DVA-C02 Practice Test 38 — 15 Questions

Question 1

A developer is designing a system that requires processing of streaming data from IoT devices in real time. The processed data will be stored in an S3 bucket for analytics. Which AWS services should the developer use together to build this solution? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Kinesis Data Firehose. Amazon Kinesis Data Streams is a scalable real-time data streaming service that ingests and processes streaming data from IoT devices in real time. It allows developers to build custom applications that consume and analyze the data as it arrives. Amazon Kinesis Data Firehose is a fully managed service that reliably loads streaming data into Amazon S3 for analytics, handling buffering, compression, and partitioning. Together, Data Streams provides real-time processing capabilities while Firehose automates delivery to S3, making them a complementary pair for this solution.

Answer

AWS Lambda

Answer

Amazon S3

Answer

Amazon SQS

Question 2

A developer is using Amazon SQS to decouple microservices. The consumer service processes messages from the queue. To reduce processing time, the developer wants to receive multiple messages in a single API call. What is the maximum number of messages that can be received at once?

Accepted Answer

10. Amazon SQS allows a consumer to retrieve up to 10 messages in a single ReceiveMessage API call. This is the hard limit enforced by the SQS service, regardless of the queue type (standard or FIFO). Using this maximum batch size can reduce the number of API calls and improve throughput, but each message must still be processed individually and deleted after processing.

Answer

5

Answer

100

Answer

20

Question 3

A developer needs to allow an IAM user to manage only their own access keys (create, list, update, delete). Which IAM policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}. It uses the `iam:*AccessKey*` wildcard action to cover all access key management operations (create, list, update, delete) and restricts the resource to `arn:aws:iam::*:user/${aws:username}`. The `${aws:username}` policy variable dynamically resolves to the IAM user's own username, ensuring that each user can only manage their own access keys. This follows the principle of least privilege by scoping permissions to the user's own resource.

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/JohnDoe"}

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["iam:ListAccessKeys","iam:GetAccessKeyLastUsed"],"Resource":"*"}

Question 4

A developer needs to deploy a serverless application using AWS CloudFormation. The application includes an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. The developer wants to create a stack that can be updated without downtime. Which CloudFormation feature should be used?

Accepted Answer

Change Sets. Change Sets allow you to preview how changes to your CloudFormation stack will affect your running resources before you apply them. By reviewing the change set, you can ensure that the update does not cause downtime, for example by replacing resources without interruptions. This makes Change Sets the appropriate feature for updating a stack without downtime.

Answer

Drift detection

Answer

StackSets

Answer

Nested stacks

Question 5

A developer ran the above CLI command to describe an EC2 instance. The instance is running but the developer cannot connect to it via SSH. Which additional step should the developer take to troubleshoot the connectivity issue?

Accepted Answer

Check the security group rules associated with the instance. Security group rules control inbound traffic to the instance. If the security group does not allow SSH (port 22) from the developer's IP, the connection will fail even if the instance is running and has a public IP. The describe-instances command output includes security group names and IDs, allowing the developer to verify the rules. Option A is wrong because a valid AMI does not guarantee network connectivity. Option B is wrong because the instance may have a public IP but still be unreachable if the security group blocks SSH. Option C is wrong because instance status checks indicate the OS and instance health, not network-level access.

Answer

Check the AMI ID to ensure it is a valid Linux AMI

Answer

Check the instance's network interfaces for a public IP

Answer

Check the instance status checks in the EC2 console

Question 6

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 7

A developer is building a serverless application that processes personally identifiable information (PII). The application uses API Gateway, Lambda, and DynamoDB. The developer needs to ensure that the PII is encrypted at rest in DynamoDB. The company already uses AWS KMS with a customer-managed key for other services. The developer wants to reuse the same KMS key for DynamoDB. After enabling encryption with the KMS key, the Lambda function fails to write to the table with an AccessDenied error. The Lambda execution role has dynamodb:PutItem permission. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.. When a DynamoDB table is encrypted with a customer-managed KMS key, any operation that reads or writes data to the table requires the caller to have permissions to use that KMS key. Even though the Lambda execution role has dynamodb:PutItem permission, the PutItem operation internally triggers KMS Encrypt and Decrypt calls to manage the encryption of the item. Without kms:Encrypt and kms:Decrypt permissions on the specific KMS key, the request fails with an AccessDenied error.

Answer

The Lambda execution role does not have DynamoDB write permissions.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The Lambda function is not in a VPC, so it cannot access the KMS key.

Question 8

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key. The command fails with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The IAM user 'DevUser' does not have the kms:Decrypt permission on the KMS key.. An AccessDeniedException indicates that the IAM identity (user or role) making the request lacks the required kms:Decrypt permission on the specified KMS key. KMS key policies and IAM policies must both allow the action for the call to succeed.

Answer

The ciphertext blob is not base64-encoded.

Answer

The KMS key is disabled.

Answer

The KMS key ID is incorrect.

Question 9

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Accepted Answer

The native library is compiled for a different operating system than Lambda (Amazon Linux).. AWS Lambda runs on Amazon Linux, which uses a different kernel and C runtime than typical local development environments (e.g., macOS or Windows). Native libraries compiled for a local OS will not be compatible with Lambda's execution environment, causing the 'Unable to import module' error. The developer must compile the native library on Amazon Linux or use a Lambda-compatible container to ensure binary compatibility.

Answer

The Lambda function's IAM role does not have permission to access the library.

Answer

The Lambda function's handler configuration is incorrect.

Answer

The Lambda function's timeout is too short.

Question 10

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Accepted Answer

Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.. Lambda aliases support traffic shifting for canary deployments by allowing you to route a percentage of incoming requests to a new function version while the majority continues to the current version. This is done by configuring the alias's routing configuration with a `RoutingConfig` that specifies the new version and the weight (e.g., 5%) of traffic it should receive. This enables gradual, controlled rollouts without modifying the API Gateway integration endpoint. Option C is also necessary because the API Gateway integration must point to the Lambda alias (rather than a fixed version) so that the routing configuration on the alias can take effect. Without updating the integration to use the alias, API Gateway would continue to invoke a specific version directly, bypassing the canary routing.

Answer

Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.

Answer

Update the Lambda function code and publish a new version.

Answer

Create a new API Gateway stage for the new version and update DNS.

Question 11

A developer is using AWS Lambda to process sensitive data. The Lambda function needs to access a DynamoDB table that is encrypted with a customer-managed CMK. The developer is using the default Lambda execution role. What must be done to allow Lambda to decrypt the DynamoDB table?

Accepted Answer

Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.. The DynamoDB table is encrypted with a customer-managed CMK. The Lambda execution role must be granted permission to use that key. This is done by adding a statement to the KMS key's key policy that allows the Lambda execution role to perform kms:Decrypt. DynamoDB will then perform the decryption on behalf of Lambda. Option A is incorrect because dynamodb:GetItem alone does not grant KMS decrypt permissions. Option C is incorrect because a VPC endpoint is not related to KMS permissions. Option D is incorrect because Lambda does not need to directly call the KMS Decrypt API; the key policy handles the authorization.

Answer

Add a policy to the Lambda execution role allowing dynamodb:GetItem.

Answer

Configure a VPC endpoint for DynamoDB.

Answer

Modify the Lambda function to call KMS Decrypt API.

Question 12

A developer is using AWS CodePipeline to automate the deployment of a web application. The developer wants to run unit tests after the source stage and before deploying to a staging environment. Which action should the developer add to the pipeline?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service to run unit tests in a CodePipeline because it provides a fully managed build environment that can execute test commands defined in a buildspec file. By adding a CodeBuild action to the pipeline after the source stage, the developer can run unit tests and fail the pipeline if tests do not pass, ensuring only validated code proceeds to the staging deployment.

Answer

AWS CodeCommit

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 13

A developer is running a Lambda function that uses the 'requests' library. The error shown in the exhibit occurs when invoking the function. Which step should the developer take to fix this?

Accepted Answer

Package the 'requests' library with the Lambda deployment package. The 'requests' library is not included in the AWS Lambda Python runtime by default. To use it, the developer must package the library as a dependency layer or include it in the deployment package. Option B correctly identifies this approach, ensuring the library is available at runtime.

Answer

Change the Lambda runtime to Python 3.9 which includes requests

Answer

Use the 'urllib' library instead of 'requests'

Answer

Install the 'requests' library using pip in the Lambda console

Question 14

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Accepted Answer

Configure automatic rollback based on CloudWatch alarms.. AWS CodeDeploy can automatically trigger a rollback when a CloudWatch alarm is breached, such as when error rates or latency exceed a threshold. This reduces the risk of a failed deployment by reverting to the last known good state without manual intervention. Option B is correct because a canary deployment shifts a small percentage of traffic to the new version first, allowing you to monitor for issues before routing all traffic, minimizing blast radius.

Answer

Disable health checks to prevent false positives.

Answer

Require a manual approval step before deployment.

Answer

Deploy to all instances at once to ensure consistency.

Question 15

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error message 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The developer checks the deployment logs and finds that the ApplicationStop hook failed on some instances. What is the most likely cause of this failure?

Accepted Answer

The ApplicationStop script is not compatible with the instance operating system or is missing.. The error message indicates that the ApplicationStop hook failed on some instances. The ApplicationStop hook is a lifecycle event that runs a script to stop the application before a new deployment begins. If the script is missing, incompatible with the instance's operating system, or has incorrect permissions, it will fail, causing the deployment to abort. This is the most direct cause of the failure described.

Answer

The ValidateService hook script is failing.

Answer

The BeforeInstall hook script is incorrectly configured.

Answer

The Auto Scaling group does not have enough capacity to perform the deployment.