DVA-C02 Practice Test 17 — 15 Questions

Question 1

Refer to the exhibit. A developer ran this CLI command and received the output shown. The application is retrieving the secret but getting an authentication error from the database. What is the MOST likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The application is not correctly parsing the JSON SecretString.. The CLI command successfully retrieved the secret, as shown by the output containing the secret value. The application, however, is failing with an authentication error from the database. This indicates that the secret was retrieved but the application is likely misinterpreting the JSON structure of the SecretString. If the secret is stored as a JSON object (e.g., containing username and password fields), the application must parse the JSON and extract the correct field (e.g., 'password'). If it treats the entire JSON string as the password, it will pass an invalid credential to the database, causing an authentication error.

Answer

The secret is not marked as AWSCURRENT.

Answer

The CLI command should have used the --secret-string parameter.

Answer

The secret ID is incorrect.

Question 2

Which TWO actions should a developer take to minimize downtime when deploying a new version of a production application running on Amazon ECS with Fargate?

Accepted Answer

Configure the ECS service to use a blue/green deployment with CodeDeploy. Blue/green deployments with AWS CodeDeploy allow you to create a new 'green' environment alongside the existing 'blue' environment, route traffic gradually, and instantly roll back if issues arise. This minimizes downtime by ensuring the old version remains fully available until the new version passes health checks and traffic is fully shifted.

Answer

Delete the existing service and recreate it with the new task definition

Answer

Update the target group health check settings to a more lenient threshold

Answer

Stop all running tasks and then start new tasks with the updated image

Question 3

A developer is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. The pipeline must automatically build and deploy the application when changes are pushed to a CodeCommit repository. The application uses AWS CloudFormation for infrastructure provisioning. Which TWO actions should the developer include in the pipeline?

Accepted Answer

Use AWS CodeBuild to run unit tests and package the application.. AWS CodeBuild can compile source code, run unit tests, and produce deployment artifacts, which is a standard build phase in a CI/CD pipeline. Option E is correct because AWS CloudFormation is the native AWS service for provisioning and updating infrastructure as code, making it the appropriate deployment action for a serverless application defined in templates.

Answer

Use AWS CodeDeploy to deploy the application to EC2 instances.

Answer

Use AWS CodeCommit as a deployment action.

Answer

Use AWS Lambda to run integration tests.

Question 4

A company needs to store application secrets such as database passwords and API keys. The secrets must be automatically rotated every 30 days. Which THREE AWS services or features can be used together to meet this requirement? (Choose THREE.)

Accepted Answer

AWS Lambda to implement the rotation function. AWS Lambda is correct because it can be used as a custom rotation function for AWS Secrets Manager. Secrets Manager natively supports automatic rotation using a Lambda function that updates the secret value in both the service and the database or third-party service. This allows the company to meet the 30-day rotation requirement by scheduling the Lambda function via a CloudWatch Events rule or Secrets Manager's built-in rotation schedule.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 5

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API has a resource /items with GET and POST methods. The GET method returns items from a DynamoDB table. The POST method adds an item to the table. Currently, all methods are open to the public. Security requirements mandate that only authenticated users can access the POST method, while the GET method remains public. Which THREE steps should the developer take to meet these requirements?

Accepted Answer

Configure the Lambda authorizer only on the POST method in the API Gateway.. You can configure a Lambda authorizer at the method level in API Gateway, which allows you to selectively secure only the POST method while leaving the GET method public. This meets the requirement of restricting access to authenticated users for POST only, without affecting the public GET endpoint.

Answer

Use an Amazon Cognito User Pools authorizer for the entire API.

Answer

Add a resource policy that denies public access to the POST method.

Question 6

Which THREE actions can be performed using AWS Lambda and Amazon S3 event notifications? (Choose three.)

Accepted Answer

Resize an image when a new image is uploaded to an S3 bucket.. AWS Lambda can be triggered by S3 event notifications for object creation events. When a new image is uploaded to an S3 bucket, the event notification invokes a Lambda function that can process the image, such as resizing it using libraries like Pillow or Sharp, and save the resized version back to S3.

Answer

Generate a pre-signed URL for an object.

Answer

Enable versioning on the S3 bucket.

Question 7

Which TWO are best practices for securing an AWS account? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users. The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture. Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Answer

Disable AWS CloudTrail to reduce costs

Answer

Disable password rotation to avoid user inconvenience

Answer

Use the root user for daily administrative tasks

Question 8

A developer is troubleshooting an application that uses Amazon SQS. Messages are being sent to a dead-letter queue (DLQ) after the maximum receive count is exceeded. The consumer processes messages but sometimes fails. The developer wants to ensure that messages are retried immediately after a failure, without waiting for the visibility timeout. Which solution should the developer implement?

Accepted Answer

After a failure, call ChangeMessageVisibility with a timeout of 0 to make the message immediately available for reprocessing.. The correct solution is to call ChangeMessageVisibility with a timeout of 0 after a failure. This makes the message immediately available for reprocessing by other consumers, effectively retrying without waiting for the visibility timeout. Option A (delay queue) introduces a delay, which is counterproductive. Option C (delete and re-send) loses original message attributes and is inefficient. Option D (increase visibility timeout) would delay retries, not accelerate them.

Answer

Configure a delay queue so that messages are not immediately visible after failure.

Answer

Delete the message from the queue and re-send it after processing failure.

Answer

Increase the visibility timeout to allow more time for processing.

Question 9

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic. Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 10

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and a Lambda function. The developer wants to set up a custom domain name for the API in the production stage. Which resource should the developer define in the SAM template to achieve this with minimal effort?

Accepted Answer

AWS::Serverless::Api. The AWS::Serverless::Api resource in an AWS SAM template provides a high-level abstraction that simplifies the configuration of API Gateway REST APIs, including the ability to set up a custom domain name via the Domain property. This approach requires minimal effort because SAM automatically creates the underlying AWS::ApiGateway::DomainName and AWS::ApiGateway::BasePathMapping resources, handles the TLS certificate association, and manages the stage deployment. Defining a raw AWS::ApiGateway::DomainName would require additional manual configuration for base path mapping and stage integration, making the Serverless::Api the most efficient choice.

Answer

AWS::ApiGateway::DomainName

Answer

AWS::ApiGateway::BasePathMapping

Answer

AWS::Route53::RecordSet

Question 11

A developer is using AWS Lambda and needs to ensure that the function can access an RDS database securely. Which THREE steps should be taken?

Accepted Answer

Place the Lambda function inside a VPC.. Option A is correct because a Lambda function can only reach an RDS instance that resides in a VPC if the function itself is configured with VPC connectivity (subnets and a security group), which is required for private network access to the database. Option B is correct because hardcoding credentials is insecure; storing them in AWS Secrets Manager and retrieving them at runtime (optionally with Lambda's Secrets Manager extension/caching) keeps the database password encrypted and rotatable. Option E is correct because RDS access is controlled by security group rules, so the RDS instance's security group must allow inbound traffic on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL) referencing the Lambda function's security group as the source. Option C is not appropriate because rds:* IAM permissions govern the RDS control plane API, not the ability to open a database connection, and Lambda's execution role does not grant network access to RDS. Option D is not required for this scenario; client certificate authentication is an optional RDS TLS feature and is not one of the standard steps to let Lambda connect securely.

Answer

Attach an IAM role to the Lambda function that grants rds:* permissions.

Answer

Configure the RDS instance to require client certificates.

Question 12

A company uses AWS KMS to encrypt data at rest. A developer wants to allow a Lambda function to decrypt data using a KMS key. What is the minimum permissions required?

Accepted Answer

kms:Decrypt on the key in the Lambda execution role.. The minimum permission required is kms:Decrypt on the specific key, attached to the Lambda execution role. The Lambda function only needs to decrypt data, not encrypt it, so kms:Decrypt is sufficient. Granting it on the specific key follows the principle of least privilege.

Answer

kms:Decrypt on all keys.

Answer

kms:Encrypt and kms:Decrypt on the key.

Answer

Full access to KMS.

Question 13

A Lambda function using a Kinesis event source repeatedly retries one bad record and blocks progress in the shard. Which feature helps isolate failed records after retry limits?

Accepted Answer

Configure failure handling with bisect batch on error and an on-failure destination where supported. Lambda's Kinesis event source mapping supports a 'bisect batch on error' feature that splits a failed batch into two smaller batches, allowing the bad record to be isolated and retried separately. Additionally, configuring an on-failure destination (e.g., an SQS queue or SNS topic) sends the record to a dead-letter destination after the retry limit is exhausted, preventing the shard from blocking progress.

Answer

Increase memory to 10 GB only

Answer

Disable batch processing

Answer

Convert the stream to an S3 bucket

Question 14

A company runs an application on Amazon EC2 instances that need to read files from an Amazon S3 bucket. The developer must grant access to the S3 bucket without storing long-term credentials on the instances. Which approach should the developer use?

Accepted Answer

Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.. Using an IAM role attached to an EC2 instance profile allows the application to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the access key ID and secret access key in environment variables on the EC2 instance.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP address.

Answer

Store the credentials in AWS Secrets Manager and have the application retrieve them at startup.

Question 15

A developer is deploying a new version of an application to Amazon ECS using the Fargate launch type. The task fails to start and the error message indicates that the task cannot pull the container image from Amazon ECR. What is the MOST likely cause?

Accepted Answer

The task execution role lacks permissions to pull from ECR.. The error message indicates a failure to pull the container image from Amazon ECR. The task execution role must have permissions such as ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to pull images. Option A is wrong because the task definition family name does not affect image pulling. Option C is wrong because Fargate does not use host port mapping; container port mapping is handled automatically. Option D is wrong because insufficient CPU or memory typically results in a different error (e.g., task stuck in provisioning), not an image pull failure.

Answer

The task definition family name is incorrect.

Answer

The container port is not mapped to a host port.

Answer

The CPU or memory limits are too low for the container.