DVA-C02 Practice Test 28 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key policy does not grant the IAM user/role permissions to use the key.. When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.

Answer

The S3 bucket's object ownership is set to BucketOwnerPreferred.

Answer

The KMS key is in a different AWS Region than the S3 bucket.

Answer

The S3 bucket policy denies PutObject without encryption.

Question 2

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Answer

Amazon EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 3

A developer notices that an S3 bucket policy allows public read access to all objects. The bucket contains sensitive data that should only be accessible by authorized IAM users. What is the BEST way to remediate this?

Accepted Answer

Modify the bucket policy to remove the public statement and use IAM policies for access.. The bucket policy currently grants public read access, which overrides any IAM-based restrictions. By removing the public statement from the bucket policy and relying solely on IAM policies, access is controlled at the user level, ensuring only authorized IAM users can read objects. This aligns with the principle of least privilege and follows AWS best practices for securing S3 data.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access at the account level.

Answer

Enable S3 Object Ownership and use ACLs.

Question 4

A CodePipeline source stage should start when code is pushed to a repository, without scheduled polling. Which integration pattern should be used?

Accepted Answer

Event-based trigger from the source provider/EventBridge integration. AWS CodePipeline can integrate with Amazon EventBridge to listen for repository events (e.g., push events from CodeCommit, GitHub, or Bitbucket) and automatically start the pipeline. This event-driven pattern eliminates the need for scheduled polling, providing near-instantaneous execution when code changes are detected.

Answer

Manual approval only

Answer

A cron job on an EC2 instance

Answer

CloudWatch Logs Insights

Question 5

A company uses AWS CodePipeline to deploy a critical web application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). During a recent deployment, the CodeDeploy stage failed because the target EC2 instances were not in a healthy state. The developer needs to ensure that the pipeline automatically rolls back the deployment to the last successful version if the deployment fails. What should the developer do?

Accepted Answer

In the CodeDeploy deployment group, enable automatic rollback when a deployment fails.. CodeDeploy deployment groups have a built-in automatic rollback configuration that can be enabled to revert to the last successful deployment revision when a deployment fails. This feature directly addresses the requirement without requiring additional services or manual steps, as it operates within the CodeDeploy service itself.

Answer

Use AWS CloudFormation to manage the deployment and enable rollback on failure.

Answer

Configure a CloudWatch alarm to trigger a rollback in CodePipeline.

Answer

Modify the CodePipeline stage to include a manual approval step that checks health before proceeding.

Question 6

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway, a Lambda function, and a DynamoDB table. The developer wants to enable canary deployments for the Lambda function. What should the developer do?

Accepted Answer

Add the AutoPublishAlias and DeploymentPreference properties to the Lambda function in the SAM template.. The AWS SAM template supports canary deployments for Lambda functions by adding the `AutoPublishAlias` property (which automatically creates and publishes a new version to a Lambda alias) and the `DeploymentPreference` property (which defines the traffic-shifting strategy, such as `Canary10Percent5Minutes`). This enables CodeDeploy to gradually shift traffic from the current version to the new version without manual intervention.

Answer

Configure a CodeDeploy deployment group in the SAM template.

Answer

Create a Lambda alias and configure traffic shifting manually.

Answer

Use AWS CodePipeline to orchestrate the canary deployment.

Question 7

A developer needs an S3 upload workflow where clients upload large files directly to S3 without exposing AWS credentials through the browser. What should the backend generate?

Accepted Answer

Pre-signed URLs with appropriate expiration and object restrictions. Pre-signed URLs allow the backend to generate time-limited, permission-restricted URLs that clients can use to upload objects directly to S3 without exposing AWS credentials. The backend signs the URL with IAM credentials, and the client uses the URL to perform the PUT operation, ensuring secure, credential-free uploads.

Answer

Long-lived IAM access keys for each client

Answer

A public-read bucket policy

Answer

An S3 Inventory report

Question 8

The developer runs a scan on the DynamoDB table 'orders' with a filter expression to find items with order_status equal to 'SHIPPED'. The output shows ScannedCount of 10000 but Count of 0. Which statement is correct?

Accepted Answer

The scan retrieved 10,000 items from the table, but none matched the filter condition.. In DynamoDB, a Scan operation retrieves all items in the table or index up to the 1 MB limit, then applies any filter expression client-side. The ScannedCount of 10,000 indicates that 10,000 items were read from the table, but the Count of 0 means none of those items satisfied the filter condition (order_status = 'SHIPPED'). This is the expected behavior: filters are applied after the data is read, not before.

Answer

The scan only returned items that matched the filter, so there are no items with status SHIPPED.

Answer

The filter expression syntax is incorrect, causing the scan to return zero items.

Answer

The scan applied the filter before reading items, so only matching items were scanned.

Question 9

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

Accepted Answer

The caller must be allowed to use the KMS key for decrypt operations. When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Answer

The caller must own the destination VPC

Answer

The bucket must enable static website hosting

Answer

The object key must end with .kms

Question 10

A developer is using the AWS CLI to upload a file to an S3 bucket with server-side encryption. The bucket is configured with default encryption (SSE-S3). The developer wants to ensure the object is encrypted with SSE-KMS instead. What should the developer do?

Accepted Answer

Use the --sse aws:kms parameter when uploading. The developer must explicitly specify the server-side encryption method at the time of upload using the `--sse aws:kms` parameter in the AWS CLI. This overrides the bucket's default SSE-S3 encryption, ensuring the object is encrypted with SSE-KMS. Without this parameter, the object inherits the bucket's default encryption (SSE-S3), regardless of any other settings.

Answer

Use the --kms-key-id parameter with a KMS key ARN

Answer

No action needed; the bucket default encryption will apply

Answer

Change the bucket policy to require SSE-KMS

Question 11

A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?

Accepted Answer

Examine the ALB access logs for 503 responses.. The correct first step is to examine the ALB access logs for 503 responses. Since health checks are succeeding, the EC2 instances are considered healthy by the target group, but the ALB itself may be returning 503 errors due to issues like request rate limits, connection limits, or backend response timeouts. Access logs provide detailed HTTP response codes and timestamps, allowing you to identify the pattern and cause of the 503 errors without making assumptions about instance count or state.

Answer

Increase the number of EC2 instances in the target group.

Answer

Check the Route 53 record for the ALB.

Answer

Verify that the EC2 instances are in a running state.

Question 12

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function sometimes fails due to transient errors. The developer wants to ensure that failed messages are retried automatically and then sent to a dead-letter queue after three failed attempts. How should the developer configure this?

Accepted Answer

Configure the SQS queue with a redrive policy and a dead-letter queue. Set the maxReceiveCount to 3.. Amazon SQS supports a redrive policy that automatically moves messages to a dead-letter queue (DLQ) after a specified number of receive attempts. By setting maxReceiveCount to 3, the SQS queue will retry delivering the message to the Lambda function up to three times (including the initial attempt). After three failed processing attempts, the message is automatically sent to the configured DLQ. This approach decouples retry logic from the Lambda function itself and leverages SQS's built-in reliability features.

Answer

Enable Lambda function's DLQ and set the retry attempts to 3.

Answer

Configure the Lambda function's reserved concurrency to 0 and set the DLQ on the function.

Answer

Use an Amazon SNS topic to send failed messages to a DLQ after three Lambda invocations.

Question 13

A company wants to encrypt data in transit between an on-premises application and an Amazon RDS instance. Which of the following should be implemented?

Accepted Answer

Use SSL/TLS for the database connection. Encrypting data in transit between an on-premises application and Amazon RDS requires enabling SSL/TLS on the database connection. RDS supports SSL/TLS for all supported engines, and the client must be configured to use the RDS certificate authority to establish an encrypted channel. This directly protects data as it travels over the network from the application to the database endpoint.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Place the RDS instance in a private subnet and use a bastion host

Answer

Enable encryption at rest on the RDS instance

Question 14

A SAM application should gradually shift Lambda traffic and roll back on errors. Which two pieces are needed?

Accepted Answer

A Lambda alias/deployment preference. AWS SAM uses Lambda aliases with deployment preferences (e.g., Canary10Percent5Minutes or Linear10PercentEvery10Minutes) to gradually shift traffic from the old version to the new version. Option C is correct because CloudWatch alarms can be tied to the deployment preferences to automatically roll back the traffic shift if the alarm enters the ALARM state, indicating errors or degraded health.

Answer

An S3 lifecycle rule

Answer

A public S3 bucket

Question 15

A developer is using AWS AppSync to build a GraphQL API. The API needs to allow clients to receive real-time updates when data changes in a DynamoDB table. Which AppSync feature should the developer use?

Accepted Answer

Subscriptions. Subscriptions in AWS AppSync are the feature designed for real-time updates. They use WebSocket connections to push data to clients automatically when a mutation modifies the underlying data source, such as a DynamoDB table. By configuring a subscription on a specific mutation, the developer enables clients to receive live changes without polling.

Answer

Resolvers

Answer

Queries

Answer

Mutations