DVA-C02 Practice Test 17 — 15 Questions

Question 1

A developer is building a RESTful API using Amazon API Gateway and Lambda. The API should support CORS for a specific origin (https://example.com) and allow only GET and POST methods. Which configuration in the OPTIONS method response will satisfy these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST. The OPTIONS method response must include the `Access-Control-Allow-Origin` header set to the specific origin `https://example.com` to restrict CORS access, and the `Access-Control-Allow-Methods` header must list only the allowed HTTP methods (`GET,POST`). The OPTIONS method itself is a preflight request and does not need to be listed in the allowed methods; it is automatically handled by the browser. This configuration satisfies the requirement of supporting CORS for a single origin and only GET and POST methods.

Answer

Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET,POST,OPTIONS

Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST,OPTIONS

Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Headers: Content-Type

Question 2

A company uses AWS Secrets Manager to store database credentials. The credentials must be automatically rotated every 30 days. The developer needs to configure rotation without exposing the secret to any IAM user directly. Which configuration steps should the developer take?

Accepted Answer

Create a Lambda function with rotation logic, attach an IAM role with permissions to read and update the secret, and configure Secrets Manager to invoke the function every 30 days.. AWS Secrets Manager does not provide a built-in Lambda function for rotating database credentials; you must create your own Lambda function that contains the rotation logic (e.g., querying the database, creating a new credential, and updating the secret). The Lambda function must be attached to an IAM role with permissions to read and update the secret, and Secrets Manager invokes this function based on the rotation schedule (every 30 days). This ensures the secret is never exposed directly to any IAM user, as only the Lambda function interacts with the secret programmatically.

Answer

Enable automatic rotation and choose a rotation interval of 30 days. Secrets Manager will automatically rotate the secret using a built-in Lambda function.

Answer

Use AWS Certificate Manager (ACM) to rotate the secret automatically every 30 days.

Answer

Store the secret in AWS Systems Manager Parameter Store and set a schedule to rotate it using a CloudWatch Events rule.

Question 3

A developer is using AWS CodeDeploy with a blue/green deployment strategy for an EC2 Auto Scaling group. The deployment must automatically roll back if any of the new instances fail a health check within the first 10 minutes after deployment. Which configuration should the developer set?

Accepted Answer

Configure the deployment group to use an alarm-based rollback with a CloudWatch alarm on the ELB health check. The requirement is to automatically roll back based on health check failures within a specific time window after deployment. AWS CodeDeploy supports alarm-based rollbacks where you can configure a CloudWatch alarm that monitors the ELB health check status of the new instances. When the alarm triggers within the configured monitoring period (e.g., 10 minutes), CodeDeploy automatically rolls back the deployment to the previous version, meeting the exact condition described.

Answer

Set the deployment configuration to 'CodeDeployDefault.EC2AllAtOnce'

Answer

Enable automatic rollback in the deployment group configuration and set the event to 'DEPLOYMENT_FAILURE' or 'DEPLOYMENT_STOP_ON_REQUEST'

Answer

Configure the deployment group with a 'LoadBalancerInfo' and enable 'originalInstanceTermination' for rollback

Question 4

A developer is using AWS Elastic Beanstalk to deploy a web application. The developer wants to run database migration scripts as part of the deployment process before the new application version starts serving traffic. Which Elastic Beanstalk configuration file should the developer use to define the migration commands?

Accepted Answer

.ebextensions/.config with container_commands. `container_commands` in `.ebextensions/.config` runs commands after the application and web server have been set up but before the new application version starts serving traffic. This makes it the ideal place to execute database migration scripts that must complete before the environment accepts requests, ensuring data consistency.

Answer

.ebextensions/<filename>.config with commands

Answer

Procfile

Answer

buildspec.yml

Question 5

A developer is building a RESTful API using Amazon API Gateway and Lambda. The API should support CORS for a specific origin (https://example.com) and allow only GET and POST methods. Which configuration in the OPTIONS method response will satisfy these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable API caching on the stage with a TTL of 300 seconds and configure the client ID as a cache key parameter.. Amazon API Gateway (REST API) supports response caching at the stage level. By enabling API caching with a TTL of 300 seconds (5 minutes) and specifying the client ID as a cache key parameter, identical requests with the same client ID within the TTL will return the cached response without invoking the Lambda function. This reduces latency and cost.

Answer

Enable request validation to reject duplicate requests.

Answer

Configure a usage plan with a throttle rate to limit requests from each client.

Answer

Enable stage variables to store the previous response.

Question 6

A developer is building a web application that uses Amazon DynamoDB as the database. The application needs to store user session data and must support eventual consistency reads for most use cases, but strongly consistent reads for critical operations. The developer wants to minimize costs. Which read capacity unit (RCU) configuration should the developer use?

Accepted Answer

Use on-demand capacity mode to pay per request, avoiding provisioned capacity costs.. On-demand capacity mode charges per request (read/write), eliminating the need to provision fixed RCUs. For a session store with mixed consistency requirements, on-demand is cost-effective when traffic is unpredictable or low, as you only pay for actual reads and writes. Eventually consistent reads consume half the RCUs of strongly consistent reads, but on-demand pricing automatically accounts for this difference without manual configuration.

Answer

Use provisioned capacity with 1 RCU per item, since eventually consistent reads consume half the RCUs.

Answer

Use provisioned capacity with sufficient RCUs to handle strongly consistent reads, as they consume the same as eventually consistent.

Answer

Use provisioned capacity with enough RCUs for peak traffic, and use DynamoDB Accelerator (DAX) for caching.

Question 7

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group of EC2 instances. The developer wants to minimize the number of instances that are taken out of service at any given time during the deployment. Which predefined deployment configuration should the developer use?

Accepted Answer

OneAtATime. The OneAtATime deployment configuration shifts traffic to one new instance at a time, ensuring that only a single instance is taken out of service during the deployment. This minimizes the number of instances removed from the Auto Scaling group at any given moment, which directly meets the developer's requirement to reduce service disruption.

Answer

AllAtOnce

Answer

HalfAtATime

Answer

Custom with 50% at a time

Question 8

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption with a specific AWS KMS customer managed key (CMK). The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not use the specified KMS key. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific AWS KMS customer managed key (CMK) ARN is used for server-side encryption on S3 PutObject requests. By using this condition key in a Deny statement, you can reject any upload that does not specify the required KMS key ID, ensuring encryption compliance.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

kms:KeyArn

Question 9

A developer is using AWS CodeDeploy to deploy an application to an Amazon ECS service using the Fargate launch type. The developer wants to ensure that the deployment rolls back automatically if the new task set fails health checks. Which configuration should the developer set?

Accepted Answer

Enable rollback in the deployment group settings.. Enabling rollback in the deployment group settings allows CodeDeploy to automatically revert the deployment to the previous working task set if the new task set fails health checks. This is a native feature of CodeDeploy that monitors the health of the ECS service and triggers a rollback without manual intervention.

Answer

Set the deployment type to in-place.

Answer

Set the deployment configuration to CodeDeployDefault.OneAtATime.

Answer

Configure CloudWatch alarms to trigger a rollback.

Question 10

A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?

Accepted Answer

The user's IAM user policy does not explicitly allow the required S3 action. When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.

Answer

The bucket policy does not have a principal of '*' to allow external accounts

Answer

The bucket is in a different region than the user's account

Answer

The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)

Question 11

A company runs a containerized application on Amazon ECS using Fargate launch type. The application needs to read and write files to a shared file system across multiple tasks. The development team wants a solution that provides high throughput and is POSIX-compliant. Which storage solution should the team use?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant shared file system that can be mounted concurrently by multiple Amazon ECS tasks using the Fargate launch type. EFS uses the NFSv4.1 protocol, supports high throughput (up to 10 GB/s with Bursting or Provisioned Throughput modes), and automatically scales storage capacity as files are added or removed, making it ideal for shared read/write workloads across containers.

Answer

Amazon S3 with mountpoint-s3

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon FSx for Windows File Server

Question 12

A developer is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database instance that is included in the Elastic Beanstalk environment. The developer wants to update the application code without affecting the database. What is the recommended approach?

Accepted Answer

Decouple the database from the Elastic Beanstalk environment by creating a separate RDS instance and connecting the application to it externally.. When an RDS instance is included in an Elastic Beanstalk environment, it is tied to the environment's lifecycle. If the environment is terminated or rebuilt, the database is also deleted. Decoupling the database by creating a standalone RDS instance and connecting the application to it externally ensures the database persists independently of application deployments, allowing code updates without risking data loss.

Answer

Update the application code directly on the EC2 instances without redeploying the environment.

Answer

Create a new environment configuration, update the code, and swap the CNAME of the environments.

Answer

Use Elastic Beanstalk's platform updates while keeping the database attached to the environment.

Question 13

A developer needs to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS Secrets Manager API, allowing the function to retrieve credentials at runtime without hardcoding them, and supports automatic rotation using built-in or custom Lambda rotation functions. This makes it the ideal choice for securely handling database credentials in a serverless application.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

Amazon DynamoDB

Question 14

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Answer

Amazon SNS

Question 15

A developer monitors an AWS Lambda function that processes records from an Amazon SQS queue and writes results to an Amazon DynamoDB table. CloudWatch Logs show that execution time has increased over the past week, and the function frequently times out at the 5-minute timeout. The function's code has not been changed recently. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 write capacity units (WCUs). What action will MOST effectively reduce the function's execution time?

Accepted Answer

Increase the write capacity units (WCUs) on the DynamoDB table.. The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient write capacity. When writes are throttled, the Lambda function must retry, which increases execution time and can lead to timeouts. Increasing the WCUs on the DynamoDB table directly addresses the root cause by allowing the function to write without throttling, thereby reducing execution time.

Answer

Increase the Lambda function's timeout to 10 minutes.

Answer

Increase the Lambda function's memory allocation to 3008 MB.

Answer

Use an Amazon SQS FIFO queue instead of a standard queue for the Lambda trigger.