DVA-C02 Practice Test 31 — 15 Questions

Question 1

A developer is troubleshooting an AWS CloudFormation stack that failed to create. The error message says 'The following resource(s) failed to create: [MyEC2Instance]'. What is the first step the developer should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

View the stack events in the CloudFormation console to see the specific error for the resource.. When a CloudFormation stack fails to create, the error message only indicates which resource failed, not why. The first troubleshooting step is to view the stack events in the CloudFormation console, which provides detailed error messages for each resource, such as an API call failure, insufficient permissions, or a resource limit exceeded. This allows the developer to diagnose the root cause before making any changes.

Answer

Update the stack with a new template.

Answer

Delete the stack and try again.

Answer

Review the CloudFormation template for syntax errors.

Question 2

A developer is deploying a microservices application on Amazon ECS using Fargate. The developer wants to implement a blue/green deployment strategy using AWS CodeDeploy. The current production environment uses an Application Load Balancer (ALB). What is the minimum configuration required to enable blue/green deployments?

Accepted Answer

An ALB with two target groups, one for blue and one for green.. AWS CodeDeploy for Amazon ECS requires an Application Load Balancer (ALB) with two target groups to handle traffic routing during a blue/green deployment. The blue target group serves the current production version, while the green target group serves the new version. CodeDeploy shifts traffic from blue to green by updating the ALB listener rules, and after a successful deployment, the green target group becomes the new production target.

Answer

An ALB with a single target group and an Amazon CloudFront distribution.

Answer

An ECS service discovery namespace.

Answer

A Network Load Balancer (NLB) with a single target group.

Question 3

A DynamoDB query must support lookup by email address as well as by user ID. Which two changes may be required?

Accepted Answer

Create a secondary index with email as a key. A Global Secondary Index (GSI) or Local Secondary Index (LSI) on the email attribute allows DynamoDB to efficiently query by email address without scanning the entire table. Since the primary key is user ID, querying by email requires an index that uses email as the partition key or sort key. Option C is correct because specifying projection attributes limits the data returned from the index or table, reducing read capacity consumption and improving performance.

Answer

Scan the full table for every login

Answer

Disable partition keys

Question 4

A developer is deploying a web application on Amazon EKS. The application needs to read configuration data from an Amazon S3 bucket at startup. The developer wants to ensure that the configuration is securely accessed without embedding AWS credentials in the application code. Which solution should the developer use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to assign an IAM role to the pod.. IAM roles for service accounts (IRSA) allows you to associate an IAM role with a Kubernetes service account, which the pod can assume to obtain temporary AWS credentials via the AWS STS endpoint. This eliminates the need to embed long-term credentials in the application code or environment variables, and the credentials are automatically rotated by the AWS SDK. The pod retrieves the configuration from S3 using the assumed role's permissions, ensuring secure access.

Answer

Store the AWS credentials in AWS Secrets Manager and retrieve them at startup.

Answer

Assign an IAM instance profile to the EC2 instances running the EKS nodes.

Answer

Embed the AWS access key and secret key in a Kubernetes ConfigMap.

Question 5

A developer needs to allow an EC2 instance to access a DynamoDB table. Which IAM entity should be attached to the EC2 instance?

Accepted Answer

IAM role. An IAM role is the correct entity to attach to an EC2 instance because it provides temporary security credentials via the AWS Security Token Service (STS) that the instance can assume. This allows the EC2 instance to securely access the DynamoDB table without embedding long-term access keys in the instance. The role is attached to the instance profile, which the EC2 instance metadata service (IMDS) uses to retrieve credentials automatically.

Answer

IAM group

Answer

IAM user

Answer

Resource-based policy on the DynamoDB table

Question 6

A developer is designing a system that ingests high-volume data from IoT devices. The data must be processed in near real-time and then stored in Amazon S3 for analytics. Which TWO AWS services should the developer use together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time ingestion of large data streams, such as IoT telemetry, and can capture and store data in shards for up to 365 days. AWS Lambda can be configured as a consumer of the Kinesis stream to process records in near real-time and then write the results to Amazon S3 for analytics. Together, they provide a serverless, scalable pipeline for high-volume IoT data.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon EC2

Question 7

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The files are encrypted with S3 server-side encryption using AWS KMS (SSE-KMS). The Lambda function needs to read the files and store metadata in DynamoDB. Which IAM policy statement should be attached to the Lambda execution role to allow it to decrypt the objects?

Accepted Answer

{"Effect":"Allow","Action":["kms:Decrypt"],"Resource":"arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab"}. The Lambda function needs to decrypt objects encrypted with SSE-KMS. The kms:Decrypt action on the specific KMS key ARN grants the necessary permission to decrypt the S3 object data using AWS KMS. Without this, the Lambda function will receive an access denied error when trying to read the encrypted file.

Answer

{"Effect":"Allow","Action":["kms:Encrypt"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["kms:GenerateDataKey"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 8

A developer is deploying a serverless application using AWS SAM. The application consists of multiple Lambda functions and an API Gateway REST API. The developer needs to ensure that the API Gateway endpoint is created before the Lambda functions are deployed, because the functions need the endpoint URL as an environment variable. How should the developer configure the SAM template?

Accepted Answer

Define the Lambda functions to use the ServerlessRestApi implicit API and reference the API's output in the function's environment variables. AWS SAM automatically creates an implicit API Gateway REST API (logical ID `ServerlessRestApi`) when you define an `AWS::Serverless::Api` or use the `Events` property on a function. You can reference its endpoint URL using the `Fn::Sub` intrinsic function with the `ServerlessRestApi` logical ID, such as `!Sub 'https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/${Stage}'`. This ensures the API Gateway resource is created before the Lambda functions that reference it, as CloudFormation resolves dependencies through intrinsic function references.

Answer

Separate the deployment into two stacks: first deploy API Gateway, then deploy Lambda functions

Answer

Add a DependsOn clause to each Lambda function resource to wait for the API Gateway resource

Answer

Use a custom resource in CloudFormation to create the API Gateway endpoint before Lambda functions

Question 9

A company is deploying a microservices architecture using AWS Lambda and Amazon API Gateway. The developer wants to implement a canary release deployment for the API. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Configure stage variables to point the canary stage to a different Lambda function alias.. Stage variables in API Gateway can be configured to point the canary stage to a different Lambda function alias, enabling the canary to invoke a separate version of the function for testing. This allows the canary to route a percentage of traffic to a new Lambda version while the main stage continues using the stable alias, supporting gradual rollouts.

Answer

Use Amazon CloudFront to distribute traffic between two API Gateway stages.

Answer

Use Lambda canary releases to gradually shift traffic.

Question 10

A developer needs to securely distribute temporary AWS credentials to authenticated mobile users. Which two components are commonly involved?

Accepted Answer

Amazon Cognito identity pools. Amazon Cognito identity pools allow you to exchange identity tokens (from a user pool or external IdP) for temporary AWS credentials via the AWS Security Token Service (STS). These credentials are scoped to an IAM role with fine-grained permissions, enabling secure, least-privilege access to AWS resources from mobile apps without embedding long-term keys.

Answer

AWS root access keys

Answer

An unrestricted S3 bucket policy

Question 11

A developer is using AWS CodeDeploy to deploy a revision to an EC2/On-Premises deployment group. The deployment fails because the specified deployment configuration requires a minimum of 1 healthy host, but the deployment group has 0 instances. What is the most likely cause?

Accepted Answer

The deployment group does not have any Amazon EC2 instances registered.. The deployment failed because the deployment group had zero registered instances, making it impossible to meet the minimum of 1 healthy host required by the deployment configuration. Option D is correct because the error message directly indicates that the deployment group contains no EC2 instances, so there are no hosts to deploy to.

Answer

The deployment group is not associated with any Auto Scaling group.

Answer

The deployment configuration requires too many healthy hosts.

Answer

The CodeDeploy agent is not installed on the instances.

Question 12

A developer wants to store application logs in Amazon S3 with automatic transition to Glacier after 30 days and deletion after 365 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle configuration. S3 Lifecycle configuration is the correct feature because it allows you to define rules that automatically transition objects to colder storage classes like Glacier after a specified number of days (30) and permanently delete them after a longer period (365). This directly matches the requirement for time-based storage tiering and deletion without manual intervention.

Answer

S3 Object Lock

Answer

S3 Replication

Answer

S3 Event Notifications

Question 13

An application running on EC2 needs to access an S3 bucket. The security team wants to avoid using long-term access keys. What is the most secure approach?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Assigning an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) automatically via the instance metadata service. This eliminates the need to store, rotate, or manage long-term access keys, adhering to the security team's requirement for a credential-less approach. The IAM role's permissions policy grants the EC2 instance access to the S3 bucket, and the credentials are automatically rotated by AWS before they expire.

Answer

Generate an access key and secret key for an IAM user and store them on the instance.

Answer

Create a new IAM user and store the credentials in S3 with bucket policies.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them at runtime.

Question 14

A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 15

A company is using AWS CloudFormation to manage infrastructure. The developer wants to update a stack but needs to prevent specific resources from being replaced. What CloudFormation feature should the developer use?

Accepted Answer

Apply a stack policy that denies updates to the specific resources.. A stack policy is a JSON-based policy that defines which resources in a CloudFormation stack can be updated, replaced, or deleted. By applying a stack policy that denies updates to specific resources, the developer can prevent those resources from being replaced during a stack update, even if the template change would normally trigger a replacement.

Answer

Use a custom resource to manage the update logic.

Answer

Create a change set to review the changes before execution.

Answer

Use a deletion policy attribute on the resources to protect them.