DVA-C02 Practice Test 21 — 15 Questions

Question 1

A developer is setting up a CI/CD pipeline using AWS CodePipeline to deploy an application to Amazon ECS. The pipeline has a source stage that pulls code from an AWS CodeCommit repository. The developer wants the pipeline to execute only when commits are pushed to the 'main' branch. How should the developer configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the pipeline's source stage to include the branch name in the CodeCommit action configuration.. AWS CodePipeline allows you to specify a branch name directly in the source action configuration for CodeCommit. When you configure the source stage, you can set the 'BranchName' parameter to 'main', which ensures the pipeline only triggers on commits pushed to that specific branch. This is the simplest and most direct method to filter by branch without additional services or custom logic.

Answer

Create an Amazon CloudWatch Events rule that triggers the pipeline only when the branch is 'main'.

Answer

Use an AWS Lambda function in the source stage to filter the branch.

Answer

Set a branch filter pattern in the pipeline trigger settings.

Question 2

A developer is building a RESTful API using Amazon API Gateway and Lambda. The API should support CORS for a specific origin (https://example.com) and allow only GET and POST methods. Which configuration in the OPTIONS method response will satisfy these requirements?

Accepted Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST. The OPTIONS method response must include the `Access-Control-Allow-Origin` header set to the specific origin `https://example.com` to restrict CORS access, and the `Access-Control-Allow-Methods` header must list only the allowed HTTP methods (`GET,POST`). The OPTIONS method itself is a preflight request and does not need to be listed in the allowed methods; it is automatically handled by the browser. This configuration satisfies the requirement of supporting CORS for a single origin and only GET and POST methods.

Answer

Access-Control-Allow-Origin: *, Access-Control-Allow-Methods: GET,POST,OPTIONS

Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Methods: GET,POST,OPTIONS

Answer

Access-Control-Allow-Origin: https://example.com, Access-Control-Allow-Headers: Content-Type

Question 3

A company uses AWS Secrets Manager to store database credentials. The credentials must be automatically rotated every 30 days. The developer needs to configure rotation without exposing the secret to any IAM user directly. Which configuration steps should the developer take?

Accepted Answer

Create a Lambda function with rotation logic, attach an IAM role with permissions to read and update the secret, and configure Secrets Manager to invoke the function every 30 days.. AWS Secrets Manager does not provide a built-in Lambda function for rotating database credentials; you must create your own Lambda function that contains the rotation logic (e.g., querying the database, creating a new credential, and updating the secret). The Lambda function must be attached to an IAM role with permissions to read and update the secret, and Secrets Manager invokes this function based on the rotation schedule (every 30 days). This ensures the secret is never exposed directly to any IAM user, as only the Lambda function interacts with the secret programmatically.

Answer

Enable automatic rotation and choose a rotation interval of 30 days. Secrets Manager will automatically rotate the secret using a built-in Lambda function.

Answer

Use AWS Certificate Manager (ACM) to rotate the secret automatically every 30 days.

Answer

Store the secret in AWS Systems Manager Parameter Store and set a schedule to rotate it using a CloudWatch Events rule.

Question 4

A developer is using AWS CodeDeploy with a blue/green deployment strategy for an EC2 Auto Scaling group. The deployment must automatically roll back if any of the new instances fail a health check within the first 10 minutes after deployment. Which configuration should the developer set?

Accepted Answer

Configure the deployment group to use an alarm-based rollback with a CloudWatch alarm on the ELB health check. The requirement is to automatically roll back based on health check failures within a specific time window after deployment. AWS CodeDeploy supports alarm-based rollbacks where you can configure a CloudWatch alarm that monitors the ELB health check status of the new instances. When the alarm triggers within the configured monitoring period (e.g., 10 minutes), CodeDeploy automatically rolls back the deployment to the previous version, meeting the exact condition described.

Answer

Set the deployment configuration to 'CodeDeployDefault.EC2AllAtOnce'

Answer

Enable automatic rollback in the deployment group configuration and set the event to 'DEPLOYMENT_FAILURE' or 'DEPLOYMENT_STOP_ON_REQUEST'

Answer

Configure the deployment group with a 'LoadBalancerInfo' and enable 'originalInstanceTermination' for rollback

Question 5

A developer is using AWS Elastic Beanstalk to deploy a web application. The developer wants to run database migration scripts as part of the deployment process before the new application version starts serving traffic. Which Elastic Beanstalk configuration file should the developer use to define the migration commands?

Accepted Answer

.ebextensions/.config with container_commands. `container_commands` in `.ebextensions/.config` runs commands after the application and web server have been set up but before the new application version starts serving traffic. This makes it the ideal place to execute database migration scripts that must complete before the environment accepts requests, ensuring data consistency.

Answer

.ebextensions/<filename>.config with commands

Answer

Procfile

Answer

buildspec.yml

Question 6

A developer is building a RESTful API using Amazon API Gateway (REST API) and AWS Lambda. The API receives a large number of requests with duplicate payloads within a short time window. To improve performance and reduce costs, the developer wants to ensure that if the same request (based on a unique client ID) is sent within 5 minutes, the Lambda function is not invoked again, and the previously calculated response is returned. Which API Gateway feature should the developer use?

Accepted Answer

Enable API caching on the stage with a TTL of 300 seconds and configure the client ID as a cache key parameter.. Amazon API Gateway (REST API) supports response caching at the stage level. By enabling API caching with a TTL of 300 seconds (5 minutes) and specifying the client ID as a cache key parameter, identical requests with the same client ID within the TTL will return the cached response without invoking the Lambda function. This reduces latency and cost.

Answer

Enable request validation to reject duplicate requests.

Answer

Configure a usage plan with a throttle rate to limit requests from each client.

Answer

Enable stage variables to store the previous response.

Question 7

A developer is building a web application that uses Amazon DynamoDB as the database. The application needs to store user session data and must support eventual consistency reads for most use cases, but strongly consistent reads for critical operations. The developer wants to minimize costs. Which read capacity unit (RCU) configuration should the developer use?

Accepted Answer

Use on-demand capacity mode to pay per request, avoiding provisioned capacity costs.. On-demand capacity mode charges per request (read/write), eliminating the need to provision fixed RCUs. For a session store with mixed consistency requirements, on-demand is cost-effective when traffic is unpredictable or low, as you only pay for actual reads and writes. Eventually consistent reads consume half the RCUs of strongly consistent reads, but on-demand pricing automatically accounts for this difference without manual configuration.

Answer

Use provisioned capacity with 1 RCU per item, since eventually consistent reads consume half the RCUs.

Answer

Use provisioned capacity with sufficient RCUs to handle strongly consistent reads, as they consume the same as eventually consistent.

Answer

Use provisioned capacity with enough RCUs for peak traffic, and use DynamoDB Accelerator (DAX) for caching.

Question 8

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group of EC2 instances. The developer wants to minimize the number of instances that are taken out of service at any given time during the deployment. Which predefined deployment configuration should the developer use?

Accepted Answer

OneAtATime. The OneAtATime deployment configuration shifts traffic to one new instance at a time, ensuring that only a single instance is taken out of service during the deployment. This minimizes the number of instances removed from the Auto Scaling group at any given moment, which directly meets the developer's requirement to reduce service disruption.

Answer

AllAtOnce

Answer

HalfAtATime

Answer

Custom with 50% at a time

Question 9

Which TWO are benefits of using AWS CloudFormation for infrastructure deployment? (Choose two.)

Accepted Answer

Infrastructure is provisioned consistently across environments.. AWS CloudFormation uses templates to define infrastructure as code, ensuring that the same set of resources is provisioned identically across multiple environments (e.g., dev, test, prod). This eliminates configuration drift and manual errors by applying the same template consistently, which is a core benefit of infrastructure as code.

Answer

Automatically enforces compliance rules.

Answer

Replaces the need for a CI/CD pipeline.

Answer

Provides real-time monitoring of deployed resources.

Question 10

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption with a specific AWS KMS customer managed key (CMK). The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not use the specified KMS key. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific AWS KMS customer managed key (CMK) ARN is used for server-side encryption on S3 PutObject requests. By using this condition key in a Deny statement, you can reject any upload that does not specify the required KMS key ID, ensuring encryption compliance.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

kms:KeyArn

Question 11

A developer is using AWS CodeDeploy to deploy an application to an Amazon ECS service using the Fargate launch type. The developer wants to ensure that the deployment rolls back automatically if the new task set fails health checks. Which configuration should the developer set?

Accepted Answer

Enable rollback in the deployment group settings.. Enabling rollback in the deployment group settings allows CodeDeploy to automatically revert the deployment to the previous working task set if the new task set fails health checks. This is a native feature of CodeDeploy that monitors the health of the ECS service and triggers a rollback without manual intervention.

Answer

Set the deployment type to in-place.

Answer

Set the deployment configuration to CodeDeployDefault.OneAtATime.

Answer

Configure CloudWatch alarms to trigger a rollback.

Question 12

A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?

Accepted Answer

The user's IAM user policy does not explicitly allow the required S3 action. When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.

Answer

The bucket policy does not have a principal of '*' to allow external accounts

Answer

The bucket is in a different region than the user's account

Answer

The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)

Question 13

A developer needs to securely pass a secret API key to an AWS Lambda function. What is the MOST secure and recommended approach?

Accepted Answer

Store the API key in AWS Secrets Manager and retrieve it in the Lambda function code.. AWS Secrets Manager is a dedicated service for securely storing and managing secrets like API keys. It integrates natively with Lambda, allowing retrieval at runtime with minimal permissions using IAM roles. Option A (DynamoDB) is less secure because it requires managing encryption and access policies manually, and the secret might be exposed in query logs. Option B (hardcoding) is insecure as the key is visible in source code and version control. Option C (environment variables) can be viewed in the Lambda console and CloudWatch Logs, and they are not encrypted by default unless using encryption helpers. Therefore, Secrets Manager (Option D) is the most secure and recommended approach.

Answer

Store the API key in an Amazon DynamoDB table and query it from the Lambda function.

Answer

Hardcode the API key in the Lambda function code.

Answer

Store the API key in an environment variable of the Lambda function.

Question 14

A company runs a containerized application on Amazon ECS using Fargate launch type. The application needs to read and write files to a shared file system across multiple tasks. The development team wants a solution that provides high throughput and is POSIX-compliant. Which storage solution should the team use?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant shared file system that can be mounted concurrently by multiple Amazon ECS tasks using the Fargate launch type. EFS uses the NFSv4.1 protocol, supports high throughput (up to 10 GB/s with Bursting or Provisioned Throughput modes), and automatically scales storage capacity as files are added or removed, making it ideal for shared read/write workloads across containers.

Answer

Amazon S3 with mountpoint-s3

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon FSx for Windows File Server

Question 15

A developer is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database instance that is included in the Elastic Beanstalk environment. The developer wants to update the application code without affecting the database. What is the recommended approach?

Accepted Answer

Decouple the database from the Elastic Beanstalk environment by creating a separate RDS instance and connecting the application to it externally.. When an RDS instance is included in an Elastic Beanstalk environment, it is tied to the environment's lifecycle. If the environment is terminated or rebuilt, the database is also deleted. Decoupling the database by creating a standalone RDS instance and connecting the application to it externally ensures the database persists independently of application deployments, allowing code updates without risking data loss.

Answer

Update the application code directly on the EC2 instances without redeploying the environment.

Answer

Create a new environment configuration, update the code, and swap the CNAME of the environments.

Answer

Use Elastic Beanstalk's platform updates while keeping the database attached to the environment.