DVA-C02 Practice Test 13 — 15 Questions

Question 1

A developer has written an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has 10,000 messages waiting to be processed. What will happen when the Lambda function is invoked?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lambda will process messages with a maximum of 5 concurrent executions, each processing a batch of messages.. AWS Lambda integrates with Amazon SQS to poll the queue and invoke the function with batches of messages. The reserved concurrency of 5 caps the maximum number of concurrent executions, so Lambda will process messages with up to 5 concurrent invocations, each receiving a batch of up to 10 messages (default batch size). The remaining messages remain in the queue until they are processed or the visibility timeout expires.

Answer

Lambda will automatically increase reserved concurrency to handle the load.

Answer

Lambda will reject the invocation because reserved concurrency is too low.

Answer

Lambda will scale up to 20 concurrent executions to process all messages quickly.

Question 2

A company uses AWS CodePipeline with a manual approval step before deployment. The developer wants to ensure that if a pipeline execution is waiting for approval and new code is pushed, the awaiting execution is canceled and a new one starts with the latest code. Which pipeline execution mode should be configured?

Accepted Answer

Superseded. The Superseded execution mode is correct because it automatically cancels any currently running or waiting pipeline execution when a new one is triggered, ensuring that only the latest code proceeds through the pipeline. This is ideal for scenarios with manual approval steps where stale executions should not block or delay the deployment of the most recent commit.

Answer

Queued

Answer

Parallel

Answer

Single

Question 3

A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which THREE factors could cause this denial?

Accepted Answer

An explicit deny statement in the bucket policy.. Option B is correct because an explicit Deny in a bucket policy always overrides any Allow in an identity-based policy, so a Deny on s3:ListBucket would block the user regardless of other permissions. Option D is correct because a permissions boundary sets the maximum permissions an IAM user can have; if s3:ListBucket is not within the boundary, the effective permissions cannot include it even if an identity policy allows it. Option E is correct because s3:ListBucket must be explicitly granted in an identity-based policy (or another applicable policy) for the user to list the bucket, and its absence results in an implicit deny. Option A is not correct because S3 bucket access is not restricted by the user's default region; region only affects endpoint routing, not authorization. Option C is not correct because KMS encryption affects access to object data via kms:Decrypt, not the s3:ListBucket permission itself.

Answer

The bucket is in a different region than the user's default region.

Answer

The bucket is encrypted with AWS KMS.

Question 4

A developer is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for database credentials. The developer wants to ensure that the credentials are encrypted at rest and rotated automatically. Which solution meets these requirements with minimal effort?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the application code. Configure automatic rotation.. AWS Secrets Manager is the correct choice because it provides built-in automatic rotation of secrets (including database credentials) with minimal configuration, and it encrypts secrets at rest using AWS KMS. The developer can retrieve the credentials at runtime via the AWS SDK, avoiding hardcoding or plaintext exposure. Elastic Beanstalk environment properties do not offer encryption at rest or rotation, and while Parameter Store SecureString parameters encrypt at rest, they lack native automatic rotation without additional custom logic.

Answer

Hardcode the credentials in the application code and use environment variables for different environments.

Answer

Store the credentials in AWS Systems Manager Parameter Store as SecureString parameters and reference them in the application code.

Answer

Use Elastic Beanstalk environment properties to set the credentials as plaintext environment variables.

Question 5

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

Accepted Answer

Retrieve the secret outside the handler function and cache it in a global variable.. The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.

Answer

Use AWS Systems Manager Parameter Store to store the secret.

Answer

Retrieve the secret inside the handler function every time it is invoked.

Answer

Store the secret in an environment variable.

Question 6

A company uses AWS CodeCommit and wants to automatically trigger a build in AWS CodePipeline when code is pushed to the master branch. Which action should be taken?

Accepted Answer

Configure a CloudWatch Events rule to start the pipeline on repository changes. AWS CodePipeline can be configured to automatically start when changes are pushed to a CodeCommit repository by using an Amazon CloudWatch Events rule. The rule listens for CodeCommit repository state changes (e.g., 'ReferenceCreated' or 'ReferenceUpdated' events on the master branch) and targets the pipeline as a CloudWatch Events target, triggering the pipeline execution without polling or manual intervention.

Answer

Add a webhook in CodeCommit to directly invoke CodePipeline

Answer

Set up a scheduled pipeline that polls CodeCommit every minute

Answer

Use an S3 trigger to start the pipeline when code is uploaded

Question 7

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 8

A developer is using Amazon S3 to store application logs. The logs are generated every hour and must be retained for 90 days. After 90 days, the logs should be deleted automatically. Which S3 lifecycle policy should the developer configure?

Accepted Answer

Expire objects after 90 days.. The requirement is to delete logs after 90 days, and the S3 lifecycle 'Expire' action permanently removes objects once they reach the specified age. No transitions are needed since the logs are not required to be stored in a different storage class before deletion.

Answer

Expire objects after 30 days.

Answer

Transition objects to Amazon S3 Glacier after 90 days.

Answer

Transition objects to S3 Standard-IA after 30 days and expire after 90 days.

Question 9

A company's application uses Amazon DynamoDB as its database. The application reads the same item multiple times per second and occasionally sees stale data. The DynamoDB table uses the default eventually consistent reads. What should the developer change to ensure strongly consistent reads?

Accepted Answer

Set the ConsistentRead parameter to true in the GetItem call.. DynamoDB's default read consistency model is eventually consistent, which can return stale data if an item is updated shortly before the read. By setting the `ConsistentRead` parameter to `true` in the `GetItem` call, the developer forces a strongly consistent read, ensuring the response reflects the most recent write. This directly addresses the stale data issue without changing throughput or adding caching.

Answer

Increase the read capacity units of the table.

Answer

Use DynamoDB Accelerator (DAX) to cache the item.

Answer

Use DynamoDB transactions for all read operations.

Question 10

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 11

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

Accepted Answer

Enable caching for the Lambda authorizer responses.. Enabling caching for the Lambda authorizer responses allows API Gateway to reuse the IAM policy returned by the authorizer for subsequent requests that match the same cache key, without invoking the Lambda function again. This eliminates the latency of the authorizer invocation on cache hits, directly addressing the throttling caused by high authorizer latency.

Answer

Use a custom authorizer instead of a Lambda authorizer.

Answer

Reduce the TTL of the authorizer cache.

Answer

Increase the memory allocated to the Lambda authorizer function.

Question 12

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 13

A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?

Accepted Answer

An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.. Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.

Answer

An S3 bucket policy in Account B that allows the IAM user's ARN.

Answer

An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.

Answer

Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.

Question 14

A company uses AWS OpsWorks for configuration management. They want to deploy a new application version to a stack. Which lifecycle event should they use to run deployment scripts?

Accepted Answer

Deploy. The Deploy lifecycle event in AWS OpsWorks is specifically designed to run deployment scripts when you deploy a new application version to a stack. This event occurs after the application code has been installed, allowing you to execute custom scripts for tasks like database migrations, cache clearing, or service restarts. It is the correct choice because it aligns with the deployment phase of the application lifecycle.

Answer

Configure

Answer

Undeploy

Answer

Setup

Question 15

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. API Gateway's built-in request validation allows you to define a JSON Schema model that automatically validates request parameters, headers, and payload before the request reaches the backend Lambda function. This offloads validation from the Lambda function, reducing compute time and cost, and provides immediate 400 error responses without invoking the backend. It is the most efficient approach because it minimizes latency and Lambda invocations for invalid requests.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.