DVA-C02 Practice Test 23 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda. The function needs to access an S3 bucket to read a configuration file. What is the best way to provide the Lambda function with the bucket name?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the bucket name in an environment variable for the Lambda function.. AWS Lambda environment variables provide a secure, configurable, and decoupled way to pass the S3 bucket name to the function without hardcoding it in the code. This follows the principle of infrastructure as code and allows the same function code to be reused across different environments (e.g., dev, staging, prod) by simply changing the environment variable value. Environment variables are encrypted at rest by default using AWS KMS, ensuring the bucket name is not exposed in plaintext within the code repository.

Answer

Hardcode the bucket name in the Lambda function code.

Answer

Read the bucket name from a text file stored in the same bucket.

Answer

Use a KMS key to encrypt the bucket name and decrypt it in the function.

Question 2

A team is using AWS CodePipeline to deploy a critical application to Amazon ECS. The pipeline has a deployment stage that uses Amazon ECS (Blue/Green) action with CodeDeploy. Recently, the deployment failed because the new task set did not become healthy within the specified timeout. The team wants to ensure that future deployments automatically roll back if the health check fails. What should the team do?

Accepted Answer

Modify the CodeDeploy deployment group to enable automatic rollback when a deployment fails. The deployment will automatically revert to the last successful deployment.. AWS CodeDeploy allows you to configure automatic rollbacks in the event of a deployment failure. If a new task set fails to become healthy within the specified timeout during an Amazon ECS blue/green deployment, CodeDeploy marks the deployment as failed. By enabling the 'Roll back when a deployment fails' option in the CodeDeploy deployment group, CodeDeploy will automatically roll back the deployment to the last known successful revision without requiring manual intervention or custom CloudWatch alarms.

Answer

Create a CloudWatch alarm that triggers when the healthy task count of the ECS service falls below a threshold. Configure the CodeDeploy deployment group to automatically roll back when this alarm is in ALARM state.

Answer

Increase the deployment timeout in the CodeDeploy deployment configuration to allow more time for the new task set to become healthy.

Answer

Configure the ECS service to automatically roll back to the previous task definition if the deployment fails. Use the ECS service's deployment circuit breaker.

Question 3

A developer is building a web application that requires user authentication. The application will run on Amazon EC2 instances behind an Application Load Balancer. The developer wants to offload authentication to a managed service that supports social login providers. Which AWS service should the developer use?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications, providing user authentication, authorization, and support for social login providers (e.g., Google, Facebook, Amazon) via OAuth 2.0 and OpenID Connect. It offloads the entire authentication workflow from the EC2 instances and ALB, integrating seamlessly with the ALB's authentication action to validate tokens before traffic reaches the application.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service

Answer

AWS Single Sign-On

Question 4

A company is building a RESTful API using Amazon API Gateway and AWS Lambda. The API must allow users to authenticate using an identity provider that supports OpenID Connect (OIDC). The developer wants to offload authentication and authorization to API Gateway. Which API Gateway feature should the developer use?

Accepted Answer

Native JWT authorizer (HTTP API). The Native JWT authorizer for HTTP APIs in API Gateway directly validates JSON Web Tokens (JWTs) from an OIDC-compliant identity provider without requiring custom code. This offloads both authentication and authorization to API Gateway by configuring the issuer URL and audience, matching the requirement to use an OIDC provider.

Answer

Amazon Cognito User Pools authorizer

Answer

Custom Lambda authorizer

Answer

AWS IAM authorizer

Question 5

A developer wants to enforce that all requests to an Amazon S3 bucket must use HTTPS (TLS). The bucket is used for static website hosting. Which bucket policy condition should be used to deny requests that do not use HTTPS?

Accepted Answer

"aws:SecureTransport": "false". The `aws:SecureTransport` condition key evaluates to `false` when the request is not sent over HTTPS (TLS). By using a Deny effect with this condition set to `false`, the policy blocks any HTTP requests to the S3 bucket, ensuring all traffic uses encrypted connections. This is a standard approach for enforcing TLS on S3 buckets, including those used for static website hosting.

Answer

"aws:SecureTransport": "true"

Answer

"aws:SourceVpc": "true"

Answer

"aws:Referer": "https"

Question 6

A developer is designing an application that will process credit card payments and store them temporarily in an Amazon DynamoDB table. The developer must ensure that the payment data is encrypted at rest and that the encryption key is managed by the company's security team using AWS KMS. Which type of encryption should the developer enable on the DynamoDB table?

Accepted Answer

Server-side encryption with a customer-managed KMS key. The requirement specifies that the encryption key must be managed by the company's security team. Server-side encryption (SSE) with a customer-managed KMS key allows the company to create, rotate, and control access to the KMS key used to encrypt the DynamoDB table at rest. This gives the security team full control over the encryption key lifecycle, meeting the stated requirement.

Answer

Server-side encryption with an AWS managed KMS key

Answer

Client-side encryption

Answer

Static key encryption

Question 7

A developer is writing an AWS Lambda function that processes files uploaded to an S3 bucket. The function should only be triggered when a new object is created in a specific subfolder (e.g., /uploads/). Which S3 event notification configuration should the developer use?

Accepted Answer

Configure the event notification with a prefix filter set to 'uploads/' and event type 's3:ObjectCreated:*'.. S3 event notifications support prefix filtering, which allows you to specify a key prefix (e.g., 'uploads/') so that only object creation events in that subfolder trigger the Lambda function. By setting the event type to 's3:ObjectCreated:*', the function responds to all object creation operations (PUT, POST, Copy, etc.) within the filtered path, meeting the requirement precisely without unnecessary invocations.

Answer

Configure a single event notification for all objects and filter on the prefix inside the Lambda function.

Answer

Configure the event notification using object tags to filter events.

Answer

Use AWS CloudTrail to detect S3 PutObject events and trigger Lambda.

Question 8

A company stores sensitive documents in an Amazon S3 bucket. The security team requires that all objects uploaded must be encrypted at rest using a specific customer-managed AWS KMS key (key-id: 1234-5678). The developer must enforce this by denying any PutObject request that does not use the correct key. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id with value 'arn:aws:kms:us-east-1:123456789012:key/1234-5678'. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` allows you to enforce that a specific customer-managed AWS KMS key (identified by its full ARN) is used for server-side encryption. By denying PutObject requests that do not match this key ID, the security team ensures all uploaded objects are encrypted at rest with the required KMS key.

Answer

s3:x-amz-server-side-encryption with value 'aws:kms'

Answer

s3:x-amz-acl with value 'bucket-owner-full-control'

Answer

aws:SourceArn with value the bucket ARN

Question 9

A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the encryption condition is not met.. An S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.

Answer

Configure default encryption on the bucket with SSE-KMS.

Answer

Enable S3 Object Lock.

Answer

Use a CloudTrail trail to monitor uploads.

Question 10

A company is running a monolithic application on an EC2 instance. The application currently stores session state in local memory on the instance. The company plans to scale the application horizontally by adding more instances behind a load balancer. What change is required to ensure that session state is preserved across requests?

Accepted Answer

Use Amazon ElastiCache to store session state externally.. Amazon ElastiCache provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store session state externally. By moving session data out of the EC2 instance's local memory and into a shared, low-latency data store, all instances behind the load balancer can access the same session state, ensuring persistence across requests regardless of which instance handles the request.

Answer

Store session data in Amazon S3 and retrieve it on each request.

Answer

Increase the EC2 instance size to handle more sessions per instance.

Answer

Use an Amazon RDS database to store session state.

Question 11

A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?

Accepted Answer

The bucket has 'Block all public access' settings enabled.. The 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.

Answer

The bucket is located in a different AWS region than the website endpoint.

Answer

The bucket name does not match the domain name.

Answer

The bucket is not configured with CloudFront as a content delivery network.

Question 12

A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?

Accepted Answer

The role in Account B must have an IAM policy that allows the S3 actions.. Cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.

Answer

Add a bucket policy that denies access to all principals.

Answer

Disable block public access settings on the bucket.

Answer

Enable ACLs on the S3 bucket.

Question 13

A company wants to ensure that no Amazon S3 buckets in the AWS account can be made publicly accessible, even if a bucket policy or ACL is later configured to allow public access. Which AWS feature should the developer enable to enforce this at the account level?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the correct choice because it provides account-level settings that override any bucket-level policies or ACLs that would grant public access. When enabled at the account level, these settings apply to all current and future S3 buckets, effectively preventing any bucket from becoming publicly accessible regardless of subsequent configuration changes.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Bucket Policy with Deny clause

Question 14

A developer is building a serverless application using AWS Lambda. The function needs to access an S3 bucket to read a configuration file. What is the best way to provide the Lambda function with the bucket name?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement a DynamoDB table to track processed objects.. S3 event notifications can occasionally deliver duplicate events (at-least-once semantics). By storing the unique object key (or ETag) in a DynamoDB table with a TTL, the Lambda function can check if the object has already been processed and skip duplicate invocations, ensuring idempotent processing.

Answer

Enable S3 event notifications with a suffix filter.

Answer

Use an SQS queue to decouple S3 events.

Answer

Increase the Lambda function's timeout.

Question 15

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function that needs to access an Amazon DynamoDB table. The developer wants to grant the Lambda function the minimum required permissions to read and write items in the table. Which resource should the developer use to define the IAM permissions?

Accepted Answer

AWS::Serverless::Function Policies property. The AWS::Serverless::Function resource's Policies property allows you to attach IAM policies directly to the Lambda function's execution role in a declarative manner. By specifying a policy statement with dynamodb:GetItem, dynamodb:PutItem, etc., and the ARN of the DynamoDB table, you grant the minimum required permissions for read and write access without manually creating an IAM role. SAM automatically creates and associates the IAM role with the function, simplifying permission management.

Answer

AWS::DynamoDB::Table

Answer

AWS::IAM::Role

Answer

AWS::Lambda::Permission