DVA-C02 Practice Test 32 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL database. Recently, the application started experiencing frequent database connection timeouts. The development team discovered that the application is not closing database connections properly, leading to exhausted database connections. The team wants a solution that does not require code changes. Which option should they choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Amazon RDS Proxy in front of the RDS instance and update the application to connect through the proxy.. Amazon RDS Proxy provides connection pooling, allowing the application to reuse database connections efficiently, reducing the number of open connections without code changes. Option B is incorrect: Multi-AZ provides high availability and failover but does not address connection leaks or exhaustion. Option C is incorrect: Migrating to Aurora with Auto Scaling for read replicas adds scalability for read traffic but does not fix connection leaks; it also requires migration effort. Option D is incorrect: Increasing max_connections may temporarily alleviate the symptom but does not solve the underlying issue of connections not being closed, and it can lead to resource contention.

Answer

Enable Multi-AZ on the RDS instance to handle failover and reduce connection timeouts.

Answer

Migrate the database to Amazon Aurora and enable Auto Scaling for read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more concurrent connections.

Question 2

A developer is using AWS CloudFormation to create a stack that includes an EC2 instance. The stack creation fails because the instance type is not supported in the selected Availability Zone. What should the developer do?

Accepted Answer

Update the stack to specify a different subnet or not specify an Availability Zone.. When an EC2 instance type is not supported in a specific Availability Zone (AZ), the developer can update the CloudFormation stack to either specify a different subnet (which implicitly selects a different AZ) or omit the Availability Zone parameter entirely, allowing AWS to automatically choose an AZ where the instance type is supported. This avoids the need to delete the stack or change the instance type, preserving other stack resources and configurations.

Answer

Delete the stack and start over.

Answer

Change the instance type to one that is supported.

Answer

Create the stack in a different region.

Question 3

A developer is debugging an AWS Lambda function that processes messages from an Amazon SQS queue. The function is failing with an error when processing certain messages. The developer wants to isolate the failed messages for later analysis without losing them. What should the developer do?

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Configuring a dead-letter queue (DLQ) for the SQS queue is the correct approach because it automatically captures messages that cannot be processed successfully after a specified number of retries (the redrive policy). This isolates the failed messages for later analysis without losing them, while allowing the function to continue processing other messages from the source queue.

Answer

Publish the failed messages to an SNS topic for later processing.

Answer

Log the error and delete the message from the queue.

Answer

Increase the visibility timeout of the SQS queue.

Question 4

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 5

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

Accepted Answer

Use Fn::ImportValue to import the exported outputs from the other stack.. Fn::ImportValue is designed to retrieve exported outputs from another CloudFormation stack. When security groups are created in a separate stack, the developer must export their IDs using the Export field in the Outputs section of that stack, and then use Fn::ImportValue in the current stack to reference those exported values. This is the standard cross-stack reference mechanism in CloudFormation, enabling decoupled infrastructure management.

Answer

Use Fn::GetAtt to retrieve the IDs from the other stack's resources.

Answer

Use a nested stack to include the security group resources in the same template.

Answer

Use Fn::Ref to reference the security group IDs directly.

Question 6

A developer is using the AWS SDK for Python (Boto3) to upload objects to an S3 bucket. The developer wants to encrypt the objects at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which parameter should the developer include in the put_object call?

Accepted Answer

ServerSideEncryption: 'aws:kms'. To use server-side encryption with AWS KMS managed keys (SSE-KMS) when uploading an object to S3 via the put_object call, you must set the ServerSideEncryption parameter to 'aws:kms'. This tells S3 to encrypt the object using a KMS key. Option C is correct because it specifies the exact value required for SSE-KMS encryption.

Answer

SSEAlgorithm: 'AES256'

Answer

SSEKMSKeyId: 'alias/aws/s3'

Answer

ServerSideEncryption: 'AES256'

Question 7

A developer uses AWS CodeBuild to run unit tests. The build succeeds but the tests fail. The developer wants to fail the build if tests fail. What should the developer do?

Accepted Answer

Ensure the test command exits with a non-zero status on failure.. In CodeBuild, the build phase succeeds or fails based on the exit code of the commands in the buildspec. By default, if a test command exits with a non-zero status, CodeBuild marks the build as FAILED. Therefore, ensuring the test command exits with a non-zero status on failure is the correct approach to fail the build when tests fail.

Answer

Run tests in the post_build phase.

Answer

Set the command to always exit 0.

Answer

Enable build badges.

Question 8

A Lambda function processes messages from an SQS standard queue and writes results to DynamoDB. Duplicate writes occasionally occur after retries. Which two changes best make the processing idempotent?

Accepted Answer

Use a deterministic idempotency key stored with a conditional write in DynamoDB. Using a deterministic idempotency key (e.g., a business transaction ID) combined with a conditional write in DynamoDB ensures that if the same message is processed more than once, the second write attempt will fail because the item already exists. This prevents duplicate records even when Lambda retries after a failure or timeout, making the processing idempotent at the database level.

Answer

Increase the Lambda timeout to 15 minutes

Answer

Disable SQS visibility timeout

Question 9

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

Accepted Answer

Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.. A bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Answer

Use SSE-KMS encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Move the sensitive data to a different S3 bucket and update the application.

Question 10

A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?

Accepted Answer

ACM automatically renews the certificate if it uses DNS validation.. ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.

Answer

The developer must configure a Lambda function to renew the certificate.

Answer

The certificate cannot be used with CloudFront; ACM certificates are only for ALB.

Answer

The developer must manually request a new certificate before expiration.

Question 11

A developer is deploying a static website to Amazon S3 and wants to use Amazon CloudFront for content delivery. The developer wants to ensure that only CloudFront can access the S3 bucket. Which S3 bucket policy should the developer use?

Accepted Answer

Grant CloudFront access via an origin access identity (OAI) and restrict the bucket policy to the OAI.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant access only to that OAI, you ensure that direct S3 requests are denied, and only requests routed through CloudFront can retrieve objects. This provides a secure, private origin without exposing the bucket publicly.

Answer

Use a bucket policy that allows access only if the Referer header matches the CloudFront distribution domain.

Answer

Make the bucket public and use CloudFront's default caching.

Answer

Grant CloudFront access by allowing the CloudFront IP address range.

Question 12

A developer is using AWS Step Functions to orchestrate a workflow that includes a Lambda function for data transformation. The Lambda function occasionally times out after 15 seconds. The Step Function execution fails with a 'States.Timeout' error. The developer wants to retry the Lambda task up to 3 times with exponential backoff. Which configuration should the developer add to the state definition in the Amazon States Language (ASL)?

Accepted Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]. It defines a retry policy for the 'States.Timeout' error, which is the error that occurs when the Lambda function times out. The configuration sets a 1-second initial interval, doubles the interval on each retry (BackoffRate of 2), and allows up to 3 retries, matching the requirement exactly.

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 2, "BackoffRate": 3, "MaxAttempts": 5 } ]

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 2 } ]

Answer

"Retry": [ { "ErrorEquals": ["Lambda.ServiceException"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]

Question 13

A developer is designing a system that requires processing of streaming data from IoT devices in real time. The processed data will be stored in an S3 bucket for analytics. Which AWS services should the developer use together to build this solution? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams is a scalable real-time data streaming service that ingests and processes streaming data from IoT devices in real time. It allows developers to build custom applications that consume and analyze the data as it arrives. Amazon Kinesis Data Firehose is a fully managed service that reliably loads streaming data into Amazon S3 for analytics, handling buffering, compression, and partitioning. Together, Data Streams provides real-time processing capabilities while Firehose automates delivery to S3, making them a complementary pair for this solution.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon SQS

Question 14

A developer is using Amazon SQS to decouple microservices. The consumer service processes messages from the queue. To reduce processing time, the developer wants to receive multiple messages in a single API call. What is the maximum number of messages that can be received at once?

Accepted Answer

10. Amazon SQS allows a consumer to retrieve up to 10 messages in a single ReceiveMessage API call. This is the hard limit enforced by the SQS service, regardless of the queue type (standard or FIFO). Using this maximum batch size can reduce the number of API calls and improve throughput, but each message must still be processed individually and deleted after processing.

Answer

5

Answer

100

Answer

20

Question 15

A developer needs to allow an IAM user to manage only their own access keys (create, list, update, delete). Which IAM policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}. It uses the `iam:*AccessKey*` wildcard action to cover all access key management operations (create, list, update, delete) and restricts the resource to `arn:aws:iam::*:user/${aws:username}`. The `${aws:username}` policy variable dynamically resolves to the IAM user's own username, ensuring that each user can only manage their own access keys. This follows the principle of least privilege by scoping permissions to the user's own resource.

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/JohnDoe"}

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["iam:ListAccessKeys","iam:GetAccessKeyLastUsed"],"Resource":"*"}