DVA-C02 Practice Test 18 — 15 Questions

Question 1

A developer needs to allow an EC2 instance to access an S3 bucket securely without storing long-term credentials on the instance. Which AWS service should be used to provide temporary credentials?

Accepted Answer

Attach an IAM role to the EC2 instance profile with S3 permissions.. IAM roles for EC2 allow the instance to assume a role and obtain temporary credentials from STS. Option A is wrong because IAM users have long-term credentials. Option B is wrong because security groups are network firewalls and do not provide credentials. Option D is wrong because EC2 key pairs are for SSH access, not API credentials.

Answer

Create an IAM user with S3 access and store the access key on the EC2 instance.

Answer

Configure a security group allowing outbound traffic to S3.

Answer

Use an EC2 key pair to encrypt access to S3.

Question 2

A developer is building a serverless application using AWS Lambda that processes messages from an Amazon SQS queue. The queue receives about 100 messages per second, and each message takes about 30 seconds to process. The Lambda function is configured with a reserved concurrency of 10. The developer notices that messages are frequently being sent to the dead-letter queue (DLQ) after three failed processing attempts. The Lambda function's execution role has the necessary permissions to read from the SQS queue and write to the DLQ. The SQS queue's visibility timeout is set to 60 seconds, and the Lambda function's timeout is set to 60 seconds. What is the most likely cause of the messages being sent to the DLQ?

Accepted Answer

The reserved concurrency of 10 is too low to handle the incoming message rate, causing messages to be repeatedly retried until they exceed the maxReceiveCount.. With a reserved concurrency of 10, the Lambda function can process at most 10 messages concurrently. Since each message takes 30 seconds, the maximum throughput is about 10 messages per 30 seconds = ~0.33 messages per second, far below the incoming rate of 100 messages per second. Messages that are not processed will become visible again after the visibility timeout (60 seconds). They will be retried, but due to the low concurrency, they will likely fail again, eventually exceeding the maxReceiveCount (default 3) and being sent to the DLQ. Option A is incorrect because long polling reduces empty responses but does not address the throughput limitation. Option C is incorrect because the 60-second timeout is sufficient for 30-second processing. Option D is incorrect because the DLQ triggers after the maxReceiveCount, not after the first attempt.

Answer

The SQS queue is not configured to use long polling, causing the Lambda function to receive empty responses and waste time.

Answer

The Lambda function timeout is too short for the processing time required.

Answer

The DLQ is incorrectly configured to receive all failed messages after the first attempt.

Question 3

A company is migrating a monolithic application to microservices on AWS. They want to use a blue/green deployment strategy for a new version of a service running on Amazon ECS with Fargate. The service is behind an Application Load Balancer. Which combination of actions should be taken to implement blue/green deployment with minimal downtime? (Choose the correct answer.)

Accepted Answer

Use AWS CodeDeploy to orchestrate a blue/green deployment by creating a new task set and shifting traffic.. AWS CodeDeploy supports blue/green deployments on Amazon ECS with Fargate. It creates a new task set and gradually shifts traffic from the existing (blue) task set to the new (green) task set, minimizing downtime. Option A is incorrect because managing a second ALB and updating DNS is more complex and not the typical approach for ECS blue/green; AWS CodeDeploy automates this. Option C is incorrect because a rolling update updates the existing service in place, which may cause downtime or require careful orchestration; it is not a blue/green deployment. Option D is incorrect because manually creating a new target group and modifying the ALB listener rule is error-prone and does not provide automated traffic shifting or rollback capabilities.

Answer

Create a second ALB pointing to the new service, then update DNS to switch traffic.

Answer

Update the existing ECS service with the new task definition and allow rolling update.

Answer

Manually create a new target group with the new service and update the ALB listener rule.

Question 4

A company is using AWS Lambda functions to process events from Amazon S3. The functions are writing logs to CloudWatch Logs. Recently, they noticed that some logs are missing and the functions are experiencing throttling errors. What is the MOST likely cause?

Accepted Answer

The Lambda function's reserved concurrency is set to a low value.. The most likely cause of throttling errors is that the Lambda function's reserved concurrency is set too low. When a Lambda function's reserved concurrency limit is reached, additional invocation requests are throttled, resulting in missing logs. Option A is incorrect because log group retention affects log storage, not Lambda throttling. Option C is incorrect because IAM permissions affect the ability to write logs, not throttling. Option D is incorrect because while S3 can send many events, Lambda's concurrency limit is the direct cause of throttling.

Answer

The CloudWatch Logs log group retention policy is set too low.

Answer

The Lambda function's IAM role lacks permissions to write to CloudWatch Logs.

Answer

The S3 bucket is sending too many event notifications.

Question 5

A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.

Answer

IAM authorizer

Answer

Amazon Cognito user pools authorizer

Answer

API Gateway resource policy

Question 6

A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?

Accepted Answer

Enable automatic key rotation in the KMS key settings. Customer managed KMS keys support optional automatic key rotation, which must be explicitly enabled in the key's settings. Once enabled, AWS rotates the backing key material every 365 days (or a custom period of 90–2560 days) while preserving the same key ID, ARN, and alias, so existing ciphertext remains decryptable. Enabling rotation in the KMS key settings is therefore the correct action.

Answer

Use AWS managed keys instead of customer managed keys

Answer

Rotation is enabled by default for all KMS keys

Answer

Create a new key and update the alias to point to the new key annually

Question 7

A developer uses the CloudFormation template in the exhibit to create an S3 bucket. The stack creation fails with the error 'Bucket already exists'. What is the MOST likely reason?

Accepted Answer

The bucket name is already taken by another AWS account.. S3 bucket names are globally unique across all AWS accounts and regions, so if the name specified in the CloudFormation template is already in use by another account, the stack creation fails with 'Bucket already exists'. This is the most likely cause given the error message. The error is not related to syntax, IAM permissions, or region availability.

Answer

The CloudFormation template has invalid JSON syntax.

Answer

The IAM user does not have permission to create S3 buckets.

Answer

The bucket name is not available in the specified region.

Question 8

The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?

Accepted Answer

Use the aws s3api put-bucket-versioning command with the --mfa parameter.. The `aws s3api put-bucket-versioning` command with the `--mfa` parameter is the correct way to enable MFA Delete on an S3 bucket. The `--mfa` parameter supplies the MFA token (serial number + code) required for this high-security operation, as MFA Delete can only be toggled by the bucket owner using multi-factor authentication.

Answer

Use the aws s3api put-bucket-acl command with MFA token.

Answer

Enable Object Lock on the bucket, which automatically enables MFA Delete.

Answer

Use the aws s3api put-bucket-policy command to require MFA.

Question 9

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 10

A developer needs to allow an IAM user to perform only specific actions on an S3 bucket. Which type of policy should be attached to the IAM user?

Accepted Answer

An IAM policy. An IAM policy (Option D) is the correct choice because it is an identity-based policy that can be directly attached to an IAM user, group, or role to grant or deny permissions for specific actions on AWS resources, including S3 buckets. This allows the developer to precisely control which S3 actions (e.g., s3:GetObject, s3:PutObject) the user can perform on a particular bucket, meeting the requirement of limiting the user to specific actions.

Answer

A service control policy

Answer

A bucket policy

Answer

A trust policy

Question 11

A developer is deploying a serverless application using AWS SAM. The deployment fails with the error 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

A resource in the stack failed to create.. The 'Resource creation cancelled' error in AWS SAM indicates that the CloudFormation stack creation was cancelled because one or more resources failed to create, triggering a rollback. Option A is incorrect because a malformed SAM template would produce a validation error, not 'Resource creation cancelled'. Option C is incorrect because a Lambda function timeout is a runtime issue, not a deployment error. Option D is incorrect because insufficient IAM permissions would result in an access denied error, not this specific cancellation message.

Answer

The SAM template is malformed.

Answer

The Lambda function code has a timeout.

Answer

The IAM role does not have sufficient permissions.

Question 12

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During rolling updates of the Auto Scaling group, users intermittently receive HTTP 502 (Bad Gateway) errors. The developer checks the ALB access logs and notices that requests are being routed to instances that are in the 'Draining' state. The ALB has connection draining enabled with a timeout of 30 seconds. The Auto Scaling group terminates instances after they are taken out of service. What is the most likely cause of the 502 errors?

Accepted Answer

The connection draining timeout is too short, causing the ALB to terminate connections before in-flight requests finish.. The 502 errors occur because the ALB's connection draining timeout of 30 seconds is too short to allow all in-flight requests to complete before the Auto Scaling group terminates the instances. When an instance enters the 'Draining' state, the ALB stops sending new requests but waits up to the draining timeout for existing connections to finish. If the timeout expires before requests complete, the ALB forcibly closes connections, resulting in HTTP 502 (Bad Gateway) errors for clients whose requests were still in progress.

Answer

The health check interval is set too long, causing the ALB to consider unhealthy instances as healthy.

Answer

Cross-zone load balancing is disabled, so the ALB is routing requests to instances that are already draining.

Answer

The Auto Scaling group's minimum size is too small, causing the ALB to have no healthy targets.

Question 13

A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime and roll forward if successful. They have two environments: a production environment (current version) and a staging environment (new version). After verifying the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?

Accepted Answer

Blue/green deployment with environment CNAME swap. Blue/green deployment with an environment CNAME swap allows you to run two separate Elastic Beanstalk environments (production and staging) simultaneously. After verifying the new version in the staging environment, you swap the CNAME records so that the production URL points to the staging environment, achieving zero downtime and a roll-forward strategy. This approach decouples the deployment from the existing environment, ensuring no disruption to live traffic during the swap.

Answer

All at once deployment

Answer

Rolling deployment with additional batch

Answer

Immutable deployment

Question 14

An application running on Amazon ECS (Fargate) uses an Application Load Balancer (ALB) with connection draining enabled. The application is experiencing intermittent 502 (Bad Gateway) errors during rolling updates of the ECS service. The developer notices that the ALB is routing requests to tasks that are in the 'Draining' state. The ECS service is configured with a deployment circuit breaker that automatically rolls back a failed deployment. What is the most likely cause of the 502 errors?

Accepted Answer

The application is not handling the SIGTERM signal from ECS, causing it to terminate abruptly while the ALB still routes traffic to it.. When ECS sends a SIGTERM signal to a Fargate task during a rolling update, the task is expected to gracefully shut down. If the application does not handle SIGTERM, it terminates immediately, but the ALB may still have the task registered as a target and continue routing requests to it. Since the task is already dead or unresponsive, the ALB receives no valid HTTP response and returns a 502 Bad Gateway error. Connection draining is enabled, but it only works if the task signals the ALB that it is deregistering; without proper SIGTERM handling, the task dies before the draining process completes.

Answer

The ALB's idle timeout is too short, causing connections to be dropped before the application responds.

Answer

The ALB's connection draining timeout is set to 0 seconds, causing connections to be dropped immediately when deregistering targets.

Answer

The ECS deployment circuit breaker is incorrectly configured to roll back on health check failures.

Question 15

A developer is deploying a multi-container Docker application on Amazon ECS using the Fargate launch type. The application consists of a web server and a background worker. The web server must be scaled independently and must be accessible from the internet via an Application Load Balancer. The worker should not be accessible from the internet. Which ECS configuration should the developer use?

Accepted Answer

Create two separate ECS services, each with its own task definition, and place the web server in a public subnet with the worker in a private subnet.. It uses two separate ECS services, each with its own task definition, allowing independent scaling of the web server and worker. Placing the web server in a public subnet with an Application Load Balancer makes it internet-accessible, while the worker in a private subnet is isolated from direct internet traffic, meeting the security requirement.

Answer

Create one ECS service with both containers in the same task definition, but only expose the web server port.

Answer

Create one ECS service with two tasks, each containing one container.

Answer

Create one ECS service with two containers in the same task, and use a service discovery to expose the worker.