DVA-C02 Practice Test 36 — 15 Questions

Question 1

A company has an IAM policy that allows access to an S3 bucket only if the request comes from a specific VPC endpoint. The developer notices that requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VPC endpoint policy does not allow the required S3 action for the principal. The VPC endpoint policy is an additional layer of access control that can explicitly deny actions even if the bucket policy allows them. If the endpoint policy does not grant the required S3 action (e.g., s3:GetObject) for the IAM principal (the EC2 instance's role), requests will be denied regardless of the bucket policy. This is a common misconfiguration where developers focus only on the bucket policy and overlook the endpoint policy.

Answer

The bucket policy does not have a condition checking aws:SourceVpce

Answer

The route table does not have a route to the S3 endpoint

Answer

The security group does not allow outbound HTTPS traffic

Question 2

Refer to the exhibit. A developer is trying to deploy an EC2 instance using AWS CloudFormation. The stack creation fails with an 'AccessDenied' error when CloudFormation tries to create the EC2 instance. The developer has the IAM policy above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role specified in the CloudFormation template is not the same as the one in the PassRole resource.. CloudFormation needs permission to pass the IAM role specified in the template. The policy allows PassRole only for a specific role ARN. If the template specifies a different role, CloudFormation cannot pass it, resulting in an AccessDenied error. Option A is incorrect because ec2:DescribeImages is allowed in the policy. Option C is incorrect because ec2:RunInstances is allowed. Option D is incorrect because ec2:TerminateInstances is not called during stack creation, and the policy allows it anyway.

Answer

The policy does not allow ec2:DescribeImages.

Answer

The policy does not allow ec2:RunInstances.

Answer

The policy does not allow ec2:TerminateInstances.

Question 3

Match each HTTP status code to its meaning.

Accepted Answer

200: OK. Correct matches: 200 OK, 404 Not Found, 500 Internal Server Error. Common confusions include mixing 200 and 201, or 404 and 403.

Answer

200: Created

Answer

404: Forbidden

Question 4

A developer is using Amazon RDS for MySQL and notices that the database performance has degraded. The developer suspects that slow queries are the cause. Which THREE actions should the developer take to identify and address the slow queries?

Accepted Answer

Enable the slow query log in RDS and review the logs.. Options A, C, and D are correct actions to identify and address slow queries in Amazon RDS for MySQL. Option A: Enabling the slow query log captures queries that exceed a specified execution time, allowing the developer to review and optimize them. Option C: Performance Insights provides a dashboard that visualizes database load, wait events, and top SQL queries, helping to pinpoint bottlenecks. Option D: Reviewing metrics for high CPU or IOPS usage can indicate whether hardware resources are exhausted due to inefficient queries, guiding further investigation. Option B is incorrect because increasing the DB instance size is a reactive scaling measure that may temporarily alleviate performance issues but does not help identify the root cause of slow queries. Option E is incorrect because creating a read replica offloads read traffic and improves read scalability, but it does not directly assist in diagnosing or addressing slow query performance on the primary instance.

Answer

Increase the DB instance size to improve performance.

Answer

Create a read replica to offload read traffic.

Question 5

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application experiences intermittent failures, and the developer suspects the application is not properly handling termination notifications. Which TWO steps should the developer take to diagnose the issue?

Accepted Answer

Configure a CloudWatch Events rule to capture Auto Scaling termination events.. Options B and D are correct. B: CloudWatch Events can capture termination events, which can be used to trigger notifications. D: Lifecycle hooks allow the instance to perform actions before termination. Option A is wrong because detailed monitoring does not capture termination signals. Option C is wrong because CloudWatch Logs agent is for logs, not for termination notifications. Option E is wrong because replacing instances does not diagnose the issue.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Install the CloudWatch Logs agent on the instances to capture application logs.

Answer

Use an Elastic Load Balancer to replace instances automatically.

Question 6

A developer is using AWS CodeDeploy to deploy an application to an Amazon EC2 Auto Scaling group. The deployment fails because the CodeDeploy agent on the instances is not running. Which TWO steps should the developer take to resolve this issue? (Choose TWO.)

Accepted Answer

Install the CodeDeploy agent on the instances.. The issue is that the CodeDeploy agent is not running on the instances. To resolve this, the developer should first ensure the agent is installed (Option B) and then start the agent service (Option C). Option A is incorrect because attaching an IAM role allows permissions but does not install or start the agent. Option D is incorrect because rebooting does not fix missing or stopped agents. Option E is incorrect because user data runs only at launch, not on existing instances; it is a preventive measure, not a fix for already-running instances.

Answer

Attach an IAM role to the instances that allows CodeDeploy actions.

Answer

Reboot the instances.

Answer

Add a script in the Auto Scaling group's launch configuration user data to install the agent.

Question 7

A company is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for configuration. The development team wants to ensure that the environment variables are not exposed in the source code or in the deployment logs. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Store sensitive environment variables in AWS Systems Manager Parameter Store and retrieve them at runtime.. Options C and D are correct. Storing environment variables in AWS Systems Manager Parameter Store (C) or AWS Secrets Manager (D) prevents exposure in source code or logs, as they are retrieved at runtime via SDK calls. Option A (detailed logging) does not prevent exposure; it may actually log the values. Option B (Elastic Beanstalk environment properties) stores values in plaintext in the environment configuration, which can be viewed. Option E (embedding in .env file) exposes them in the source code and deployment artifacts.

Answer

Enable detailed logging for the Elastic Beanstalk environment and filter out sensitive data.

Answer

Set environment variables using Elastic Beanstalk environment properties in the console.

Answer

Embed the environment variables in the application package as a .env file.

Question 8

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The developer needs to ensure that the Lambda function can read objects from the S3 bucket. Which TWO steps should the developer take to meet this requirement? (Choose two.)

Accepted Answer

Add a bucket policy on the S3 bucket that grants access to the Lambda function's execution role.. To allow the Lambda function to read objects from S3, the developer must attach an IAM policy to the Lambda execution role that includes the s3:GetObject permission (Option D). Additionally, an S3 bucket policy can be used to explicitly grant access to the Lambda function's execution role (Option C). This provides cross-account access if needed. Option A is incorrect because S3 object-level permissions are not set directly on objects; instead, bucket policies or IAM policies control access. Option B is incorrect because AWS KMS is used for encryption key management, not for granting access to S3. Option E is incorrect because Lambda functions use execution roles, not IAM users, to obtain permissions.

Answer

Set the S3 bucket's object-level permissions to allow the Lambda function.

Answer

Use AWS Key Management Service (KMS) to grant the Lambda function access to the S3 bucket.

Answer

Create an IAM user with S3 read permissions and configure the Lambda function to assume that user.

Question 9

A development team is using AWS Elastic Beanstalk to deploy a web application. The team wants to perform a blue/green deployment. Which THREE steps are required to complete the blue/green deployment?

Accepted Answer

Swap the CNAMEs of the two environments.. In a blue/green deployment with Elastic Beanstalk, you first deploy the new application version to a separate environment (E). Then, you swap the CNAMEs of the two environments to route traffic to the new environment (B). After verifying the new environment works correctly, you terminate the old environment (C). Option A is incorrect because you do not update the existing environment; you create a new one. Option D is incorrect because you swap CNAMEs, not manually update Route 53 DNS records.

Answer

Update the existing environment with the new version.

Answer

Update the Route 53 DNS record to point to the new environment.

Question 10

A developer is troubleshooting a slow-running query on an Amazon RDS for MySQL database. The query is used by a reporting application and takes over 30 seconds to complete. The database is a db.r5.large instance with 200 GB of gp2 storage. Which TWO actions should the developer take to improve query performance?

Accepted Answer

Review the slow query log to identify the query and its execution plan.. Reviewing the slow query log helps identify the query and its execution plan, which is essential for diagnosing performance issues. Option D is correct: adding appropriate indexes can speed up query execution by reducing the number of rows scanned. Option A is incorrect: terminating idle connections frees up resources but does not directly improve query performance for a slow-running query. Option C is incorrect: increasing storage to gp2 does not improve I/O performance; gp2 performance scales with size only up to a point, but the primary bottleneck is likely query optimization, not storage. Option E is incorrect: Multi-AZ is for high availability and failover, not for enhancing read performance.

Answer

Terminate idle connections to free up resources.

Answer

Increase the allocated storage to 500 GB to improve I/O performance.

Answer

Enable Multi-AZ deployment for better read performance.

Question 11

Which TWO approaches can be used to optimize costs for an Amazon DynamoDB table with predictable read/write patterns? (Select TWO.)

Accepted Answer

Use provisioned capacity with auto scaling.. Optimizing costs for DynamoDB with predictable workloads involves avoiding over-provisioning and reducing read/write consumption. Provisioned capacity with auto scaling (B) adjusts capacity based on actual usage, preventing unnecessary spending on unused capacity. DynamoDB Accelerator (DAX) (D) caches frequent reads, reducing read capacity unit consumption. Option A (increasing RCU) leads to over-provisioning and higher costs. Option C (global tables) adds replication costs. Option E (on-demand) is more expensive than provisioned for predictable patterns.

Answer

Increase the read capacity units to avoid throttling.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use on-demand capacity mode.

Question 12

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS MySQL database. The development team wants to ensure that database credentials are not exposed in the application code. Which THREE actions should the team take to securely manage and retrieve database credentials? (Choose three.)

Accepted Answer

Configure Elastic Beanstalk to pass the secret ARN to the application as an environment property.. To securely manage database credentials in Elastic Beanstalk, the team should store credentials in AWS Secrets Manager (option E). Then, configure Elastic Beanstalk to pass the secret ARN as an environment property (option B) so the application can retrieve the secret at startup (option C). This avoids hardcoding credentials in code or environment variables. Option A (S3 bucket) is less secure and not best practice; Option D (hardcoding) is insecure and should never be done.

Answer

Store the credentials in an S3 bucket with a bucket policy that restricts access to the application.

Answer

Hardcode the credentials in the application code and use environment variables to override them.

Question 13

A developer is debugging an application that uses Amazon SQS. The application occasionally processes the same message twice. Which TWO configurations can help prevent duplicate processing?

Accepted Answer

Increase the visibility timeout to ensure messages are deleted before becoming visible again.. Increasing the visibility timeout gives the consumer more time to process and delete the message before it becomes visible again, reducing the chance of duplicate processing from another consumer. Option E is correct: using a FIFO queue with content-based deduplication ensures exactly-once processing by deduplicating messages with the same deduplication ID or based on message content within a 5-minute deduplication interval. Option B is incorrect: a dead-letter queue is used to capture messages that fail processing, not to prevent duplicates. Option C is incorrect: increasing the delivery delay only delays the first delivery of a message, it does not prevent duplicate processing. Option D is incorrect: enabling long polling reduces empty responses and improves efficiency but does not prevent duplicates.

Answer

Configure a dead-letter queue to capture duplicates.

Answer

Increase the delivery delay to defer message processing.

Answer

Enable long polling to reduce empty responses.

Question 14

A developer is deploying a new microservice on AWS Elastic Beanstalk. The service uses an RDS database. The developer wants to ensure that database credentials are not stored in the application's source code. Which TWO methods should the developer use to securely provide credentials to the application?

Accepted Answer

Use AWS Secrets Manager to store and retrieve the credentials at runtime.. Options A and C are correct. AWS Secrets Manager allows you to store and automatically rotate database credentials, and retrieve them securely at runtime via API calls, avoiding hardcoding. Elastic Beanstalk environment properties let you set environment variables that the application can read, and these properties can be configured to reference secrets from Secrets Manager (e.g., using the `aws-secrets-manager` namespace). Option B is incorrect because storing credentials in source code exposes them in version control and is insecure. Option D is incorrect because storing credentials in an encrypted file on an EC2 instance still requires managing the encryption key and is not a recommended practice for Elastic Beanstalk. Option E is incorrect because an S3 bucket with a public read policy makes the credentials publicly accessible, violating security best practices.

Answer

Store the credentials in a configuration file within the application source code.

Answer

Store the credentials in an encrypted file on an EC2 instance.

Answer

Store the credentials in an S3 bucket with a public read policy.

Question 15

Which THREE are valid methods to authenticate to AWS APIs? (Choose 3)

Accepted Answer

Temporary security credentials from AWS STS. The three valid methods to authenticate to AWS APIs are: A - Temporary security credentials from AWS STS, C - Credentials from an EC2 instance profile, and E - IAM user access key ID and secret access key. Option B (database password stored in Secrets Manager) is not used for API authentication; Secrets Manager stores secrets but does not provide AWS API credentials. Option D (CloudFront key pair) is used for signed URLs and signed cookies, not for general AWS API authentication.

Answer

Database password stored in Secrets Manager

Answer

CloudFront key pair