DVA-C02 Practice Test 22 — 15 Questions

Question 1

A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.

Answer

AWS Systems Manager Parameter Store (SecureString)

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM) roles

Question 2

A Lambda function must share reusable validation code across several functions without packaging the same library into every deployment artifact. What should be used?

Accepted Answer

Lambda layer. Lambda layers allow you to centrally manage reusable code (e.g., validation libraries) and share it across multiple Lambda functions without packaging it into each deployment artifact. When you attach a layer to a function, the layer's content is extracted into the /opt directory, making it available at runtime. This avoids duplication and simplifies updates, as you only need to update the layer version rather than every function's deployment package.

Answer

API Gateway usage plan

Answer

S3 multipart upload

Answer

CloudWatch metric filter

Question 3

A company is deploying a new microservice on AWS Lambda that processes high-resolution images and stores results in Amazon S3. The Lambda function currently uses 1024 MB of memory and has a timeout of 2 minutes. During peak load, many invocations are timing out. The function is CPU-bound during image processing. Which change is MOST likely to reduce timeouts without increasing costs unnecessarily?

Accepted Answer

Increase the function memory to 2048 MB.. Increasing memory from 1024 MB to 2048 MB proportionally increases CPU allocation in AWS Lambda (up to 1.7 GHz per vCPU at 1769 MB). Since the function is CPU-bound, this directly reduces processing time, mitigating timeouts without the cost spike of 3008 MB. The cost increase is linear with memory, so doubling memory doubles cost per invocation, but the reduced duration often offsets this, keeping total cost similar or lower.

Answer

Increase the function memory to 3008 MB.

Answer

Enable provisioned concurrency to reduce cold starts.

Answer

Increase the function timeout to 5 minutes.

Question 4

A developer is troubleshooting an IAM policy that is not working as expected. The policy has an Allow effect for s3:PutObject but the user gets AccessDenied. The user also has a Deny policy attached. What is the most likely reason?

Accepted Answer

An explicit Deny in an IAM policy overrides the Allow. AWS IAM evaluates all policies (identity-based, resource-based, and SCPs) and an explicit Deny always overrides any Allow, regardless of the order in which the policies are written. In this scenario, even though the user has an Allow effect for s3:PutObject, the attached Deny policy explicitly denies the action, resulting in an AccessDenied error. This is a fundamental rule of AWS authorization logic: an explicit Deny cannot be overridden by any Allow.

Answer

The resource-based policy on S3 denies access

Answer

The Allow policy is evaluated before the Deny policy

Answer

An SCP denies the action

Question 5

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications are the correct trigger because they natively support event-driven architectures where S3 object creation events (e.g., s3:ObjectCreated:Put) can directly invoke a Lambda function. This enables asynchronous processing of uploaded images without any intermediate polling or custom integration, ensuring fault tolerance through Lambda's built-in retry mechanism and dead-letter queue (DLQ) support.

Answer

Amazon SQS

Answer

Amazon API Gateway

Answer

AWS Step Functions

Question 6

Drag and drop the steps to configure an S3 bucket for static website hosting in the correct order.

Accepted Answer

Create an S3 bucket, enable static website hosting, configure index and error documents, set appropriate bucket policy for public read access, upload website content. First create the bucket, then enable static website hosting, configure index and error documents, set appropriate permissions, and finally upload content.

Answer

Create an S3 bucket, configure index and error documents, enable static website hosting, set bucket policy, upload content

Answer

Create an S3 bucket, enable static website hosting, set bucket policy, upload content, configure index and error documents

Answer

Create an S3 bucket, set bucket policy, enable static website hosting, configure index and error documents, upload content

Question 7

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

Accepted Answer

Use AWS CloudFormation to define and deploy the API Gateway.. AWS CloudFormation provides infrastructure as code (IaC) capabilities that allow you to define the entire API Gateway configuration, including resources, methods, integrations, and deployment stages, in a template. When integrated with CodePipeline, CloudFormation can automatically create or update the API Gateway and trigger a deployment as part of the CI/CD pipeline, ensuring consistent and repeatable deployments without manual intervention.

Answer

Use AWS Lambda to update the API Gateway configuration.

Answer

Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.

Answer

Use AWS CodeBuild to compile and deploy the API Gateway configuration.

Question 8

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. An HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 9

An API backed by Lambda returns high p95 latency after deployment. Which two telemetry sources are most useful first?

Accepted Answer

CloudWatch Lambda duration/init duration/logs. CloudWatch Lambda duration and init duration metrics directly measure the time your function spends executing and initializing, which are the primary drivers of p95 latency. Logs can reveal cold starts, timeouts, or inefficient code paths that cause high latency. These are the most immediate telemetry sources to identify performance bottlenecks in the Lambda function itself.

Answer

AWS Billing console only

Answer

S3 Inventory reports

Question 10

A developer is using AWS CodeCommit as a source repository. They want to automatically build and test code whenever a new branch is created. Which AWS service should they use to trigger the pipeline?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture AWS CodeCommit repository events, such as the creation of a new branch. By setting a rule that matches the 'Reference Created' event type, you can automatically trigger an AWS CodePipeline pipeline execution, enabling continuous integration for new branches.

Answer

Amazon S3 event notification

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Lambda

Question 11

A service needs loosely coupled asynchronous communication where one producer sends events to many different AWS service targets using rules. Which service fits best?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is a serverless event bus service that enables loosely coupled asynchronous communication. It allows a single producer to publish events, and then uses rules to route those events to multiple AWS service targets (e.g., Lambda, SQS, Step Functions) simultaneously, fulfilling the requirement exactly.

Answer

Amazon EFS

Answer

AWS CloudHSM

Answer

AWS DataSync

Question 12

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The EC2 instances are in an Auto Scaling group. What is the MOST likely cause?

Accepted Answer

The target group health checks are failing.. The intermittent 503 errors indicate that the ALB temporarily has no healthy targets to forward requests to. When target group health checks fail, the ALB marks instances as unhealthy and stops routing traffic to them, causing a 503 response if all instances are unhealthy. This aligns with the Auto Scaling group potentially launching new instances that haven't passed health checks yet, or existing instances failing health checks due to application overload or misconfiguration.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB DNS name is not resolving.

Answer

The security group for the ALB is blocking traffic.

Question 13

A developer needs to prevent accidental public access to all S3 buckets in an account. Which account-level control should be enabled?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is an account-level control that provides a centralized way to enforce that no S3 buckets or objects in the account can be made publicly accessible, regardless of individual bucket policies or ACLs. This setting overrides any bucket-level public access settings, effectively preventing accidental exposure of data to the internet.

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Answer

S3 Object Lambda

Question 14

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway endpoint and an AWS Lambda function. The developer wants to define a stage name for the API Gateway deployment. Which section of the SAM template should the developer use?

Accepted Answer

Globals. The `Globals` section in an AWS SAM template allows you to define shared configuration settings that apply to all resources in the template. For API Gateway, you can set properties like `StageName` under `Globals.Api`, which will be inherited by all API Gateway resources defined in the template, ensuring consistent stage naming without repeating the configuration.

Answer

Conditions

Answer

Outputs

Answer

Parameters

Question 15

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.