DVA-C02 Practice Test 23 — 15 Questions

Question 1

An ECS blue/green deployment with CodeDeploy and an Application Load Balancer fails because the replacement task set never receives test traffic. Which configuration should be checked?

Accepted Answer

The test listener and target group mapping in the deployment group. In an ECS blue/green deployment with CodeDeploy and an Application Load Balancer, the test listener and its associated target group are responsible for routing test traffic to the replacement task set. If the replacement task set never receives test traffic, the most likely cause is that the test listener is not correctly mapped to the target group in the CodeDeploy deployment group configuration. This mapping ensures that traffic from the test listener is directed to the replacement task set during the deployment lifecycle.

Answer

S3 bucket versioning

Answer

Lambda provisioned concurrency

Answer

DynamoDB TTL

Question 2

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The bucket policy also grants access to the role. An application running on the instance is unable to read objects. The instance has the correct instance profile. What is the MOST likely cause?

Accepted Answer

The bucket policy has a condition that does not match the request context.. The most likely cause is that the bucket policy includes a condition (e.g., aws:SourceIp, aws:SourceVpce, or aws:SecureTransport) that does not match the request context from the EC2 instance. Even though the IAM role grants access, the bucket policy's explicit condition denies the request if the condition key evaluates to false, resulting in an implicit deny. This is a common misconfiguration where the role has permissions but the bucket policy's conditions are too restrictive.

Answer

The EC2 instance's security group blocks outbound traffic to S3.

Answer

The S3 bucket is in a different AWS account.

Answer

The instance profile is not attached to the EC2 instance.

Question 3

An application uses DynamoDB Streams to trigger downstream processing. The processor must receive both old and new item images after updates. Which stream view type should be configured?

Accepted Answer

NEW_AND_OLD_IMAGES. B is correct because DynamoDB Streams must be configured with the NEW_AND_OLD_IMAGES stream view type to capture both the item's state before and after a write operation (update, insert, or delete). This ensures the downstream processor receives the complete old and new item data, which is required for use cases like auditing, change data capture, or reconciling state changes.

Answer

KEYS_ONLY

Answer

NEW_IMAGE only

Answer

OLD_IMAGE only

Question 4

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

Accepted Answer

Use the multipart upload API.. Objects larger than 100 MB should be uploaded using the multipart upload API to improve throughput and provide resilience against network failures. The multipart upload API allows the 200 MB object to be split into parts, uploaded in parallel, and then assembled, which is more efficient and reliable than a single PutObject operation for objects over 5 GB or for large objects in general.

Answer

Enable S3 Transfer Acceleration and use the PutObject API.

Answer

Use the PutObject API operation.

Answer

Use a pre-signed URL and upload using HTTP PUT.

Question 5

An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?

Accepted Answer

The task execution role does not have permissions to pull from ECR.. When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.

Answer

The task role does not have permissions to access ECR.

Answer

The ECS cluster does not have permissions to access ECR.

Answer

The ECS service role does not have permissions to access ECR.

Question 6

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The KMS key policy does not grant the IAM user/role permissions to use the key.. When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.

Answer

The S3 bucket's object ownership is set to BucketOwnerPreferred.

Answer

The KMS key is in a different AWS Region than the S3 bucket.

Answer

The S3 bucket policy denies PutObject without encryption.

Question 7

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Answer

Amazon EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 8

A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?

Accepted Answer

Modify the bucket policy to remove the public statement and use IAM policies for access.. The bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable S3 Object Ownership and use ACLs.

Question 9

A CodePipeline source stage should start when code is pushed to a repository, without scheduled polling. Which integration pattern should be used?

Accepted Answer

Event-based trigger from the source provider/EventBridge integration. AWS CodePipeline can integrate with Amazon EventBridge to listen for repository events (e.g., push events from CodeCommit, GitHub, or Bitbucket) and automatically start the pipeline. This event-driven pattern eliminates the need for scheduled polling, providing near-instantaneous execution when code changes are detected.

Answer

Manual approval only

Answer

A cron job on an EC2 instance

Answer

CloudWatch Logs Insights

Question 10

A company uses AWS CodePipeline to deploy a critical web application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). During a recent deployment, the CodeDeploy stage failed because the target EC2 instances were not in a healthy state. The developer needs to ensure that the pipeline automatically rolls back the deployment to the last successful version if the deployment fails. What should the developer do?

Accepted Answer

In the CodeDeploy deployment group, enable automatic rollback when a deployment fails.. CodeDeploy deployment groups have a built-in automatic rollback configuration that can be enabled to revert to the last successful deployment revision when a deployment fails. This feature directly addresses the requirement without requiring additional services or manual steps, as it operates within the CodeDeploy service itself.

Answer

Use AWS CloudFormation to manage the deployment and enable rollback on failure.

Answer

Configure a CloudWatch alarm to trigger a rollback in CodePipeline.

Answer

Modify the CodePipeline stage to include a manual approval step that checks health before proceeding.

Question 11

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway, a Lambda function, and a DynamoDB table. The developer wants to enable canary deployments for the Lambda function. What should the developer do?

Accepted Answer

Add the AutoPublishAlias and DeploymentPreference properties to the Lambda function in the SAM template.. The AWS SAM template supports canary deployments for Lambda functions by adding the `AutoPublishAlias` property (which automatically creates and publishes a new version to a Lambda alias) and the `DeploymentPreference` property (which defines the traffic-shifting strategy, such as `Canary10Percent5Minutes`). This enables CodeDeploy to gradually shift traffic from the current version to the new version without manual intervention.

Answer

Configure a CodeDeploy deployment group in the SAM template.

Answer

Create a Lambda alias and configure traffic shifting manually.

Answer

Use AWS CodePipeline to orchestrate the canary deployment.

Question 12

A developer needs an S3 upload workflow where clients upload large files directly to S3 without exposing AWS credentials through the browser. What should the backend generate?

Accepted Answer

Pre-signed URLs with appropriate expiration and object restrictions. Pre-signed URLs allow the backend to generate time-limited, permission-restricted URLs that clients can use to upload objects directly to S3 without exposing AWS credentials. The backend signs the URL with IAM credentials, and the client uses the URL to perform the PUT operation, ensuring secure, credential-free uploads.

Answer

Long-lived IAM access keys for each client

Answer

A public-read bucket policy

Answer

An S3 Inventory report

Question 13

The developer runs a scan on the DynamoDB table 'orders' with a filter expression to find items with order_status equal to 'SHIPPED'. The output shows ScannedCount of 10000 but Count of 0. Which statement is correct?

Accepted Answer

The scan retrieved 10,000 items from the table, but none matched the filter condition.. In DynamoDB, a Scan operation retrieves all items in the table or index up to the 1 MB limit, then applies any filter expression client-side. The ScannedCount of 10,000 indicates that 10,000 items were read from the table, but the Count of 0 means none of those items satisfied the filter condition (order_status = 'SHIPPED'). This is the expected behavior: filters are applied after the data is read, not before.

Answer

The scan only returned items that matched the filter, so there are no items with status SHIPPED.

Answer

The filter expression syntax is incorrect, causing the scan to return zero items.

Answer

The scan applied the filter before reading items, so only matching items were scanned.

Question 14

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

Accepted Answer

The caller must be allowed to use the KMS key for decrypt operations. When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Answer

The caller must own the destination VPC

Answer

The bucket must enable static website hosting

Answer

The object key must end with .kms

Question 15

A developer is using the AWS CLI to upload a file to an S3 bucket with server-side encryption. The bucket is configured with default encryption (SSE-S3). The developer wants to ensure the object is encrypted with SSE-KMS instead. What should the developer do?

Accepted Answer

Use the --sse aws:kms parameter when uploading. The developer must explicitly specify the server-side encryption method at the time of upload using the `--sse aws:kms` parameter in the AWS CLI. This overrides the bucket's default SSE-S3 encryption, ensuring the object is encrypted with SSE-KMS. Without this parameter, the object inherits the bucket's default encryption (SSE-S3), regardless of any other settings.

Answer

Use the --kms-key-id parameter with a KMS key ARN

Answer

No action needed; the bucket default encryption will apply

Answer

Change the bucket policy to require SSE-KMS