DVA-C02 Practice Test 14 — 15 Questions

Question 1

A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.

Answer

IAM authorizer

Answer

Amazon Cognito user pools authorizer

Answer

API Gateway resource policy

Question 2

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?

Accepted Answer

Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }. The `Null` condition operator checks whether the `aws:MultiFactorAuthPresent` key is absent or explicitly set to `false`. When set to `false`, it denies API calls that were made without MFA, effectively enforcing MFA for all API operations. Option E is correct because the `Bool` condition operator with `true` requires that MFA was used, but it must be combined with a `Deny` effect to block unauthenticated requests; used alone in an `Allow` statement, it only permits MFA-authenticated calls without blocking non-MFA ones.

Answer

Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }

Answer

Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }

Answer

Condition: { "StringEquals": { "iam:ResourcePath": "/" } }

Question 3

A developer is writing a script to programmatically create an Amazon EC2 instance. The script will run on an EC2 instance that already has an IAM role attached. Which AWS SDK method should the developer use to securely obtain temporary credentials for the script?

Accepted Answer

Retrieve the temporary credentials from the instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).. The instance metadata endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/ provides temporary, automatically rotated credentials for the IAM role attached to the EC2 instance. The AWS SDK's default credential provider chain automatically checks this endpoint, but explicitly retrieving from the metadata service is a valid and secure method when you need direct access to the credentials, such as for use with non-AWS tools or custom signing logic.

Answer

Store the access key ID and secret access key in the script.

Answer

Use AWS Secrets Manager to store and retrieve the credentials.

Answer

Use the AWS SDK's default credential provider chain.

Question 4

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a highly available environment across multiple Availability Zones. The developer wants to update the application without any downtime while minimizing the number of new instances launched. Which deployment policy should the developer use?

Accepted Answer

Rolling with additional batch. (Rolling with additional batch) is correct because it launches a new batch of instances before taking the old ones out of service, ensuring full capacity is maintained during the deployment. This provides high availability across multiple Availability Zones while minimizing the number of new instances compared to an immutable deployment, which would double the instance count. The additional batch absorbs the traffic during the rolling update, preventing any downtime.

Answer

All at once

Answer

Rolling

Answer

Immutable

Question 5

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Accepted Answer

Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.. CodePipeline and Elastic Beanstalk must be in the same AWS region for the pipeline to locate the application version. When the Source stage stores the artifact in an S3 bucket in a different region, the Deploy stage cannot find the version in Elastic Beanstalk, which expects the artifact to be in the same region. This cross-region mismatch causes the 'version of the application to be deployed could not be found' error. Option E is also correct because the IAM role for CodePipeline must have permissions to read from the S3 bucket and to deploy to Elastic Beanstalk. Without these permissions, the pipeline cannot access the artifact or perform the deployment, leading to the 'could not be found' error.

Answer

Make sure the source artifact is a valid zip file containing the application code and environment configuration.

Answer

Confirm that the S3 object key does not contain special characters.

Answer

Verify that the S3 bucket name is exactly as specified in the pipeline.

Question 6

A developer is deploying a Lambda function that processes messages from an SQS queue. The queue has a batch size of 10. To optimize cost and performance, the developer wants to minimize the number of Lambda invocations while ensuring that all messages are processed within the SQS visibility timeout. Which configuration should the developer use?

Accepted Answer

Set the Lambda function timeout to less than the SQS visibility timeout.. Setting the Lambda function timeout to less than the SQS visibility timeout ensures that the function completes (success or failure) before the message visibility timeout expires. This prevents the message from becoming visible again while the function is still running, which would cause duplicate invocations. If the function fails, the message remains in the queue and becomes visible again after the original visibility timeout, allowing for reprocessing without overlapping executions. This configuration keeps the number of invocations to one per batch for successful processing and avoids unintended duplicates, rather than adding extra retries.

Answer

Increase the SQS visibility timeout to 5 minutes and set Lambda timeout to 5 minutes.

Answer

Configure the Lambda function to process messages asynchronously.

Answer

Set the Lambda reserved concurrency to 1 to limit concurrent executions.

Question 7

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. An Application Load Balancer (ALB) is required for blue/green deployments on Amazon ECS with AWS CodeDeploy because it routes traffic between the 'blue' (current) and 'green' (new) task sets. CodeDeploy uses the ALB's target groups to shift traffic incrementally during the deployment, enabling zero-downtime updates. Without an ALB, there is no mechanism to direct production traffic to the new task set while keeping the old one available for rollback.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 8

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a relational database. The developer wants to ensure that the database is not accidentally deleted when the Elastic Beanstalk environment is terminated. Which approach should the developer take?

Accepted Answer

Create the RDS instance outside of Elastic Beanstalk and configure the application to connect to it using environment variables.. Creating the RDS instance outside of Elastic Beanstalk decouples the database lifecycle from the environment lifecycle. When the Elastic Beanstalk environment is terminated, the external RDS instance remains intact and is not deleted. The application can connect to it using environment variables configured in the Elastic Beanstalk environment, ensuring persistence of data.

Answer

Create the database as part of the Elastic Beanstalk environment by adding an RDS database configuration in the .ebextensions.

Answer

Use an Amazon DynamoDB table instead of a relational database.

Answer

Configure a retention policy on the RDS instance within the Elastic Beanstalk environment.

Question 9

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a relational database. Which THREE components are created by Elastic Beanstalk when you add a database to your environment?

Accepted Answer

A DB subnet group. When you add a database to an Elastic Beanstalk environment, Elastic Beanstalk automatically creates a DB subnet group, an Amazon RDS DB instance, and a security group for the database. The CloudFormation stack is already created as part of the environment's infrastructure, not specifically when adding the database. DynamoDB is not used for relational databases.

Answer

An AWS CloudFormation stack

Answer

An Amazon DynamoDB table

Question 10

A developer needs to allow an IAM user to perform only specific actions on an S3 bucket. Which type of policy should be attached to the IAM user?

Accepted Answer

An IAM policy. An IAM policy (Option D) is the correct choice because it is an identity-based policy that can be directly attached to an IAM user, group, or role to grant or deny permissions for specific actions on AWS resources, including S3 buckets. This allows the developer to precisely control which S3 actions (e.g., s3:GetObject, s3:PutObject) the user can perform on a particular bucket, meeting the requirement of limiting the user to specific actions.

Answer

A service control policy

Answer

A bucket policy

Answer

A trust policy

Question 11

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent errors where some requests return HTTP 503 (Service Unavailable) errors. The developers have verified that the application code is healthy and the EC2 instances pass health checks. The ALB health check is configured to hit a specific endpoint (/health) with a healthy threshold of 2 and an unhealthy threshold of 2. The health check interval is 30 seconds, and the timeout is 5 seconds. The application's /health endpoint sometimes takes up to 6 seconds to respond due to a dependency on a third-party service. The developers want to minimize the 503 errors without changing the application code. Which action should the developer take?

Accepted Answer

Increase the health check timeout to 10 seconds to accommodate the slow /health endpoint.. The correct action is to increase the health check timeout from 5 seconds to 10 seconds. Since the /health endpoint sometimes takes up to 6 seconds to respond, the current timeout of 5 seconds causes the ALB to consider the instance unhealthy, leading to 503 errors. By increasing the timeout, the ALB will wait longer for a response, reducing unnecessary health check failures. Option B is wrong because decreasing the unhealthy threshold would make instances even more sensitive, increasing 503 errors. Option C is wrong because deregistration delay affects connection draining during instance termination, not health check behavior. Option D is wrong because decreasing the health check interval does not help; the issue is timeout, not frequency.

Answer

Decrease the unhealthy threshold to 1 so that instances are marked unhealthy after one failed health check.

Answer

Increase the deregistration delay to 300 seconds to allow connections to drain.

Answer

Decrease the health check interval to 10 seconds to detect health changes faster.

Question 12

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During rolling updates of the Auto Scaling group, users intermittently receive HTTP 502 (Bad Gateway) errors. The developer checks the ALB access logs and notices that requests are being routed to instances that are in the 'Draining' state. The ALB has connection draining enabled with a timeout of 30 seconds. The Auto Scaling group terminates instances after they are taken out of service. What is the most likely cause of the 502 errors?

Accepted Answer

The connection draining timeout is too short, causing the ALB to terminate connections before in-flight requests finish.. The 502 errors occur because the ALB's connection draining timeout of 30 seconds is too short to allow all in-flight requests to complete before the Auto Scaling group terminates the instances. When an instance enters the 'Draining' state, the ALB stops sending new requests but waits up to the draining timeout for existing connections to finish. If the timeout expires before requests complete, the ALB forcibly closes connections, resulting in HTTP 502 (Bad Gateway) errors for clients whose requests were still in progress.

Answer

The health check interval is set too long, causing the ALB to consider unhealthy instances as healthy.

Answer

Cross-zone load balancing is disabled, so the ALB is routing requests to instances that are already draining.

Answer

The Auto Scaling group's minimum size is too small, causing the ALB to have no healthy targets.

Question 13

A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime and roll forward if successful. They have two environments: a production environment (current version) and a staging environment (new version). After verifying the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?

Accepted Answer

Blue/green deployment with environment CNAME swap. Blue/green deployment with an environment CNAME swap allows you to run two separate Elastic Beanstalk environments (production and staging) simultaneously. After verifying the new version in the staging environment, you swap the CNAME records so that the production URL points to the staging environment, achieving zero downtime and a roll-forward strategy. This approach decouples the deployment from the existing environment, ensuring no disruption to live traffic during the swap.

Answer

All at once deployment

Answer

Rolling deployment with additional batch

Answer

Immutable deployment

Question 14

An application running on Amazon ECS (Fargate) uses an Application Load Balancer (ALB) with connection draining enabled. The application is experiencing intermittent 502 (Bad Gateway) errors during rolling updates of the ECS service. The developer notices that the ALB is routing requests to tasks that are in the 'Draining' state. The ECS service is configured with a deployment circuit breaker that automatically rolls back a failed deployment. What is the most likely cause of the 502 errors?

Accepted Answer

The application is not handling the SIGTERM signal from ECS, causing it to terminate abruptly while the ALB still routes traffic to it.. When ECS sends a SIGTERM signal to a Fargate task during a rolling update, the task is expected to gracefully shut down. If the application does not handle SIGTERM, it terminates immediately, but the ALB may still have the task registered as a target and continue routing requests to it. Since the task is already dead or unresponsive, the ALB receives no valid HTTP response and returns a 502 Bad Gateway error. Connection draining is enabled, but it only works if the task signals the ALB that it is deregistering; without proper SIGTERM handling, the task dies before the draining process completes.

Answer

The ALB's idle timeout is too short, causing connections to be dropped before the application responds.

Answer

The ALB's connection draining timeout is set to 0 seconds, causing connections to be dropped immediately when deregistering targets.

Answer

The ECS deployment circuit breaker is incorrectly configured to roll back on health check failures.

Question 15

A developer is deploying a multi-container Docker application on Amazon ECS using the Fargate launch type. The application consists of a web server and a background worker. The web server must be scaled independently and must be accessible from the internet via an Application Load Balancer. The worker should not be accessible from the internet. Which ECS configuration should the developer use?

Accepted Answer

Create two separate ECS services, each with its own task definition, and place the web server in a public subnet with the worker in a private subnet.. It uses two separate ECS services, each with its own task definition, allowing independent scaling of the web server and worker. Placing the web server in a public subnet with an Application Load Balancer makes it internet-accessible, while the worker in a private subnet is isolated from direct internet traffic, meeting the security requirement.

Answer

Create one ECS service with both containers in the same task definition, but only expose the web server port.

Answer

Create one ECS service with two tasks, each containing one container.

Answer

Create one ECS service with two containers in the same task, and use a service discovery to expose the worker.