DVA-C02 Practice Test 37 — 15 Questions

Question 1

Which TWO actions are required to enable server-side encryption for an Amazon RDS instance? (Choose 2)

Accepted Answer

Use AWS KMS to manage the encryption key. To enable server-side encryption for an Amazon RDS instance, you must specify encryption at rest when creating the DB instance (Option E) and use AWS KMS to manage the encryption key (Option D). Encryption cannot be enabled after the instance is created (Option A is incorrect). Client-side encryption (Option B) is a separate approach that encrypts data before sending to RDS, not server-side encryption. Configuring a VPC (Option C) is unrelated to enabling encryption.

Answer

Enable encryption on the database after creation

Answer

Use client-side encryption in the application

Answer

Configure the DB instance to use a VPC

Question 2

A developer is designing a system that stores sensitive user data in DynamoDB. The data must be encrypted at rest and in transit. Which THREE actions should the developer take?

Accepted Answer

Enable DynamoDB encryption at rest using an AWS KMS managed key (SSE-KMS).. Options A, B, and C are correct. DynamoDB supports encryption at rest using AWS KMS; both SSE-KMS (A) and customer managed keys (B) provide encrypted storage. Using HTTPS (C) ensures encryption in transit. Option D is incorrect because DynamoDB already uses TLS 1.2 by default for all connections, so no explicit action is needed. Option E is unnecessary as server-side encryption and HTTPS provide the required protections.

Answer

Use TLS 1.2 for all connections.

Answer

Implement client-side encryption before writing items to DynamoDB.

Question 3

A developer is troubleshooting a slow-performing Amazon RDS for MySQL database. Which TWO actions should the developer take to improve query performance?

Accepted Answer

Increase the instance size to provide more CPU and memory.. Increasing the instance size provides more CPU and memory, which can improve query processing speed. Option D is correct because enabling the slow query log allows you to identify and analyze poorly performing queries so you can optimize them. Option A is incorrect: while deleting unused indexes reduces write overhead, indexes typically improve read performance, so removing them would not help with slow queries. Option B is incorrect: Multi-AZ deployment is for high availability and failover, not for improving read performance; read replicas would be more appropriate. Option E is incorrect: deleting binary log files frees storage but does not directly improve query performance.

Answer

Delete unused indexes to reduce write overhead.

Answer

Enable Multi-AZ deployment for better read performance.

Answer

Delete the binary log files to free up storage.

Question 4

Match each AWS service to its primary use case.

Accepted Answer

AWS Lambda: Serverless compute service that runs code in response to events.. Correct matches: Lambda is serverless compute, DynamoDB is NoSQL database, S3 is object storage, Elastic Beanstalk is PaaS. Common confusions include swapping Lambda and DynamoDB definitions.

Answer

AWS Lambda: Fully managed NoSQL database service for key-value and document data.

Answer

Amazon DynamoDB: Serverless compute service that runs code in response to events.

Question 5

Which TWO actions are recommended to secure an S3 bucket? (Choose 2)

Accepted Answer

Block public access at the bucket level. Options A and D are correct. A: Block public access is a key security measure. D: Enable default encryption ensures data at rest is encrypted. B: Disabling versioning reduces data protection and is not recommended for security. C: Using HTTP instead of HTTPS is insecure. E: Granting public read access via ACLs is insecure and should be avoided.

Answer

Disable versioning to reduce complexity

Answer

Use HTTP instead of HTTPS for faster access

Answer

Grant public read access via ACLs

Question 6

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Options A and D are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store (with SecureString parameter type) are secure services for storing and retrieving database credentials at runtime. Option B is incorrect because storing credentials in an S3 bucket is not a secure practice for secrets management, even with server-side encryption, as access policies may inadvertently expose the bucket and it is not designed for secret rotation or fine-grained access control. Option C is incorrect because hardcoding credentials in the application code exposes them in version control and to anyone with access to the code. Option E is incorrect because environment variables in Elastic Beanstalk can be viewed in the environment configuration and may be exposed in logs or through other AWS services if not carefully managed.

Answer

Store credentials in an Amazon S3 bucket with server-side encryption.

Answer

Hardcode credentials in the application configuration file.

Answer

Store credentials as environment variables in the Elastic Beanstalk environment.

Question 7

Which THREE are best practices for managing IAM users and roles? (Choose three.)

Accepted Answer

Rotate IAM user access keys periodically.. Options A, B, and C are correct. Option A: Rotating IAM user access keys periodically reduces the risk of compromised credentials. Option B: Granting least privilege ensures users have only the permissions necessary to perform their tasks, minimizing security risks. Option C: Using IAM roles for EC2 instances avoids the need to store long-term access keys on the instances, which is more secure. Option D is incorrect because the root account should not be used for daily tasks; it should be secured and used only for account-level administrative actions. Option E is incorrect because assigning full administrator access violates the principle of least privilege and increases security risk.

Answer

Use the root account for daily administrative tasks.

Answer

Assign full administrator access to all users.

Question 8

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. The correct actions are to create an IAM service role that allows CodeDeploy to access the instances (Option A) and install the CodeDeploy agent on each EC2 instance in the Auto Scaling group (Option E). The service role grants CodeDeploy the necessary permissions to deploy to the instances, and the agent must be running on each instance to receive and execute deployment commands. Option B is not required; a load balancer is optional and not necessary for successful deployments. Option C is irrelevant; the Application Discovery Service is used for discovery and migration planning, not for CodeDeploy. Option D is not required; CodeDeploy supports both in-place and blue/green deployments, but the question does not specify which type, and a blue/green deployment is not mandatory for success.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 9

Match each AWS storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. The correct matches are S3 Standard with frequently accessed data, S3 Intelligent-Tiering with automatic cost optimization, S3 Glacier Instant Retrieval with archive and fast retrieval, and S3 One Zone-IA with infrequent data in one AZ. Common confusions include mixing up storage class descriptions.

Answer

S3 Standard: Infrequent access data stored in a single Availability Zone.

Answer

S3 Intelligent-Tiering: Archive storage with retrieval times of minutes.

Question 10

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager.. To pass the database connection string securely without hard-coding it, developers can use AWS Secrets Manager (B) to store and retrieve secrets programmatically, Elastic Beanstalk environment properties (C) to inject configuration into the application environment, and AWS Systems Manager Parameter Store (E) to securely store strings and secrets. Option A is incorrect because RDS tags are not designed for sensitive data like connection strings. Option D is incorrect because storing the connection string in a configuration file within the application bundle would expose it in the source code and deployment package.

Answer

Read the connection string from Amazon RDS tags.

Answer

Store the connection string in a configuration file in the application bundle.

Question 11

A developer is storing secrets such as database passwords. Which TWO AWS services can be used to securely store and retrieve secrets?

Accepted Answer

AWS Systems Manager Parameter Store. And Option D are correct. AWS Secrets Manager is designed for secrets with automatic rotation. AWS Systems Manager Parameter Store can store secrets in the Advanced tier with encryption. IAM is for identities. S3 is object storage. CloudHSM is a hardware security module.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 12

A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?

Accepted Answer

SSE-C. S3 offers three server-side encryption options: SSE-S3 (using S3-managed keys), SSE-KMS (using AWS KMS), and SSE-C (using customer-provided keys).

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 13

A developer is tasked with securing a legacy application that stores secrets in environment variables. Which THREE AWS services can be used to improve the security posture?

Accepted Answer

AWS Key Management Service (KMS). Secrets Manager, Parameter Store, and KMS can all help manage and encrypt secrets.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 14

A developer needs to send large files (up to 5 GB) from a web application to Amazon S3. The application runs on EC2 instances. Which approach is MOST efficient and reliable?

Accepted Answer

Use S3 multipart upload to upload the file in parts.. S3 multipart upload is the most efficient and reliable approach for uploading large files (up to 5 GB) because it allows the file to be split into smaller parts that can be uploaded in parallel, improving throughput and resilience. If a part fails, only that part needs to be retried, not the entire file, and the upload can be paused and resumed. This is the recommended AWS method for objects larger than 100 MB and is required for objects over 5 GB.

Answer

Save the file to EC2 instance store and then copy to S3.

Answer

Upload the file as a single S3 PutObject operation.

Answer

Use S3 Transfer Acceleration to upload the file.

Question 15

A developer attaches the following IAM policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": "t2.micro"
        }
      }
    }
  ]
}
```

What happens when the developer attempts to launch a t2.micro instance?

Accepted Answer

The action is allowed because the Allow statement applies and the Deny condition excludes t2.micro.. The question implies an IAM policy with an Allow statement for ec2:RunInstances and a Deny statement that uses a condition (e.g., ec2:InstanceType StringNotEquals t2.micro) to block instances that are not t2.micro. Since the condition in the Deny only matches non-t2.micro instances, the Deny does not apply to t2.micro. Therefore, the Allow takes effect and launching a t2.micro instance is allowed.

Answer

The action is denied because ec2:RunInstances requires additional permissions.

Answer

The action is denied because the Deny statement overrides the Allow.

Answer

The action is allowed only if the user has ec2:DescribeInstances as well.