DVA-C02 Practice Test 18 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy a web application. The template creates an Auto Scaling group, an Application Load Balancer, and a security group. The developer wants to ensure that the stack update fails if the new Auto Scaling group instances fail health checks. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to send a signal to CloudFormation using cfn-signal.. Option A is correct because the Auto Scaling group must associate with the ALB target group for health checks. Option B is correct because creation policies allow CloudFormation to wait for a signal of success. Option D is correct because a CloudFormation signal (cfn-signal) is used to report success/failure. Option C is wrong because UpdatePolicy is used for rolling updates, not for signaling health checks. Option E is wrong because AWS::CloudFormation::Init is for software configuration, not health check signaling.

Answer

Add an UpdatePolicy to the Auto Scaling group with a rolling update configuration.

Answer

Use the AWS::CloudFormation::Init metadata to run a health check script.

Question 2

A developer is designing a serverless application using AWS Lambda. The function needs to process messages from an Amazon SQS queue. The developer wants to configure the Lambda function to be triggered by the SQS queue. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Attach an IAM execution role to Lambda with permission to receive messages from SQS.. B and D are correct. The Lambda function needs an event source mapping (B) and the execution role needs permissions to poll the queue (D). Option A is wrong because SQS does not need a resource-based policy for the same account. Option C is wrong because DLQ is optional. Option E is wrong because VPC is not required.

Answer

Configure a resource-based policy on the SQS queue to allow Lambda invocation.

Answer

Set up a dead-letter queue for failed messages.

Answer

Place the Lambda function in a VPC to access the SQS queue.

Question 3

The above command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught and returned as an error.. Option C is correct because 'Handled' means the function threw an exception that was caught by the code (e.g., in a try-catch block) and returned an error response. Option A is wrong because 'Handled' does not mean the function succeeded. Option B is wrong because a timeout would be 'Unhandled'. Option D is wrong because permission errors would result in 403.

Answer

The function had a permission error.

Answer

The function executed successfully.

Answer

The function timed out.

Question 4

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. B, C, and D are correct. You need an approval action (B), SNS notification for approvers (C), and an IAM policy for approvers to allow approval (D). Option A is wrong because CloudWatch Events is not required for approval. Option E is wrong because Lambda is not required; approval action is built-in.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 5

The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?

Accepted Answer

Use the aws s3api put-bucket-versioning command with the --mfa parameter.. Option A is correct because the 'aws s3api put-bucket-versioning' command with MFA is required to enable MFA Delete. Option B is wrong because 's3api put-bucket-versioning' is the correct command. Option C is wrong because 's3api put-bucket-versioning' can enable MFA Delete without locking. Option D is wrong because 's3api put-bucket-versioning' is the right command.

Answer

Use the aws s3api put-bucket-acl command with MFA token.

Answer

Enable Object Lock on the bucket, which automatically enables MFA Delete.

Answer

Use the aws s3api put-bucket-policy command to require MFA.

Question 6

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Accepted Answer

Use S3 multipart upload for large files to improve throughput.. Option B is correct because increasing Lambda memory often increases CPU and network throughput, reducing processing time. Option D is correct because using S3 multipart upload for large files can reduce the time to download/upload. Option A is wrong because updating the function code may not help if the issue is resource constraints. Option C is wrong because changing the trigger to SQS adds complexity and does not directly address the timeout. Option E is wrong because increasing timeout without addressing performance may just delay the failure.

Answer

Change the S3 event notification to send messages to an Amazon SQS queue instead.

Answer

Update the Lambda function code to use a more efficient algorithm.

Answer

Increase the Lambda function timeout to 15 minutes.

Question 7

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. Option C is correct because assigning an IAM role to the Lambda function with a policy that allows DynamoDB actions follows the principle of least privilege and is the recommended approach. Option A is wrong because embedding access keys in environment variables is insecure. Option B is wrong because IAM users are for human users, not services. Option D is wrong because granting full admin access violates least privilege.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 8

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. Option B is correct because the artifacts section in buildspec.yml uses the 'files' key (not 'file') to specify which files are build artifacts. Option A is wrong because 'file' is not a valid key. Option C is wrong because 'path' is not a key in the artifacts section; it's a property of the 'files' list. Option D is wrong because 'base-directory' is misspelled and the structure is incorrect.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 9

A company has a microservices architecture running on Amazon ECS with Fargate. Each service exposes an API through an Application Load Balancer (ALB). The development team needs to implement canary deployments for one of the services. What is the MOST efficient way to achieve this?

Accepted Answer

Configure the ALB to use weighted target groups, each pointing to a different task set of the same ECS service.. Option D is correct because using the ALB weighted target groups feature allows directing a percentage of traffic to a new task set, enabling canary deployments without additional infrastructure. Option A is wrong because CodeDeploy can perform canary deployments with ECS, but it requires additional setup and is not as direct as ALB weighted target groups. Option B is wrong because multiple ECS services would require a separate ALB or complex routing. Option C is wrong because Route 53 cannot route based on percentage for canary deployments without complex health checks and DNS propagation delays.

Answer

Create two ECS services behind the same ALB, each with a different task definition, and use sticky sessions.

Answer

Use Amazon Route 53 weighted routing policies to distribute traffic between two ALBs.

Answer

Use AWS CodeDeploy with an ECS blue/green deployment configuration that supports canary traffic shifting.

Question 10

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option C is correct because AWS Secrets Manager is designed for securely storing and rotating secrets. Option A is wrong because hardcoding credentials is insecure. Option B is wrong because environment variables can be exposed in logs. Option D is wrong because S3 is not secure for credentials without encryption.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.

Question 11

Refer to the exhibit. An IAM policy statement is attached to an AWS Lambda function's execution role. The function needs to invoke another Lambda function named 'my-function'. However, the invocation fails with an access denied error. What is the most likely cause?

Accepted Answer

The policy is attached to the wrong IAM role.. The policy allows lambda:InvokeFunction on the specific function ARN. Option B is correct because the resource ARN includes the function name, so it should work. Option A is incorrect because the ARN is correct. Option C is incorrect because the action is allowed. Option D is incorrect because the error is access denied, not a timeout.

Answer

The action should be 'lambda:*' to allow all Lambda actions.

Answer

The Lambda function has a timeout set too low.

Answer

The resource ARN is missing the function name.

Question 12

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

Accepted Answer

Amazon EFS file system. Option B is correct because EFS can be mounted as a volume in Fargate tasks and shared among containers. Option A (EBS) is not supported in Fargate. Option C (S3) is object storage, not a file system. Option D (Instance store) is ephemeral and not available in Fargate.

Answer

Amazon EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 13

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

Accepted Answer

Enable CORS in the API Gateway settings and configure the required headers.. Option B is correct because API Gateway can enable CORS by adding the appropriate headers. Option A is incorrect because CORS is not automatically enabled. Option C is incorrect because Lambda does not handle CORS headers for API Gateway. Option D is incorrect because CloudFront is not required.

Answer

Use Amazon CloudFront to proxy the API and add CORS headers.

Answer

Nothing; API Gateway automatically handles CORS.

Answer

Add CORS headers in the Lambda function code.

Question 14

The IAM policy above is attached to a user. The user tries to decrypt a KMS key with encryption context {"department": "finance"}. What will happen?

Accepted Answer

The action is allowed because the Allow statement matches the encryption context.. Option C is correct because the first statement allows decryption when the encryption context equals "finance", and the second statement denies if it does not equal "finance". For the context {"department": "finance"}, it matches both: the Allow applies, and the Deny does not because the condition is not met (it equals, not not-equals). Since an explicit Allow overrides an explicit Deny? Actually, Deny always overrides Allow. But here the Deny condition is not satisfied, so only the Allow applies. So the action is allowed. Option A is wrong because the Deny condition does not match. Option B is wrong because the Allow condition matches. Option D is wrong because the Deny does not apply.

Answer

The action is denied because the Deny statement applies to all resources.

Answer

The action is denied because there is an explicit Deny that overrides any Allow.

Answer

The action is denied because the Allow statement does not explicitly allow.

Question 15

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The application experiences occasional throttling on DynamoDB writes. The developer wants to implement a retry mechanism with exponential backoff. Which THREE steps should the developer take?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function to capture failed events.. Option A, B, and D are correct. The AWS SDK automatically retries with exponential backoff (A). The developer can also implement custom retry logic (B). DLQ helps capture failed events (D). Option C (reserved capacity) does not implement retry. Option E (SQS) is not needed for this scenario.

Answer

Use Amazon SQS to buffer write requests to DynamoDB.

Answer

Increase the DynamoDB table's provisioned write capacity.