DVA-C02 Practice Test 34 — 15 Questions

Question 1

A company wants to encrypt data at rest in an S3 bucket using server-side encryption. Which option provides the MOST control over the encryption key?

Accepted Answer

SSE-C (customer-provided keys). SSE-C (customer-provided keys) gives you the most control because you manage the encryption key yourself—you provide the key in each request, and AWS discards it after use. This means you have full lifecycle control over the key material, including rotation, deletion, and access policies, without AWS ever storing the key. In contrast, SSE-KMS and SSE-S3 rely on AWS-managed or AWS-controlled key stores, reducing your direct control.

Answer

SSE-KMS (AWS KMS keys)

Answer

Client-side encryption

Answer

SSE-S3 (S3-managed keys)

Question 2

A developer is deploying a web application on AWS Elastic Beanstalk. The application requires a fixed IP address for outbound traffic to a third-party API. What is the MOST cost-effective solution?

Accepted Answer

Launch the environment in a VPC with a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides a fixed public IP address for outbound traffic from private subnets, enabling the web application to communicate with the third-party API while remaining secure. Elastic Beanstalk environments are typically launched in private subnets, and the NAT Gateway is the most cost-effective managed service for this purpose compared to a NAT instance or assigning Elastic IPs to each EC2 instance.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a VPC endpoint for the third-party API.

Answer

Assign an Elastic IP to each EC2 instance.

Question 3

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 4

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Accepted Answer

Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.. Setting the SQS queue's visibility timeout to be greater than the Lambda function's timeout ensures that if the Lambda function fails or times out, the message becomes visible again in the queue after the visibility timeout expires, allowing another consumer to retry processing. This prevents messages from being lost due to processing failures, supporting at-least-once processing. Option E is correct because calling the SQS DeleteMessage API only after successful processing ensures that the message is not removed from the queue until it has been fully and correctly handled, so if processing fails, the message remains available for retry.

Answer

Configure a Dead Letter Queue (DLQ) to capture failed messages.

Answer

Enable long polling on the SQS queue.

Answer

Use a FIFO queue to ensure exactly-once processing.

Question 5

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

Accepted Answer

Create a Global Secondary Index (GSI) with CustomerID as the partition key.. Creating a Global Secondary Index (GSI) with CustomerID as the partition key allows DynamoDB to efficiently query orders by CustomerID using the index's key structure, avoiding full table scans. This directly addresses the slow performance and high read capacity consumption by enabling targeted lookups instead of scanning all items and filtering.

Answer

Increase the provisioned read capacity for the table.

Answer

Change the table's primary key to use CustomerID as the partition key.

Answer

Use a FilterExpression on the CustomerID attribute in a Scan operation.

Question 6

A DynamoDB table uses partition key customerId. One enterprise customer generates most traffic and is throttled while the table has unused capacity elsewhere. What design change best addresses the hot partition?

Accepted Answer

Add write sharding or redesign the partition key to distribute that customer's workload. The hot partition is caused by a single customerId receiving a disproportionate amount of traffic, exceeding the 3000 RCU or 1000 WCU per partition limit. By adding write sharding (e.g., appending a random suffix to the partition key) or redesigning the partition key to include a more granular attribute, you distribute that customer's writes across multiple partitions, eliminating the bottleneck and utilizing the table's unused capacity.

Answer

Enable point-in-time recovery

Answer

Reduce item size by removing attributes

Answer

Use strongly consistent reads only

Question 7

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is designed specifically for securely storing, managing, and automatically rotating database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a custom rotation interval (e.g., 90 days) without custom infrastructure. Secrets Manager also integrates natively with Amazon RDS, Redshift, and DocumentDB for automatic credential rotation.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS KMS

Question 8

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The developer wants to automatically roll back the deployment if the CloudFormation stack update fails. Which configuration should be used?

Accepted Answer

Configure the CloudFormation stack to roll back on failure using the RollbackConfiguration.. CloudFormation natively supports automatic rollback on stack update failure through the `RollbackConfiguration` property. When a stack update fails, CloudFormation can automatically revert to the last known good state, which is exactly what the developer needs for a serverless deployment pipeline. This configuration can be set in the CloudFormation template or passed as a parameter during the deploy action in CodePipeline.

Answer

Add a stack policy to the CloudFormation stack to prevent updates.

Answer

Set the deployment to use AWS CodeDeploy and enable rollback.

Answer

Configure a manual approval action in the pipeline to trigger a rollback.

Question 9

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

Accepted Answer

Create an Amazon RDS database instance separately and configure the application to connect to it.. The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Answer

Use the Elastic Beanstalk console to add an RDS database to the environment.

Answer

Use an S3 bucket to store data.

Answer

Use Amazon DynamoDB as the database.

Question 10

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption. The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not include the server-side encryption header. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The `s3:x-amz-server-side-encryption` condition key matches the `x-amz-server-side-encryption` request header, which is used to specify server-side encryption (SSE-S3 or SSE-KMS) for S3 PutObject requests. By denying requests that do not include this header, the policy enforces that all uploads must be encrypted at rest using server-side encryption.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 11

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon ElastiCache for session state. Recently, users are experiencing intermittent session timeouts and slow page loads. The developer suspects the issue is related to the ElastiCache cluster. Which THREE actions should the developer take to troubleshoot and resolve the issue? (Choose THREE.)

Accepted Answer

Monitor the ElastiCache cluster's CPU utilization and cache hit ratio in CloudWatch.. Option A is correct because CloudWatch metrics such as CPUUtilization and CacheHits/CacheMisses (cache hit ratio) directly reveal whether the ElastiCache cluster is saturated or failing to serve cached session data, which would cause the intermittent timeouts and slow loads. Option C is correct because if monitoring shows sustained high CPU or memory pressure, vertically scaling to a larger node type or horizontally adding nodes/shards increases capacity and restores consistent session-state performance. Option D is correct because uneven key distribution or poor cache key design can create hot shards/keys, leading to throttling and latency spikes even when overall cluster capacity looks adequate, so reviewing key design and shard balance addresses the root cause. Option B does not belong because enabling encryption in transit is a security hardening measure and does not resolve performance or session-timeout issues. Option E does not belong because Multi-AZ replication improves availability/failover, not the intermittent latency and timeout symptoms described.

Answer

Enable Encryption in transit for the ElastiCache cluster.

Answer

Enable Multi-AZ replication for the ElastiCache cluster.

Question 12

A developer is deploying a Lambda function that processes images uploaded to an S3 bucket. The function is triggered by S3 events. After deployment, the function does not execute when new images are uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the Lambda function.. The most likely cause is that the S3 bucket does not have an event notification configured to invoke the Lambda function. S3 event notifications must be explicitly set on the bucket to trigger a Lambda function when objects are created; without this configuration, S3 will not send any invocation request to Lambda, regardless of the function's permissions or settings.

Answer

The Lambda function memory is set too low.

Answer

The Lambda function does not have permission to read from the S3 bucket.

Answer

The Lambda function is not in the same region as the S3 bucket.

Question 13

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that reduces read latency for DynamoDB tables from single-digit milliseconds to microseconds. Since the data is not frequently updated, DAX can serve repeated read requests from its cache without hitting the underlying table, making it ideal for high-read, low-write workloads.

Answer

DynamoDB Auto Scaling

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Question 14

A company uses CodePipeline to deploy a web application to Elastic Beanstalk. The deployment fails at the Build stage with an error 'BUILD FAILED'. Which step should the developer take first to troubleshoot?

Accepted Answer

Review the buildspec.yml file for syntax errors. The error 'BUILD FAILED' originates from the Build stage, which is executed by CodeBuild. The first step in troubleshooting a CodeBuild failure is to review the buildspec.yml file for syntax errors or misconfigurations, as this file defines the build commands, environment variables, and phases. Incorrect YAML formatting, missing required fields (e.g., 'phases'), or invalid commands will cause the build to fail immediately, making it the most direct and logical starting point.

Answer

Verify the CodeDeploy application revision

Answer

Examine the Elastic Beanstalk environment logs

Answer

Check AWS CloudTrail for API calls

Question 15

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails during the 'BeforeInstall' lifecycle event. Which file should the developer check to debug the failure?

Accepted Answer

appspec.yml. The 'BeforeInstall' lifecycle event in AWS CodeDeploy is a hook defined in the appspec.yml file. This file specifies the deployment lifecycle hooks, including scripts to run before installation. When a deployment fails during this event, the appspec.yml is the primary file to inspect for misconfigured scripts, incorrect permissions, or missing script paths.

Answer

index.js

Answer

taskdef.json

Answer

buildspec.yml