DVA-C02 Practice Test 5 — 25 Questions

Question 1

A developer is deploying a containerized application on Amazon ECS with Fargate. The application needs to read configuration data from AWS Systems Manager Parameter Store. The developer wants to ensure that the ECS task definition can access the parameter without hardcoding the value. What should the developer do?

Accepted Answer

Use the 'secrets' field in the task definition to reference the parameter ARN.. Option D is correct because the 'secrets' field in an ECS task definition allows you to reference AWS Systems Manager Parameter Store (or AWS Secrets Manager) parameters by their ARN. This enables the container to retrieve the configuration value at runtime without hardcoding it in the task definition or container image, maintaining security and flexibility.

Answer

Store the configuration in Amazon ECR as a label and reference it in the task definition.

Answer

Use the 'configs' section in the task definition to load from Parameter Store.

Answer

Add a 'parameters' section in the task definition to load from Parameter Store.

Question 2

A company is using Amazon S3 to store sensitive documents. They must encrypt all objects at rest. Which TWO methods can be used to enforce server-side encryption? (Choose TWO.)

Accepted Answer

Set a bucket policy that denies PutObject if x-amz-server-side-encryption header is not present.. Option A is correct because a bucket policy can be configured to deny any PutObject request that does not include the `x-amz-server-side-encryption` header, thereby enforcing server-side encryption at the time of upload. This policy-based approach ensures that all objects written to the bucket must specify encryption, even if the uploader does not explicitly set it. Option B is correct because enabling default encryption on the S3 bucket automatically applies server-side encryption to all new objects stored, regardless of whether the upload request includes encryption headers.

Answer

Attach an IAM policy that denies all S3 actions unless encryption is specified.

Answer

Configure an SQS queue policy to require encryption.

Answer

Use client-side encryption before uploading objects.

Question 3

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

Accepted Answer

Lambda authorizer. Option C is correct because a Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.

Answer

IAM authorization

Answer

Resource policy

Answer

Amazon Cognito User Pools

Question 4

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

Accepted Answer

Blue/green deployment.. Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Answer

Canary deployment.

Answer

In-place deployment.

Answer

Immutable deployment.

Question 5

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

Accepted Answer

The message remains in the queue and becomes visible after the visibility timeout expires.. When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing. The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Answer

The message is sent to a dead-letter queue (DLQ).

Answer

The message is deleted from the queue to prevent duplicate processing.

Answer

Lambda automatically retries the function with a 1-minute delay.

Question 6

A developer is using AWS CodePipeline to deploy a microservices application to Amazon ECS using the 'Rolling update' deployment type. The pipeline includes a source stage (CodeCommit), build stage (CodeBuild), and deploy stage (CodeDeploy to ECS). After a recent commit, the build stage succeeds, but the deploy stage fails with 'The service has reached the maximum number of running tasks.' What is the MOST likely cause?

Accepted Answer

The ECS service is configured with auto scaling and has reached the maximum task count.. The error message 'The service has reached the maximum number of running tasks' indicates that the ECS service's desired count or the maximum task count defined in its auto scaling configuration has been hit. Since the deployment type is 'Rolling update', CodeDeploy replaces old tasks with new ones, but if the service has an auto scaling policy with a maximum task count, and the current number of tasks plus the new ones exceed that limit, the deployment will fail. Option B correctly identifies that the ECS service's auto scaling maximum task count is the most likely cause.

Answer

The task definition is misconfigured and the task fails to start.

Answer

The ECS service has reached the AWS account service quota for Fargate tasks.

Answer

The CodeDeploy deployment configuration uses a 'canary' instead of 'rolling' update.

Question 7

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. Option C is correct because it grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 8

A developer wants to debug an AWS Lambda function by viewing real-time logs. Which AWS service should the developer use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because AWS Lambda automatically streams all execution logs, including real-time output from console.log() statements and any errors, to CloudWatch Logs. The developer can use the CloudWatch Logs console or the `aws logs tail` command to view these logs in near real-time, enabling effective debugging of function behavior as it executes.

Answer

AWS X-Ray

Answer

Amazon S3

Answer

AWS CloudTrail

Question 9

A developer is using AWS Step Functions to orchestrate a workflow that includes a Lambda function for data transformation. The Lambda function occasionally times out after 15 seconds. The Step Function execution fails with a 'States.Timeout' error. The developer wants to retry the Lambda task up to 3 times with exponential backoff. Which configuration should the developer add to the state definition in the Amazon States Language (ASL)?

Accepted Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]. Option A is correct because it defines a retry policy for the 'States.Timeout' error, which is the error that occurs when the Lambda function times out. The configuration sets a 1-second initial interval, doubles the interval on each retry (BackoffRate of 2), and allows up to 3 retries, matching the requirement exactly.

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 2, "BackoffRate": 3, "MaxAttempts": 5 } ]

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 2 } ]

Answer

"Retry": [ { "ErrorEquals": ["Lambda.ServiceException"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]

Question 10

A company is deploying a microservices architecture on Amazon ECS. Each service needs to store secrets such as database passwords. Which service should be used to securely inject these secrets into containers?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and injecting secrets such as database passwords into containerized applications. It integrates natively with Amazon ECS via the `secrets` parameter in the task definition, allowing secrets to be injected as environment variables or mounted as files without exposing them in the container image or logs. Secrets Manager also supports automatic rotation of credentials for supported AWS services like RDS, which is critical for maintaining security in a microservices environment.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Question 11

A developer is designing a serverless application that uses AWS Lambda and Amazon DynamoDB. The application needs to handle high traffic spikes without data loss. Which TWO actions should the developer take?

Accepted Answer

Enable DynamoDB Auto Scaling. Option A is correct because DynamoDB Auto Scaling automatically adjusts the provisioned read and write capacity based on actual traffic patterns, preventing throttling during traffic spikes while maintaining cost efficiency. This ensures the application can handle high traffic without data loss by dynamically scaling the database's throughput capacity.

Answer

Use Provisioned IOPS for DynamoDB

Answer

Enable DynamoDB Streams

Answer

Increase the Lambda concurrency limit to the maximum

Question 12

A company is building a serverless application using AWS Lambda and Amazon API Gateway. The application needs to process user uploads to an S3 bucket. The Lambda function should be invoked only when new objects are created in the bucket. Which service should be used to trigger the Lambda function?

Accepted Answer

Amazon S3 event notifications. Option B is correct because Amazon S3 can send event notifications directly to AWS Lambda when new objects are created. Option A (Amazon Kinesis Data Streams) is incorrect because it is used for real-time streaming data, not for triggering Lambda from S3 events directly; it would require additional components. Option C (Amazon CloudWatch Events) is incorrect because it is used for scheduling or responding to AWS resource state changes, not for S3 object creation events directly. Option D (Amazon Simple Queue Service) is incorrect because it requires polling by a consumer, and while S3 can send events to SQS, the question asks for the service that triggers the Lambda function directly; S3 event notifications are the simplest direct integration.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Events

Answer

Amazon Simple Queue Service (SQS)

Question 13

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

Accepted Answer

Increase the compute type of the build project. Option D is correct because AWS CodeBuild allows you to increase the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM or LARGE), which provides more memory and CPU resources. This directly addresses the 'OutOfMemoryError: Java heap space' by giving the JVM more physical memory to work with, without requiring any source code changes.

Answer

Add -Xmx1024m to the buildspec commands

Answer

Change the build image to a smaller one

Answer

Set the memory parameter in the build project

Question 14

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The Lambda function queries an Amazon RDS database. Under heavy load, the database connection pool is exhausted, causing errors. What is the BEST way to manage database connections in this serverless architecture?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between Lambda and RDS, managing a pool of database connections that can be reused across multiple concurrent Lambda invocations. This prevents connection exhaustion under heavy load without requiring code changes, as the proxy handles connection multiplexing and keeps idle connections warm.

Answer

Migrate the database to Amazon DynamoDB.

Answer

Increase the concurrency limit of the Lambda function.

Answer

Use Amazon ElastiCache to cache database connections.

Question 15

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which THREE steps should the developer take to ensure that only approved changes are deployed to production?

Accepted Answer

Use AWS CloudFormation change sets to review changes. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will impact existing resources before you execute them. By reviewing the change set, you can verify that only approved modifications (e.g., infrastructure updates) are applied, providing a safety check before deployment to production. This step ensures that unapproved or unintended changes are caught early in the pipeline.

Answer

Configure cross-account access for the pipeline

Answer

Encrypt the S3 bucket with AWS KMS

Question 16

A company has a web application running on Amazon ECS with Fargate launch type. The application needs to store and retrieve user session data. The sessions are small and require very low latency access. The development team wants a fully managed solution. Which storage options meet these requirements? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is correct because it is a fully managed NoSQL key-value database that provides single-digit millisecond latency for read and write operations, making it ideal for storing small session data with low latency requirements. It scales automatically and requires no server management, aligning with the fully managed requirement and the Fargate launch type's serverless nature.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for PostgreSQL

Question 17

A developer is building a serverless application using AWS Lambda. The Lambda function needs to access a VPC to connect to an RDS database. Which TWO resources must the developer configure to allow the Lambda function to access the VPC?

Accepted Answer

A security group that allows inbound/outbound traffic to the RDS database.. Option B is correct because a security group acts as a virtual firewall for the Lambda function, controlling inbound and outbound traffic. To connect to an RDS database in a VPC, the Lambda function's security group must allow outbound traffic to the RDS database's security group on the database port (e.g., 3306 for MySQL), and the RDS security group must allow inbound traffic from the Lambda security group. This two-way rule ensures the Lambda function can establish a TCP connection to the database.

Answer

A NAT gateway in the VPC.

Answer

An IAM role with permissions to access RDS.

Answer

An internet gateway attached to the VPC.

Question 18

A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize the image and store the result in another S3 bucket. The developer notices that the Lambda function fails intermittently with timeout errors for large images. What is the MOST efficient solution to resolve this issue?

Accepted Answer

Increase the Lambda function timeout and memory allocation to accommodate larger images.. Increasing the Lambda function timeout and memory allocation directly addresses the root cause of the failure: large images require more processing time and memory. Lambda's CPU and I/O throughput scale proportionally with allocated memory, so raising both parameters provides the necessary resources to complete the resize operation within the function's execution environment.

Answer

Limit the S3 event notification to only trigger for images smaller than 5 MB.

Answer

Refactor the Lambda function to use multi-threading for parallel processing of image chunks.

Answer

Use AWS Step Functions to orchestrate the image processing in smaller steps.

Question 19

A company runs a containerized application on Amazon ECS using Fargate launch type. The application needs to read and write files to a shared file system across multiple tasks. The development team wants a solution that provides high throughput and is POSIX-compliant. Which storage solution should the team use?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, POSIX-compliant shared file system that can be mounted concurrently by multiple Amazon ECS tasks using the Fargate launch type. EFS uses the NFSv4.1 protocol, supports high throughput (up to 10 GB/s with Bursting or Provisioned Throughput modes), and automatically scales storage capacity as files are added or removed, making it ideal for shared read/write workloads across containers.

Answer

Amazon S3 with mountpoint-s3

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon FSx for Windows File Server

Question 20

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Answer

Amazon SNS