DVA-C02 Practice Test 32 — 15 Questions

Question 1

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. The AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 2

A service publishes order events to SNS. Several consumers need different filtered subsets of events without changing publisher code. What should the developer configure?

Accepted Answer

SNS subscription filter policies. SNS subscription filter policies allow each consumer to define a JSON policy on their subscription that selectively delivers only messages matching specified attributes (e.g., event type, region). This enables multiple consumers to receive different filtered subsets of the same SNS topic without modifying the publisher's code, as the filtering happens server-side at the SNS service level.

Answer

Separate AWS accounts for each consumer

Answer

Lambda code that discards unwanted events after invocation

Answer

SQS long polling only

Question 3

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. It uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 4

An application stores session data in DynamoDB and must expire sessions automatically after a timestamp. Which feature should be used?

Accepted Answer

DynamoDB Time to Live. DynamoDB Time to Live (TTL) allows you to define a timestamp attribute per item, and DynamoDB automatically deletes items once that timestamp is reached. This is the ideal feature for expiring session data without requiring custom scan-and-delete logic, reducing cost and operational overhead.

Answer

DynamoDB global tables

Answer

DynamoDB transactions

Answer

DynamoDB export to S3

Question 5

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to connected clients. The developer notices that the 'connectionId' changes every time a client reconnects. How should the developer store the mapping between user identity and connectionId?

Accepted Answer

Use Amazon DynamoDB to store the mapping, with user identity as the partition key and connectionId as an attribute.. Amazon DynamoDB is the recommended, fully managed, serverless key-value store for persisting WebSocket connection IDs in AWS. It offers single-digit millisecond latency, scales automatically, and integrates seamlessly with AWS Lambda without requiring VPC configuration (unlike Amazon ElastiCache, which typically requires a VPC, adding setup complexity and potential latency for Lambda functions).

Answer

Use Amazon ElastiCache to store the mapping in memory.

Answer

Use Amazon RDS to store the mapping in a relational database.

Answer

Use Amazon S3 to store the mapping as a JSON file.

Question 6

An application running on EC2 instances in an Auto Scaling group needs to access an S3 bucket. The security team wants to avoid storing long-term AWS credentials on the instances. Which approach should be used?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. It uses an IAM role attached to an EC2 instance profile, which allows the EC2 instances to automatically obtain temporary security credentials from the AWS Security Token Service (STS). This approach eliminates the need to store long-term credentials on the instances, as the credentials are rotated automatically and are retrieved via the instance metadata service (IMDS).

Answer

Store the credentials in AWS Systems Manager Parameter Store and retrieve them in User Data.

Answer

Use an AWS Lambda function to generate temporary credentials and pass them to the instances.

Answer

Generate access keys for a dedicated IAM user and store them in a file on the AMI.

Question 7

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

Accepted Answer

Use Fn::GetAtt with "Arn" attribute on the DLQ resource.. `Fn::GetAtt` with the `Arn` attribute retrieves the actual Amazon Resource Name (ARN) of the Dead Letter Queue (DLQ) resource dynamically at stack creation time. This avoids hardcoding the ARN, making the template portable across accounts and regions. The RedrivePolicy property requires the full ARN of the DLQ, and `Fn::GetAtt` is the intrinsic function designed to return resource attributes like ARN.

Answer

Use Ref to reference the DLQ's QueueName and construct the ARN.

Answer

Use Fn::Sub to substitute the queue name into a hardcoded ARN template.

Answer

Use Fn::ImportValue to import the DLQ ARN from another stack.

Question 8

A developer is deploying a microservices application on Amazon ECS using Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The developer needs to perform a blue/green deployment with automatic rollback if health checks fail. What should the developer use?

Accepted Answer

Use AWS CodeDeploy with a blue/green deployment configuration.. AWS CodeDeploy natively supports blue/green deployments for Amazon ECS, allowing you to specify a blue/green configuration that automatically shifts traffic from the old (blue) task set to the new (green) task set. It integrates with the ALB to perform health checks and can automatically roll back the deployment if the health checks fail, meeting the requirement without manual intervention.

Answer

Configure ECS service auto scaling to replace tasks gradually.

Answer

Manually update the ECS service using the AWS Management Console.

Answer

Use AWS CloudFormation to update the ECS service with a new task definition.

Question 9

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. AWS Systems Manager Parameter Store and AWS Secrets Manager are AWS-native services designed to securely store and manage sensitive information like database credentials. By storing credentials in these services, the developer avoids hardcoding them in the application code, adhering to security best practices. The application can then retrieve the credentials at runtime using IAM roles and permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 10

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon S3 bucket. The company wants to follow the principle of least privilege. How should the developer provide the necessary permissions?

Accepted Answer

Create an IAM task role with S3 permissions and associate it with the ECS task definition.. Amazon ECS with Fargate launch type uses IAM task roles to grant permissions to containers at the task level. The task role is an IAM role that the ECS task assumes, allowing the application to securely access S3 without hardcoding credentials. This follows the principle of least privilege by scoping permissions to the specific task and using temporary credentials via the AWS STS service.

Answer

Use Amazon EFS to store access keys.

Answer

Assign an IAM instance profile to the Fargate tasks.

Answer

Store AWS credentials in the container image.

Question 11

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 12

Drag and drop the steps to create a Lambda function that processes S3 events in the correct order.

Accepted Answer

Set up permissions, then write code, then create function, then configure trigger, then test.. First set up permissions, then code, create function, configure trigger, and test.

Answer

Write code, then set up permissions, then create function, then configure trigger, then test.

Answer

Set up permissions, then create function, then write code, then configure trigger, then test.

Answer

Set up permissions, then write code, then create function, then test, then configure trigger.

Question 13

An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?

Accepted Answer

Task role permissions for Secrets Manager access. The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.

Answer

Store the secret in the container image

Answer

An EC2 instance profile attached to the Fargate host

Question 14

A company stores sensitive user data in an S3 bucket. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The bucket already has default encryption configured with SSE-S3. What is the MINIMUM change needed to meet the requirement?

Accepted Answer

Change the default encryption of the bucket to SSE-KMS with the desired KMS key.. The current bucket has default encryption set to SSE-S3, which uses AWS-managed keys, not customer-managed KMS keys. Changing the default encryption to SSE-KMS with the desired customer-managed KMS key ensures that all new objects uploaded to the bucket are automatically encrypted at rest using that key, meeting the security team's requirement without additional per-object configuration.

Answer

Add an object-level encryption setting to each object after upload.

Answer

Enable S3 Bucket Keys on the bucket.

Answer

Attach a bucket policy that denies uploads without the required KMS key.

Question 15

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For read-heavy workloads like session data, DAX offloads read traffic from the DynamoDB table, reducing latency and providing a seamless caching layer without application code changes.

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Answer

DynamoDB Time to Live (TTL)