DVA-C02 Practice Test 34 — 15 Questions

Question 1

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS. AWS Cloud Map provides service discovery by registering ECS service instances with DNS-based or API-based resolution, enabling dynamic routing between microservices. AWS App Mesh with mutual TLS (mTLS) encrypts traffic between services and enforces identity-based authentication, ensuring end-to-end encryption and secure communication. This combination directly addresses the requirements for service discovery and encrypted traffic.

Answer

Use Amazon API Gateway and AWS Lambda

Answer

Use Amazon Route 53 private hosted zones and enable DNSSEC

Answer

Use an Application Load Balancer for each service and enable TLS termination

Question 2

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails in CodeBuild with the error 'BUILD FAILED: Unable to find a Java installation.' The buildspec.yml file includes a 'runtime-versions' section specifying Java 11. The CodeBuild project uses the 'aws/codebuild/amazonlinux2-x86_64-standard:4.0' image. What is the MOST likely cause of the failure?

Accepted Answer

The runtime-versions section in buildspec.yml is not correctly formatted.. The error 'Unable to find a Java installation' indicates that the CodeBuild environment does not have Java available at runtime. When using a standard managed image like 'aws/codebuild/amazonlinux2-x86_64-standard:4.0', Java must be explicitly declared in the 'runtime-versions' section of buildspec.yml. The most likely cause is that the 'runtime-versions' section is incorrectly formatted (e.g., using 'java: 11' instead of the correct 'java: corretto11'), causing CodeBuild to skip installing Java.

Answer

The CodeBuild project does not have sufficient permissions to download Java.

Answer

The buildspec.yml file is not in the root of the source directory.

Answer

The build commands reference a non-existent Maven dependency.

Question 3

A developer notices that an S3 bucket used for static website hosting returns 403 Forbidden for anonymous requests. The bucket policy allows s3:GetObject for Principal "*". What is the most likely issue?

Accepted Answer

The S3 Block Public Access settings are enabled.. D is correct because S3 Block Public Access settings, when enabled at the account or bucket level, override any bucket policy or ACL that grants public access. Even though the bucket policy allows s3:GetObject for Principal "*", the Block Public Access settings explicitly deny all public requests, resulting in a 403 Forbidden error for anonymous users.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket ACL does not allow public read.

Answer

The bucket policy is not attached to the correct bucket.

Question 4

A developer is using CloudFront to serve content from an S3 bucket. The bucket contains sensitive data and should only be accessible through CloudFront. How can the developer enforce this?

Accepted Answer

Create an origin access identity (OAI) and grant it read access in the bucket policy.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant read access only to that OAI, you ensure that content can only be retrieved via CloudFront, not directly from the S3 endpoint. This enforces the requirement that the bucket is accessible exclusively through CloudFront.

Answer

Set the bucket policy to allow access only from CloudFront IP addresses.

Answer

Set the bucket policy to allow access only from AWS services.

Answer

Set the bucket policy to allow public read access and use CloudFront signed URLs.

Question 5

A developer is building a RESTful API using Amazon API Gateway and AWS Lambda. The API needs to support custom domain names with SSL/TLS certificates. The developer has created the custom domain name in API Gateway and uploaded the certificate to AWS Certificate Manager (ACM) in the same region. However, when accessing the custom domain, users get an SSL error. What is the most likely cause?

Accepted Answer

The custom domain name's DNS record does not point to API Gateway's regional domain name.. The most likely cause is that the custom domain name's DNS record does not point to API Gateway's regional domain name. When using a custom domain name with API Gateway, you must create a DNS record (typically a CNAME or A record using Route 53 alias) that maps your custom domain to the API Gateway-generated regional domain name (e.g., d-xxxxx.execute-api.region.amazonaws.com). Without this correct DNS mapping, the SSL/TLS handshake fails because the certificate presented by API Gateway does not match the domain name the client is connecting to, resulting in an SSL error.

Answer

The certificate was not issued by a trusted certificate authority.

Answer

The API Gateway API is not deployed to a stage that is mapped to the custom domain name.

Answer

The certificate is in the wrong region relative to the API Gateway regional endpoint.

Question 6

A developer is using an S3 bucket to store sensitive files. The bucket policy includes a condition that requires TLS for all requests. A user reports that they can access the bucket via the AWS Management Console but not via an application using HTTP. What is the likely issue?

Accepted Answer

The bucket policy denies HTTP requests via aws:SecureTransport condition.. The condition aws:SecureTransport requires HTTPS; the application uses HTTP, which violates the policy.

Answer

The application is using an expired IAM access key.

Answer

The S3 bucket is in a different region.

Answer

The application is not signing requests with Signature Version 4.

Question 7

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the BeforeInstall lifecycle event. What should the developer do to troubleshoot the issue?

Accepted Answer

Check the appspec.yml file for errors in the BeforeInstall hook.. The BeforeInstall hook scripts are defined in the appspec.yml file, and a failure during that lifecycle event typically indicates an error in the script or the hook configuration. Option A is wrong because the deployment group configuration (e.g., Auto Scaling group, tags) does not directly cause a script failure in the BeforeInstall hook. Option B is wrong because the build output from CodeBuild is already successful and not related to the deployment failure. Option D is wrong because deployment configuration settings (e.g., deployment type, rollback triggers) do not affect the execution of the BeforeInstall hook scripts.

Answer

Check the deployment group configuration.

Answer

Verify the build output from CodeBuild.

Answer

Review the deployment configuration settings.

Question 8

A developer uses AWS SAM (Serverless Application Model) to define a serverless application. The developer wants to run the application locally for testing. Which AWS SAM CLI command should be used?

Accepted Answer

sam local start-api. `sam local start-api` starts a local HTTP server that emulates the API Gateway endpoint and invokes your Lambda functions defined in the SAM template. This allows you to test API requests and responses locally without deploying to AWS, making it the appropriate command for local testing of a serverless application.

Answer

sam build

Answer

sam deploy

Answer

sam package

Question 9

A company stores sensitive customer data in Amazon S3. The security policy requires that all data be encrypted at rest using server-side encryption with a customer-managed AWS KMS key. Which S3 server-side encryption option should the developer use?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it provides server-side encryption with a customer-managed AWS KMS key, allowing the company to control key rotation, access policies, and audit usage via AWS CloudTrail. This meets the security policy requirement for encryption at rest using a customer-managed key, which SSE-S3 (using AWS-managed keys) and SSE-C (using customer-provided keys) do not fulfill.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 10

Match each AWS service to its port number (if applicable).

Accepted Answer

Amazon RDS (MySQL engine): 3306. Default ports are important for configuring security groups and connecting to databases.

Answer

Amazon RDS (MySQL engine): 5439

Answer

Amazon Redshift: 3306

Question 11

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)

Accepted Answer

Check the Amazon ECS service events for the task failure reason.. Options B, C, and E are correct. Checking Amazon ECS service events (B) provides the task failure reason directly from the ECS service. Validating the task definition JSON (C) ensures correct container image references and configuration. Verifying the task execution IAM role (E) ensures it has permissions to pull the container image from ECR. Option A (CodeBuild logs) is incorrect because the failure occurs during deployment, not build. Option D (CloudFormation stack events) is incorrect because the ECS service may not be created via CloudFormation or events there are not relevant for task failures.

Answer

Review the CodeBuild build logs for errors.

Answer

Check the CloudFormation stack events for the ECS service.

Question 12

A developer is using AWS X-Ray to trace requests through a microservices application. The developer notices that some traces are incomplete. Which TWO actions can help ensure complete traces?

Accepted Answer

Use the X-Ray SDK to instrument the application code.. The X-Ray SDK instruments application code to generate trace segments and sends them to the X-Ray daemon. Option E is correct because the X-Ray daemon must be running on each EC2 instance to receive trace data from the SDK and forward it to the X-Ray service. Without both, traces may be incomplete. Option B is incorrect because the X-Ray daemon communicates over UDP, not TCP, and port 2000 is UDP; opening TCP 2000 does not help. Option C is incorrect because the X-Ray daemon is designed to run locally on each instance, not as a centralized service. Option D is incorrect because the CloudWatch agent does not handle X-Ray traces; it is used for CloudWatch metrics and logs.

Answer

Open port 2000 on the security groups for TCP traffic.

Answer

Deploy the X-Ray daemon as a centralized service in a separate instance.

Answer

Install the CloudWatch agent on all instances.

Question 13

A developer is troubleshooting a slow-running Amazon RDS for PostgreSQL instance. Which TWO metrics should the developer examine in Amazon CloudWatch to identify a possible resource bottleneck?

Accepted Answer

CPUUtilization. High CPU utilization indicates a CPU bottleneck, which can slow down query processing. Option B is correct because high ReadIOPS and WriteIOPS accompanied by a high Average Queue Depth signal an I/O bottleneck, where the storage subsystem cannot keep up with requests. Option C is incorrect because FreeableMemory alone does not directly indicate a performance bottleneck; while low memory can cause issues, it is not a primary metric for resource bottlenecks. Option D is incorrect because NetworkThroughput is rarely a limiting factor for RDS performance; the database typically processes requests faster than network bandwidth constraints. Option E is incorrect because DatabaseConnections only indicates the number of connections, not a direct resource bottleneck; performance problems are better captured by CPU or I/O metrics.

Answer

FreeableMemory

Answer

NetworkThroughput

Answer

DatabaseConnections

Question 14

Which THREE steps should a developer include in a CI/CD pipeline to deploy a serverless application using AWS SAM? (Choose three.)

Accepted Answer

Run 'sam build' to prepare the application. In a typical SAM CI/CD pipeline, the three essential steps are: (A) running 'sam build' to prepare the application, (E) running 'sam package' to upload the build artifacts to an S3 bucket, and (C) running 'sam deploy' to create or update the CloudFormation stack. Option B is incorrect because manually configuring API Gateway stages is not a standard automated step in a CI/CD pipeline; SAM manages API Gateway configurations as part of the deployment. Option D is incorrect because 'aws lambda update-alias' is not a typical step in a SAM deployment; traffic shifting can be handled via SAM's deployment preferences.

Answer

Manually configure API Gateway stages

Answer

Run 'aws lambda update-alias' to shift traffic

Question 15

Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)

Accepted Answer

Define fine-grained permissions with policies. Options C and E are correct. IAM allows you to define fine-grained permissions using policies (C) and create and manage users and groups (E). Option A is incorrect because encrypting S3 objects is a feature of S3, not IAM. Option B is incorrect because monitoring network traffic is typically done by VPC flow logs or CloudTrail, not IAM. Option D is incorrect because managing EC2 instance lifecycle is an EC2 function, not IAM.

Answer

Encrypt S3 objects automatically

Answer

Monitor network traffic

Answer

Manage EC2 instance lifecycle