DVA-C02 Practice Test 33 — 15 Questions

Question 1

A developer needs to deploy a serverless application using AWS CloudFormation. The application includes an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. The developer wants to create a stack that can be updated without downtime. Which CloudFormation feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change Sets. Change Sets allow you to preview how changes to your CloudFormation stack will affect your running resources before you apply them. By reviewing the change set, you can ensure that the update does not cause downtime, for example by replacing resources without interruptions. This makes Change Sets the appropriate feature for updating a stack without downtime.

Answer

Drift detection

Answer

StackSets

Answer

Nested stacks

Question 2

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 3

A developer is building a serverless application that processes personally identifiable information (PII). The application uses API Gateway, Lambda, and DynamoDB. The developer needs to ensure that the PII is encrypted at rest in DynamoDB. The company already uses AWS KMS with a customer-managed key for other services. The developer wants to reuse the same KMS key for DynamoDB. After enabling encryption with the KMS key, the Lambda function fails to write to the table with an AccessDenied error. The Lambda execution role has dynamodb:PutItem permission. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.. When a DynamoDB table is encrypted with a customer-managed KMS key, any operation that reads or writes data to the table requires the caller to have permissions to use that KMS key. Even though the Lambda execution role has dynamodb:PutItem permission, the PutItem operation internally triggers KMS Encrypt and Decrypt calls to manage the encryption of the item. Without kms:Encrypt and kms:Decrypt permissions on the specific KMS key, the request fails with an AccessDenied error.

Answer

The Lambda execution role does not have DynamoDB write permissions.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The Lambda function is not in a VPC, so it cannot access the KMS key.

Question 4

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Accepted Answer

The native library is compiled for a different operating system than Lambda (Amazon Linux).. AWS Lambda runs on Amazon Linux, which uses a different kernel and C runtime than typical local development environments (e.g., macOS or Windows). Native libraries compiled for a local OS will not be compatible with Lambda's execution environment, causing the 'Unable to import module' error. The developer must compile the native library on Amazon Linux or use a Lambda-compatible container to ensure binary compatibility.

Answer

The Lambda function's IAM role does not have permission to access the library.

Answer

The Lambda function's handler configuration is incorrect.

Answer

The Lambda function's timeout is too short.

Question 5

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Accepted Answer

Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.. Lambda aliases support traffic shifting for canary deployments by allowing you to route a percentage of incoming requests to a new function version while the majority continues to the current version. This is done by configuring the alias's routing configuration with a `RoutingConfig` that specifies the new version and the weight (e.g., 5%) of traffic it should receive. This enables gradual, controlled rollouts without modifying the API Gateway integration endpoint. Option C is also necessary because the API Gateway integration must point to the Lambda alias (rather than a fixed version) so that the routing configuration on the alias can take effect. Without updating the integration to use the alias, API Gateway would continue to invoke a specific version directly, bypassing the canary routing.

Answer

Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.

Answer

Update the Lambda function code and publish a new version.

Answer

Create a new API Gateway stage for the new version and update DNS.

Question 6

A developer is using AWS Lambda to process sensitive data. The Lambda function needs to access a DynamoDB table that is encrypted with a customer-managed CMK. The developer is using the default Lambda execution role. What must be done to allow Lambda to decrypt the DynamoDB table?

Accepted Answer

Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.. The DynamoDB table is encrypted with a customer-managed CMK. The Lambda execution role must be granted permission to use that key. This is done by adding a statement to the KMS key's key policy that allows the Lambda execution role to perform kms:Decrypt. DynamoDB will then perform the decryption on behalf of Lambda. Option A is incorrect because dynamodb:GetItem alone does not grant KMS decrypt permissions. Option C is incorrect because a VPC endpoint is not related to KMS permissions. Option D is incorrect because Lambda does not need to directly call the KMS Decrypt API; the key policy handles the authorization.

Answer

Add a policy to the Lambda execution role allowing dynamodb:GetItem.

Answer

Configure a VPC endpoint for DynamoDB.

Answer

Modify the Lambda function to call KMS Decrypt API.

Question 7

A developer is using AWS CodePipeline to automate the deployment of a web application. The developer wants to run unit tests after the source stage and before deploying to a staging environment. Which action should the developer add to the pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service to run unit tests in a CodePipeline because it provides a fully managed build environment that can execute test commands defined in a buildspec file. By adding a CodeBuild action to the pipeline after the source stage, the developer can run unit tests and fail the pipeline if tests do not pass, ensuring only validated code proceeds to the staging deployment.

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 8

A developer is running a Lambda function that uses the 'requests' library. The error shown in the exhibit occurs when invoking the function. Which step should the developer take to fix this?

Accepted Answer

Package the 'requests' library with the Lambda deployment package. The 'requests' library is not included in the AWS Lambda Python runtime by default. To use it, the developer must package the library as a dependency layer or include it in the deployment package. Option B correctly identifies this approach, ensuring the library is available at runtime.

Answer

Change the Lambda runtime to Python 3.9 which includes requests

Answer

Use the 'urllib' library instead of 'requests'

Answer

Install the 'requests' library using pip in the Lambda console

Question 9

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Accepted Answer

Configure automatic rollback based on CloudWatch alarms.. AWS CodeDeploy can automatically trigger a rollback when a CloudWatch alarm is breached, such as when error rates or latency exceed a threshold. This reduces the risk of a failed deployment by reverting to the last known good state without manual intervention. Option B is correct because a canary deployment shifts a small percentage of traffic to the new version first, allowing you to monitor for issues before routing all traffic, minimizing blast radius.

Answer

Disable health checks to prevent false positives.

Answer

Require a manual approval step before deployment.

Answer

Deploy to all instances at once to ensure consistency.

Question 10

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error message 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The developer checks the deployment logs and finds that the ApplicationStop hook failed on some instances. What is the most likely cause of this failure?

Accepted Answer

The ApplicationStop script is not compatible with the instance operating system or is missing.. The error message indicates that the ApplicationStop hook failed on some instances. The ApplicationStop hook is a lifecycle event that runs a script to stop the application before a new deployment begins. If the script is missing, incompatible with the instance's operating system, or has incorrect permissions, it will fail, causing the deployment to abort. This is the most direct cause of the failure described.

Answer

The ValidateService hook script is failing.

Answer

The BeforeInstall hook script is incorrectly configured.

Answer

The Auto Scaling group does not have enough capacity to perform the deployment.

Question 11

Which THREE factors should a developer consider when choosing between a blue/green deployment and a rolling deployment for an Amazon ECS service?

Accepted Answer

Rolling deployments update a subset of tasks at a time, which may cause slower rollback. Rolling deployments in Amazon ECS update a subset of tasks at a time, which means if a rollback is needed, the deployment must reverse the updates incrementally, potentially taking longer than a blue/green deployment where traffic can be switched back instantly. This slower rollback is a key trade-off when choosing between the two strategies.

Answer

Rolling deployments require manual intervention to rollback

Answer

Blue/green deployments are always cheaper than rolling deployments

Question 12

A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.. AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.

Answer

Encrypt the configuration file using AWS KMS and store the encrypted file on S3.

Answer

Store the credentials in environment variables on the EC2 instance.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.

Question 13

A developer is using AWS CodeCommit as a source repository and AWS CodePipeline for CI/CD. The developer wants to automatically trigger a pipeline execution when changes are pushed to the main branch. Which action should the developer take?

Accepted Answer

Create an Amazon CloudWatch Events rule that detects changes to the CodeCommit repository and triggers the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can detect CodeCommit repository state changes, such as push events to a specific branch, and automatically trigger a CodePipeline execution as a target. This is the recommended AWS-native approach for event-driven pipeline triggers without polling or manual webhook configuration.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute.

Answer

Set up a webhook in CodeCommit to notify CodePipeline on push events.

Answer

Use an SNS topic to send a notification to CodePipeline when a push occurs.

Question 14

A company is using AWS CodeBuild to compile a Java application. The build takes a long time because Maven dependencies are downloaded each time. How can the developer reduce build time?

Accepted Answer

Configure a cache in Amazon S3 for the Maven repository.. Configuring an Amazon S3 cache for the Maven repository allows CodeBuild to reuse previously downloaded dependencies across builds, eliminating the need to re-download them each time. This significantly reduces build time by leveraging the local cache stored in S3, which is a best practice for dependency-heavy builds like Java applications with Maven.

Answer

Use a higher compute type for the build project.

Answer

Use a custom AMI with pre-installed dependencies.

Answer

Increase the timeout value for the build.

Question 15

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.