DVA-C02 Practice Test 22 — 15 Questions

Question 1

A developer needs to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS Secrets Manager API, allowing the function to retrieve credentials at runtime without hardcoding them, and supports automatic rotation using built-in or custom Lambda rotation functions. This makes it the ideal choice for securely handling database credentials in a serverless application.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

Amazon DynamoDB

Question 2

A company has a DynamoDB table that stores personally identifiable information (PII). A developer needs to allow a Lambda function to read and write to this table. What is the MOST secure way to grant the Lambda function access?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read/write access and attach it to the Lambda function.. Attaching an IAM role with a least-privilege policy to the Lambda function is the AWS-recommended, most secure approach. Lambda assumes the execution role automatically at invocation, and no long-lived credentials are stored anywhere. This eliminates credential leakage risk and follows the principle of least privilege.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's IAM role.

Answer

Create an IAM user with programmatic access and embed the credentials in the Lambda environment variables.

Answer

Have the Lambda function assume a role using AWS STS each time it runs.

Question 3

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Answer

Amazon SNS

Question 4

A developer monitors an AWS Lambda function that processes records from an Amazon SQS queue and writes results to an Amazon DynamoDB table. CloudWatch Logs show that execution time has increased over the past week, and the function frequently times out at the 5-minute timeout. The function's code has not been changed recently. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 write capacity units (WCUs). What action will MOST effectively reduce the function's execution time?

Accepted Answer

Increase the write capacity units (WCUs) on the DynamoDB table.. The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient write capacity. When writes are throttled, the Lambda function must retry, which increases execution time and can lead to timeouts. Increasing the WCUs on the DynamoDB table directly addresses the root cause by allowing the function to write without throttling, thereby reducing execution time.

Answer

Increase the Lambda function's timeout to 10 minutes.

Answer

Increase the Lambda function's memory allocation to 3008 MB.

Answer

Use an Amazon SQS FIFO queue instead of a standard queue for the Lambda trigger.

Question 5

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The deployment configuration is set to CodeDeployDefault.OneAtATime. What is the most likely cause of this failure?

Accepted Answer

The deployment failed on a single instance, causing the overall deployment to fail because the minimum number of healthy hosts was not maintained.. CodeDeployDefault.OneAtATime deploys to one instance at a time. The deployment stops immediately if a single instance fails, because the deployment configuration expects no failures. The error 'too many individual instances failed' is triggered by that single failure, since the deployment cannot proceed to the next instance without violating the minimum healthy hosts requirement, which is set to maintain availability.

Answer

The instances in the Auto Scaling group are not running a supported operating system.

Answer

The deployment configuration should be changed to AllAtOnce to avoid this error.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Question 6

A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?

Accepted Answer

The user must have an IAM policy allowing the required S3 actions on that bucket. A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.

Answer

The bucket must be made public

Answer

The user must use a different AWS CLI profile

Answer

The resource-based policy must explicitly allow the user's ARN

Question 7

A company manages multiple AWS accounts using AWS Organizations. A developer needs to allow an IAM role in the production account to read objects from an S3 bucket in the development account. The bucket is encrypted with an AWS KMS customer managed key (CMK) in the development account. Which of the following is required to enable this cross-account access?

Accepted Answer

Add a bucket policy allowing the production account's IAM role and a KMS key policy granting the same role.. Cross-account access to an S3 bucket encrypted with a KMS customer managed key requires both a bucket policy that grants the production account's IAM role s3:GetObject permission and a KMS key policy that grants the same role kms:Decrypt permission. The bucket policy authorizes the S3 operation, while the key policy authorizes decryption of the object; both policies must explicitly allow the cross-account principal.

Answer

Grant the production account's root user access to the KMS key and the S3 bucket.

Answer

Create an IAM role in the production account with permissions to access the S3 bucket and KMS key.

Answer

Enable S3 bucket logging to allow cross-account access.

Question 8

A developer is storing an API secret for a third-party service in AWS Secrets Manager. The secret needs to be accessed by an AWS Lambda function that runs in a VPC. The Lambda function must have the minimum required permissions. Which IAM policy statement should the developer attach to the Lambda execution role?

Accepted Answer

A policy that grants secretsmanager:GetSecretValue for the specific secret ARN and includes a condition for aws:SourceVpce to restrict access to the VPC endpoint. It grants the minimum required permission (secretsmanager:GetSecretValue) scoped to the specific secret ARN, and uses the aws:SourceVpce condition key to restrict access to the VPC endpoint used by the Lambda function. This ensures that only requests originating from the specified VPC endpoint can retrieve the secret, aligning with the principle of least privilege and the requirement that the Lambda function runs in a VPC.

Answer

A policy that grants secretsmanager:GetSecretValue for all secrets in the account

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for aws:SourceIp

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for ec2:Vpc

Question 9

A company has a microservices architecture running on Amazon ECS with Fargate. Each service exposes an API through an Application Load Balancer (ALB). The development team needs to implement canary deployments for one of the services. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS CodeDeploy with an ECS blue/green deployment configuration that supports canary traffic shifting.. AWS CodeDeploy natively supports blue/green and canary deployments (e.g., ECSCanary10Percent5Minutes) for Amazon ECS. While ALB weighted target groups and ECS Task Sets are the underlying mechanisms used during these deployments, managing them manually (Option C) requires using the EXTERNAL deployment controller and writing custom orchestration code, which is highly inefficient. CodeDeploy automates this entire process seamlessly.

Answer

Create two ECS services behind the same ALB, each with a different task definition, and use sticky sessions.

Answer

Use Amazon Route 53 weighted routing policies to distribute traffic between two ALBs.

Answer

Configure the ALB to use weighted target groups, each pointing to a different task set of the same ECS service.

Question 10

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 11

The exhibit shows an IAM policy attached to a Lambda function's execution role. The function writes objects to an S3 bucket that is encrypted with a KMS key (the key specified in the policy). When the function tries to write an object, it receives an access denied error. What is the MOST likely missing permission?

Accepted Answer

kms:GenerateDataKey is missing.. When writing an object to an S3 bucket encrypted with SSE-KMS, the caller must have kms:GenerateDataKey permission so S3 can obtain a data key to encrypt the object. Without it, the write fails with AccessDenied even if s3:PutObject is granted. The other options either describe a different failure mode or a permission not required for a simple PutObject.

Answer

The KMS key policy does not allow the Lambda function role.

Answer

s3:GetObject is missing for the bucket.

Answer

kms:ReEncrypt is missing.

Question 12

A company has a legacy application that generates log files on an EC2 instance. The developer needs to stream these log files to Amazon CloudWatch Logs in real time. The developer installed the CloudWatch agent on the EC2 instance and configured it to monitor the log files. However, the logs are not appearing in CloudWatch Logs. The developer checks the agent status and sees that the agent is running. What is the most likely cause of this issue?

Accepted Answer

The EC2 instance does not have an IAM role with the necessary CloudWatch Logs permissions.. The CloudWatch agent uses the EC2 instance's IAM role credentials to call the CloudWatch Logs API (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). If the instance profile lacks these permissions, the agent process runs but every API call is rejected with AccessDenied, so logs never appear. This is the most common cause when the agent status shows running but no data arrives.

Answer

The log file format is not compatible with the CloudWatch agent.

Answer

The EC2 instance is in a private subnet without internet access.

Answer

The CloudWatch agent configuration file does not specify an existing log group.

Question 13

The exhibit shows the output of invoking a Lambda function from the AWS CLI. The function returned a status code of 200 but included a FunctionError field set to 'Unhandled'. What does this indicate?

Accepted Answer

The function executed but threw an unhandled exception.. When a Lambda function returns a status code of 200 but includes a FunctionError field set to 'Unhandled', it means the function was invoked successfully but encountered an unhandled exception during execution. The 'Unhandled' error indicates that the function threw an error that was not caught by the function's code, causing the Lambda runtime to report it. The status code 200 refers to the HTTP response from the Lambda service, not the function's execution status.

Answer

The function returned an error in the LogResult field.

Answer

The function timed out during execution.

Answer

The function was invoked but there was a network error.

Question 14

A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?

Accepted Answer

The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.. AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.

Answer

The CMK directly encrypts the object data.

Answer

When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.

Answer

Each object is encrypted with a unique data key that is stored alongside the object.

Question 15

A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?

Accepted Answer

Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.. The most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.

Answer

Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.

Answer

Share the access keys of an IAM user in Account A with the user in Account B.

Answer

Attach an IAM policy to the user in Account B that grants access to the S3 bucket.