DVA-C02 Practice Test 10 — 10 Questions

Question 1

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance.. The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Answer

The Lambda function timeout is set too low for the database query.

Answer

The SAM template does not support RDS as an event source.

Answer

The Lambda function uses a runtime that is not compatible with the MySQL client.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Viewing the application logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Logs can reveal application errors, missing dependencies, or configuration issues. Option D is wrong because SSH may not be configured for the instance, and restarting the web server without understanding the root cause may not resolve the issue. Option B is incorrect because modifying the CloudFormation template to increase instance size does not address health check failures. Option C is incorrect because adding an Application Load Balancer does not fix underlying application problems.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 3

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 4

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?

Accepted Answer

Attach an IAM execution role with CloudWatch Logs permissions.. AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.

Answer

Use AWS KMS to encrypt the log data and grant permissions.

Answer

Create a resource-based policy on the Lambda function.

Answer

Store AWS access keys in environment variables.

Question 5

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.

Question 6

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.

Question 7

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 8

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

Accepted Answer

No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.. AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.

Answer

Enable encryption in the SAM template using the 'Encrypt' property.

Answer

Modify the Lambda function's code to encrypt environment variables before deployment.

Answer

Create a customer managed KMS key and specify it in the SAM template.

Question 9

A developer is deploying a microservices architecture on Amazon ECS with Fargate. Each service needs to store sensitive configuration data such as database passwords. The developer wants to avoid hardcoding secrets in the application code. Which approach should the developer use?

Accepted Answer

Store the secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and reference them in the ECS task definition using the 'secrets' parameter.. AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing sensitive configuration data. By referencing secrets via the `secrets` parameter in the ECS task definition, the secrets are injected into the container at runtime without being exposed in the application code, task definition plaintext, or Docker image. This approach integrates natively with ECS Fargate and supports automatic rotation of secrets.

Answer

Store the secrets in an Amazon S3 bucket and use a pre-signed URL to download them at startup.

Answer

Define the secrets as environment variables in the ECS task definition.

Answer

Encrypt the secrets using AWS KMS and store the encrypted blob in a configuration file within the Docker image.

Question 10

A developer is troubleshooting a CloudFormation stack that fails to create. The stack includes an Auto Scaling group with a launch template. The error message says 'Value (null) for parameter groupId is invalid.' What is the MOST likely cause?

Accepted Answer

The launch template references a SecurityGroupId parameter that is not provided or is misspelled.. The error 'Value (null) for parameter groupId is invalid' indicates that a SecurityGroupId parameter referenced in the launch template is either not provided or misspelled. CloudFormation resolves parameters at stack creation; if the parameter is missing or has a typo, it evaluates to null, causing the launch template to fail validation because a security group ID is required for the network interface.

Answer

The Auto Scaling group does not specify a VPC subnet.

Answer

The Auto Scaling group's user data script contains a syntax error.

Answer

The launch template specifies an invalid key pair name.