DVA-C02 Practice Test 26 — 15 Questions

Question 1

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Blue/green deployment.. Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Answer

Canary deployment.

Answer

In-place deployment.

Answer

Immutable deployment.

Question 2

A developer uses AWS CodePipeline with a manual approval step before deployment. The developer wants to ensure that if a new commit is pushed while a pipeline execution is waiting for approval, the waiting execution is canceled and a new one starts with the latest commit. Which pipeline execution mode should be configured?

Accepted Answer

Superseded. The Superseded execution mode is designed to automatically cancel any in-progress pipeline execution when a new commit is pushed, and start a new execution with the latest source changes. This ensures that the manual approval step does not block newer commits, as the waiting execution is replaced by the one triggered by the latest commit. In contrast, other modes either queue or run executions in parallel, which would not cancel the waiting approval step.

Answer

Queued

Answer

Parallel

Answer

Single

Question 3

A developer is deploying a microservices application using Amazon ECS with Fargate. The application consists of multiple services that need to communicate with each other over HTTP. The developer wants to ensure that service-to-service communication is encrypted in transit and that the services can discover each other by logical service names instead of IP addresses. Which combination of AWS services should the developer use?

Accepted Answer

AWS App Mesh with AWS Cloud Map. AWS App Mesh provides a service mesh that handles service-to-service communication with encryption in transit using TLS, while AWS Cloud Map enables service discovery by logical names, allowing ECS services to resolve each other via DNS or API calls. Together, they meet the requirements for encrypted HTTP communication and logical name resolution without exposing IP addresses.

Answer

Elastic Load Balancing with AWS Systems Manager

Answer

Amazon Route 53 with AWS Direct Connect

Answer

AWS Lambda with Amazon API Gateway

Question 4

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

Accepted Answer

Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.. The Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Answer

Add an S3 bucket policy allowing the Lambda function's ARN to write objects.

Answer

Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.

Answer

Add a KMS key policy to allow the Lambda function to use a customer managed key.

Question 5

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with KMS (SSE-KMS). They want to ensure that only certain IAM roles can decrypt objects. What must be configured?

Accepted Answer

KMS key policy to allow the IAM roles to decrypt. SSE-KMS uses a customer master key (CMK) to encrypt and decrypt S3 objects. The KMS key policy is the primary access control mechanism for a CMK; it must explicitly grant the IAM roles the kms:Decrypt permission. Without this policy statement, even if the IAM roles have a policy allowing kms:Decrypt, they will be denied access because KMS key policies can override IAM permissions when the key policy does not grant access to the account's IAM principals.

Answer

IAM role policy to allow kms:Decrypt

Answer

S3 bucket policy to allow decrypt

Answer

KMS key policy to allow s3.amazonaws.com to decrypt

Question 6

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The application must remain fully available; only one instance should be taken offline at a time. The developer wants to configure the deployment to update instances one by one, ensuring that the deployment fails fast if any instance fails to deploy. Which deployment configuration should the developer choose?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime, is correct because it deploys the application to one instance at a time, ensuring that only one instance is taken offline during the deployment. This satisfies the requirement for the application to remain fully available. Additionally, this configuration fails fast: if any instance fails to deploy, the deployment stops immediately, preventing further instances from being updated.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.BlueGreen

Question 7

A company stores sensitive data in Amazon S3. The security team requires that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). The developer needs to enforce that any PutObject request that does not specify the 'x-amz-server-side-encryption' header with value 'aws:kms' is denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption equals 'aws:kms'. The condition key `s3:x-amz-server-side-encryption` in an S3 bucket policy can be used to require that the `x-amz-server-side-encryption` header is set to `aws:kms` on every PutObject request. This enforces server-side encryption with AWS KMS (SSE-KMS) at the bucket policy level, denying any request that omits or uses a different encryption header value.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN

Answer

s3:x-amz-acl equals 'bucket-owner-full-control'

Answer

s3:signatureversion equals 'AWS4-HMAC-SHA256'

Question 8

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

Accepted Answer

The message remains in the queue and becomes visible after the visibility timeout expires.. When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing. The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Answer

The message is sent to a dead-letter queue (DLQ).

Answer

The message is deleted from the queue to prevent duplicate processing.

Answer

Lambda automatically retries the function with a 1-minute delay.

Question 9

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.

Question 10

A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.

Answer

AWS Systems Manager Parameter Store (SecureString)

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM) roles

Question 11

A Lambda function must share reusable validation code across several functions without packaging the same library into every deployment artifact. What should be used?

Accepted Answer

Lambda layer. Lambda layers allow you to centrally manage reusable code (e.g., validation libraries) and share it across multiple Lambda functions without packaging it into each deployment artifact. When you attach a layer to a function, the layer's content is extracted into the /opt directory, making it available at runtime. This avoids duplication and simplifies updates, as you only need to update the layer version rather than every function's deployment package.

Answer

API Gateway usage plan

Answer

S3 multipart upload

Answer

CloudWatch metric filter

Question 12

A company is deploying a new microservice on AWS Lambda that processes high-resolution images and stores results in Amazon S3. The Lambda function currently uses 1024 MB of memory and has a timeout of 2 minutes. During peak load, many invocations are timing out. The function is CPU-bound during image processing. Which change is MOST likely to reduce timeouts without increasing costs unnecessarily?

Accepted Answer

Increase the function memory to 2048 MB.. Increasing memory from 1024 MB to 2048 MB proportionally increases CPU allocation in AWS Lambda (up to 1.7 GHz per vCPU at 1769 MB). Since the function is CPU-bound, this directly reduces processing time, mitigating timeouts without the cost spike of 3008 MB. The cost increase is linear with memory, so doubling memory doubles cost per invocation, but the reduced duration often offsets this, keeping total cost similar or lower.

Answer

Increase the function memory to 3008 MB.

Answer

Enable provisioned concurrency to reduce cold starts.

Answer

Increase the function timeout to 5 minutes.

Question 13

A developer is troubleshooting an IAM policy that is not working as expected. The policy has an Allow effect for s3:PutObject but the user gets AccessDenied. The user also has a Deny policy attached. What is the most likely reason?

Accepted Answer

An explicit Deny in an IAM policy overrides the Allow. AWS IAM evaluates all policies (identity-based, resource-based, and SCPs) and an explicit Deny always overrides any Allow, regardless of the order in which the policies are written. In this scenario, even though the user has an Allow effect for s3:PutObject, the attached Deny policy explicitly denies the action, resulting in an AccessDenied error. This is a fundamental rule of AWS authorization logic: an explicit Deny cannot be overridden by any Allow.

Answer

The resource-based policy on S3 denies access

Answer

The Allow policy is evaluated before the Deny policy

Answer

An SCP denies the action

Question 14

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications are the correct trigger because they natively support event-driven architectures where S3 object creation events (e.g., s3:ObjectCreated:Put) can directly invoke a Lambda function. This enables asynchronous processing of uploaded images without any intermediate polling or custom integration, ensuring fault tolerance through Lambda's built-in retry mechanism and dead-letter queue (DLQ) support.

Answer

Amazon SQS

Answer

Amazon API Gateway

Answer

AWS Step Functions

Question 15

Drag and drop the steps to configure an S3 bucket for static website hosting in the correct order.

Accepted Answer

Create an S3 bucket, enable static website hosting, configure index and error documents, set appropriate bucket policy for public read access, upload website content. First create the bucket, then enable static website hosting, configure index and error documents, set appropriate permissions, and finally upload content.

Answer

Create an S3 bucket, configure index and error documents, enable static website hosting, set bucket policy, upload content

Answer

Create an S3 bucket, enable static website hosting, set bucket policy, upload content, configure index and error documents

Answer

Create an S3 bucket, set bucket policy, enable static website hosting, configure index and error documents, upload content