DVA-C02 Practice Test 37 — 15 Questions

Question 1

A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 2

A company is using AWS CloudFormation to manage infrastructure. The developer wants to update a stack but needs to prevent specific resources from being replaced. What CloudFormation feature should the developer use?

Accepted Answer

Apply a stack policy that denies updates to the specific resources.. A stack policy is a JSON-based policy that defines which resources in a CloudFormation stack can be updated, replaced, or deleted. By applying a stack policy that denies updates to specific resources, the developer can prevent those resources from being replaced during a stack update, even if the template change would normally trigger a replacement.

Answer

Use a custom resource to manage the update logic.

Answer

Create a change set to review the changes before execution.

Answer

Use a deletion policy attribute on the resources to protect them.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL database. Recently, the application started experiencing frequent database connection timeouts. The development team discovered that the application is not closing database connections properly, leading to exhausted database connections. The team wants a solution that does not require code changes. Which option should they choose?

Accepted Answer

Configure Amazon RDS Proxy in front of the RDS instance and update the application to connect through the proxy.. Amazon RDS Proxy provides connection pooling, allowing the application to reuse database connections efficiently, reducing the number of open connections without code changes. Option B is incorrect: Multi-AZ provides high availability and failover but does not address connection leaks or exhaustion. Option C is incorrect: Migrating to Aurora with Auto Scaling for read replicas adds scalability for read traffic but does not fix connection leaks; it also requires migration effort. Option D is incorrect: Increasing max_connections may temporarily alleviate the symptom but does not solve the underlying issue of connections not being closed, and it can lead to resource contention.

Answer

Enable Multi-AZ on the RDS instance to handle failover and reduce connection timeouts.

Answer

Migrate the database to Amazon Aurora and enable Auto Scaling for read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more concurrent connections.

Question 4

A developer is using AWS CloudFormation to create a stack that includes an EC2 instance. The stack creation fails because the instance type is not supported in the selected Availability Zone. What should the developer do?

Accepted Answer

Update the stack to specify a different subnet or not specify an Availability Zone.. When an EC2 instance type is not supported in a specific Availability Zone (AZ), the developer can update the CloudFormation stack to either specify a different subnet (which implicitly selects a different AZ) or omit the Availability Zone parameter entirely, allowing AWS to automatically choose an AZ where the instance type is supported. This avoids the need to delete the stack or change the instance type, preserving other stack resources and configurations.

Answer

Delete the stack and start over.

Answer

Change the instance type to one that is supported.

Answer

Create the stack in a different region.

Question 5

A developer is debugging an AWS Lambda function that processes messages from an Amazon SQS queue. The function is failing with an error when processing certain messages. The developer wants to isolate the failed messages for later analysis without losing them. What should the developer do?

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Configuring a dead-letter queue (DLQ) for the SQS queue is the correct approach because it automatically captures messages that cannot be processed successfully after a specified number of retries (the redrive policy). This isolates the failed messages for later analysis without losing them, while allowing the function to continue processing other messages from the source queue.

Answer

Publish the failed messages to an SNS topic for later processing.

Answer

Log the error and delete the message from the queue.

Answer

Increase the visibility timeout of the SQS queue.

Question 6

A Lambda function needs to read from a DynamoDB table and send messages to an SQS queue. The function's IAM role should follow the principle of least privilege. Which policy statement should be attached to the role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}, {"Effect":"Allow","Action":["sqs:SendMessage"],"Resource":"arn:aws:sqs:us-east-1:123456789012:MyQueue"}. It grants only the specific DynamoDB read action (GetItem) needed to read from the table and the specific SQS write action (SendMessage) needed to send messages to the queue, scoped to the exact resource ARNs. This adheres to the principle of least privilege by not allowing any unnecessary operations or resources. Wrapping the statements in an array makes the policy snippet syntactically valid.

Answer

{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","sqs:SendMessage","sqs:ReceiveMessage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}

Question 7

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

Accepted Answer

Use Fn::ImportValue to import the exported outputs from the other stack.. Fn::ImportValue is designed to retrieve exported outputs from another CloudFormation stack. When security groups are created in a separate stack, the developer must export their IDs using the Export field in the Outputs section of that stack, and then use Fn::ImportValue in the current stack to reference those exported values. This is the standard cross-stack reference mechanism in CloudFormation, enabling decoupled infrastructure management.

Answer

Use Fn::GetAtt to retrieve the IDs from the other stack's resources.

Answer

Use a nested stack to include the security group resources in the same template.

Answer

Use Fn::Ref to reference the security group IDs directly.

Question 9

A developer is using the AWS SDK for Python (Boto3) to upload objects to an S3 bucket. The developer wants to encrypt the objects at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). Which parameter should the developer include in the put_object call?

Accepted Answer

ServerSideEncryption: 'aws:kms'. To use server-side encryption with AWS KMS managed keys (SSE-KMS) when uploading an object to S3 via the put_object call, you must set the ServerSideEncryption parameter to 'aws:kms'. This tells S3 to encrypt the object using a KMS key. Option C is correct because it specifies the exact value required for SSE-KMS encryption.

Answer

SSEAlgorithm: 'AES256'

Answer

SSEKMSKeyId: 'alias/aws/s3'

Answer

ServerSideEncryption: 'AES256'

Question 10

A developer uses AWS CodeBuild to run unit tests. The build succeeds but the tests fail. The developer wants to fail the build if tests fail. What should the developer do?

Accepted Answer

Ensure the test command exits with a non-zero status on failure.. In CodeBuild, the build phase succeeds or fails based on the exit code of the commands in the buildspec. By default, if a test command exits with a non-zero status, CodeBuild marks the build as FAILED. Therefore, ensuring the test command exits with a non-zero status on failure is the correct approach to fail the build when tests fail.

Answer

Run tests in the post_build phase.

Answer

Set the command to always exit 0.

Answer

Enable build badges.

Question 11

A Lambda function processes messages from an SQS standard queue and writes results to DynamoDB. Duplicate writes occasionally occur after retries. Which two changes best make the processing idempotent?

Accepted Answer

Use a deterministic idempotency key stored with a conditional write in DynamoDB. Using a deterministic idempotency key (e.g., a business transaction ID) combined with a conditional write in DynamoDB ensures that if the same message is processed more than once, the second write attempt will fail because the item already exists. This prevents duplicate records even when Lambda retries after a failure or timeout, making the processing idempotent at the database level.

Answer

Increase the Lambda timeout to 15 minutes

Answer

Disable SQS visibility timeout

Question 12

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

Accepted Answer

Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.. A bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Answer

Use SSE-KMS encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Move the sensitive data to a different S3 bucket and update the application.

Question 13

A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?

Accepted Answer

ACM automatically renews the certificate if it uses DNS validation.. ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.

Answer

The developer must configure a Lambda function to renew the certificate.

Answer

The certificate cannot be used with CloudFront; ACM certificates are only for ALB.

Answer

The developer must manually request a new certificate before expiration.

Question 14

A developer is deploying a static website to Amazon S3 and wants to use Amazon CloudFront for content delivery. The developer wants to ensure that only CloudFront can access the S3 bucket. Which S3 bucket policy should the developer use?

Accepted Answer

Grant CloudFront access via an origin access identity (OAI) and restrict the bucket policy to the OAI.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant access only to that OAI, you ensure that direct S3 requests are denied, and only requests routed through CloudFront can retrieve objects. This provides a secure, private origin without exposing the bucket publicly.

Answer

Use a bucket policy that allows access only if the Referer header matches the CloudFront distribution domain.

Answer

Make the bucket public and use CloudFront's default caching.

Answer

Grant CloudFront access by allowing the CloudFront IP address range.

Question 15

A developer is using AWS Step Functions to orchestrate a workflow that includes a Lambda function for data transformation. The Lambda function occasionally times out after 15 seconds. The Step Function execution fails with a 'States.Timeout' error. The developer wants to retry the Lambda task up to 3 times with exponential backoff. Which configuration should the developer add to the state definition in the Amazon States Language (ASL)?

Accepted Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]. It defines a retry policy for the 'States.Timeout' error, which is the error that occurs when the Lambda function times out. The configuration sets a 1-second initial interval, doubles the interval on each retry (BackoffRate of 2), and allows up to 3 retries, matching the requirement exactly.

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 2, "BackoffRate": 3, "MaxAttempts": 5 } ]

Answer

"Retry": [ { "ErrorEquals": ["States.Timeout"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 2 } ]

Answer

"Retry": [ { "ErrorEquals": ["Lambda.ServiceException"], "IntervalSeconds": 1, "BackoffRate": 2, "MaxAttempts": 3 } ]