DVA-C02 Practice Test 38 — 15 Questions

Question 1

A company has an Amazon S3 bucket (Bucket-A) in Account A that contains sensitive data. A developer in Account B needs read-only access to objects in Bucket-A. The developer in Account A added a bucket policy granting s3:GetObject to the IAM user in Account B. However, the IAM user in Account B still receives Access Denied errors. What additional step is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM policy in Account B that allows s3:GetObject for the specific bucket and attach it to the user. The bucket policy in Account A grants access to the IAM user in Account B, but the user's identity in Account B must also have an explicit IAM policy that allows the s3:GetObject action. Without this, the user in Account B lacks the necessary permissions to access the bucket, even though the bucket policy permits it. This is because cross-account access requires both a resource-based policy (bucket policy) in the source account and an identity-based policy (IAM policy) in the target account to authorize the request.

Answer

Add an S3 bucket ACL granting the user in Account B Read access

Answer

Generate a pre-signed URL for each object and share it with the user

Answer

Add a condition in the bucket policy to allow requests only from the user's IP address

Question 2

A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?

Accepted Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'. The bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.

Answer

Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'

Answer

Condition: Null: 's3:x-amz-server-side-encryption': 'true'

Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'

Question 3

A company requires that all data in an S3 bucket be encrypted at rest. The security team wants to enforce that only objects encrypted with AWS KMS are allowed. Which S3 bucket policy condition key should be used to deny PutObject requests if the object is not encrypted with KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key specifically checks for the AWS KMS key ID (or alias) used for server-side encryption with AWS KMS (SSE-KMS). By using this key in a bucket policy with a `Deny` effect, you can enforce that only objects encrypted with a specific KMS key are allowed, rejecting any `PutObject` request that does not include the required `x-amz-server-side-encryption-aws-kms-key-id` header.

Answer

s3:x-amz-server-side-encryption-key-id

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-kms-key-id

Question 4

An organization wants to deploy a microservices architecture using AWS Lambda functions. They need to manage environment variables for each function across different stages (dev, test, prod). Which approach is the MOST secure and maintainable?

Accepted Answer

Use AWS Systems Manager Parameter Store with separate paths for each stage.. AWS Systems Manager Parameter Store (Option A) is the most secure and maintainable approach for managing environment variables across stages. It provides hierarchical storage (e.g., /dev/myapp/var, /prod/myapp/var), supports encryption with AWS KMS, and can be referenced by Lambda functions using the AWS SDK. Option B (CloudFormation parameters) ties configuration to deployment templates and does not provide a secure, runtime-configurable store. Option C (hardcoding) is insecure and not maintainable. Option D (storing in Lambda configuration) lacks the stage-specific hierarchy and encryption features of Parameter Store.

Answer

Use AWS CloudFormation parameters to pass values at deployment.

Answer

Hardcode the environment variables in each Lambda function code.

Answer

Store environment variables in the Lambda function configuration.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API requires that the same Lambda function handle different HTTP methods (GET, POST, DELETE) for the same resource. The developer wants to minimize code and configuration. Which integration type should the developer use?

Accepted Answer

Lambda proxy integration. Lambda proxy integration (option A) is correct because it automatically passes the entire HTTP request (method, headers, query parameters, path parameters) to the Lambda function as a single event object, allowing the same function to inspect the `httpMethod` field and branch logic for GET, POST, DELETE without any additional API Gateway mapping or transformation configuration. This minimizes both code (the function handles routing internally) and configuration (no need to define separate integration requests/responses per method).

Answer

Lambda custom integration

Answer

HTTP integration

Answer

Mock integration

Question 6

A developer is deploying an application on Amazon EC2 instances that need to securely retrieve secrets from AWS Secrets Manager. What is the MOST secure way to provide the necessary permissions without hardcoding credentials?

Accepted Answer

Attach an IAM role to the EC2 instance with permission to access Secrets Manager.. Attaching an IAM role to the EC2 instance is the most secure method because it leverages temporary security credentials obtained via the EC2 instance metadata service (IMDS). This eliminates the need to hardcode, embed, or store any long-term credentials on the instance, adhering to the AWS Well-Architected Framework's security pillar. The IAM role's policy grants the instance precise permissions to call Secrets Manager APIs like GetSecretValue, ensuring least privilege.

Answer

Store the secret in an environment variable.

Answer

Embed the secret in the application code.

Answer

Use a configuration file stored in S3 with bucket policy.

Question 7

A company uses AWS CodeBuild to compile and test a Java application. The build process takes a long time because dependencies are downloaded every time. Which TWO actions can reduce build time? (Choose TWO.)

Accepted Answer

Enable local caching in the CodeBuild project to reuse dependency files between builds.. Options D and E are correct. Both local caching (D) and S3 caching (E) allow CodeBuild to reuse previously downloaded dependencies, reducing build time. Option A (increasing compute type) improves CPU/memory but does not affect dependency download time. Option B (changing runtime language) is unrelated to dependency caching. Option C (parallel builds) runs multiple builds concurrently but does not reduce the time for a single build's dependency download.

Answer

Increase the compute type of the build environment to have more CPU and memory.

Answer

Change the build runtime to a language that compiles faster.

Answer

Configure the build project to run builds in parallel.

Question 8

A developer is designing a system that must meet the following security requirements: (1) Encrypt data at rest in S3, (2) Automatically rotate encryption keys annually, (3) Use an encryption key that is managed by AWS. Which services or features should the developer use? (Choose TWO.)

Accepted Answer

SSE-KMS. The correct answers are B (SSE-KMS) and C (SSE-S3). SSE-KMS uses AWS KMS customer master keys (CMKs) which can be configured for automatic annual rotation via key rotation. SSE-S3 uses S3-managed keys that are automatically rotated by AWS. Both provide encryption at rest with keys managed by AWS. Option A (SSE-C) uses customer-provided keys, not AWS-managed. Option D (AWS CloudHSM) provides customer-managed hardware security modules. Option E (client-side encryption with AWS KMS) is client-side encryption, not server-side, and does not meet the requirement for AWS-managed key for S3.

Answer

SSE-C

Answer

AWS CloudHSM

Answer

Client-side encryption with AWS KMS

Question 9

A developer wants a Lambda function to process SQS messages in batches but avoid losing the whole batch when only one record fails. Which feature should be enabled?

Accepted Answer

Partial batch response for SQS event source mapping. Partial batch response for SQS event source mapping allows the Lambda function to report which messages in a batch failed processing. When enabled, Lambda retries only the failed messages instead of the entire batch, preventing successful messages from being reprocessed or lost. This is achieved by returning a `batchItemFailures` array in the function's response, which tells Lambda which message IDs to retry.

Answer

Reserved concurrency of one

Answer

Maximum message size increase

Answer

SQS short polling

Question 10

A developer is troubleshooting an AWS Lambda function that times out when processing large files from Amazon S3. The function has a 15-minute timeout and 512 MB memory. What should the developer do to resolve this issue?

Accepted Answer

Increase the Lambda function memory to 3008 MB.. Increasing the Lambda function memory to 3008 MB is correct because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like file parsing. The 15-minute timeout is already the maximum, so the issue is insufficient compute resources, not timeout duration. With 512 MB, the function lacks the CPU throughput to process large files within the timeout, so boosting memory (and thus CPU) directly addresses the root cause.

Answer

Use Amazon S3 batch operations to split the files before processing.

Answer

Add an S3 Event Notification to trigger the function asynchronously.

Answer

Reduce the Lambda timeout to 5 minutes to force faster processing.

Question 11

A company has an S3 bucket that stores sensitive data. They want to ensure that any object uploaded to the bucket is automatically encrypted with server-side encryption using AWS KMS (SSE-KMS). They also want to deny any uploads that do not specify the correct encryption. Which bucket policy condition should be used to enforce this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals aws:kms. The condition `s3:x-amz-server-side-encryption equals aws:kms` enforces that any PUT request to the S3 bucket must include the `x-amz-server-side-encryption` header set to `aws:kms`, which triggers SSE-KMS encryption. This policy condition ensures that objects uploaded without specifying SSE-KMS are denied, meeting the requirement to automatically encrypt all uploaded objects with AWS KMS.

Answer

s3:x-amz-server-side-encryption equals AES256

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals a specific key ARN

Answer

aws:SecureTransport equals true

Question 12

A developer is building a serverless application using AWS Lambda that needs to connect to an Amazon RDS MySQL database. The function will be deployed in a VPC. Which resource should the developer use to ensure secure and efficient database connections?

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it manages a pool of database connections, allowing Lambda functions to reuse them efficiently and avoid exhausting MySQL connection limits under high concurrency. It also enforces IAM authentication and securely stores credentials in AWS Secrets Manager, eliminating the need to hardcode database passwords in the function code.

Answer

NAT Gateway

Answer

VPC Endpoint

Answer

AWS PrivateLink

Question 13

A company is using AWS Lambda with a 1 GB memory configuration. The function processes large CSV files from S3 and occasionally times out after 15 seconds. The function currently uses synchronous invocation. What is the MOST cost-effective solution to handle larger files without losing data?

Accepted Answer

Increase the Lambda timeout to 15 minutes and keep memory at 1 GB.. Increasing the Lambda timeout from 15 seconds to 15 minutes directly addresses the timeout issue without incurring additional costs. Keeping memory at 1 GB avoids the higher per-GB-second cost of larger memory configurations, making it the most cost-effective solution. Lambda charges based on memory allocation and execution duration, so extending the timeout alone does not increase the cost per invocation if the function runs for the same duration.

Answer

Switch to asynchronous Lambda invocation to allow up to 15 minutes of processing.

Answer

Increase the Lambda memory to 3 GB to improve processing speed.

Answer

Use AWS Step Functions to orchestrate the processing in smaller chunks.

Question 14

An application running on EC2 instances behind an Application Load Balancer (ALB) occasionally returns HTTP 503 errors. The instances are in an Auto Scaling group. Which action should be taken to resolve this issue?

Accepted Answer

Review the ALB access logs to identify the target response codes.. HTTP 503 errors from an ALB indicate that the targets (EC2 instances) are not responding successfully. Reviewing ALB access logs reveals the specific target response codes (e.g., 503 from the target itself or connection timeouts), which helps pinpoint whether the issue is due to overloaded instances, application errors, or health check failures. This diagnostic step is essential before making any configuration changes.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the ALB idle timeout setting.

Answer

Increase the size of the EC2 instances.

Question 15

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

Accepted Answer

Amazon S3 versioning is not enabled on the bucket.. CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The pipeline is configured to use polling instead of event-based triggers.

Answer

AWS CloudTrail is not enabled.