DVA-C02 Practice Test 27 — 15 Questions

Question 1

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. It uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 2

A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms. It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.

Answer

Deny s3:PutObject if the request includes x-amz-server-side-encryption

Answer

Allow s3:PutObject only if the request uses a specific KMS key

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256

Question 3

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

Accepted Answer

Configure an SQS event source mapping on the Lambda function.. AWS Lambda supports native SQS event source mappings, which allow Lambda to poll an SQS queue and invoke the function automatically when new messages arrive. This integration handles the polling, batch retrieval, and deletion of messages from the queue, making it the simplest and most efficient way to process SQS messages with Lambda.

Answer

Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

Answer

Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

Answer

Use AWS Step Functions to poll the SQS queue and invoke Lambda.

Question 4

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. The AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 5

A service publishes order events to SNS. Several consumers need different filtered subsets of events without changing publisher code. What should the developer configure?

Accepted Answer

SNS subscription filter policies. SNS subscription filter policies allow each consumer to define a JSON policy on their subscription that selectively delivers only messages matching specified attributes (e.g., event type, region). This enables multiple consumers to receive different filtered subsets of the same SNS topic without modifying the publisher's code, as the filtering happens server-side at the SNS service level.

Answer

Separate AWS accounts for each consumer

Answer

Lambda code that discards unwanted events after invocation

Answer

SQS long polling only

Question 6

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. It uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 7

An application stores session data in DynamoDB and must expire sessions automatically after a timestamp. Which feature should be used?

Accepted Answer

DynamoDB Time to Live. DynamoDB Time to Live (TTL) allows you to define a timestamp attribute per item, and DynamoDB automatically deletes items once that timestamp is reached. This is the ideal feature for expiring session data without requiring custom scan-and-delete logic, reducing cost and operational overhead.

Answer

DynamoDB global tables

Answer

DynamoDB transactions

Answer

DynamoDB export to S3

Question 8

An application running on EC2 instances in an Auto Scaling group needs to access an S3 bucket. The security team wants to avoid storing long-term AWS credentials on the instances. Which approach should be used?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the EC2 instances to automatically obtain temporary security credentials from the AWS Security Token Service (STS). This approach eliminates the need to store long-term credentials on the instances, as the credentials are rotated automatically and are retrieved via the instance metadata service (IMDS).

Answer

Store the credentials in AWS Systems Manager Parameter Store and retrieve them in User Data.

Answer

Use an AWS Lambda function to generate temporary credentials and pass them to the instances.

Answer

Generate access keys for a dedicated IAM user and store them in a file on the AMI.

Question 9

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

Accepted Answer

Use Fn::GetAtt with "Arn" attribute on the DLQ resource.. `Fn::GetAtt` with the `Arn` attribute retrieves the actual Amazon Resource Name (ARN) of the Dead Letter Queue (DLQ) resource dynamically at stack creation time. This avoids hardcoding the ARN, making the template portable across accounts and regions. The RedrivePolicy property requires the full ARN of the DLQ, and `Fn::GetAtt` is the intrinsic function designed to return resource attributes like ARN.

Answer

Use Ref to reference the DLQ's QueueName and construct the ARN.

Answer

Use Fn::Sub to substitute the queue name into a hardcoded ARN template.

Answer

Use Fn::ImportValue to import the DLQ ARN from another stack.

Question 10

A developer is deploying a microservices application on Amazon ECS using Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The developer needs to perform a blue/green deployment with automatic rollback if health checks fail. What should the developer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration.. AWS CodeDeploy natively supports blue/green deployments for Amazon ECS, allowing you to specify a blue/green configuration that automatically shifts traffic from the old (blue) task set to the new (green) task set. It integrates with the ALB to perform health checks and can automatically roll back the deployment if the health checks fail, meeting the requirement without manual intervention.

Answer

Configure ECS service auto scaling to replace tasks gradually.

Answer

Manually update the ECS service using the AWS Management Console.

Answer

Use AWS CloudFormation to update the ECS service with a new task definition.

Question 11

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. AWS Systems Manager Parameter Store and AWS Secrets Manager are AWS-native services designed to securely store and manage sensitive information like database credentials. By storing credentials in these services, the developer avoids hardcoding them in the application code, adhering to security best practices. The application can then retrieve the credentials at runtime using IAM roles and permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 12

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

Accepted Answer

Create an IAM task role with S3 permissions and associate it with the ECS task definition.. Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.

Answer

Use Amazon EFS to store access keys.

Answer

Assign an IAM instance profile to the Fargate tasks.

Answer

Store AWS credentials in the container image.

Question 13

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 14

Drag and drop the steps to create a Lambda function that processes S3 events in the correct order.

Accepted Answer

Set up permissions, then write code, then create function, then configure trigger, then test.. First set up permissions, then code, create function, configure trigger, and test.

Answer

Write code, then set up permissions, then create function, then configure trigger, then test.

Answer

Set up permissions, then create function, then write code, then configure trigger, then test.

Answer

Set up permissions, then write code, then create function, then test, then configure trigger.

Question 15

An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?

Accepted Answer

Task role permissions for Secrets Manager access. The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.

Answer

Store the secret in the container image

Answer

An EC2 instance profile attached to the Fargate host