DVA-C02 Practice Test 28 — 15 Questions

Question 1

A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the default encryption of the bucket to SSE-KMS with the desired KMS key.. The current bucket has default encryption set to SSE-S3, which uses AWS-managed keys, not customer-managed KMS keys. Changing the default encryption to SSE-KMS with the desired customer-managed KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that key, meeting the security team's requirement without additional per-object configuration.

Answer

Add an object-level encryption setting to each object after upload.

Answer

Enable S3 Bucket Keys on the bucket.

Answer

Attach a bucket policy that denies uploads without the required KMS key.

Question 2

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For read-heavy workloads like session data, DAX offloads read traffic from the DynamoDB table, reducing latency and providing a seamless caching layer without application code changes.

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Answer

DynamoDB Time to Live (TTL)

Question 3

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet without internet access. Which method should be used to grant the instance access to DynamoDB securely?

Accepted Answer

Create a VPC endpoint for DynamoDB and attach an IAM role to the instance. A VPC Gateway Endpoint for DynamoDB allows EC2 instances in a private subnet to access DynamoDB without traversing the internet or requiring a NAT gateway. By attaching an IAM role to the EC2 instance, the application can securely obtain temporary credentials via the instance metadata service, eliminating the need to store long-term credentials on the instance.

Answer

Store AWS credentials in a file on the instance and use them in the application

Answer

Configure security group rules to allow outbound traffic to DynamoDB

Answer

Attach a NAT gateway to the private subnet and use IAM user credentials

Question 4

A company uses Amazon DynamoDB as a session store for a web application. The application recently experienced a spike in traffic, causing increased read latency. The DynamoDB table has a read capacity of 5000 RCUs and uses eventual consistent reads. The application performs many GetItem calls. What should a developer do to improve read performance with minimal cost?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for GetItem calls from single-digit milliseconds to microseconds. Since the application uses eventual consistent reads and performs many GetItem operations, DAX offloads reads from the table, improving performance without increasing provisioned RCUs. This is the most cost-effective solution because it avoids scaling the table's read capacity and only charges for the cache nodes used.

Answer

Increase the read capacity to 10000 RCUs

Answer

Configure DynamoDB global tables for the application

Answer

Enable DynamoDB Streams and process updates asynchronously

Question 5

A company uses an Amazon S3 bucket to store sensitive documents. The security team requires that all objects uploaded to the bucket must be encrypted at rest using server-side encryption with a customer-managed KMS key (SSE-KMS). A developer needs to enforce this by denying any PutObject request that does not specify the required encryption. Which bucket policy condition should be used?

Accepted Answer

"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. The condition `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` explicitly denies any PutObject request that does not specify the exact customer-managed KMS key ARN. This enforces SSE-KMS with a specific key, meeting the security team's requirement that all objects must be encrypted at rest using that key.

Answer

"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"}}

Answer

"Condition": {"ArnNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Question 6

A developer is implementing S3 multipart upload for large files. Which two actions are required to complete the upload?

Accepted Answer

Upload all parts and keep their ETags/part numbers. During an S3 multipart upload, each part must be uploaded individually, and the response includes an ETag (a hash of the part) and a part number. These must be recorded and provided in the final request to assemble the object. Option D is correct because the CompleteMultipartUpload API call is required to signal S3 to combine all uploaded parts into the final object, using the list of ETags and part numbers.

Answer

Enable S3 static website hosting

Answer

Disable bucket encryption

Question 7

A developer has deployed a serverless application using AWS SAM. After a recent update, the API Gateway endpoints return 500 errors. The Lambda function logs show no errors. What should the developer investigate first?

Accepted Answer

Verify the API Gateway integration response and mapping templates.. When API Gateway returns 500 errors but Lambda logs show no errors, the issue is typically in the API Gateway integration response or mapping templates. API Gateway may fail to transform the Lambda response into the expected format, causing an internal server error without the Lambda function ever throwing an exception.

Answer

Increase the Lambda function timeout.

Answer

Check the Lambda function's reserved concurrency.

Answer

Review the CloudFormation stack events for any failures.

Question 8

A developer is building a real-time chat application using WebSocket APIs in Amazon API Gateway. The backend is an AWS Lambda function that stores connection IDs in an Amazon DynamoDB table. After a few days, the application stops working for new users. The developer checks CloudWatch Logs and sees that the Lambda function is returning 'AccessDeniedException' when calling DynamoDB. What is the MOST likely cause?

Accepted Answer

The DynamoDB table was recreated and the Lambda function's IAM role still references the old table ARN.. The most likely cause is that the DynamoDB table was recreated, which changes its ARN. The Lambda function's IAM role still references the old table ARN, so when the function attempts to perform DynamoDB operations (e.g., PutItem for storing connection IDs), the request is denied because the role no longer has permissions on the new table. This is a common issue when infrastructure is rebuilt without updating IAM policies.

Answer

The Lambda function code was updated but the IAM role was not reattached.

Answer

The Lambda function uses an outdated AWS SDK version.

Answer

The API Gateway route was updated without redeploying the API.

Question 9

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The build stage runs successfully, but the deploy stage fails with an error: 'The deployment failed because no instances were found for the environment.' What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment has no running instances due to a failed health check.. The error 'no instances were found for the environment' directly indicates that the Elastic Beanstalk environment has no running EC2 instances. This typically occurs when the environment's health checks have failed, causing all instances to be terminated or remain in a degraded state. Without any healthy instances, CodePipeline cannot deploy the application, as Elastic Beanstalk requires at least one running instance to perform a deployment.

Answer

The CodeDeploy application is not configured correctly.

Answer

The IAM role for CodePipeline lacks permissions to describe EC2 instances.

Answer

The build artifact is not named correctly for Elastic Beanstalk.

Question 10

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The new application version fails the configured health checks on the instances.. The error message indicates that instances failed deployment, which is most commonly caused by the new application version failing the health checks configured in the deployment group. CodeDeploy uses these health checks (e.g., ELB health checks or custom scripts) to determine if an instance is healthy after deployment; if the application crashes or returns non-200 status codes, CodeDeploy marks the instance as failed and aborts the deployment.

Answer

The deployment group does not exist.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on the instances.

Question 11

A developer is creating an IAM policy to allow an EC2 instance to read objects from a specific S3 bucket named 'my-app-data'. The policy should be attached to an IAM role that will be assumed by the EC2 instance. Which policy statement meets this requirement?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-app-data/*" } ] }. It grants only the s3:GetObject permission on the specific S3 bucket 'my-app-data' and its objects, which is the minimum required to allow an EC2 instance to read objects from that bucket. The policy is designed to be attached to an IAM role that the EC2 instance assumes, following the principle of least privilege.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::my-app-data/*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-app-data/*" } ] }

Question 12

A developer is creating a Lambda function that requires access to a DynamoDB table. The function will be invoked by an Amazon API Gateway REST API. What is the BEST way to secure this architecture?

Accepted Answer

Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table.. The Lambda function needs an execution role—an IAM role that Lambda assumes at runtime—with a policy that grants the specific DynamoDB actions (e.g., GetItem, PutItem) on the target table. This follows the principle of least privilege and is the standard AWS pattern for granting Lambda access to AWS resources. API Gateway invokes the Lambda function via a resource-based policy on the function itself, but that does not affect DynamoDB access; the Lambda execution role handles all downstream permissions.

Answer

Attach a resource-based policy to the DynamoDB table allowing Lambda access.

Answer

Use API Gateway to pass a shared secret to Lambda for DynamoDB access.

Answer

Store the DynamoDB access keys in the Lambda environment variables.

Question 13

A company runs a microservices architecture on Amazon ECS with Fargate. The application experiences intermittent high latency. The operations team wants to trace requests across services and identify bottlenecks. Which AWS service should be used?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, capturing latency at each hop. It generates a service map that visualizes the flow and pinpoints bottlenecks, which is exactly what the operations team needs for a distributed application on ECS Fargate.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Metrics

Question 14

A CodeDeploy deployment to Lambda should shift 10 percent of traffic for 10 minutes before full rollout and automatically roll back on alarms. Which configuration should be used?

Accepted Answer

Canary deployment preference with CloudWatch alarms. A is correct because CodeDeploy's canary deployment preference shifts 10% of traffic to the new Lambda version for 10 minutes, then automatically shifts the remaining 90% after the specified interval. CloudWatch alarms are configured to trigger an automatic rollback if the alarm state is breached during the canary period, meeting the requirement for a gradual shift with automated rollback on failure.

Answer

All-at-once deployment without alarms

Answer

Manual alias update after deployment

Answer

S3 static website deployment

Question 15

A company has a Lambda function that writes to an S3 bucket. The IAM role used by the function has an inline policy allowing s3:PutObject on the bucket. However, writes fail with an access denied error. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies the request.. Even if the Lambda function's IAM role grants s3:PutObject, an explicit deny in the S3 bucket policy takes precedence over any allow. The access denied error indicates that the request is being evaluated and denied by the bucket policy, which overrides the IAM permission due to AWS's policy evaluation logic (explicit deny > allow).

Answer

The S3 bucket is in a different region.

Answer

The S3 bucket uses SSE-KMS encryption and the function lacks kms:Decrypt permissions.

Answer

The Lambda function does not have the correct execution role.