DVA-C02 Practice Test 27 — 15 Questions

Question 1

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation to define and deploy the API Gateway.. AWS CloudFormation provides infrastructure as code (IaC) capabilities that allow you to define the entire API Gateway configuration, including resources, methods, integrations, and deployment stages, in a template. When integrated with CodePipeline, CloudFormation can automatically create or update the API Gateway and trigger a deployment as part of the CI/CD pipeline, ensuring consistent and repeatable deployments without manual intervention.

Answer

Use AWS Lambda to update the API Gateway configuration.

Answer

Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.

Answer

Use AWS CodeBuild to compile and deploy the API Gateway configuration.

Question 2

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. An HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 3

An API backed by Lambda returns high p95 latency after deployment. Which two telemetry sources are most useful first?

Accepted Answer

CloudWatch Lambda duration/init duration/logs. CloudWatch Lambda duration and init duration metrics directly measure the time your function spends executing and initializing, which are the primary drivers of p95 latency. Logs can reveal cold starts, timeouts, or inefficient code paths that cause high latency. These are the most immediate telemetry sources to identify performance bottlenecks in the Lambda function itself.

Answer

AWS Billing console only

Answer

S3 Inventory reports

Question 4

A developer is using AWS CodeCommit as a source repository. They want to automatically build and test code whenever a new branch is created. Which AWS service should they use to trigger the pipeline?

Accepted Answer

Amazon CloudWatch Events. Amazon CloudWatch Events (now part of Amazon EventBridge) can capture AWS CodeCommit repository events, such as the creation of a new branch. By setting a rule that matches the 'Reference Created' event type, you can automatically trigger an AWS CodePipeline pipeline execution, enabling continuous integration for new branches.

Answer

Amazon S3 event notification

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Lambda

Question 5

A service needs loosely coupled asynchronous communication where one producer sends events to many different AWS service targets using rules. Which service fits best?

Accepted Answer

Amazon EventBridge. Amazon EventBridge is a serverless event bus service that enables loosely coupled asynchronous communication. It allows a single producer to publish events, and then uses rules to route those events to multiple AWS service targets (e.g., Lambda, SQS, Step Functions) simultaneously, fulfilling the requirement exactly.

Answer

Amazon EFS

Answer

AWS CloudHSM

Answer

AWS DataSync

Question 6

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The EC2 instances are in an Auto Scaling group. What is the MOST likely cause?

Accepted Answer

The target group health checks are failing.. The intermittent 503 errors indicate that the ALB temporarily has no healthy targets to forward requests to. When target group health checks fail, the ALB marks instances as unhealthy and stops routing traffic to them, causing a 503 response if all instances are unhealthy. This aligns with the Auto Scaling group potentially launching new instances that haven't passed health checks yet, or existing instances failing health checks due to application overload or misconfiguration.

Answer

The SSL certificate on the ALB has expired.

Answer

The ALB DNS name is not resolving.

Answer

The security group for the ALB is blocking traffic.

Question 7

A developer needs to prevent accidental public access to all S3 buckets in an account. Which account-level control should be enabled?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is an account-level control that provides a centralized way to enforce that no S3 buckets or objects in the account can be made publicly accessible, regardless of individual bucket policies or ACLs. This setting overrides any bucket-level public access settings, effectively preventing accidental exposure of data to the internet.

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Answer

S3 Object Lambda

Question 8

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway endpoint and an AWS Lambda function. The developer wants to define a stage name for the API Gateway deployment. Which section of the SAM template should the developer use?

Accepted Answer

Globals. The `Globals` section in an AWS SAM template allows you to define shared configuration settings that apply to all resources in the template. For API Gateway, you can set properties like `StageName` under `Globals.Api`, which will be inherited by all API Gateway resources defined in the template, ensuring consistent stage naming without repeating the configuration.

Answer

Conditions

Answer

Outputs

Answer

Parameters

Question 9

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.

Question 10

An ECS blue/green deployment with CodeDeploy and an Application Load Balancer fails because the replacement task set never receives test traffic. Which configuration should be checked?

Accepted Answer

The test listener and target group mapping in the deployment group. In an ECS blue/green deployment with CodeDeploy and an Application Load Balancer, the test listener and its associated target group are responsible for routing test traffic to the replacement task set. If the replacement task set never receives test traffic, the most likely cause is that the test listener is not correctly mapped to the target group in the CodeDeploy deployment group configuration. This mapping ensures that traffic from the test listener is directed to the replacement task set during the deployment lifecycle.

Answer

S3 bucket versioning

Answer

Lambda provisioned concurrency

Answer

DynamoDB TTL

Question 11

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The bucket policy also grants access to the role. An application running on the instance is unable to read objects. The instance has the correct instance profile. What is the MOST likely cause?

Accepted Answer

The bucket policy has a condition that does not match the request context.. The most likely cause is that the bucket policy includes a condition (e.g., aws:SourceIp, aws:SourceVpce, or aws:SecureTransport) that does not match the request context from the EC2 instance. Even though the IAM role grants access, the bucket policy's explicit condition denies the request if the condition key evaluates to false, resulting in an implicit deny. This is a common misconfiguration where the role has permissions but the bucket policy's conditions are too restrictive.

Answer

The EC2 instance's security group blocks outbound traffic to S3.

Answer

The S3 bucket is in a different AWS account.

Answer

The instance profile is not attached to the EC2 instance.

Question 12

An application uses DynamoDB Streams to trigger downstream processing. The processor must receive both old and new item images after updates. Which stream view type should be configured?

Accepted Answer

NEW_AND_OLD_IMAGES. B is correct because DynamoDB Streams must be configured with the NEW_AND_OLD_IMAGES stream view type to capture both the item's state before and after a write operation (update, insert, or delete). This ensures the downstream processor receives the complete old and new item data, which is required for use cases like auditing, change data capture, or reconciling state changes.

Answer

KEYS_ONLY

Answer

NEW_IMAGE only

Answer

OLD_IMAGE only

Question 13

Drag and drop the steps to implement a disaster recovery plan using cross-region replication for S3 in the correct order.

Accepted Answer

Create source and destination S3 buckets, then enable versioning on both buckets, then set up IAM permissions for replication, then configure a replication rule on the source bucket.. First create buckets, enable versioning, configure replication rule, and set permissions.

Answer

Enable versioning on both buckets, then create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule.

Answer

Configure a replication rule on the source bucket, then create source and destination S3 buckets, then enable versioning, then set up IAM permissions.

Answer

Create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule, then enable versioning on both buckets.

Question 14

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

Accepted Answer

Use the multipart upload API.. Objects larger than 100 MB should be uploaded using the multipart upload API to improve throughput and provide resilience against network failures. The multipart upload API allows the 200 MB object to be split into parts, uploaded in parallel, and then assembled, which is more efficient and reliable than a single PutObject operation for objects over 5 GB or for large objects in general.

Answer

Enable S3 Transfer Acceleration and use the PutObject API.

Answer

Use the PutObject API operation.

Answer

Use a pre-signed URL and upload using HTTP PUT.

Question 15

An application running on Amazon ECS with Fargate is unable to pull an image from Amazon ECR. The task definition uses the 'default' task execution role. What is the most likely cause?

Accepted Answer

The task execution role does not have permissions to pull from ECR.. When using Amazon ECS with Fargate, the task execution role (not the task role) is responsible for pulling container images from Amazon ECR. The 'default' task execution role is created automatically but lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability) unless explicitly attached via an IAM policy. Since the question states the task definition uses the 'default' task execution role, the most likely cause is that this role does not have the required ECR permissions.

Answer

The task role does not have permissions to access ECR.

Answer

The ECS cluster does not have permissions to access ECR.

Answer

The ECS service role does not have permissions to access ECR.