DVA-C02 Practice Test 33 — 15 Questions

Question 1

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The function is currently active and handling traffic. The developer wants to gradually shift traffic to the new version and rollback if errors increase. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the alias to route a percentage of traffic to the new version and the rest to the current version.. Lambda aliases can route traffic. Option A and C are correct. Option B is wrong because weights sum to 100. Option D is wrong because CodeDeploy can manage traffic shifting but not directly via CLI. Option E is wrong because SDK is not needed.

Answer

Invoke the Lambda function with the new version using the AWS SDK.

Answer

Update the alias to route 100% of traffic to the new version.

Answer

Use AWS CodeDeploy to create a deployment group for the Lambda function.

Question 2

A company is using Amazon SQS to decouple microservices. The producer sends messages, and the consumer processes them. The consumer occasionally fails to process a message due to transient errors. What is the BEST way to ensure such messages are retried automatically?

Accepted Answer

Configure a dead-letter queue with a redrive policy on the source queue.. Option A is correct because setting the 'redrive policy' with a dead-letter queue (DLQ) allows messages to be retried up to maxReceiveCount, and then moved to DLQ. Option B is wrong because delay queues delay all messages, not retry failures. Option C is wrong because FIFO queues still need redrive policy. Option D is wrong because visibility timeout alone does not retry on failure.

Answer

Use a delay queue to postpone message processing.

Answer

Use a FIFO queue with content-based deduplication.

Answer

Increase the visibility timeout to give the consumer more time.

Question 3

A developer is deploying a microservices architecture on Amazon ECS with Fargate. Each service needs to store sensitive configuration data such as database passwords. The developer wants to avoid hardcoding secrets in the application code. Which approach should the developer use?

Accepted Answer

Store the secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and reference them in the ECS task definition using the 'secrets' parameter.. Option A is correct because AWS Systems Manager Parameter Store or AWS Secrets Manager can securely store secrets and be referenced in ECS task definitions. Option B is wrong because environment variables in the task definition are visible in plaintext. Option C is wrong because S3 is not designed for secrets. Option D is wrong because it increases attack surface.

Answer

Store the secrets in an Amazon S3 bucket and use a pre-signed URL to download them at startup.

Answer

Define the secrets as environment variables in the ECS task definition.

Answer

Encrypt the secrets using AWS KMS and store the encrypted blob in a configuration file within the Docker image.

Question 4

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the uploaded file, transform it, and write the result to a DynamoDB table. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:PutItem"],"Resource":"*"}. The Lambda execution role needs permissions for S3 GetObject and DynamoDB PutItem. Option C provides both. Option A lacks DynamoDB write. Option B lacks S3 read. Option D lacks S3 read and uses incorrect DynamoDB action.

Answer

{"Effect":"Allow","Action":["s3:PutObject","dynamodb:PutItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:UpdateItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:GetItem"],"Resource":"*"}

Question 5

A company is using AWS CloudFormation to manage infrastructure. A developer needs to create a stack that will launch an EC2 instance and associate an Elastic IP address. The Elastic IP must be released when the stack is deleted. Which TWO resources should the developer include in the CloudFormation template? (Choose TWO.)

Accepted Answer

AWS::EC2::EIP. AWS::EC2::EIP and AWS::EC2::EIPAssociation are needed. Option B and D are correct. Option A (EC2::Instance) is needed but not part of the pair. Option C (EC2::NetworkInterface) is not required. Option E (EC2::Address) is not a valid resource.

Answer

AWS::EC2::Instance

Answer

AWS::EC2::NetworkInterface

Answer

AWS::EC2::Address

Question 6

An organization uses AWS CodeBuild to run tests for a Node.js application. The build environment is Linux. The buildspec.yml includes a pre_build phase that runs 'npm install'. Occasionally, the build fails with an error 'npm ERR! code EINTEGRITY'. The developer wants to resolve this issue without compromising security. Which action should be taken?

Accepted Answer

Add 'npm cache verify' to the pre_build phase before 'npm install'.. Option B is correct because adding 'npm cache verify' before 'npm install' can fix integrity errors by clearing the cache. Option A is wrong because disabling integrity checks reduces security. Option C is wrong because 'npm install --prefer-offline' uses cache and may still have integrity issues. Option D is wrong because using a separate CodeBuild project does not solve the integrity problem.

Answer

Create a separate CodeBuild project to run npm install.

Answer

Add 'npm config set registry http://registry.npmjs.org/' to use HTTP.

Answer

Use 'npm install --prefer-offline' to avoid fetching from registry.

Question 7

A company is using Amazon CloudFront to serve content from an Application Load Balancer (ALB) origin. The ALB is configured as an internal load balancer in a VPC. Users are getting HTTP 502 errors when accessing the CloudFront distribution. What is the MOST likely cause?

Accepted Answer

The ALB is not internet-facing, so CloudFront cannot reach it.. Option D is correct because CloudFront cannot reach an internal ALB unless it is internet-facing. Option A is wrong because CloudFront does not need a VPN. Option B is wrong because WAF does not cause 502 errors. Option C is wrong because content caching does not cause 502.

Answer

The ALB has AWS WAF enabled, blocking CloudFront IP addresses.

Answer

The CloudFront distribution's cache behavior is set to cache all objects.

Answer

The CloudFront distribution is not associated with a VPN connection to the VPC.

Question 8

A developer runs the AWS CLI command shown. The Lambda function returns a 200 status code but the output file is null and the response includes FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an unhandled exception.. Option A is correct because 'Unhandled' means the function threw an exception that was not caught, and the output is null because the function returned an error. Option B is wrong because 200 indicates invocation succeeded. Option C is wrong because no such error. Option D is wrong because the function was invoked.

Answer

The Lambda function timed out.

Answer

The payload was too large for synchronous invocation.

Answer

The Lambda function was not found.

Question 9

A developer is deploying a web application on Amazon EKS. The application needs to read configuration data from an Amazon S3 bucket at startup. The developer wants to ensure that the configuration is securely accessed without embedding AWS credentials in the application code. Which solution should the developer use?

Accepted Answer

Use IAM roles for service accounts (IRSA) to assign an IAM role to the pod.. IAM roles for service accounts (IRSA) allow Kubernetes pods to assume IAM roles. The developer can create an IAM role with an S3 read policy and associate it with a Kubernetes service account. The pod then uses that service account to access S3. This avoids hardcoded credentials. The other options either expose credentials or are not best practice: AWS Secrets Manager stores secrets but not directly for S3 access; environment variables in a ConfigMap can contain credentials but that is insecure; IAM instance profile is for EC2 instances, not for EKS pods directly (though there are workarounds, IRSA is the recommended approach).

Answer

Store the AWS credentials in AWS Secrets Manager and retrieve them at startup.

Answer

Assign an IAM instance profile to the EC2 instances running the EKS nodes.

Answer

Embed the AWS access key and secret key in a Kubernetes ConfigMap.

Question 10

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

Accepted Answer

Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.. Elastic Beanstalk uses Auto Scaling groups. Option B correctly configures a scale-out policy based on CPU > 70% and a scale-in policy for CPU < 30%. Option A uses incorrect metric (Memory). Option C uses incorrect service (CloudFront). Option D uses incorrect metric (NetworkIn).

Answer

Configure an Auto Scaling step scaling policy based on MemoryReservation metric.

Answer

Use AWS CloudFront to cache responses and reduce load on the application.

Answer

Configure an Auto Scaling target tracking policy based on NetworkIn metric.

Question 11

A developer is building a REST API using API Gateway and Lambda. The API must be secured using a Lambda authorizer. Which THREE steps are necessary to implement the Lambda authorizer? (Choose THREE.)

Accepted Answer

Configure the API Gateway method to use the Lambda authorizer.. Option A, B, and D are correct. Option C is wrong because API key is not required for Lambda authorizer. Option E is wrong because the authorizer returns an IAM policy, not a token.

Answer

Return a JSON Web Token (JWT) from the authorizer function.

Answer

Generate an API key and distribute it to clients.

Question 12

A developer is designing a system where an S3 bucket receives uploads, and each upload triggers a Lambda function to process the file. The processed output is stored in another S3 bucket. The developer notices that sometimes the same file is processed multiple times. How can this be prevented?

Accepted Answer

Make the Lambda function idempotent by checking if the object has already been processed using a DynamoDB table.. Option C is correct because enabling S3 event notifications with the 'S3:ObjectCreated:*' event type and ensuring the Lambda function is idempotent (e.g., using the object key as a unique identifier) prevents duplicate processing. Option A is wrong because S3 does not have a deduplication feature for events. Option B is wrong because SQS FIFO queues can deduplicate messages, but S3 event notifications do not support FIFO queues. Option D is wrong because versioning does not prevent duplicate events.

Answer

Use an SQS FIFO queue as the event destination and enable content-based deduplication.

Answer

Enable S3 bucket replication to another bucket and trigger Lambda from the replica.

Answer

Enable S3 bucket versioning and use 's3:ObjectCreated:Put' events.

Question 13

A developer needs to analyze real-time streaming data from thousands of devices. The data consists of JSON messages that must be processed and stored in Amazon S3. Which AWS service should the developer use to ingest and buffer the streaming data?

Accepted Answer

Amazon Kinesis Data Streams. Option A is correct because Amazon Kinesis Data Streams is designed for real-time data ingestion and can buffer data. Option B is wrong because Lambda is for compute, not ingestion. Option C is wrong because SQS is for message queues, not high-throughput streaming. Option D is wrong because S3 is storage, not ingestion.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 14

A developer creates an AWS CloudFormation stack with the template snippet shown. The stack creation fails with the error: "Bucket with name my-unique-bucket-12345 already exists." What is the MOST likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. Option C is correct because AWS S3 bucket names must be globally unique, and CloudFormation is trying to create a bucket with a name that already exists. Option A is wrong because the template is valid. Option B is wrong because the name is not taken by the same account. Option D is wrong because IAM permissions would cause a different error.

Answer

The developer does not have permission to create S3 buckets.

Answer

The CloudFormation template has a syntax error.

Answer

The bucket name was used by another stack in the same account.

Question 15

Which TWO AWS services can be used to store and retrieve application configuration data in a serverless application? (Choose two.)

Accepted Answer

AWS AppConfig. AWS AppConfig is designed for application configuration. Amazon DynamoDB is a NoSQL database that can store configuration data. AWS Systems Manager Parameter Store also stores configuration, but it is not listed as an option (it's a valid service but not in the list). AWS CloudFormation is for infrastructure provisioning. Amazon S3 is object storage, not optimized for configuration. AWS Secrets Manager is for secrets, not general configuration.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS Secrets Manager