DVA-C02 Practice Test 29 — 15 Questions

Question 1

A developer runs a script that uses the AWS CLI to copy a large number of files from an on-premises server to an S3 bucket. The copy operation fails partway through with a 'RequestTimeout' error. What is the MOST efficient way to resume the copy and ensure all files are transferred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the aws s3 sync command to synchronize the source directory with the S3 bucket.. The `aws s3 sync` command is the most efficient way to resume the copy because it automatically compares the source directory with the destination S3 bucket and transfers only the files that are missing or have been modified. This avoids re-uploading already transferred files, directly addressing the partial failure without manual intervention or unnecessary overhead.

Answer

Delete the S3 bucket and restart the copy operation.

Answer

Use the cp command with the --recursive flag to copy the remaining files.

Answer

Increase the --cli-read-timeout value in the AWS CLI configuration and retry the original command.

Question 2

Drag and drop the steps to encrypt an EBS volume using AWS KMS in the correct order.

Accepted Answer

1. Create a KMS key, 2. Create a snapshot of the unencrypted EBS volume, 3. Copy the snapshot with encryption (specifying the KMS key), 4. Create a new encrypted EBS volume from the encrypted snapshot.. First create a KMS key, then snapshot the unencrypted volume, copy with encryption, and create the encrypted volume.

Answer

1. Create a snapshot of the unencrypted EBS volume, 2. Create a KMS key, 3. Copy the snapshot with encryption, 4. Create a new encrypted EBS volume from the encrypted snapshot.

Answer

1. Create a KMS key, 2. Create a snapshot of the unencrypted EBS volume, 3. Create a new encrypted EBS volume directly from the unencrypted snapshot.

Answer

1. Create an encrypted EBS volume, 2. Attach it to an EC2 instance, 3. Migrate data from the unencrypted volume, 4. Detach and delete the unencrypted volume.

Question 3

A company wants to encrypt data at rest in an S3 bucket using server-side encryption. Which option provides the MOST control over the encryption key?

Accepted Answer

SSE-C (customer-provided keys). SSE-C (customer-provided keys) gives you the most control because you manage the encryption key yourself—you provide the key in each request, and AWS discards it after use. This means you have full lifecycle control over the key material, including rotation, deletion, and access policies, without AWS ever storing the key. In contrast, SSE-KMS and SSE-S3 rely on AWS-managed or AWS-controlled key stores, reducing your direct control.

Answer

SSE-KMS (AWS KMS keys)

Answer

Client-side encryption

Answer

SSE-S3 (S3-managed keys)

Question 4

A developer is deploying a web application on AWS Elastic Beanstalk. The application requires a fixed IP address for outbound traffic to a third-party API. What is the MOST cost-effective solution?

Accepted Answer

Launch the environment in a VPC with a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides a fixed public IP address for outbound traffic from private subnets, enabling the web application to communicate with the third-party API while remaining secure. Elastic Beanstalk environments are typically launched in private subnets, and the NAT Gateway is the most cost-effective managed service for this purpose compared to a NAT instance or assigning Elastic IPs to each EC2 instance.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a VPC endpoint for the third-party API.

Answer

Assign an Elastic IP to each EC2 instance.

Question 5

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 6

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Accepted Answer

Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.. Setting the SQS queue's visibility timeout to be greater than the Lambda function's timeout ensures that if the Lambda function fails or times out, the message becomes visible again in the queue after the visibility timeout expires, allowing another consumer to retry processing. This prevents messages from being lost due to processing failures, supporting at-least-once processing. Option E is correct because calling the SQS DeleteMessage API only after successful processing ensures that the message is not removed from the queue until it has been fully and correctly handled, so if processing fails, the message remains available for retry.

Answer

Configure a Dead Letter Queue (DLQ) to capture failed messages.

Answer

Enable long polling on the SQS queue.

Answer

Use a FIFO queue to ensure exactly-once processing.

Question 7

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

Accepted Answer

Create a Global Secondary Index (GSI) with CustomerID as the partition key.. Creating a Global Secondary Index (GSI) with CustomerID as the partition key allows DynamoDB to efficiently query orders by CustomerID using the index's key structure, avoiding full table scans. This directly addresses the slow performance and high read capacity consumption by enabling targeted lookups instead of scanning all items and filtering.

Answer

Increase the provisioned read capacity for the table.

Answer

Change the table's primary key to use CustomerID as the partition key.

Answer

Use a FilterExpression on the CustomerID attribute in a Scan operation.

Question 8

A DynamoDB table uses partition key customerId. One enterprise customer generates most traffic and is throttled while the table has unused capacity elsewhere. What design change best addresses the hot partition?

Accepted Answer

Add write sharding or redesign the partition key to distribute that customer's workload. The hot partition is caused by a single customerId receiving a disproportionate amount of traffic, exceeding the 3000 RCU or 1000 WCU per partition limit. By adding write sharding (e.g., appending a random suffix to the partition key) or redesigning the partition key to include a more granular attribute, you distribute that customer's writes across multiple partitions, eliminating the bottleneck and utilizing the table's unused capacity.

Answer

Enable point-in-time recovery

Answer

Reduce item size by removing attributes

Answer

Use strongly consistent reads only

Question 9

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is designed specifically for securely storing, managing, and automatically rotating database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a custom rotation interval (e.g., 90 days) without custom infrastructure. Secrets Manager also integrates natively with Amazon RDS, Redshift, and DocumentDB for automatic credential rotation.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS KMS

Question 10

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The developer wants to automatically roll back the deployment if the CloudFormation stack update fails. Which configuration should be used?

Accepted Answer

Configure the CloudFormation stack to roll back on failure using the RollbackConfiguration.. CloudFormation natively supports automatic rollback on stack update failure through the `RollbackConfiguration` property. When a stack update fails, CloudFormation can automatically revert to the last known good state, which is exactly what the developer needs for a serverless deployment pipeline. This configuration can be set in the CloudFormation template or passed as a parameter during the deploy action in CodePipeline.

Answer

Add a stack policy to the CloudFormation stack to prevent updates.

Answer

Set the deployment to use AWS CodeDeploy and enable rollback.

Answer

Configure a manual approval action in the pipeline to trigger a rollback.

Question 11

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

Accepted Answer

Create an Amazon RDS database instance separately and configure the application to connect to it.. The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Answer

Use the Elastic Beanstalk console to add an RDS database to the environment.

Answer

Use an S3 bucket to store data.

Answer

Use Amazon DynamoDB as the database.

Question 12

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. The application uses read-heavy workloads. Which action would MOST effectively reduce CPU load without major architectural changes?

Accepted Answer

Implement an in-memory cache layer with Amazon ElastiCache.. The most effective solution without major architectural changes. Amazon ElastiCache provides an in-memory cache that offloads read traffic from the RDS instance, reducing CPU utilization. While it requires application modifications to integrate the cache, this is a standard practice and does not involve a full database migration or architectural overhaul. Option B (migrate to Aurora) involves significant migration effort. Option C (increase instance size) may temporarily help but is less cost-effective and does not address the read-heavy nature. Option D is incorrect because Multi-AZ standby instances are for failover only and cannot serve read queries.

Answer

Migrate the database to Amazon Aurora with auto-scaling.

Answer

Increase the DB instance size to a larger instance type.

Answer

Create a Multi-AZ deployment and use the standby for read queries.

Question 13

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption. The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not include the server-side encryption header. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The `s3:x-amz-server-side-encryption` condition key matches the `x-amz-server-side-encryption` request header, which is used to specify server-side encryption (SSE-S3 or SSE-KMS) for S3 PutObject requests. By denying requests that do not include this header, the policy enforces that all uploads must be encrypted at rest using server-side encryption.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 14

A developer is deploying a Lambda function that processes images uploaded to an S3 bucket. The function is triggered by S3 events. After deployment, the function does not execute when new images are uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the Lambda function.. The most likely cause is that the S3 bucket does not have an event notification configured to invoke the Lambda function. S3 event notifications must be explicitly set on the bucket to trigger a Lambda function when objects are created; without this configuration, S3 will not send any invocation request to Lambda, regardless of the function's permissions or settings.

Answer

The Lambda function memory is set too low.

Answer

The Lambda function does not have permission to read from the S3 bucket.

Answer

The Lambda function is not in the same region as the S3 bucket.

Question 15

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Answer

DynamoDB Auto Scaling

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)