DVA-C02 Practice Test 3 — 30 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.

Question 2

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.

Question 3

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 4

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

Accepted Answer

No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.. AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.

Answer

Enable encryption in the SAM template using the 'Encrypt' property.

Answer

Modify the Lambda function's code to encrypt environment variables before deployment.

Answer

Create a customer managed KMS key and specify it in the SAM template.

Question 5

A developer is deploying a microservices architecture on Amazon ECS with Fargate. Each service needs to store sensitive configuration data such as database passwords. The developer wants to avoid hardcoding secrets in the application code. Which approach should the developer use?

Accepted Answer

Store the secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and reference them in the ECS task definition using the 'secrets' parameter.. AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing sensitive configuration data. By referencing secrets via the `secrets` parameter in the ECS task definition, the secrets are injected into the container at runtime without being exposed in the application code, task definition plaintext, or Docker image. This approach integrates natively with ECS Fargate and supports automatic rotation of secrets.

Answer

Store the secrets in an Amazon S3 bucket and use a pre-signed URL to download them at startup.

Answer

Define the secrets as environment variables in the ECS task definition.

Answer

Encrypt the secrets using AWS KMS and store the encrypted blob in a configuration file within the Docker image.

Question 6

A developer is troubleshooting a CloudFormation stack that fails to create. The stack includes an Auto Scaling group with a launch template. The error message says 'Value (null) for parameter groupId is invalid.' What is the MOST likely cause?

Accepted Answer

The launch template references a SecurityGroupId parameter that is not provided or is misspelled.. The error 'Value (null) for parameter groupId is invalid' indicates that a SecurityGroupId parameter referenced in the launch template is either not provided or misspelled. CloudFormation resolves parameters at stack creation; if the parameter is missing or has a typo, it evaluates to null, causing the launch template to fail validation because a security group ID is required for the network interface.

Answer

The Auto Scaling group does not specify a VPC subnet.

Answer

The Auto Scaling group's user data script contains a syntax error.

Answer

The launch template specifies an invalid key pair name.

Question 7

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 8

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53

Question 9

A company is using AWS CodeDeploy with an in-place deployment to an Auto Scaling group. The deployment fails with the error 'Deployment failed because the deployment group does not have enough instances to deploy to'. The Auto Scaling group has a minimum size of 2, maximum size of 5, and desired capacity of 2. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

Accepted Answer

The instances in the Auto Scaling group are not passing health checks.. The error 'Deployment failed because the deployment group does not have enough instances to deploy to' occurs when there are zero healthy instances in the deployment group at the start of deployment. With CodeDeployDefault.AllAtOnce, the minimum number of healthy hosts is 0, so a single instance failure during deployment would not trigger this error. The most likely cause is that the instances in the Auto Scaling group are not passing health checks, resulting in no healthy instances available for deployment. Option C is correct.

Answer

The Auto Scaling group needs to have at least 3 instances to use AllAtOnce.

Answer

The deployment configuration is not compatible with Auto Scaling groups.

Answer

The deployment group has only 2 instances, and the deployment failed on one instance, causing the minimum healthy hosts threshold to be violated.

Question 10

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Accepted Answer

Enable default encryption.. Options B and D are correct. Enabling default encryption (B) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data from unauthorized access if the bucket is misconfigured or accessed improperly. Blocking public access at the bucket level (D) prevents accidental public exposure of data. Option A (versioning) helps recover from accidental deletions or overwrites but does not prevent data leaks. Option C (MFA Delete) adds an extra authentication step for deleting objects or changing versioning, which protects against unauthorized deletions, not leaks. Option E (cross-region replication) provides data redundancy and disaster recovery, but does not prevent data leaks.

Answer

Enable versioning.

Answer

Enable MFA Delete.

Answer

Configure cross-region replication.

Question 11

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS DB instance. They want to update the DB instance class without downtime. Which update policy should they use?

Accepted Answer

UseLatestRestorableTime. None of the listed options is correct. AWS CloudFormation does not have a built-in update policy that avoids downtime when changing the DB instance class of an RDS instance. To modify the instance class with minimal downtime, you can use a custom approach such as creating a read replica, promoting it, and updating DNS, or modifying the DB instance directly (which typically involves brief downtime). The options presented are either invalid or unrelated: UseLatestRestorableTime is a property for restoring from a snapshot or creating read replicas, not an update policy; AutoScalingRollingUpdate is for Auto Scaling groups; UpdateReplacePolicy controls replacement behavior; CreationPolicy controls creation signals.

Answer

AutoScalingRollingUpdate

Answer

UpdateReplacePolicy

Answer

CreationPolicy

Question 12

A developer is managing an application running on Amazon EC2 instances behind an Application Load Balancer. Users report that the application becomes unresponsive after several hours, and restarting the instance temporarily fixes the issue. The developer suspects a memory leak but cannot add custom instrumentation. Which AWS service can collect memory utilization metrics and help identify the memory leak with minimal configuration?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and emit them to CloudWatch.. The CloudWatch agent can collect custom metrics, including memory utilization, from EC2 instances and publish them to Amazon CloudWatch. This allows the developer to monitor memory usage over time and identify a memory leak without modifying the application code. The default EC2 metrics do not include memory utilization, so the CloudWatch agent is the minimal-configuration solution for this requirement.

Answer

Use Amazon CloudWatch Logs agent to capture application logs.

Answer

Use the EC2 instance metadata service to query memory usage.

Answer

Use AWS X-Ray to trace memory allocation.

Question 13

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the ECS task definition to use the awslogs log driver and set the log group.. The awslogs log driver is the native, zero-configuration way to send container stdout/stderr to Amazon CloudWatch Logs from ECS Fargate. By specifying the awslogs log driver and a log group in the task definition, logs are automatically forwarded without any additional agents, code changes, or infrastructure, meeting the requirement for minimal operational overhead.

Answer

Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.

Answer

Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.

Answer

Install the CloudWatch agent in the container and configure it to send logs.

Question 14

A developer needs to grant a Lambda function permission to write logs to CloudWatch Logs. Which IAM entity should be used?

Accepted Answer

Create an IAM execution role with the necessary permissions and associate it with the function.. Lambda functions require an IAM execution role to obtain temporary credentials for accessing other AWS services. This role must include a trust policy allowing Lambda to assume it and a permissions policy granting the specific actions (e.g., logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents) on CloudWatch Logs. Associating this role with the function is the standard and secure way to grant permissions.

Answer

Attach an inline policy to the Lambda function.

Answer

Use a service control policy (SCP) to allow logging.

Answer

Add a resource-based policy to the Lambda function.

Question 15

A developer is building a real-time chat application using WebSockets via API Gateway. The backend uses AWS Lambda functions to handle connect, disconnect, and message events. The application needs to broadcast messages to all connected clients. What is the most scalable and cost-effective way to maintain the list of connection IDs and broadcast messages?

Accepted Answer

Store connection IDs in a DynamoDB table. Use a Lambda function to query all connection IDs and send messages using the API Gateway Management API.. DynamoDB provides a scalable and cost-effective solution for storing connection IDs because it is a NoSQL database designed for high availability and low latency. The Lambda function can query the entire table to retrieve all connection IDs and then use the API Gateway Management API (via `postToConnection`) to send messages to each client. This approach scales horizontally because multiple Lambda instances can access the same DynamoDB table. Option A is wrong because SQS FIFO queues are not suitable for broadcasting all messages to all connections; they are designed for point-to-point messaging and would require polling, adding latency and cost. Option C is wrong because an in-memory list in a single Lambda instance does not persist across cold starts and cannot be shared across multiple concurrent Lambda instances, leading to data loss and incorrect broadcasts. Option D is wrong because ElastiCache Redis adds operational complexity and cost, and using its Pub/Sub feature would require additional infrastructure; DynamoDB is simpler and more aligned with serverless best practices.

Answer

Use an SQS FIFO queue to store connection IDs and have a Lambda function poll the queue to broadcast.

Answer

Maintain an in-memory list of connection IDs in a global variable of a single Lambda function.

Answer

Use Amazon ElastiCache Redis to store connection IDs and use Redis Pub/Sub for broadcasting.

Question 16

A developer uses the AWS SDK to list thousands of DynamoDB items from a query. Only the first page is processed. What should be implemented?

Accepted Answer

Pagination using LastEvaluatedKey until no further key is returned. The DynamoDB Query API returns paginated results, with a maximum of 1 MB of data per page. The `LastEvaluatedKey` in the response indicates that more items exist. To retrieve all items, the application must check for `LastEvaluatedKey` and, if present, issue a subsequent Query request with the `ExclusiveStartKey` parameter set to that value, repeating until `LastEvaluatedKey` is no longer returned. This is the standard pagination pattern for DynamoDB.

Answer

A larger Lambda memory setting only

Answer

A global secondary index with the same key

Answer

Strongly consistent reads on every request

Question 17

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

Accepted Answer

Amazon Simple Email Service (SES). Amazon Simple Email Service (SES) is specifically designed for sending transactional emails, such as order confirmations, password resets, and marketing communications. It provides a reliable, scalable SMTP interface or API to send high-deliverability emails, with features like dedicated IP addresses and feedback loops. This makes it the correct choice for an application that needs to send email notifications directly to users.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Question 18

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?

Accepted Answer

Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.. The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.

Answer

Configure the ALB target group to authenticate using the OIDC identity provider.

Answer

Use AWS Lambda@Edge to authenticate users at the edge.

Answer

Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.

Question 19

A developer needs to store application configuration data that can be read by multiple EC2 instances. The data is less than 1 KB and changes frequently. Which AWS service is BEST suited for this?

Accepted Answer

AWS AppConfig. AWS AppConfig is the best choice because it is designed for dynamic, frequent configuration changes that need to be deployed to multiple EC2 instances without redeploying code or restarting applications. It supports hosted configuration data (up to 1 MB) and provides controlled rollouts, validation, and monitoring, making it ideal for sub-1 KB data that changes frequently.

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Question 20

A developer is building a microservice that needs to invoke another AWS Lambda function and wait for the result to continue processing. Which Lambda invocation type must the developer use to achieve synchronous invocation?

Accepted Answer

RequestResponse. The RequestResponse invocation type is the correct choice for synchronous invocation of a Lambda function, where the caller waits for the function to execute and receive a response. This is the default invocation type when using the Invoke API with InvocationType set to 'RequestResponse', and it is required for microservices that need to block until the downstream Lambda returns a result.

Answer

Event

Answer

DryRun

Answer

None of the above