DVA-C02 Practice Test 21 — 15 Questions

Question 1

A company uses AWS OpsWorks to manage a stack of EC2 instances. After a deployment, the application becomes unresponsive. The engineer suspects that a configuration file was not updated correctly. What is the best way to verify the deployed configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SSH into an instance and inspect the configuration files in /var/lib/aws/opsworks.. OpsWorks stores its configuration data, including the applied custom JSON and stack settings, in /var/lib/aws/opsworks on each EC2 instance. By SSHing into the instance and inspecting these files, the engineer can directly verify whether the configuration file was updated correctly after deployment, bypassing any application-level logging or abstraction.

Answer

Use AWS Systems Manager Run Command to execute a script that outputs the configuration.

Answer

Check the OpsWorks stack's logs for any JSON syntax errors in the custom JSON.

Answer

Review the application logs in Amazon CloudWatch Logs for configuration errors.

Question 2

A developer stores database credentials in Secrets Manager. The application sometimes receives AccessDeniedException from Lambda after secret rotation. What should be checked first?

Accepted Answer

Whether the Lambda execution role and KMS key policy allow access to the new secret version and key. The AccessDeniedException from Lambda after secret rotation indicates that the Lambda function cannot access the new secret version. This is most commonly caused by the Lambda execution role lacking the necessary permissions (e.g., secretsmanager:GetSecretValue) for the new secret version ARN, or the KMS key policy not granting the Lambda role access to decrypt the secret using the customer-managed KMS key. Checking these two policies first is the correct troubleshooting step because rotation creates a new version with a different ARN, and the IAM policy must allow access to all versions or use a wildcard.

Answer

Whether API Gateway caching is enabled

Answer

Whether the VPC has exactly three subnets

Answer

Whether CloudFront invalidation completed

Question 3

A developer needs to trace a request across API Gateway, Lambda, and downstream AWS service calls. Which service should be enabled?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing for requests flowing through distributed applications, including API Gateway, Lambda functions, and downstream AWS services like DynamoDB or S3. It captures trace data as the request traverses each component, allowing developers to identify performance bottlenecks and errors across the entire request path. X-Ray integrates natively with API Gateway and Lambda via the X-Ray SDK or active tracing configuration, requiring no code changes for basic tracing.

Answer

AWS Budgets

Answer

AWS Artifact

Answer

AWS License Manager

Question 4

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all objects uploaded to a specific S3 bucket must be encrypted with a specific KMS key (key ID: xyz). The developer needs to enforce this by denying any PutObject request that does not use the correct key. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific KMS key ID (e.g., `xyz`) is used for server-side encryption with AWS KMS (SSE-KMS). By including this condition in a bucket policy with a `Deny` effect, any `PutObject` request that does not specify the required key ID will be denied, meeting the security team's requirement.

Answer

kms:EncryptionContext

Answer

s3:EncryptionAlgorithm

Answer

kms:GrantOperations

Question 5

A developer wants to upload a large file (5 GB) to an Amazon S3 bucket using the AWS SDK. Which approach is MOST efficient and resilient?

Accepted Answer

Use the Multipart Upload API to upload the file in parts.. The Multipart Upload API is specifically designed for large objects (over 100 MB, recommended for 5 GB). It allows uploading a file in parallel parts, which improves throughput and resilience by enabling retries of individual failed parts without restarting the entire upload. This approach also supports pausing and resuming uploads, making it the most efficient and resilient method for a 5 GB file.

Answer

Generate a presigned URL and use a third-party tool to upload.

Answer

Invoke an AWS Lambda function to upload the file.

Answer

Use the PutObject API call with the entire file.

Question 6

A company uses AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a Lambda function without downtime. The function is part of a stack. Which action should the team take?

Accepted Answer

Update the CloudFormation stack with the new function code and deploy the stack update.. Updating the CloudFormation stack with the new Lambda function code and deploying the stack update is the correct approach because CloudFormation performs a rolling update on the Lambda function, replacing the old version with the new one without deleting the stack. This ensures zero downtime as the update is applied in place, and the function remains available throughout the process.

Answer

Create a change set and execute it after the current stack is deleted.

Answer

Manually update the Lambda function code in the console and then update the stack.

Answer

Create a new CloudFormation stack for the new function and delete the old stack.

Question 7

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

Accepted Answer

Blue/green deployment.. Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Answer

Canary deployment.

Answer

In-place deployment.

Answer

Immutable deployment.

Question 8

A developer uses AWS CodePipeline with a manual approval step before deployment. The developer wants to ensure that if a new commit is pushed while a pipeline execution is waiting for approval, the waiting execution is canceled and a new one starts with the latest commit. Which pipeline execution mode should be configured?

Accepted Answer

Superseded. The Superseded execution mode is designed to automatically cancel any in-progress pipeline execution when a new commit is pushed, and start a new execution with the latest source changes. This ensures that the manual approval step does not block newer commits, as the waiting execution is replaced by the one triggered by the latest commit. In contrast, other modes either queue or run executions in parallel, which would not cancel the waiting approval step.

Answer

Queued

Answer

Parallel

Answer

Single

Question 9

A developer is deploying a microservices application using Amazon ECS with Fargate. The application consists of multiple services that need to communicate with each other over HTTP. The developer wants to ensure that service-to-service communication is encrypted in transit and that the services can discover each other by logical service names instead of IP addresses. Which combination of AWS services should the developer use?

Accepted Answer

AWS App Mesh with AWS Cloud Map. AWS App Mesh provides a service mesh that handles service-to-service communication with encryption in transit using TLS, while AWS Cloud Map enables service discovery by logical names, allowing ECS services to resolve each other via DNS or API calls. Together, they meet the requirements for encrypted HTTP communication and logical name resolution without exposing IP addresses.

Answer

Elastic Load Balancing with AWS Systems Manager

Answer

Amazon Route 53 with AWS Direct Connect

Answer

AWS Lambda with Amazon API Gateway

Question 10

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

Accepted Answer

Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.. The Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Answer

Add an S3 bucket policy allowing the Lambda function's ARN to write objects.

Answer

Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.

Answer

Add a KMS key policy to allow the Lambda function to use a customer managed key.

Question 11

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with KMS (SSE-KMS). They want to ensure that only certain IAM roles can decrypt objects. What must be configured?

Accepted Answer

KMS key policy to allow the IAM roles to decrypt. SSE-KMS uses a customer master key (CMK) to encrypt and decrypt S3 objects. The KMS key policy is the primary access control mechanism for a CMK; it must explicitly grant the IAM roles the kms:Decrypt permission. Without this policy statement, even if the IAM roles have a policy allowing kms:Decrypt, they will be denied access because KMS key policies can override IAM permissions when the key policy does not grant access to the account's IAM principals.

Answer

IAM role policy to allow kms:Decrypt

Answer

S3 bucket policy to allow decrypt

Answer

KMS key policy to allow s3.amazonaws.com to decrypt

Question 12

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The application must remain fully available; only one instance should be taken offline at a time. The developer wants to configure the deployment to update instances one by one, ensuring that the deployment fails fast if any instance fails to deploy. Which deployment configuration should the developer choose?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime, is correct because it deploys the application to one instance at a time, ensuring that only one instance is taken offline during the deployment. This satisfies the requirement for the application to remain fully available. Additionally, this configuration fails fast: if any instance fails to deploy, the deployment stops immediately, preventing further instances from being updated.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.BlueGreen

Question 13

A company stores sensitive data in Amazon S3. The security team requires that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). The developer needs to enforce that any PutObject request that does not specify the 'x-amz-server-side-encryption' header with value 'aws:kms' is denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption equals 'aws:kms'. The condition key `s3:x-amz-server-side-encryption` in an S3 bucket policy can be used to require that the `x-amz-server-side-encryption` header is set to `aws:kms` on every PutObject request. This enforces server-side encryption with AWS KMS (SSE-KMS) at the bucket policy level, denying any request that omits or uses a different encryption header value.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN

Answer

s3:x-amz-acl equals 'bucket-owner-full-control'

Answer

s3:signatureversion equals 'AWS4-HMAC-SHA256'

Question 14

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

Accepted Answer

The message remains in the queue and becomes visible after the visibility timeout expires.. When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing. The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Answer

The message is sent to a dead-letter queue (DLQ).

Answer

The message is deleted from the queue to prevent duplicate processing.

Answer

Lambda automatically retries the function with a 1-minute delay.

Question 15

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.