DVA-C02 Practice Test 15 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 2

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

Accepted Answer

The Lambda function must send a response to an S3 pre-signed URL.. AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.

Answer

The Lambda function must be defined in the same CloudFormation template.

Answer

The Lambda function must return a JSON object with the desired output.

Answer

The Lambda function must be written in Python.

Question 3

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 4

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

Accepted Answer

Increase the Lambda function's memory allocation. Increasing the Lambda function's memory allocation is the most cost-effective way to reduce execution time for a CPU-bound function because Lambda allocates CPU proportionally to memory. More memory means more vCPU capacity, which directly speeds up CPU-bound processing. This reduces the function's duration, and since Lambda billing is based on compute time (GB-seconds), the total cost can decrease even if the per-GB-second rate is higher.

Answer

Increase the SQS batch window size

Answer

Switch the Lambda runtime from Python to Node.js

Answer

Enable Provisioned Concurrency for the function

Question 5

A developer is writing a Lambda function that processes records from a Kinesis stream. The function must handle duplicate records and ensure exactly-once processing. Which approach should the developer use?

Accepted Answer

Use a unique identifier for each record and store processed IDs in a DynamoDB table to skip duplicates.. Exactly-once processing in a Kinesis-triggered Lambda function requires idempotency. By using a unique identifier (e.g., Kinesis sequence number or a business key) and storing processed IDs in a DynamoDB table, the function can check for duplicates before processing each record. This pattern ensures that even if Kinesis delivers the same record multiple times (due to retries or shard rebalancing), the record is only processed once.

Answer

Disable retries in the Lambda function to avoid processing duplicates.

Answer

Enable record ordering in the Kinesis stream.

Answer

Send the records to an SQS FIFO queue for deduplication.

Question 6

A developer is deploying a web application using AWS Elastic Beanstalk. The application experiences high traffic during peak hours. The developer wants to ensure that the environment can scale out quickly without manual intervention. Which Elastic Beanstalk configuration should be used?

Accepted Answer

Configure Auto Scaling triggers based on CloudWatch alarms.. Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on demand. By configuring Auto Scaling triggers that respond to CloudWatch alarms (e.g., CPU utilization > 70%), the environment can scale out quickly and without manual intervention during peak hours.

Answer

Use a scheduled scaling action to increase capacity during peak hours.

Answer

Manually add EC2 instances during peak hours.

Answer

Set the environment to use a fixed number of EC2 instances.

Question 7

A developer is designing a REST API using Amazon API Gateway that experiences high traffic with many repeated requests for the same data. The developer wants to reduce backend load and improve response times. Which feature should the developer enable on the API Gateway method?

Accepted Answer

Enable API Gateway caching. API Gateway caching stores responses from backend endpoints for a configurable Time-to-Live (TTL). When a request for the same data arrives, API Gateway serves the cached response directly without invoking the backend, reducing load and improving latency. This is the most straightforward and managed solution for repeated requests at the API layer.

Answer

Implement caching in the Lambda function using a local cache

Answer

Use an Amazon ElastiCache Redis cluster and modify the Lambda function to check the cache first

Answer

Place an Amazon CloudFront distribution in front of API Gateway

Question 8

A developer is building an application that uses Amazon DynamoDB as a data store. The application reads the same item frequently but writes rarely. The developer wants to reduce read costs. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Since the application reads the same item frequently but writes rarely, DAX can serve repeated read requests from its cache, significantly reducing the number of read capacity units consumed against the DynamoDB table and thus lowering read costs.

Answer

DynamoDB Global Tables

Answer

DynamoDB Auto Scaling

Answer

Time to Live (TTL)

Question 9

A developer attached the IAM policy above to an IAM user. The user reports being unable to list objects in the bucket 'my-bucket' using the AWS CLI command 'aws s3 ls s3://my-bucket/'. What is the most likely reason?

Accepted Answer

The IAM policy does not include the s3:GetBucketLocation action.. The `aws s3 ls s3://my-bucket/` command requires the `s3:GetBucketLocation` permission to determine the bucket's region before listing its contents. Without this action, the CLI fails with an error like 'An error occurred (AccessDenied) when calling the GetBucketLocation operation', even if `s3:ListBucket` is granted. Option D correctly identifies this missing permission as the root cause.

Answer

The IAM policy does not allow the s3:GetObject action on the bucket.

Answer

The IAM policy resource for s3:ListBucket should include the bucket and objects.

Answer

The IAM policy is missing the s3:ListAllMyBuckets action.

Question 10

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

Question 11

A developer is using AWS CodeBuild to compile and package a Java application. The build process takes longer than expected. The developer wants to speed up the build by reusing dependencies that have not changed between builds. Which feature should the developer enable?

Accepted Answer

Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage. AWS CodeBuild caching allows you to persist dependencies (e.g., Maven .m2 repository, Gradle caches) between builds. By specifying an S3 bucket as the cache storage, CodeBuild uploads the cache after a successful build and downloads it at the start of subsequent builds, avoiding re-downloading unchanged dependencies. This significantly reduces build time for Java applications.

Answer

Configure the build project to run builds concurrently

Answer

Enable build artifacts in the CodeBuild project

Answer

Store the build's output artifacts in an S3 bucket

Question 12

A development team needs to deploy a containerized web application on AWS. The deployment must be automated, scalable, and minimize manual intervention. Which AWS service should the team use to orchestrate the deployment of containers across a cluster of Amazon EC2 instances?

Accepted Answer

Amazon ECS. Amazon ECS (Elastic Container Service) is a fully managed container orchestration service that allows you to run and scale containerized applications on a cluster of Amazon EC2 instances. It integrates with AWS services like Auto Scaling and Elastic Load Balancing to automate deployment, scaling, and management, minimizing manual intervention.

Answer

AWS Lambda

Answer

AWS CloudFormation

Answer

Amazon S3

Question 13

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that is ideal for storing session state data with high availability and durability. By using ElastiCache for Redis or Memcached, session data is stored outside of individual EC2 instances, ensuring that if an instance fails, the session state is preserved and can be accessed by other instances in the application tier. ElastiCache supports replication and automatic failover, meeting the requirements for high availability and durability.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon CloudFront

Question 14

A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)

Accepted Answer

Remove the public access grant from the bucket ACL.. The bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.

Answer

Create an IAM user policy that denies s3:GetObject for anonymous users.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 15

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. An explicit Deny statement always overrides any Allow in IAM policy evaluation, so adding {"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"} guarantees the user cannot terminate instances even if an existing policy grants it. This is the only option that removes the unwanted permission while leaving ec2:StopInstances untouched.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}