DVA-C02 Practice Test 3 — 25 Questions

Question 1

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift 10% of traffic to the new version for 5 minutes before routing all traffic. Which configuration should the developer add to the SAM template?

Accepted Answer

DeploymentPreference with Type: Canary10Percent5Minutes. Option A is correct because the `DeploymentPreference` property with `Type: Canary10Percent5Minutes` instructs AWS SAM to use AWS CodeDeploy to shift 10% of traffic to the new Lambda version for 5 minutes, then automatically route the remaining 90% after the canary period ends. This matches the requirement exactly, leveraging SAM's built-in integration with CodeDeploy for canary deployments.

Answer

Add a CodeDeploy application and deployment group manually

Answer

DeploymentPreference with Type: Linear10PercentEvery1Minute

Answer

DeploymentPreference with Type: AllAtOnce

Question 2

A company uses AWS CodeCommit for source control. A developer needs to automate the build and test process for every commit to the 'develop' branch. The developer creates a CodeBuild project and wants to trigger it automatically. What is the most efficient way to set up this automation?

Accepted Answer

Create a CodePipeline with a source stage from CodeCommit and a build stage from CodeBuild. Option C is correct because AWS CodePipeline is the most efficient and fully managed way to orchestrate a continuous integration workflow. It natively integrates CodeCommit as a source action that automatically detects changes on the specified branch (e.g., 'develop') and triggers a CodeBuild build stage without any custom scripting or additional infrastructure. This provides built-in retry, status tracking, and seamless integration with other AWS services.

Answer

Create a CloudWatch Events rule that triggers CodeBuild on code commit events

Answer

Configure a webhook in CodeCommit to call CodeBuild directly

Answer

Use an SQS queue to receive SNS notifications from CodeCommit and trigger CodeBuild

Question 3

Which THREE factors should a developer consider when choosing between a blue/green deployment and a rolling deployment for an Amazon ECS service?

Accepted Answer

Rolling deployments update a subset of tasks at a time, which may cause slower rollback. Option B is correct because rolling deployments in Amazon ECS update a subset of tasks at a time, which means if a rollback is needed, the deployment must reverse the updates incrementally, potentially taking longer than a blue/green deployment where traffic can be switched back instantly. This slower rollback is a key trade-off when choosing between the two strategies.

Answer

Rolling deployments require manual intervention to rollback

Answer

Blue/green deployments are always cheaper than rolling deployments

Question 4

Which TWO approaches can a developer use to automate the deployment of a microservices application to Amazon ECS with Fargate, ensuring that each microservice is independently deployable and can scale based on demand?

Accepted Answer

Define each microservice as a separate ECS service with its own task definition. Option D is correct because defining each microservice as a separate ECS service with its own task definition allows independent deployment, scaling, and lifecycle management. Each service can be updated, rolled back, or scaled based on its own demand without affecting other microservices, which aligns with microservices architecture principles.

Answer

Define all microservices in a single task definition and run them as one service

Answer

Use a single ECS service with multiple containers per task definition

Answer

Use a single CodePipeline that builds all microservices together

Question 5

Refer to the exhibit. A developer has attached the above IAM policy to an IAM role used by an AWS Lambda function. The Lambda function reads and writes objects to an S3 bucket. However, the function fails when trying to write objects. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses AWS KMS encryption, and the policy does not include KMS permissions.. The IAM policy grants s3:PutObject and s3:GetObject actions, but if the S3 bucket uses AWS KMS encryption (SSE-KMS), the Lambda function also needs kms:GenerateDataKey and kms:Decrypt permissions to write and read encrypted objects. Without these KMS permissions, the PutObject API call fails because the Lambda cannot generate the data key needed to encrypt the object or decrypt it on read. This is the most likely cause of the write failure.

Answer

The S3 bucket policy denies the Lambda function.

Answer

The Lambda function does not have permission to read objects.

Answer

The Lambda function is not using the correct IAM role.

Question 6

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that the deployment does not cause any downtime and that new instances are fully registered with the load balancer before old instances are terminated. Which deployment policy should they use?

Accepted Answer

Rolling with an additional batch. The Rolling with an additional batch deployment policy launches a new batch of instances in addition to the current ones, registers them with the load balancer, and only then terminates the old instances. This ensures zero downtime because the new instances are fully serving traffic before any old instances are removed, unlike standard rolling deployments which terminate old instances before new ones are fully ready.

Answer

Immutable

Answer

Rolling

Answer

All at once

Question 7

A developer is using AWS CodeCommit as a source repository. They want to automatically build and test code whenever a new branch is created. Which AWS service should they use to trigger the pipeline?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture AWS CodeCommit repository events, such as the creation of a new branch. By setting a rule that matches the 'Reference Created' event type, you can automatically trigger an AWS CodePipeline pipeline execution, enabling continuous integration for new branches.

Answer

Amazon S3 event notification

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Lambda

Question 8

A company uses AWS CodePipeline with a source stage from Amazon S3. The pipeline triggers on changes to the S3 bucket. However, the pipeline does not trigger when a new object is uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the pipeline.. Option B is correct because CodePipeline does not automatically detect changes in an S3 source bucket. You must configure an Amazon S3 event notification to publish to Amazon CloudWatch Events (or use S3 Event Notifications with Amazon EventBridge) so that the pipeline is triggered when a new object is uploaded. Without this notification, the pipeline will not start automatically.

Answer

The S3 bucket policy denies access to CodePipeline.

Answer

The pipeline is not configured with a webhook.

Answer

The object is encrypted and CodePipeline cannot read it.

Question 9

Which TWO are valid deployment strategies supported by AWS CodeDeploy? (Choose TWO.)

Accepted Answer

In-place deployment. AWS CodeDeploy supports in-place deployments (option B) where the application is updated on the existing instances without provisioning new ones. This is a valid deployment strategy that updates the current fleet by stopping and starting the application, and it is one of the two core strategies explicitly documented by AWS.

Answer

Immutable deployment

Answer

Canary deployment

Answer

All at once deployment

Question 10

A company is deploying a new microservice using AWS Lambda and Amazon API Gateway. Which THREE steps should be included in the deployment pipeline? (Choose three.)

Accepted Answer

Deploy the API Gateway API to a stage.. Deploying the API Gateway API to a stage is essential because it makes the API publicly available at a specific URL (e.g., https://api-id.execute-api.region.amazonaws.com/prod). Without a stage deployment, any updates to the API resources and methods remain in draft state and are not accessible to clients.

Answer

Invalidate the Amazon CloudFront cache.

Answer

Update the Route 53 DNS record to point to the new API.

Question 11

Which TWO AWS services can be used to send messages between microservices in a decoupled manner? (Choose two.)

Accepted Answer

Amazon SQS. Amazon SQS is a fully managed message queuing service that enables you to decouple and scale microservices, serverless applications, and distributed systems. It allows microservices to send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available. By using SQS queues, producers and consumers can operate independently, ensuring fault tolerance and asynchronous communication.

Answer

AWS Lambda

Answer

Amazon MQ

Answer

Amazon Kinesis Data Streams

Question 12

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Option B is correct because registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 13

Which TWO are valid ways to automate deployments to Amazon ECS? (Choose TWO.)

Accepted Answer

Use AWS CodeDeploy with an Amazon ECS blue/green deployment.. Option A is correct because AWS CodeDeploy natively supports Amazon ECS blue/green deployments, allowing you to automate the process of shifting traffic from an old task set to a new one. You can define the deployment configuration, including traffic routing and lifecycle hooks, directly in CodeDeploy, making it a fully managed deployment automation solution for ECS.

Answer

Use AWS CloudFormation to create a change set and update the service.

Answer

Use AWS OpsWorks with a Docker layer.

Answer

Use AWS Elastic Beanstalk with a Docker platform.

Question 14

Which TWO AWS services can be used to store and retrieve application configuration data? (Choose two.)

Accepted Answer

AWS AppConfig. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configuration data separately from your code. It supports feature flags, tuning parameters, and other dynamic configuration, and can validate configuration changes before deployment to reduce risk. This makes it a correct choice for storing and retrieving application configuration data.

Answer

AWS Secrets Manager

Answer

Amazon S3

Answer

AWS CloudFormation

Question 15

A developer receives an AccessDenied error when trying to put an object into an S3 bucket using the AWS SDK. The IAM user has an attached policy that grants s3:PutObject on the bucket. What is the MOST likely cause of the error?

Accepted Answer

The bucket policy explicitly denies the action.. The most likely cause is that the bucket policy explicitly denies the s3:PutObject action. IAM policies grant permissions, but S3 bucket policies can override them with an explicit deny, which takes precedence over any allow. Since the IAM user already has an attached policy allowing s3:PutObject, the only way to get an AccessDenied error is if a bucket policy explicitly denies the action.

Answer

The request is being throttled by S3.

Answer

The object key is too long.

Answer

The AWS SDK version is outdated.

Question 16

Refer to the exhibit. A developer created this CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?

Accepted Answer

The bucket does not have static website hosting enabled.. The 403 Forbidden error indicates that the S3 bucket is not configured to serve static content. For a static website hosted on S3, the bucket must have static website hosting enabled under the Properties tab, which generates a website endpoint (e.g., http://bucket-name.s3-website-region.amazonaws.com). Without this setting, S3 treats requests as standard REST API calls and returns 403 Forbidden because the bucket policy (if any) does not grant public read access via the REST endpoint, or the bucket is not configured for website hosting at all.

Answer

The bucket has versioning enabled, which blocks public access.

Answer

The bucket name is not unique.

Answer

The bucket policy does not allow public access.

Question 17

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 18

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. Lately, the API is returning 502 Bad Gateway errors. What is the MOST likely cause?

Accepted Answer

The Lambda function is returning an unhandled exception.. A 502 Bad Gateway error from API Gateway typically indicates that the backend integration (in this case, the Lambda function) returned an error response. When a Lambda function throws an unhandled exception, API Gateway receives a 200 OK with a function error payload, but it cannot parse the response into a valid HTTP response, resulting in a 502. This is distinct from throttling or permission issues, which produce different HTTP status codes.

Answer

The API Gateway request throttling limit has been exceeded.

Answer

The API Gateway API key is invalid.

Answer

The Lambda function's execution role does not allow API Gateway to invoke it.

Question 19

A developer is building a serverless application using AWS Lambda. The function needs to access a DynamoDB table and write logs to Amazon CloudWatch. What is the minimum set of IAM permissions the Lambda execution role must have?

Accepted Answer

dynamodb:PutItem, logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents. Option A is correct because the Lambda execution role must include `dynamodb:PutItem` to write to the DynamoDB table, and the three `logs:` permissions (`CreateLogGroup`, `CreateLogStream`, `PutLogEvents`) are required for Lambda to create log groups/streams and send log events to CloudWatch Logs. This is the minimum set that satisfies both requirements without granting unnecessary privileges.

Answer

logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents

Answer

dynamodb:*, logs:PutLogEvents

Answer

dynamodb:GetItem, dynamodb:PutItem, logs:PutLogEvents

Question 20

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to enable caching for API responses to reduce latency and cost. Which step is REQUIRED to enable caching?

Accepted Answer

Create a cache cluster in API Gateway for the stage. Option C is correct because API Gateway caching requires a dedicated cache cluster to be enabled and configured at the stage level. This cluster stores API responses and serves them directly from the cache for identical requests, reducing the number of calls to the backend Lambda function and lowering latency. Without creating and enabling this cache cluster in the API Gateway stage settings, caching cannot function.

Answer

Enable caching in the Lambda function code

Answer

Set the TTL in the API Gateway method request integration

Answer

Use Amazon ElastiCache and modify the Lambda function to check cache