DVA-C02 Practice Test 17 — 15 Questions

Question 1

A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)

Accepted Answer

Create an AWS KMS customer-managed key.. Options A, C, and D are correct. Using a KMS key for encryption ensures SSE-KMS; bucket policies can deny writes without the correct encryption header; default encryption enforces SSE-KMS. Option B is wrong because S3 does not automatically encrypt with SSE-KMS without configuration. Option E is wrong because bucket ACLs do not control encryption.

Answer

Configure the bucket ACL to require encryption.

Answer

Enable S3 default encryption with SSE-S3.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

Accepted Answer

S3 is not a suitable store for session state due to its eventual consistency and higher latency.. Option C is correct because S3 is not designed for low-latency session state access and is eventually consistent, leading to lost writes. A managed service like ElastiCache or DynamoDB is better. Option A is wrong because ALB supports sticky sessions. Option B is wrong because S3 can be accessed from EC2. Option D is wrong because scaling alone does not cause session loss if storage is properly configured.

Answer

The EC2 instances do not have internet access to reach S3.

Answer

The ALB does not have sticky sessions enabled.

Answer

The application is not scaling properly, causing session loss.

Question 3

A developer runs the command above. The output.txt file is empty. What could be the reason?

Accepted Answer

The Lambda function did not return any output.. Option C is correct because by default, Lambda returns only the response if the function is invoked synchronously and the output goes to output.txt; if the function returns nothing or errors, output.txt may be empty. Option A is wrong because a non-existent function returns a 404. Option B is wrong because incorrect payload may cause error but still output to stderr. Option D is wrong because Lambda invocation with --payload does not need an explicit return; empty output means the function returned nothing.

Answer

The payload is not valid JSON.

Answer

The Lambda function timed out.

Answer

The function name is incorrect.

Question 4

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. Option B is correct because API Gateway provides built-in usage plans with the ability to set rate limits per API key. Option A is wrong because Lambda reserved concurrency limits the overall concurrency, not per-key throttling. Option C is wrong because WAF is for web application firewall, not per-key throttling. Option D is wrong because CloudWatch alarms only alert, they don't throttle.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 5

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. Option B is correct because private subnets need a VPC endpoint (or NAT gateway) to access DynamoDB. Option A is wrong because security groups control traffic at instance level, but the issue is routing. Option C is wrong because IAM roles are for permissions, not network connectivity. Option D is wrong because task definitions don't have network settings for VPC endpoints.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 6

A developer attaches this IAM policy to a user. The user tries to upload an object to example-bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an access denied error.. Option B is correct because the condition requires s3:x-amz-server-side-encryption to be AES256; if not specified, the condition fails and the request is denied. Option A is wrong because S3 default encryption would apply but the policy condition is not met. Option C is wrong because the condition does not require the header to be set; it requires it to be AES256 if present. Option D is wrong because the policy does not specify any encryption key.

Answer

The upload succeeds only if the object is smaller than 5 GB.

Answer

The upload succeeds but the object is not encrypted.

Answer

The upload succeeds because S3 default encryption is applied.

Question 7

A developer is using AWS CodePipeline to automate a build and deploy process. The pipeline has a build stage that uses AWS CodeBuild and a deploy stage that uses AWS CodeDeploy. The build stage produces a build artifact that is stored in Amazon S3. The deploy stage fails with 'NoSuchKey' error. What is the MOST likely cause?

Accepted Answer

The pipeline does not have an OutputArtifact configured for the build stage, so the artifact is not passed to the deploy stage.. Option B is correct because the artifact must be passed explicitly between stages via the OutputArtifacts and InputArtifacts configuration. Option A is wrong because S3 bucket policy is not typically the issue for cross-account same account. Option C is wrong because CodeBuild permissions are separate. Option D is wrong because CodeDeploy permissions are for deployment, not artifact access.

Answer

The CodeDeploy application does not have the correct service role.

Answer

The CodeBuild project does not have permissions to upload to the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to access the artifact.

Question 8

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. Option A is correct because the Lambda execution role can be attached to the function and include an IAM policy granting access to the S3 bucket. This follows the principle of least privilege and avoids hardcoding credentials. Option B is wrong because bucket policies are resource-based and not attached to functions. Option C is wrong because environment variables would expose credentials. Option D is wrong because Lambda does not have an inline policy property - policies are attached via roles.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 9

A developer is using AWS Lambda with Amazon API Gateway to build a REST API. The Lambda function is written in Node.js and uses the 'aws-sdk' to interact with DynamoDB. When the function is invoked, it consistently takes more than 10 seconds to complete, causing API Gateway to timeout (default timeout is 29 seconds). The developer wants to reduce latency. What should the developer do FIRST?

Accepted Answer

Enable provisioned concurrency on the Lambda function to reduce cold starts.. Option D is correct because the cold start is the most common cause of high latency in Lambda, especially for Node.js. Provisioned concurrency keeps the function warm. Option A is wrong because increasing timeout does not reduce latency. Option B is wrong because Lambda has execution role, not IAM role attached. Option C is wrong because DynamoDB is not the bottleneck typically.

Answer

Increase the Lambda function timeout in the function configuration.

Answer

Switch from DynamoDB to Amazon RDS for faster queries.

Answer

Attach an IAM role to the Lambda function to speed up DynamoDB access.

Question 10

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. The developer wants to implement caching to improve performance. Which THREE steps are necessary to enable caching for a specific stage? (Choose THREE.)

Accepted Answer

Enable API caching in the stage settings.. A, B, and D are correct. You must enable caching in API Gateway (A), specify a cache size (B), and set a TTL (D). Option C is wrong because the Lambda function does not need changes. Option E is wrong because IAM permissions are not directly required for caching.

Answer

Attach an IAM policy to the API Gateway role for cache access.

Answer

Modify the Lambda function to store responses in ElastiCache.

Question 11

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. Option B is correct because when MFA Delete is enabled, permanent deletion of object versions requires MFA authentication. Without MFA, the request fails. Option A is wrong because the delete marker is not created; the request is denied. Option C is wrong because the request does not succeed. Option D is wrong because a delete marker is not created when trying to delete a specific version.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 12

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. Option C is correct because AWS Systems Manager Parameter Store (or Secrets Manager) is designed for secure storage of secrets and can be accessed via IAM roles. Option A is wrong because environment variables can be exposed. Option B is wrong because S3 is not designed for secrets and requires encryption management. Option D is wrong because Lambda is a compute service, not a secret store.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 13

A company uses AWS OpsWorks for Chef Automate to manage their infrastructure. A developer needs to deploy a new application version to a stack of EC2 instances. The developer wants to minimize downtime and ensure that the deployment is rolled back automatically if any instance fails. Which deployment strategy should the developer use?

Accepted Answer

Rolling deployment with rollback on error. Option B is correct because rolling deployments update instances in batches, and if any instance fails, the deployment can be rolled back. Option A is wrong because blue/green is not built into OpsWorks. Option C is wrong because in-place updates can cause downtime. Option D is wrong because canary is not a standard OpsWorks strategy.

Answer

Canary deployment

Answer

In-place deployment with a single batch

Answer

Blue/green deployment

Question 14

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

Accepted Answer

aws deploy get-deployment-instance. Option D is correct because 'aws deploy get-deployment-instance' provides detailed information about a specific instance deployment. Option A is wrong because 'list-deployment-instances' only lists IDs. Option B is wrong because 'get-deployment' gives overall deployment info. Option C is wrong because 'list-deployments' lists deployments.

Answer

aws deploy get-deployment

Answer

aws deploy list-deployments

Answer

aws deploy list-deployment-instances

Question 15

The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The policy does not include the 'dynamodb:Scan' action.. Option B is correct because the policy does not include 'dynamodb:Scan' action. Option A is wrong because the resource ARN is correct. Option C is wrong because table exists. Option D is wrong because the role is attached.

Answer

The DynamoDB table does not exist.

Answer

The IAM role is not attached to the Lambda function.

Answer

The resource ARN is incorrect.