security groups control network reachability, not encryption of the payload.

A developer needs to grant a container running as an ECS task permission to read from a specific S3 bucket. What is the recommended mechanism?

• a.Make the bucket public
• b.Assign an ECS task role scoped to the required bucket and actions✓
• c.Use the EC2 instance role for all tasks
• d.Bake access keys into the container image

An ECS task role provides temporary credentials scoped to just that task, following least privilege. Baking keys into an image leaks them, sharing the instance role over-grants to every task on the host, and making the bucket public removes access control entirely.