DVA-C02 Practice Test 36 — 15 Questions

Question 1

A developer is building a serverless application that uses Amazon S3 for static website hosting and AWS Lambda for dynamic API calls. The developer wants to enable logging of all API requests. Which TWO services can be used to log API requests? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Options B and D are correct. B: Amazon CloudWatch Logs can capture API Gateway logs. D: AWS CloudTrail logs API calls for auditing. Option A is wrong because S3 server access logs log S3 requests, not API calls. Option C is wrong because VPC Flow Logs log network traffic. Option E is wrong because Route 53 logs DNS queries.

Answer

VPC Flow Logs

Answer

Amazon S3 server access logs

Answer

Amazon Route 53 logs

Question 2

A developer attaches the IAM policy shown to a user. The user attempts to upload an object to example-bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://example-bucket/`. The upload fails. What is the MOST likely reason?

Accepted Answer

The user did not specify server-side encryption in the request.. Option B is correct because the policy requires the `x-amz-server-side-encryption` header to be set to AES256, but the CLI command does not specify SSE. Option A is wrong because the action is allowed. Option C is wrong because the resource allows all objects. Option D is wrong because the bucket policy is not shown.

Answer

The user does not have permission to perform s3:PutObject on the bucket.

Answer

The bucket policy overrides the IAM policy and denies the request.

Answer

The resource ARN does not include the bucket itself.

Question 3

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

Accepted Answer

Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.. AWS Batch is designed for batch computing jobs. It can launch Fargate tasks, run the job, and then stop the resources automatically. The developer can define a job queue and job definition, and schedule the job with Amazon EventBridge (CloudWatch Events). AWS Step Functions can orchestrate but is more complex. ECS Scheduled Tasks can also work, but AWS Batch is purpose-built for this and handles retries, dependencies, and cost optimization better. The other options are not appropriate: EC2 Auto Scaling scales EC2 instances, not Fargate tasks; Lambda has a 15-minute timeout; ECS Service Auto Scaling keeps desired count at least 1, not 0.

Answer

Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

Answer

Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

Answer

Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

Question 4

A developer is deploying a microservices application using Amazon ECS with Fargate. The application consists of multiple services that need to communicate with each other over HTTP. The developer wants to ensure that service-to-service communication is encrypted in transit and that the services can discover each other by logical service names instead of IP addresses. Which combination of AWS services should the developer use?

Accepted Answer

AWS App Mesh with AWS Cloud Map. AWS App Mesh provides service mesh capabilities including mTLS for encryption and service discovery using virtual services. AWS Cloud Map is used for service discovery with logical names. Together, they enable encrypted service-to-service communication. Route 53 is for DNS but not mTLS. ELB is for load balancing, not service discovery. Systems Manager is for configuration management, not networking. Direct Connect is a dedicated network connection.

Answer

Elastic Load Balancing with AWS Systems Manager

Answer

Amazon Route 53 with AWS Direct Connect

Answer

AWS Lambda with Amazon API Gateway

Question 5

Refer to the exhibit. The IAM policy is attached to an IAM role that is assumed by an AWS Lambda function. The Lambda function needs to read and write objects in the 'my-bucket' S3 bucket, but it should never delete objects. What will happen when the function attempts to delete an object?

Accepted Answer

The delete will fail because the Deny statement explicitly denies the delete action.. The policy explicitly denies s3:DeleteObject. IAM policies are evaluated with an explicit deny override. Even if another policy allows delete, the explicit deny will take effect, and the request will be denied.

Answer

The delete will succeed because there is no explicit deny for the specific object.

Answer

The delete will succeed because the Allow statement gives full access.

Answer

The delete will fail because the Allow statement only includes GetObject and PutObject.

Question 6

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The developer wants to ensure that the DB instance is not accidentally deleted when the stack is updated. Which property should be set on the DB instance resource?

Accepted Answer

DeletionPolicy: Retain. Option D is correct because DeletionPolicy: Retain prevents the DB instance from being deleted when the stack is deleted or the resource is removed from the stack. Option A is wrong because UpdateReplacePolicy handles replacement updates, not deletion. Option B is wrong because DependsOn does not prevent deletion. Option C is wrong because DeletionPolicy: Delete is the default and does not prevent deletion.

Answer

UpdateReplacePolicy: Retain

Answer

DeletionPolicy: Delete

Answer

DependsOn: SomeOtherResource

Question 7

A developer needs to access a DynamoDB table from a Lambda function. The Lambda function is in the same AWS account as the DynamoDB table. What is the most secure way to grant the Lambda function access to the DynamoDB table?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and assign it as the Lambda execution role.. Option C is correct because the Lambda execution role is an IAM role that the Lambda function assumes at runtime. Attaching an IAM policy to this role with the necessary DynamoDB permissions is the best practice for granting permissions.

Answer

Use the AWS account root user credentials.

Answer

Store the AWS access key and secret access key in the Lambda environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Question 8

A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.. Option A is correct because using AWS Secrets Manager allows automatic rotation and secure retrieval of secrets without hardcoding. Option B is wrong because environment variables are visible in the Lambda console. Option C is wrong because storing in S3 is less secure and requires additional permissions. Option D is wrong because IAM roles are for AWS services, not database credentials.

Answer

Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.

Answer

Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.

Answer

Hardcode the credentials as environment variables in the Lambda function configuration.

Question 9

A developer has written an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has 10,000 messages waiting to be processed. What will happen when the Lambda function is invoked?

Accepted Answer

Lambda will process messages with a maximum of 5 concurrent executions, each processing a batch of messages.. Reserved concurrency limits the maximum number of concurrent invocations to 5. Lambda will poll the SQS queue and process messages up to the reserved concurrency. If the batch size is 10, each invocation processes up to 10 messages, so up to 50 messages can be processed concurrently. The rest remain in the queue. Lambda does not scale beyond reserved concurrency.

Answer

Lambda will automatically increase reserved concurrency to handle the load.

Answer

Lambda will reject the invocation because reserved concurrency is too low.

Answer

Lambda will scale up to 20 concurrent executions to process all messages quickly.

Question 10

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The output shows StatusCode 200 and no FunctionError. However, the application that depends on this function's output is not working correctly. What should the developer check next?

Accepted Answer

Check the Lambda function's CloudWatch Logs for any errors or unexpected output.. A StatusCode 200 indicates that Lambda accepted the invocation and ran the function without a runtime error. However, the function might have a logical error, incorrect business logic, or might be returning unexpected data. The developer should check the function's logs in CloudWatch Logs to see the actual output and any debug messages. The payload format might also be incorrect, but the invocation succeeded technically. The function's memory or timeout settings might cause issues but would typically result in an error. The IAM role might be insufficient but would show an error in logs.

Answer

Check the IAM role attached to the Lambda function for insufficient permissions.

Answer

Check the payload format against the function's expected input.

Answer

Check the Lambda function's memory and timeout configuration.

Question 11

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

Accepted Answer

Amazon ElastiCache. Option B is correct because ElastiCache provides a high-performance, highly available in-memory cache suitable for session state. Option A is wrong because S3 is object storage, not ideal for low-latency session state. Option C is wrong because EBS volumes are attached to a single instance. Option D is wrong because CloudFront is a CDN, not a session store.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon CloudFront

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Option A is correct because enabling eviction policies (like allkeys-lru) allows Redis to remove less frequently used keys when memory is full, preventing out-of-memory errors. Scaling up is a longer-term solution but may not be needed if eviction is enabled.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.

Question 13

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a build stage that uses AWS CodeBuild. The developer wants to run unit tests and only proceed to the deploy stage if the tests pass. Which configuration should the developer use to achieve this?

Accepted Answer

Configure the build stage to run tests and fail the build if tests fail; CodePipeline will automatically stop.. CodeBuild can be configured with a buildspec file that defines phases, including a 'post_build' phase for running tests. If the tests fail, CodeBuild returns a non-zero exit code, causing the build to fail. CodePipeline will then stop and not proceed to the deploy stage. The developer can also use a 'test' action in CodePipeline with a test provider like CodeBuild. The other options either don't stop the pipeline or are not automated.

Answer

Configure a manual approval step before the deploy stage.

Answer

Configure Amazon CloudWatch alarms to stop the pipeline if tests fail.

Answer

Configure AWS Lambda to invoke a function that checks test results and manually stops the pipeline.

Question 14

Match each AWS service to its primary use case.

Question 15

Match each DynamoDB concept to its description.