DVA-C02 Practice Test 5 — 25 Questions

Question 1

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 2

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53

Question 3

Refer to the exhibit. A developer created this CloudFormation template. After deployment, the stack creation fails with 'Bucket name already exists'. What should the developer do to fix the issue?

Accepted Answer

Change the BucketName to include a random suffix.. The error 'Bucket name already exists' occurs because S3 bucket names are globally unique across all AWS accounts. The CloudFormation template hardcodes a BucketName that someone else already owns. The fix is to make the name unique, typically by appending a random suffix or using CloudFormation's auto-generated name (by omitting BucketName). This ensures the stack can create a new bucket without collision.

Answer

Remove the MyQueue resource.

Answer

Remove the VersioningConfiguration from the bucket.

Answer

Set SqsManagedSseEnabled to false.

Question 4

A developer is managing an application running on Amazon EC2 instances behind an Application Load Balancer. Users report that the application becomes unresponsive after several hours, and restarting the instance temporarily fixes the issue. The developer suspects a memory leak but cannot add custom instrumentation. Which AWS service can collect memory utilization metrics and help identify the memory leak with minimal configuration?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and emit them to CloudWatch.. The CloudWatch agent can collect custom metrics, including memory utilization, from EC2 instances and publish them to Amazon CloudWatch. This allows the developer to monitor memory usage over time and identify a memory leak without modifying the application code. The default EC2 metrics do not include memory utilization, so the CloudWatch agent is the minimal-configuration solution for this requirement.

Answer

Use Amazon CloudWatch Logs agent to capture application logs.

Answer

Use the EC2 instance metadata service to query memory usage.

Answer

Use AWS X-Ray to trace memory allocation.

Question 5

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the ECS task definition to use the awslogs log driver and set the log group.. The awslogs log driver is the native, zero-configuration way to send container stdout/stderr to Amazon CloudWatch Logs from ECS Fargate. By specifying the awslogs log driver and a log group in the task definition, logs are automatically forwarded without any additional agents, code changes, or infrastructure, meeting the requirement for minimal operational overhead.

Answer

Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.

Answer

Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.

Answer

Install the CloudWatch agent in the container and configure it to send logs.

Question 6

A developer needs to grant a Lambda function permission to write logs to CloudWatch Logs. Which IAM entity should be used?

Accepted Answer

Create an IAM execution role with the necessary permissions and associate it with the function.. Lambda functions require an IAM execution role to obtain temporary credentials for accessing other AWS services. This role must include a trust policy allowing Lambda to assume it and a permissions policy granting the specific actions (e.g., logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents) on CloudWatch Logs. Associating this role with the function is the standard and secure way to grant permissions.

Answer

Attach an inline policy to the Lambda function.

Answer

Use a service control policy (SCP) to allow logging.

Answer

Add a resource-based policy to the Lambda function.

Question 7

A developer uses the AWS SDK to list thousands of DynamoDB items from a query. Only the first page is processed. What should be implemented?

Accepted Answer

Pagination using LastEvaluatedKey until no further key is returned. The DynamoDB Query API returns paginated results, with a maximum of 1 MB of data per page. The `LastEvaluatedKey` in the response indicates that more items exist. To retrieve all items, the application must check for `LastEvaluatedKey` and, if present, issue a subsequent Query request with the `ExclusiveStartKey` parameter set to that value, repeating until `LastEvaluatedKey` is no longer returned. This is the standard pagination pattern for DynamoDB.

Answer

A larger Lambda memory setting only

Answer

A global secondary index with the same key

Answer

Strongly consistent reads on every request

Question 8

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

Accepted Answer

Amazon Simple Email Service (SES). Amazon Simple Email Service (SES) is specifically designed for sending transactional emails, such as order confirmations, password resets, and marketing communications. It provides a reliable, scalable SMTP interface or API to send high-deliverability emails, with features like dedicated IP addresses and feedback loops. This makes it the correct choice for an application that needs to send email notifications directly to users.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Question 9

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?

Accepted Answer

Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.. The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.

Answer

Configure the ALB target group to authenticate using the OIDC identity provider.

Answer

Use AWS Lambda@Edge to authenticate users at the edge.

Answer

Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.

Question 10

A developer needs to store application configuration data that can be read by multiple EC2 instances. The data is less than 1 KB and changes frequently. Which AWS service is BEST suited for this?

Accepted Answer

AWS AppConfig. AWS AppConfig is the best choice because it is designed for dynamic, frequent configuration changes that need to be deployed to multiple EC2 instances without redeploying code or restarting applications. It supports hosted configuration data (up to 1 MB) and provides controlled rollouts, validation, and monitoring, making it ideal for sub-1 KB data that changes frequently.

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Question 11

Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?

Accepted Answer

S3 bucket/object access policy or IAM policy. When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.

Answer

CloudFront cache policy

Answer

Route 53 resolver rule policy

Question 12

A developer is building a microservice that needs to invoke another AWS Lambda function and wait for the result to continue processing. Which Lambda invocation type must the developer use to achieve synchronous invocation?

Accepted Answer

RequestResponse. The RequestResponse invocation type is the correct choice for synchronous invocation of a Lambda function, where the caller waits for the function to execute and receive a response. This is the default invocation type when using the Invoke API with InvocationType set to 'RequestResponse', and it is required for microservices that need to block until the downstream Lambda returns a result.

Answer

Event

Answer

DryRun

Answer

None of the above

Question 13

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users using a third-party identity provider that supports SAML 2.0. The company wants to use AWS Identity and Access Management (IAM) to manage user permissions. Which solution should the developer implement?

Accepted Answer

Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.. It describes the standard AWS pattern for SAML 2.0 federation: creating an IAM identity provider for the external SAML IdP, then configuring an IAM role with a trust policy that allows users authenticated by that IdP to assume the role. This enables the application to use IAM to manage permissions for federated users without creating IAM users in the AWS account.

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the users.

Answer

Store the SAML metadata document in AWS Certificate Manager.

Answer

Use Amazon Cognito user pools with a SAML identity provider.

Question 14

A developer wants to invoke an AWS Lambda function every hour to perform a maintenance task. Which AWS service should be used to schedule the invocation?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now part of Amazon EventBridge) is the correct service for scheduling periodic invocations of AWS Lambda functions. It allows you to create a rule with a cron or rate expression (e.g., `rate(1 hour)`) that triggers the Lambda function on a defined schedule. This is the native, serverless way to run code on a recurring timer without managing any infrastructure.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Step Functions

Answer

Amazon Simple Notification Service (SNS)

Question 15

A developer is using AWS CodePipeline with multiple actions in a stage. The pipeline has a build action that produces artifacts, followed by a deploy action. The developer wants to ensure that if the deploy action fails, the pipeline stops and does not continue to the next stage. How can they achieve this?

Accepted Answer

No additional configuration is needed; the pipeline stops on failure by default.. AWS CodePipeline stages are sequential by default: if any action within a stage fails, the entire stage fails and the pipeline stops, preventing execution of subsequent stages. No additional configuration is needed to halt the pipeline on a deploy action failure, as this is the inherent behavior of a pipeline stage with multiple actions.

Answer

Configure the deploy action to 'Abort' on failure.

Answer

Set the runOrder for the deploy action to 'Blocked'.

Answer

Set the pipeline's execution mode to 'PARALLEL'.

Question 16

A developer created the following IAM role for a Lambda function:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "lambda.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}
```

The function needs to write logs to CloudWatch Logs. What is missing?

Accepted Answer

The role needs a permissions policy that grants logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. The role shown includes a trust policy that allows Lambda to assume the role but does not include an attached permissions policy for CloudWatch Logs. To write logs to CloudWatch Logs, the Lambda function must be granted logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents through a permissions policy attached to the role.

Answer

The trust policy is incorrect; it should allow ec2.amazonaws.com.

Answer

The role name is invalid.

Answer

The trust policy should not allow Lambda to assume the role.

Question 17

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

Accepted Answer

Amazon API Gateway WebSocket API. Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Answer

Amazon SQS with long polling

Answer

Application Load Balancer with WebSocket support

Answer

Amazon CloudFront with WebSocket support

Question 18

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 19

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'ScriptMissing' during the BeforeInstall lifecycle event. What is the most likely cause?

Accepted Answer

The script file specified in the appspec.yml for the BeforeInstall hook is not present on the instance. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment failed because a script file referenced in the appspec.yml for a lifecycle event (in this case, BeforeInstall) could not be found on the EC2 instance. CodeDeploy expects the script to be present at the specified path after the archive is extracted; if the file is missing or the path is incorrect, the agent reports this error. Option B correctly identifies that the script file is not present on the instance.

Answer

The BeforeInstall lifecycle event is not defined in the appspec.yml

Answer

The CodeDeploy agent on the instance is not running

Answer

The instance does not have the necessary permissions to execute the script

Question 20

A developer runs the following AWS CLI query against a DynamoDB table named 'Orders' and receives a ValidationException:

```
aws dynamodb query \
    --table-name Orders \
    --key-condition-expression "OrderID = :orderID" \
    --expression-attribute-values '{":orderID":{"S":"12345"}}'
```

What is the MOST likely cause?

Accepted Answer

The table's partition key is not named 'OrderID'. DynamoDB's Query operation requires that the KeyConditionExpression reference the table's actual partition key name exactly. If the Orders table's partition key is not named 'OrderID', the query fails with a ValidationException. The expression attribute values are formatted correctly, and a sort key is not required to query by partition key alone.

Answer

The expression attribute values are incorrectly formatted

Answer

The table does not exist

Answer

The query needs to use a sort key