DVA-C02 Practice Test 25 — 15 Questions

Question 1

A developer is building a serverless application using AWS SAM. The application includes an Amazon API Gateway endpoint with a Lambda function that processes user uploads. The developer wants to enable API caching in the development stage to speed up repeated requests, but disable caching in the production stage. What is the most efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure caching in the SAM template using the CacheClusterEnabled property and use CloudFormation conditions to enable it only in the dev stage.. AWS SAM extends AWS CloudFormation, allowing you to use CloudFormation conditions to conditionally enable the `CacheClusterEnabled` property on the `AWS::ApiGateway::Stage` resource. By defining a condition that evaluates to true only for the dev stage (e.g., based on a parameter like `StageName`), you can enable caching in dev and disable it in prod within a single SAM template, avoiding duplication and manual steps.

Answer

Create two separate SAM templates, one for dev with caching and one for prod without.

Answer

Enable caching in the API Gateway console after each deployment for the dev stage.

Answer

Use a custom CloudFormation resource to toggle caching based on a parameter.

Question 2

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Answer

Amazon EBS

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 3

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.

Answer

IAM authorization

Answer

Resource policy

Answer

Amazon Cognito User Pools

Question 4

A developer is using AWS CodeDeploy to deploy a new version of an AWS Lambda function. The developer wants to gradually shift traffic from the old version to the new version in 10-minute increments. Which deployment configuration should the developer use?

Accepted Answer

Linear10PercentEvery10Minutes. The Linear10PercentEvery10Minutes configuration shifts traffic from the old Lambda version to the new version in 10% increments every 10 minutes, which matches the developer's requirement of gradually shifting traffic in 10-minute increments. This is a linear deployment type in AWS CodeDeploy that provides a steady, incremental traffic shift over time.

Answer

Canary10Percent10Minutes

Answer

Canary10Percent30Minutes

Answer

AllAtOnce

Question 5

A company has a requirement that all API calls to AWS must be logged and monitored for suspicious activity. They want to receive alerts when root account activity is detected. Which AWS service and configuration should they use?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to match root account API calls and trigger a Lambda function.. AWS CloudTrail captures all API calls, including those made by the root account. By creating a CloudWatch Events (now Amazon EventBridge) rule that matches the `userIdentity.type` field set to `Root` and the `eventSource` set to `signin.amazonaws.com`, you can trigger a Lambda function to send alerts or perform remediation. This provides real-time monitoring and notification for suspicious root account activity.

Answer

Enable AWS CloudTrail and configure SNS notifications for root account events.

Answer

Use VPC Flow Logs to capture API calls and analyze with Athena.

Answer

Use AWS Config rules to detect root account usage.

Question 6

A developer is using AWS CodeDeploy with a blue/green deployment on an Amazon ECS service running on Fargate. The developer wants to ensure that the new (green) task set is fully healthy and serving traffic before the old (blue) task set is terminated. The deployment should automatically roll back to the blue task set if the green task set fails health checks. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Deployment type: blue/green, with rollback configuration enabled to trigger automatic rollback and reroute traffic to the original task set. The developer needs to configure the CodeDeploy deployment group with a blue/green deployment type and enable automatic rollback. This ensures that if the green task set fails health checks, CodeDeploy automatically terminates the green deployment and reroutes traffic back to the original blue task set, meeting the requirement for a fully healthy green task set before termination.

Answer

Deployment type: blue/green, Deployment configuration: CodeDeployDefault.ECSAllAtOnce

Answer

Deployment type: blue/green, Deployment configuration: CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Answer

Deployment type: blue/green, with an Application Load Balancer

Question 7

A developer is creating a REST API using Amazon API Gateway with Lambda proxy integration. The API needs to accept and return binary data such as images or PDF files. The developer has configured the API to use the Lambda proxy integration. What additional configuration is required to support binary data?

Accepted Answer

In API Gateway, add the binary media types to the API settings, e.g., image/png, application/pdf.. With Lambda proxy integration, API Gateway passes the client request as-is to Lambda and returns the Lambda response as-is to the client. To handle binary data, you must explicitly declare the binary media types (e.g., image/png, application/pdf) in the API Gateway REST API settings. This tells API Gateway to base64-encode the binary payload before sending it to Lambda and to decode the base64-encoded response from Lambda back to binary for the client. Without this configuration, API Gateway treats all payloads as text and will corrupt binary data.

Answer

Set the Content-Type header to application/octet-stream in the Lambda response.

Answer

Use an API Gateway custom domain with an SSL certificate.

Answer

Enable API caching with binary support.

Question 8

A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

Accepted Answer

AWS Systems Manager Parameter Store.. AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with server-side encryption.

Answer

Amazon DynamoDB with encryption at rest.

Question 9

A Lambda function connects to an RDS database and causes too many database connections during traffic spikes. Which service should be introduced?

Accepted Answer

Amazon RDS Proxy. Amazon RDS Proxy sits between your Lambda function and the RDS database, managing a pool of established database connections. During traffic spikes, Lambda can rapidly scale up concurrent executions, each potentially opening a new database connection, which can exhaust the database's maximum connections. RDS Proxy reuses connections from the pool, reducing the number of open connections and preventing database overload, while also improving connection handling efficiency for serverless applications.

Answer

AWS Glue Data Catalog

Answer

Amazon Route 53 Resolver

Answer

AWS WAF

Question 10

A company uses AWS OpsWorks to manage a stack of EC2 instances. After a deployment, the application becomes unresponsive. The engineer suspects that a configuration file was not updated correctly. What is the best way to verify the deployed configuration?

Accepted Answer

SSH into an instance and inspect the configuration files in /var/lib/aws/opsworks.. OpsWorks stores its configuration data, including the applied custom JSON and stack settings, in /var/lib/aws/opsworks on each EC2 instance. By SSHing into the instance and inspecting these files, the engineer can directly verify whether the configuration file was updated correctly after deployment, bypassing any application-level logging or abstraction.

Answer

Use AWS Systems Manager Run Command to execute a script that outputs the configuration.

Answer

Check the OpsWorks stack's logs for any JSON syntax errors in the custom JSON.

Answer

Review the application logs in Amazon CloudWatch Logs for configuration errors.

Question 11

A developer stores database credentials in Secrets Manager. The application sometimes receives AccessDeniedException from Lambda after secret rotation. What should be checked first?

Accepted Answer

Whether the Lambda execution role and KMS key policy allow access to the new secret version and key. The AccessDeniedException from Lambda after secret rotation indicates that the Lambda function cannot access the new secret version. This is most commonly caused by the Lambda execution role lacking the necessary permissions (e.g., secretsmanager:GetSecretValue) for the new secret version ARN, or the KMS key policy not granting the Lambda role access to decrypt the secret using the customer-managed KMS key. Checking these two policies first is the correct troubleshooting step because rotation creates a new version with a different ARN, and the IAM policy must allow access to all versions or use a wildcard.

Answer

Whether API Gateway caching is enabled

Answer

Whether the VPC has exactly three subnets

Answer

Whether CloudFront invalidation completed

Question 12

A developer needs to trace a request across API Gateway, Lambda, and downstream AWS service calls. Which service should be enabled?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing for requests flowing through distributed applications, including API Gateway, Lambda functions, and downstream AWS services like DynamoDB or S3. It captures trace data as the request traverses each component, allowing developers to identify performance bottlenecks and errors across the entire request path. X-Ray integrates natively with API Gateway and Lambda via the X-Ray SDK or active tracing configuration, requiring no code changes for basic tracing.

Answer

AWS Budgets

Answer

AWS Artifact

Answer

AWS License Manager

Question 13

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all objects uploaded to a specific S3 bucket must be encrypted with a specific KMS key (key ID: xyz). The developer needs to enforce this by denying any PutObject request that does not use the correct key. Which bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific KMS key ID (e.g., `xyz`) is used for server-side encryption with AWS KMS (SSE-KMS). By including this condition in a bucket policy with a `Deny` effect, any `PutObject` request that does not specify the required key ID will be denied, meeting the security team's requirement.

Answer

kms:EncryptionContext

Answer

s3:EncryptionAlgorithm

Answer

kms:GrantOperations

Question 14

A developer wants to upload a large file (5 GB) to an Amazon S3 bucket using the AWS SDK. Which approach is MOST efficient and resilient?

Accepted Answer

Use the Multipart Upload API to upload the file in parts.. The Multipart Upload API is specifically designed for large objects (over 100 MB, recommended for 5 GB). It allows uploading a file in parallel parts, which improves throughput and resilience by enabling retries of individual failed parts without restarting the entire upload. This approach also supports pausing and resuming uploads, making it the most efficient and resilient method for a 5 GB file.

Answer

Generate a presigned URL and use a third-party tool to upload.

Answer

Invoke an AWS Lambda function to upload the file.

Answer

Use the PutObject API call with the entire file.

Question 15

A company uses AWS CloudFormation to manage infrastructure. The development team wants to deploy a new version of a Lambda function without downtime. The function is part of a stack. Which action should the team take?

Accepted Answer

Update the CloudFormation stack with the new function code and deploy the stack update.. Updating the CloudFormation stack with the new Lambda function code and deploying the stack update is the correct approach because CloudFormation performs a rolling update on the Lambda function, replacing the old version with the new one without deleting the stack. This ensures zero downtime as the update is applied in place, and the function remains available throughout the process.

Answer

Create a change set and execute it after the current stack is deleted.

Answer

Manually update the Lambda function code in the console and then update the stack.

Answer

Create a new CloudFormation stack for the new function and delete the old stack.