DVA-C02 Practice Test 11 — 15 Questions

Question 1

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

Accepted Answer

Retrieve the secret outside the handler function and cache it in a global variable.. The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.

Answer

Use AWS Systems Manager Parameter Store to store the secret.

Answer

Retrieve the secret inside the handler function every time it is invoked.

Answer

Store the secret in an environment variable.

Question 2

A company uses AWS CodeCommit and wants to automatically trigger a build in AWS CodePipeline when code is pushed to the master branch. Which action should be taken?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline on repository changes. AWS CodePipeline can be configured to automatically start when changes are pushed to a CodeCommit repository by using an Amazon CloudWatch Events rule. The rule listens for CodeCommit repository state changes (e.g., 'ReferenceCreated' or 'ReferenceUpdated' events on the master branch) and targets the pipeline as a CloudWatch Events target, triggering the pipeline execution without polling or manual intervention.

Answer

Add a webhook in CodeCommit to directly invoke CodePipeline

Answer

Set up a scheduled pipeline that polls CodeCommit every minute

Answer

Use an S3 trigger to start the pipeline when code is uploaded

Question 3

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 4

A developer is using Amazon S3 to store application logs. The logs are generated every hour and must be retained for 90 days. After 90 days, the logs should be deleted automatically. Which S3 lifecycle policy should the developer configure?

Accepted Answer

Expire objects after 90 days.. The requirement is to delete logs after 90 days, and the S3 lifecycle 'Expire' action permanently removes objects once they reach the specified age. No transitions are needed since the logs are not required to be stored in a different storage class before deletion.

Answer

Expire objects after 30 days.

Answer

Transition objects to Amazon S3 Glacier after 90 days.

Answer

Transition objects to S3 Standard-IA after 30 days and expire after 90 days.

Question 5

A company's application uses Amazon DynamoDB as its database. The application reads the same item multiple times per second and occasionally sees stale data. The DynamoDB table uses the default eventually consistent reads. What should the developer change to ensure strongly consistent reads?

Accepted Answer

Set the ConsistentRead parameter to true in the GetItem call.. DynamoDB's default read consistency model is eventually consistent, which can return stale data if an item is updated shortly before the read. By setting the `ConsistentRead` parameter to `true` in the `GetItem` call, the developer forces a strongly consistent read, ensuring the response reflects the most recent write. This directly addresses the stale data issue without changing throughput or adding caching.

Answer

Increase the read capacity units of the table.

Answer

Use DynamoDB Accelerator (DAX) to cache the item.

Answer

Use DynamoDB transactions for all read operations.

Question 6

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 7

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

Accepted Answer

Enable caching for the Lambda authorizer responses.. Enabling caching for the Lambda authorizer responses allows API Gateway to reuse the IAM policy returned by the authorizer for subsequent requests that match the same cache key, without invoking the Lambda function again. This eliminates the latency of the authorizer invocation on cache hits, directly addressing the throttling caused by high authorizer latency.

Answer

Use a custom authorizer instead of a Lambda authorizer.

Answer

Reduce the TTL of the authorizer cache.

Answer

Increase the memory allocated to the Lambda authorizer function.

Question 8

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 9

A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?

Accepted Answer

An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.. Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.

Answer

An S3 bucket policy in Account B that allows the IAM user's ARN.

Answer

An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.

Answer

Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.

Question 10

A company uses AWS OpsWorks for configuration management. They want to deploy a new application version to a stack. Which lifecycle event should they use to run deployment scripts?

Accepted Answer

Deploy. The Deploy lifecycle event in AWS OpsWorks is specifically designed to run deployment scripts when you deploy a new application version to a stack. This event occurs after the application code has been installed, allowing you to execute custom scripts for tasks like database migrations, cache clearing, or service restarts. It is the correct choice because it aligns with the deployment phase of the application lifecycle.

Answer

Configure

Answer

Undeploy

Answer

Setup

Question 11

A company has an S3 bucket that contains sensitive data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS. Which combination of actions will enforce this?

Accepted Answer

Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.. A bucket policy that denies PutObject requests when the `x-amz-server-side-encryption` header is not set to `aws:kms` enforces encryption at rest using AWS KMS for all uploads. This policy explicitly rejects any upload that does not include the required KMS encryption header, ensuring compliance with the security team's requirement. Default encryption settings (like SSE-S3 or SSE-KMS) can be overridden by the client, so a bucket policy is the only way to enforce encryption at the API level.

Answer

Configure the bucket to use SSE-S3 by default.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Use a bucket policy that allows only PutObject with KMS encryption.

Question 12

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. API Gateway's built-in request validation allows you to define a JSON Schema model that automatically validates request parameters, headers, and payload before the request reaches the backend Lambda function. This offloads validation from the Lambda function, reducing compute time and cost, and provides immediate 400 error responses without invoking the backend. It is the most efficient approach because it minimizes latency and Lambda invocations for invalid requests.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.

Question 13

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The deployment configuration has a minimum healthy instances setting that is too restrictive.. The error message indicates that the deployment failed because too many instances were unhealthy or failed. The most likely cause is that the deployment configuration's minimum healthy hosts setting is too restrictive, meaning it requires a higher percentage of healthy instances during deployment than the environment can sustain, causing CodeDeploy to stop the deployment when the threshold is breached.

Answer

The CodeDeploy agent is not sending logs to CloudWatch.

Answer

The application's lifecycle hooks are failing during the ApplicationStop event.

Answer

The instances were launched from an AMI that does not have the CodeDeploy agent installed.

Question 14

Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?

Accepted Answer

The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.. The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Therefore, the user is denied access to objects under the 'secret/' prefix, including s3://my-bucket/secret/config.txt. Option D is correct. Option A is incorrect because the explicit Deny overrides any bucket policy allow. Option B is incorrect because the Deny applies to all s3 actions, including s3:GetObject, and is scoped to the 'secret/' prefix. Option C is incorrect because the Allow statement does not grant access to the 'secret/' prefix; the Deny overrides it.

Answer

The user is denied access only if the bucket policy also denies access.

Answer

The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.

Answer

The user can download the object because the Allow statement grants s3:GetObject on the bucket.

Question 15

An application uses Amazon Cognito user pools for authentication. A developer wants to restrict access to an API Gateway endpoint to only authenticated users from a specific user pool. What is the best approach?

Accepted Answer

Use a Cognito User Pool authorizer in API Gateway.. A Cognito User Pool authorizer in API Gateway is the native, fully managed way to restrict access to an API endpoint to authenticated users from a specific user pool. It automatically validates the JWT token issued by the user pool and caches the result, requiring no custom code. This approach integrates directly with API Gateway's authorization flow, ensuring only tokens from the specified user pool are accepted.

Answer

Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

Answer

Use an API Gateway resource policy that allows access only from the Cognito user pool.

Answer

Use a Lambda authorizer that validates the JWT token against the user pool.