DVA-C02 Practice Test 27 — 15 Questions

Question 1

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint that invokes a Lambda function. The developer wants to pass a stage name as a parameter to the Lambda function. How should the developer define the Lambda function's environment variable in the SAM template?

Accepted Answer

Use the parameter reference 'Ref: StageName' in the environment variable mapping.. Option B is correct because the SAM template can use the Ref function to reference a parameter and assign it to an environment variable. Option A is wrong because it uses hardcoded value. Option C is wrong because AWS::StackName would give the stack name, not the stage parameter. Option D is wrong because GetAtt is not used for parameters.

Answer

Define the environment variable as 'Stage: dev' in the Lambda function configuration.

Answer

Use 'Fn::GetAtt: [AWS::StackName, Outputs.StageName]' to get the stage name.

Answer

Use 'Fn::ImportValue: StageName' to import from another stack.

Question 2

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. The developer wants to ensure that session data is not lost if an EC2 instance is terminated. Which solution should the developer implement?

Accepted Answer

Store session data in an Amazon ElastiCache cluster.. Option D is correct because ElastiCache provides a managed, external cache for session state that persists independently of EC2 instances. Option A is wrong because instance store is ephemeral. Option B is wrong because EBS is tied to the instance and is lost on termination if not configured for persistence. Option C is wrong because S3 is not optimized for low-latency session storage.

Answer

Store session data in an Amazon EBS volume.

Answer

Store session data in an Amazon S3 bucket.

Answer

Store session data in the instance store.

Question 3

A company runs a microservices application on Amazon ECS with Fargate. The application consists of three services: frontend, orders, and payments. The frontend service is behind an Application Load Balancer (ALB). The orders service processes requests from frontend and sends messages to the payments service via an Amazon SQS queue. The payments service polls the queue. Recently, during peak hours, the orders service experiences high latency and the SQS queue depth increases significantly. The monitoring shows that the payments service is not keeping up. The company wants to scale the payments service based on the queue depth. The developer has configured an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric. However, the payments service is not scaling up as expected. What is the most likely cause?

Accepted Answer

The target tracking policy is not configured correctly because ECS Service Auto Scaling requires a custom metric, and the metric may not have been published yet.. Option D is correct because the ECS Service Auto Scaling requires a custom metric to be published to CloudWatch, and it may take a few minutes for the metric to appear. Option A is wrong because Fargate tasks do not have a maximum task limit by default; the limit is per region and can be increased. Option B is wrong because the SQS ApproximateNumberOfMessagesVisible metric is available as a standard CloudWatch metric. Option C is wrong because the payments service polls the queue; the scaling policy should work regardless of polling frequency.

Answer

The SQS queue is not sending the ApproximateNumberOfMessagesVisible metric to CloudWatch.

Answer

The payments service has reached the maximum number of tasks allowed by the service quota.

Answer

The payments service is not configured to poll the SQS queue frequently enough.

Question 4

A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?

Accepted Answer

Change the default encryption of the bucket to SSE-KMS with the desired KMS key.. SSE-S3 is Amazon-managed keys, not customer-managed. To use customer-managed KMS keys, you must change the default encryption to SSE-KMS. S3 Bucket Keys reduce KMS costs but are not required. Object-level encryption settings are not needed if default encryption is set. Policy change is not sufficient.

Answer

Add an object-level encryption setting to each object after upload.

Answer

Enable S3 Bucket Keys on the bucket.

Answer

Attach a bucket policy that denies uploads without the required KMS key.

Question 5

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

Accepted Answer

Amazon S3 versioning is not enabled on the bucket.. Option A is correct because S3 source actions require versioning enabled to detect changes. Option B is wrong because CloudTrail is not required. Option C is wrong because polling is not the default method. Option D is wrong because IAM permissions are separate from the detection mechanism.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The pipeline is configured to use polling instead of event-based triggers.

Answer

AWS CloudTrail is not enabled.

Question 6

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API has a resource /items with GET and POST methods. The GET method returns items from a DynamoDB table. The POST method adds an item to the table. Currently, all methods are open to the public. Security requirements mandate that only authenticated users can access the POST method, while the GET method remains public. Which THREE steps should the developer take to meet these requirements?

Accepted Answer

Configure the Lambda authorizer only on the POST method in the API Gateway.. Option A is correct because a Lambda authorizer can validate tokens. Option C is correct because the authorizer can be configured only on the POST method. Option E is correct because the Lambda authorizer returns an IAM policy that allows or denies access. Option B is incorrect because Cognito User Pools authorizer would apply to the entire API. Option D is incorrect because resource policies are global, not method-specific.

Answer

Use an Amazon Cognito User Pools authorizer for the entire API.

Answer

Add a resource policy that denies public access to the POST method.

Question 7

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

Accepted Answer

Create an IAM task role with S3 permissions and associate it with the ECS task definition.. Option B is correct because an IAM task role is the recommended way to grant permissions to ECS tasks. Option A is wrong because instance roles are for EC2, not Fargate. Option C is wrong because storing credentials in the container is insecure. Option D is wrong because EFS is for file storage, not for granting S3 permissions.

Answer

Use Amazon EFS to store access keys.

Answer

Assign an IAM instance profile to the Fargate tasks.

Answer

Store AWS credentials in the container image.

Question 8

A developer is implementing a solution to store application logs from multiple EC2 instances. The logs must be stored in a centralized location for analysis. Which services can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because CloudWatch Logs can aggregate logs from EC2 instances via the CloudWatch agent. Option C is correct because S3 can store log files as a centralized repository. Option B is wrong because CloudTrail is for API activity, not application logs. Option D is wrong because DynamoDB is not optimized for log storage. Option E is wrong because Kinesis Data Analytics processes streams, not stores logs.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Answer

Amazon DynamoDB

Question 9

A Lambda function processes messages from an SQS queue. The function occasionally fails due to network timeouts when calling an external API. The developer wants to retry failed messages automatically. What should the developer do?

Accepted Answer

Configure a dead-letter queue for the SQS queue and set the Lambda function's maximum retries to 2.. Option D is correct because configuring a dead-letter queue (DLQ) for the SQS queue allows messages that exceed the maximum retries to be stored for later analysis, while the Lambda function's retry behavior handles transient failures. Option A is wrong because increasing the Lambda timeout may help but does not provide automatic retries. Option B is wrong because SQS does not have a built-in retry mechanism; Lambda retries are separate. Option C is wrong because DLQ on Lambda captures only events that Lambda cannot process, but the best practice is to use SQS DLQ.

Answer

Enable SQS redrive policy to automatically retry after a failure.

Answer

Configure a dead-letter queue on the Lambda function to capture failed events.

Answer

Increase the Lambda function's timeout to 15 minutes.

Question 10

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application must be highly available across multiple Availability Zones. The developer needs to configure the ECS service. Which THREE configuration options are required? (Choose THREE.)

Accepted Answer

Set the desired number of tasks to at least 2.. Option A is correct because a load balancer is needed to distribute traffic across tasks in multiple AZs. Option C is correct because setting the number of tasks to at least 2 ensures redundancy. Option D is correct because spreading tasks across multiple AZs ensures high availability. Option B is wrong because ECS does not support Auto Scaling groups with Fargate. Option E is wrong because a DynamoDB table is not needed for ECS service configuration.

Answer

Create an Auto Scaling group for the Fargate tasks.

Answer

Use a DynamoDB table to store task state.

Question 11

A developer needs to store application logs in a highly available and durable storage service. The logs must be retained for 7 years for compliance purposes. The logs are accessed infrequently after the first 30 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest cost for long-term archival with retrieval times of 12 hours. S3 Standard is expensive for long retention. S3 Intelligent-Tiering automatically moves to lower cost tiers, but still incurs monitoring fees. S3 One Zone-Infrequent Access is not highly available across AZs.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Standard

Question 12

A developer is designing a serverless application that processes streaming data from IoT devices. The application must be able to handle data from millions of devices and store the data in a durable, scalable data store. Which AWS services should the developer use? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Streams. Option A is correct because Kinesis Data Streams can ingest large volumes of streaming data. Option C is correct because Lambda can process the data in real-time. Option E is correct because DynamoDB is a scalable, durable data store suitable for IoT data. Option B is wrong because SQS is not a streaming service. Option D is wrong because RDS is not as scalable for high-throughput streaming data.

Answer

Amazon RDS

Answer

Amazon SQS

Question 13

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. Option B is correct because attaching an IAM role to the Lambda function with the least privilege permissions is the AWS best practice for granting permissions to AWS services. Option A is wrong because storing access keys in environment variables is insecure. Option C is wrong because resource-based policies are for granting cross-account access, not for Lambda's own permissions. Option D is wrong because hardcoding credentials is a security risk.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.

Question 14

Which TWO of the following are benefits of using Amazon API Gateway to manage APIs? (Choose two.)

Accepted Answer

Throttling and rate limiting of API requests. Correct: A and D. API Gateway provides throttling to protect backend services and can generate SDKs for multiple languages. Option B is wrong because API Gateway does not provide a built-in caching layer for RDS; it can cache responses but not RDS queries directly. Option C is wrong because API Gateway does not manage database connections. Option E is wrong because API Gateway does not handle file storage.

Answer

Built-in caching of database queries to Amazon RDS

Answer

Direct integration with Amazon S3 for file storage

Answer

Automatic connection pooling for backend databases

Question 15

A developer is building a serverless application using AWS Lambda to process images uploaded to an S3 bucket. The Lambda function needs to resize each image and store the result in another S3 bucket. Which TWO actions should the developer take to ensure the function can access the S3 buckets securely?

Accepted Answer

Create an IAM execution role for the Lambda function with permissions to read from the source bucket and write to the destination bucket.. Option A is correct because Lambda functions need an execution role with permissions. Option D is correct because S3 bucket policies can grant access to the Lambda function's execution role. Option B is incorrect because Lambda functions do not use IAM users. Option C is incorrect because EC2 instance profiles are for EC2, not Lambda. Option E is incorrect because Lambda does not use access keys directly.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Assign an IAM user to the Lambda function and embed the user's access key in the function code.

Answer

Attach an IAM instance profile to the Lambda function.