DVA-C02 Practice Test 25 — 15 Questions

Question 1

A developer is using AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment fails because the new instances do not pass the health check. The developer wants to automatically roll back the deployment if the health check fails. Which CodeDeploy setting should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic rollback in the deployment group configuration.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, if a deployment fails (e.g., due to health check failures), CodeDeploy automatically reverts to the last known successful deployment, ensuring minimal downtime and manual intervention.

Answer

Set the deployment configuration to AllAtOnce to speed up the process.

Answer

Configure a lifecycle hook to terminate failing instances.

Answer

Use a blue/green deployment strategy instead of in-place.

Question 2

A developer needs to store a large number of binary files (e.g., images) that are accessed infrequently but must be retrievable within minutes. The storage solution should be cost-effective. Which Amazon S3 storage class is MOST suitable?

Accepted Answer

S3 Glacier Instant Retrieval. S3 Glacier Instant Retrieval is the most suitable because it is designed for long-lived, infrequently accessed data that requires retrieval in milliseconds (within minutes), offering a lower storage cost than S3 Standard while still providing rapid access. The question specifies 'retrievable within minutes' and 'cost-effective,' which aligns with Glacier Instant Retrieval's sub-second retrieval times and lower storage price point compared to S3 Standard or Intelligent-Tiering for data accessed rarely.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Question 3

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

Accepted Answer

The S3 bucket's event notification still points to the old Lambda function.. After deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Answer

The Lambda function has a syntax error.

Answer

The Lambda function alias is not pointing to the new version.

Answer

The S3 events are being throttled by Lambda.

Question 4

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?

Accepted Answer

Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.. Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.

Answer

Configure a VPC endpoint policy that allows only API Gateway.

Answer

Add a resource-based policy with 'aws:SourceAccount' condition.

Answer

Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.

Question 5

A developer is troubleshooting a web application that intermittently returns HTTP 504 errors. The application runs on EC2 instances behind an Application Load Balancer. What is the most likely cause of these errors?

Accepted Answer

The load balancer idle timeout is set too low, and the application takes longer than the timeout to respond.. HTTP 504 (Gateway Timeout) errors from an Application Load Balancer indicate that the load balancer successfully connected to the target (EC2 instance) but the target did not respond within the configured idle timeout period. The default idle timeout is 60 seconds, and if the application's processing time exceeds this value, the load balancer terminates the connection and returns a 504. Option C directly addresses this mismatch between the load balancer timeout and the application response time.

Answer

The target group is using an HTTPS health check but the instances only support HTTP.

Answer

The load balancer's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is missing an inbound rule for the load balancer.

Question 6

A developer is using AWS KMS to encrypt data in an S3 bucket. The developer wants to ensure that the S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) by default. Which configuration should be applied?

Accepted Answer

Set the bucket's default encryption to SSE-KMS with a KMS key.. Setting the bucket's default encryption to SSE-KMS with a KMS key ensures that all objects uploaded to the S3 bucket are automatically encrypted using server-side encryption with AWS KMS managed keys (SSE-KMS). This configuration enforces encryption at rest without requiring the client to specify encryption headers in the request, meeting the requirement for default SSE-KMS encryption.

Answer

Add a bucket policy that denies PutObject without the 'x-amz-server-side-encryption' header set to 'aws:kms'.

Answer

Configure the bucket to use SSE-C with a customer-provided key.

Answer

Set the bucket's default encryption to SSE-S3.

Question 7

A developer wants to store session state for a web application that runs on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to store the session state in a centralized, highly available location?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that supports Redis or Memcached, which are ideal for storing session state in a centralized, highly available manner. Session data requires low-latency reads and writes, and ElastiCache offers sub-millisecond performance, replication across multiple Availability Zones, and automatic failover, making it suitable for stateless web applications behind an Application Load Balancer.

Answer

Amazon RDS

Answer

Amazon S3

Answer

AWS Lambda

Question 8

A developer is building a REST API using API Gateway and Lambda. The API must support multiple HTTP methods and use a custom domain name with an SSL certificate. The developer wants to enable caching for the /products GET endpoint to reduce latency. Which step is essential to enable caching for this specific endpoint?

Accepted Answer

Enable caching on the /products GET method and specify cache key parameters.. Enabling caching on a specific method (e.g., /products GET) in API Gateway allows you to configure cache key parameters, which control how the cache key is generated based on request parameters. This is essential for per-endpoint caching, as it ensures that only responses for the /products GET endpoint are cached, reducing latency for that specific method without affecting other endpoints.

Answer

Set the TTL (time-to-live) for the /products GET method to a non-zero value.

Answer

Flush the API cache to start fresh.

Answer

Enable caching on the API stage and set the 'Cache Status' to 'AVAILABLE'.

Question 9

A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?

Accepted Answer

Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.. Fetching the public key from a well-known URL (e.g., the JWKS endpoint) at runtime allows the Lambda authorizer to automatically use the latest signing key without manual intervention. This approach decouples key rotation from the authorizer code, ensuring that valid tokens signed with the new key are accepted immediately. It is the most efficient method as it avoids redeployments, environment variable updates, or recreating the authorizer.

Answer

Update the API Gateway stage deployment to redeploy the API.

Answer

Delete and recreate the API Gateway authorizer with the new key.

Answer

Update the Lambda authorizer's environment variable with the new key and publish a new version.

Question 10

A developer is building a serverless web application using AWS Lambda and Amazon DynamoDB. The application needs to perform complex aggregations on data stored in DynamoDB. Which AWS service should the developer use to perform these aggregations efficiently without reading all the data into Lambda?

Accepted Answer

DynamoDB Streams with AWS Lambda. DynamoDB Streams captures item-level changes in near real-time and can trigger a Lambda function to perform incremental aggregations without scanning the entire table. This pattern avoids reading all data into Lambda, making it efficient for continuous aggregation workloads.

Answer

AWS Glue

Answer

Amazon EMR

Answer

Amazon Redshift

Question 11

A team uses AWS CodePipeline to automate deployments. They notice that a deployment to Amazon ECS fails because the task definition is not updated. The pipeline includes a source stage from CodeCommit, a build stage using AWS CodeBuild, and a deploy stage to Amazon ECS. What is the most likely missing step?

Accepted Answer

The build stage does not output the updated task definition as an artifact.. In a CodePipeline that deploys to Amazon ECS, the build stage must output the updated task definition file (typically `imagedefinitions.json` or a task definition JSON) as an artifact. Without this artifact, the deploy stage cannot reference the new task definition revision, so it continues using the old one, causing the deployment to fail.

Answer

The pipeline has a manual approval step before deployment.

Answer

The deploy stage action is set to 'Create a new ECS service'.

Answer

The task definition is not registered in the Amazon ECS console.

Question 12

A company is using Amazon CloudFront to distribute static content from an S3 bucket. The content is updated frequently, but users see stale content. The developer wants to ensure that new content is served as soon as possible after an update. Which action should be taken?

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront caches content at edge locations based on TTL settings. When content is updated in the S3 origin, existing cached copies remain stale until they expire or are explicitly invalidated. Creating a CloudFront invalidation for the updated files immediately removes the cached objects from all edge locations, forcing CloudFront to fetch the latest version from S3 on the next request. This ensures new content is served as soon as possible after an update.

Answer

Enable 'Origin Shield' to reduce the number of requests to S3.

Answer

Set the 'Minimum TTL' to 0 and 'Default TTL' to 0.

Answer

Set the 'Object Caching' to 0 in the CloudFront distribution.

Question 13

A developer is deploying a new version of an AWS Lambda function. The function uses an environment variable for a database password. The developer wants to securely store the password and automatically rotate it. Which combination of AWS services should the developer use?

Accepted Answer

Store the password in AWS Secrets Manager and retrieve it in the Lambda function using the AWS SDK.. AWS Secrets Manager is specifically designed to securely store secrets like database passwords, supports automatic rotation of secrets, and integrates with Lambda via the AWS SDK to retrieve the secret at runtime. This ensures the password is never hardcoded or exposed in environment variables, and rotation can be scheduled without code changes.

Answer

Use AWS KMS to generate a data key and store it in the Lambda environment variable.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it in the Lambda function.

Answer

Encrypt the password using AWS KMS and store it in Amazon DynamoDB.

Question 14

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. Lately, the API is returning 502 Bad Gateway errors. What is the MOST likely cause?

Accepted Answer

The Lambda function is returning an unhandled exception.. A 502 Bad Gateway error from API Gateway typically indicates that the backend integration (in this case, the Lambda function) returned an error response. When a Lambda function throws an unhandled exception, API Gateway receives a 200 OK with a function error payload, but it cannot parse the response into a valid HTTP response, resulting in a 502. This is distinct from throttling or permission issues, which produce different HTTP status codes.

Answer

The API Gateway request throttling limit has been exceeded.

Answer

The API Gateway API key is invalid.

Answer

The Lambda function's execution role does not allow API Gateway to invoke it.

Question 15

An e-commerce platform uses AWS CodePipeline to deploy a web application to an Auto Scaling group behind an Application Load Balancer. The deployment strategy must minimize downtime and allow immediate rollback if the new version fails health checks. Which deployment configuration meets these requirements?

Accepted Answer

Use blue/green deployment with an immutable infrastructure.. Blue/green deployment with immutable infrastructure minimizes downtime by running the new version (green) alongside the old (blue) and switching traffic only after health checks pass. If the new version fails, rollback is immediate by routing traffic back to the blue environment without redeploying. AWS CodePipeline supports this via CodeDeploy with a blue/green configuration, ensuring zero-downtime deployments and instant rollback capability.

Answer

Use all-at-once deployment to the Auto Scaling group.

Answer

Use canary deployment shifting 10% traffic for 5 minutes.

Answer

Use in-place rolling update with a batch size of 50%.