DVA-C02 Practice Test 30 — 15 Questions

Question 1

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other securely. Which THREE methods can be used to enable service-to-service authentication?

Accepted Answer

Use AWS App Mesh with mutual TLS (mTLS) authentication.. IAM roles for tasks can be used to authenticate to other AWS services via SDK. Service Connect can handle service discovery and encryption. App Mesh provides mTLS for authentication between services. Security groups control network access, not authentication. API Gateway is for external APIs.

Answer

Use Amazon API Gateway as a proxy for inter-service communication.

Answer

Use security group rules to allow traffic only between services.

Question 2

Which TWO actions can improve the performance of an Amazon DynamoDB table that experiences frequent throttling due to hot partitions? (Choose TWO.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching. Options B and D are correct. Adding a random prefix to the partition key distributes writes across partitions. Using DynamoDB Accelerator (DAX) reduces read load. Option A is wrong because increasing read capacity does not solve hot partition issue. Option C is wrong because global secondary indexes do not reduce throttling on the base table. Option E is wrong because disabling auto scaling may worsen throttling.

Answer

Disable auto scaling to provision fixed capacity

Answer

Increase the read capacity units (RCUs) of the table

Answer

Use a global secondary index (GSI) with a different partition key

Question 3

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

Accepted Answer

Increase the Lambda function's memory allocation. Option C is correct because increasing the Lambda memory allocation also increases allocated CPU, which directly helps CPU-bound functions. Option A is wrong because increasing batch size does not help CPU-bound tasks. Option B is wrong because Provisioned Concurrency does not reduce execution time. Option D is wrong because changing to a different runtime may not address the CPU limitation.

Answer

Increase the SQS batch window size

Answer

Switch the Lambda runtime from Python to Node.js

Answer

Enable Provisioned Concurrency for the function

Question 4

Which THREE steps are required to set up cross-account access for an Amazon S3 bucket? (Choose THREE.)

Accepted Answer

Create an IAM role in the source account that the other account can assume. Options A, B, and D are correct. The bucket policy must grant access to the other account's user or role. The user in the other account must have permissions via IAM. The IAM role in the source account can be used for cross-account access. Option C is wrong because ACLs are legacy and not recommended. Option E is wrong because VPC endpoint is for network connectivity, not cross-account access.

Answer

Configure the bucket ACL to allow the other account

Answer

Set up a VPC endpoint for S3

Question 5

A company uses Amazon DynamoDB as a session store for a web application. The application recently experienced a spike in traffic, causing increased read latency. The DynamoDB table has a read capacity of 5000 RCUs and uses eventual consistent reads. The application performs many GetItem calls. What should a developer do to improve read performance with minimal cost?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table. Option B is correct because DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Option A is wrong because increasing RCUs increases cost and does not use caching. Option C is wrong because DynamoDB Streams are for change data capture, not caching. Option D is wrong because Global Tables are for multi-region replication, not read performance.

Answer

Increase the read capacity to 10000 RCUs

Answer

Configure DynamoDB global tables for the application

Answer

Enable DynamoDB Streams and process updates asynchronously

Question 6

Which TWO AWS services can be used to decouple microservices in a distributed application? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Options B and C are correct. Amazon SQS provides message queuing for decoupling. Amazon SNS enables pub/sub messaging. Option A is wrong because ELB is for load balancing traffic to a single service. Option D is wrong because CloudWatch is for monitoring. Option E is wrong because Route 53 is DNS.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancer (ELB)

Answer

Amazon Route 53

Question 7

A developer needs to store application configuration settings that may change at runtime and wants to avoid redeploying the application. Which AWS service should be used?

Accepted Answer

AWS AppConfig. Option A is correct because AWS AppConfig is designed to manage application configuration and allow dynamic updates without redeployment. Option B is wrong because Secrets Manager is for secrets, not general config. Option C is wrong because SSM Parameter Store can store config but lacks advanced features like validation and staged rollouts. Option D is wrong because DynamoDB is a database, not purpose-built for config management.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Secrets Manager

Answer

Amazon DynamoDB

Question 8

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

Accepted Answer

DynamoDB Accelerator (DAX). Correct: A. DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency. Option B is wrong because DynamoDB Streams is for change data capture, not caching. Option C is wrong because Global Tables are for multi-region replication, not read performance within a region. Option D is wrong because TTL is for automatic item expiration, not caching.

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Answer

DynamoDB Time to Live (TTL)

Question 9

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

Accepted Answer

Use the FireLens log driver to route logs to Fluent Bit and then to the tool. Option D is correct because the FireLens integration allows you to use a log router (e.g., Fluent Bit) in the task definition to transform logs to JSON and forward them to any destination. Option A is wrong because CloudWatch Logs agent is for EC2, not Fargate. Option B is wrong because you cannot modify the `awslogs` driver to output JSON; it sends to CloudWatch Logs. Option C is wrong because modifying the application requires code change.

Answer

Use the awslogs log driver and configure a JSON output format

Answer

Install the CloudWatch Logs agent on the container

Answer

Modify the application to output logs in JSON format

Question 10

A developer is creating an Amazon S3 bucket to store sensitive documents. The bucket must encrypt objects at rest using an AWS Key Management Service (KMS) key. Which S3 bucket property should be configured?

Accepted Answer

Default encryption. Option B is correct because S3 default encryption can be set to use SSE-KMS. Option A is wrong because bucket policies control access, not encryption. Option C is wrong because lifecycle policies manage object lifecycle. Option D is wrong because versioning is for object versions, not encryption.

Answer

Bucket policy

Answer

Versioning

Answer

Lifecycle configuration

Question 11

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs. Correct: C. Amazon CloudWatch Logs can collect logs from EC2 instances via the CloudWatch agent and store them with customizable retention. Option A is wrong because S3 is object storage, not designed for real-time log collection. Option B is wrong because Kinesis Data Firehose is for streaming data to destinations like S3, but it's more complex for simple log collection. Option D is wrong because CloudTrail records API activity, not application logs.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3 with S3 Server Access Logs

Question 12

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Option A is correct because Amazon SNS can send email notifications when integrated with CloudWatch Events (now Amazon EventBridge) for CodePipeline state changes. Option B is wrong because SES is for sending transactional emails, but not directly integrated with CodePipeline. Option C is wrong because CloudWatch Logs is for log storage. Option D is wrong because Lambda can be used but is not the simplest service for just sending email notifications.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 13

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

Accepted Answer

Amazon API Gateway WebSocket API. Correct: A. Amazon API Gateway supports WebSocket APIs and can manage connections and broadcast messages. Option B is wrong because ALB supports WebSocket but does not provide broadcasting capabilities. Option C is wrong because CloudFront is a CDN and does not natively support WebSocket broadcasting. Option D is wrong because SQS is a queue, not for WebSocket management.

Answer

Amazon SQS with long polling

Answer

Application Load Balancer with WebSocket support

Answer

Amazon CloudFront with WebSocket support

Question 14

A developer is designing a microservice that processes orders. The service must ensure that each order is processed exactly once. The developer uses an SQS queue to decouple the order submission from processing. Which SQS feature should be used to prevent duplicate processing?

Accepted Answer

FIFO queue with content-based deduplication. Option B is correct because SQS FIFO queues support exactly-once processing through deduplication based on message deduplication ID. Option A is wrong because standard queues guarantee at-least-once delivery. Option C is wrong because visibility timeout prevents other consumers from processing the same message, but does not prevent duplicates if the message is delivered again. Option D is wrong because dead-letter queues store messages that could not be processed, they do not prevent duplicates.

Answer

Standard queue with visibility timeout

Answer

FIFO queue with a dead-letter queue

Answer

Standard queue with message retention period

Question 15

A developer is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for database credentials. The developer wants to ensure that the credentials are encrypted at rest and rotated automatically. Which solution meets these requirements with minimal effort?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the application code. Configure automatic rotation.. Correct: B. AWS Secrets Manager provides automatic rotation of secrets and encryption at rest. Option A is wrong because SSM Parameter Store with SecureString provides encryption but does not automatically rotate. Option C is wrong because hardcoding credentials is insecure. Option D is wrong because environment variables in Elastic Beanstalk are not encrypted by default and do not rotate.

Answer

Hardcode the credentials in the application code and use environment variables for different environments.

Answer

Store the credentials in AWS Systems Manager Parameter Store as SecureString parameters and reference them in the application code.

Answer

Use Elastic Beanstalk environment properties to set the credentials as plaintext environment variables.