DVA-C02 Practice Test 29 — 15 Questions

Question 1

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

Accepted Answer

The HMAC or digital signature over the payload using the shared/public key material. Webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Answer

The source port number

Answer

The CloudWatch log stream name

Answer

The API Gateway request ID only

Question 2

A developer is monitoring an AWS Lambda function that is triggered by an Amazon SQS queue. The function's CloudWatch metrics show a high number of throttles. The function has a reserved concurrency of 10 and the SQS queue has a large backlog of messages. The function processes each message in about 2 seconds and has a timeout of 60 seconds. Which action will most effectively reduce the throttles and increase throughput?

Accepted Answer

Increase the reserved concurrency of the Lambda function to 50. The high throttles indicate that the Lambda function's reserved concurrency of 10 is insufficient to handle the incoming messages from the SQS queue. By increasing reserved concurrency to 50, you allow more concurrent executions, which reduces throttling and increases throughput. The function's 2-second processing time and 60-second timeout are not the bottleneck; the concurrency limit is.

Answer

Increase the batch size in the SQS event source mapping to 100

Answer

Increase the function timeout to 120 seconds

Answer

Decrease the reserved concurrency to 5

Question 3

A developer is designing a serverless application using API Gateway, Lambda, and DynamoDB. The API must authenticate users using a JWT token. Which API Gateway feature should the developer use to validate the JWT before invoking the Lambda function?

Accepted Answer

Use a Lambda authorizer (custom authorizer).. A Lambda authorizer (custom authorizer) is required to validate JWTs issued by a third-party identity provider (IdP) in API Gateway REST APIs. While Amazon Cognito user pool authorizers can natively validate Cognito-issued JWTs, they cannot validate tokens from external providers. A Lambda authorizer allows you to run custom code to verify the signature, expiration, and claims of any third-party JWT before routing the request to the backend Lambda function.

Answer

Use an IAM authorizer with a resource policy.

Answer

Use an Amazon Cognito user pool authorizer.

Answer

Use an API Gateway resource policy to allow only authenticated IPs.

Question 4

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer needs to identify the root cause. Which AWS service should the developer use to view detailed error logs from the failed deployment?

Accepted Answer

Amazon CloudWatch Logs (if configured) or the CodeDeploy agent log files on the EC2 instances. When a CodeDeploy deployment fails due to instance-level errors, the most direct way to investigate is to examine the CodeDeploy agent logs located on each EC2 instance at `/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent.log`. If Amazon CloudWatch Logs has been configured to stream these logs, you can also view them centrally in the CloudWatch console. These logs contain detailed error messages from the `codedeploy-agent` process, including script failures, permission issues, or missing dependencies that caused the deployment to fail.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS CodeDeploy console

Question 5

A team is using AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Deploy stage uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The pipeline runs successfully, but the application still serves the old version. What is the most likely cause?

Accepted Answer

The CodeDeploy deployment group is associated with a different Auto Scaling group than the one serving traffic.. The most likely cause is that the CodeDeploy deployment group is associated with a different Auto Scaling group than the one actually serving traffic. Even though the pipeline runs successfully, CodeDeploy deploys the new application revision only to instances in the Auto Scaling group linked to its deployment group. If the deployment group targets a different Auto Scaling group (e.g., a staging group) while the live traffic is served by another group (e.g., production), the old version remains on the production instances.

Answer

The load balancer's target group is not pointing to the correct instances.

Answer

The build artifact in the Source stage is corrupted.

Answer

The CodeBuild stage failed silently and did not produce a new artifact.

Question 6

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage that pulls from CodeCommit and a deploy stage that uses AWS Elastic Beanstalk. The developer wants to run unit tests automatically before deploying to Elastic Beanstalk. Which action should the developer add to the pipeline?

Accepted Answer

Add a test stage that uses an AWS CodeBuild project configured to run unit tests. AWS CodeBuild can be integrated as a test stage in CodePipeline to run unit tests automatically. By adding a CodeBuild project configured with a buildspec.yml file that executes unit tests, the pipeline will run tests after the source stage and before the deploy stage, ensuring only code that passes tests is deployed to Elastic Beanstalk.

Answer

Add a manual approval step before the deploy stage

Answer

Configure Elastic Beanstalk health checks to run tests

Answer

Replace Elastic Beanstalk with AWS CodeDeploy

Question 7

A Step Functions workflow calls three independent Lambda functions and should continue only after all results are available. Which state pattern should be used?

Accepted Answer

Parallel state. The Parallel state in AWS Step Functions is designed to execute multiple branches of work concurrently and then aggregate their outputs into a single array. This is exactly what is needed when three independent Lambda functions must all complete before the workflow continues, as the Parallel state waits for all branches to finish before proceeding to the next state.

Answer

Choice state

Answer

Wait state

Answer

Fail state

Question 8

A developer is using AWS CodeBuild to build a Java application. The build fails with the error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE'. What is the most likely cause?

Accepted Answer

The Docker image specified in the build environment does not exist or the repository is not accessible.. The error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' in AWS CodeBuild indicates that the service cannot pull the specified Docker image from the repository. This occurs when the image name/tag is incorrect, the image does not exist in the specified registry (e.g., Amazon ECR or Docker Hub), or the CodeBuild service role lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage) to access the repository. Option B correctly identifies this as the most likely cause.

Answer

The build environment does not have enough memory.

Answer

The build command has a syntax error.

Answer

The buildspec.yml file does not define artifacts.

Question 9

Drag and drop the steps to set up a custom domain for an API Gateway API in the correct order.

Accepted Answer

1. Register or have a domain, 2. Request or import a certificate in ACM, 3. Create a custom domain name in API Gateway, 4. Create an API mapping to a stage, 5. Update DNS records to point to the API Gateway domain name. First have a domain, get a certificate, create custom domain in API Gateway, map to stage, and update DNS.

Answer

1. Create a custom domain name in API Gateway, 2. Register or have a domain, 3. Request or import a certificate in ACM, 4. Create an API mapping to a stage, 5. Update DNS records

Answer

1. Update DNS records, 2. Register or have a domain, 3. Request or import a certificate in ACM, 4. Create a custom domain name in API Gateway, 5. Create an API mapping to a stage

Answer

1. Register or have a domain, 2. Create a custom domain name in API Gateway, 3. Request or import a certificate in ACM, 4. Create an API mapping to a stage, 5. Update DNS records

Question 10

A developer is using Amazon DynamoDB with provisioned throughput. The application is receiving ProvisionedThroughputExceededException errors. What is the BEST way to handle this error?

Accepted Answer

Implement exponential backoff and retry in the application code.. The ProvisionedThroughputExceededException indicates that the application has exceeded the provisioned read/write capacity units for the DynamoDB table. The best practice to handle this error is to implement exponential backoff and retry logic in the application code, which progressively increases the wait time between retries to reduce request volume and allow the throttling to subside. This approach is recommended by AWS for handling throttling errors gracefully without manual intervention.

Answer

Contact AWS Support to increase the DynamoDB service limits.

Answer

Reduce the read and write capacity units.

Answer

Switch the table to on-demand capacity mode.

Question 11

Which AWS service provides a managed, rotating secret store for database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to manage the entire lifecycle of secrets, including automatic rotation of database credentials on a configurable schedule (e.g., every 30 days). It natively integrates with Amazon RDS, Aurora, Redshift, and DocumentDB to rotate credentials without application downtime, using a built-in Lambda rotation function. This makes it the only fully managed, rotating secret store among the options.

Answer

AWS KMS

Answer

AWS IAM Roles

Answer

AWS Systems Manager Parameter Store

Question 12

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

Accepted Answer

Use the FireLens log driver to route logs to Fluent Bit and then to the tool. FireLens is an ECS log driver that integrates with Fluent Bit or Fluentd to route, filter, and transform container logs without modifying application code. By using FireLens with Fluent Bit, you can configure a JSON parser to convert stdout logs into JSON format before forwarding them to the centralized log management tool, meeting the requirement exactly.

Answer

Use the awslogs log driver and configure a JSON output format

Answer

Install the CloudWatch Logs agent on the container

Answer

Modify the application to output logs in JSON format

Question 13

A developer is using AWS CodeDeploy to deploy a new version of an application to an Auto Scaling group. The deployment fails because the new instances do not pass the health check. The developer wants to automatically roll back the deployment if the health check fails. Which CodeDeploy setting should be configured?

Accepted Answer

Enable automatic rollback in the deployment group configuration.. AWS CodeDeploy provides a built-in automatic rollback feature that can be configured at the deployment group level. When enabled, if a deployment fails (e.g., due to health check failures), CodeDeploy automatically reverts to the last known successful deployment, ensuring minimal downtime and manual intervention.

Answer

Set the deployment configuration to AllAtOnce to speed up the process.

Answer

Configure a lifecycle hook to terminate failing instances.

Answer

Use a blue/green deployment strategy instead of in-place.

Question 14

A developer needs to store a large number of binary files (e.g., images) that are accessed infrequently but must be retrievable within minutes. The storage solution should be cost-effective. Which Amazon S3 storage class is MOST suitable?

Accepted Answer

S3 Glacier Instant Retrieval. S3 Glacier Instant Retrieval is the most suitable because it is designed for long-lived, infrequently accessed data that requires retrieval in milliseconds (within minutes), offering a lower storage cost than S3 Standard while still providing rapid access. The question specifies 'retrievable within minutes' and 'cost-effective,' which aligns with Glacier Instant Retrieval's sub-second retrieval times and lower storage price point compared to S3 Standard or Intelligent-Tiering for data accessed rarely.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Question 15

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

Accepted Answer

The S3 bucket's event notification still points to the old Lambda function.. After deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Answer

The Lambda function has a syntax error.

Answer

The Lambda function alias is not pointing to the new version.

Answer

The S3 events are being throttled by Lambda.