DVA-C02 Practice Test 39 — 15 Questions

Question 1

Which THREE factors should a developer consider when choosing between a blue/green deployment and a rolling deployment for an Amazon ECS service?

Accepted Answer

Rolling deployments update a subset of tasks at a time, which may cause slower rollback. Rolling deployments in Amazon ECS update a subset of tasks at a time, which means if a rollback is needed, the deployment must reverse the updates incrementally, potentially taking longer than a blue/green deployment where traffic can be switched back instantly. This slower rollback is a key trade-off when choosing between the two strategies.

Answer

Rolling deployments require manual intervention to rollback

Answer

Blue/green deployments are always cheaper than rolling deployments

Question 2

What is required for the Lambda function to access the code in the S3 bucket?

Accepted Answer

The Lambda execution role must have s3:GetObject permission on the S3 bucket.. To allow a Lambda function to access AWS resources like an S3 bucket during its execution, it must assume an IAM execution role with the appropriate permissions. To read an object from S3, the execution role must have the `s3:GetObject` permission for the target bucket and object path.

Answer

The S3 bucket policy must grant access to the Lambda service.

Answer

The Lambda function must be in a VPC with an S3 VPC endpoint.

Answer

The S3 bucket must be configured as a static website with CloudFront.

Question 3

A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.. AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.

Answer

Encrypt the configuration file using AWS KMS and store the encrypted file on S3.

Answer

Store the credentials in environment variables on the EC2 instance.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.

Question 4

A developer is using AWS CodeCommit as a source repository and AWS CodePipeline for CI/CD. The developer wants to automatically trigger a pipeline execution when changes are pushed to the main branch. Which action should the developer take?

Accepted Answer

Create an Amazon CloudWatch Events rule that detects changes to the CodeCommit repository and triggers the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can detect CodeCommit repository state changes, such as push events to a specific branch, and automatically trigger a CodePipeline execution as a target. This is the recommended AWS-native approach for event-driven pipeline triggers without polling or manual webhook configuration.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute.

Answer

Set up a webhook in CodeCommit to notify CodePipeline on push events.

Answer

Use an SNS topic to send a notification to CodePipeline when a push occurs.

Question 5

A company is using AWS CodeBuild to compile a Java application. The build takes a long time because Maven dependencies are downloaded each time. How can the developer reduce build time?

Accepted Answer

Configure a cache in Amazon S3 for the Maven repository.. Configuring an Amazon S3 cache for the Maven repository allows CodeBuild to reuse previously downloaded dependencies across builds, eliminating the need to re-download them each time. This significantly reduces build time by leveraging the local cache stored in S3, which is a best practice for dependency-heavy builds like Java applications with Maven.

Answer

Use a higher compute type for the build project.

Answer

Use a custom AMI with pre-installed dependencies.

Answer

Increase the timeout value for the build.

Question 6

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.

Question 7

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS. AWS Cloud Map provides service discovery by registering ECS service instances with DNS-based or API-based resolution, enabling dynamic routing between microservices. AWS App Mesh with mutual TLS (mTLS) encrypts traffic between services and enforces identity-based authentication, ensuring end-to-end encryption and secure communication. This combination directly addresses the requirements for service discovery and encrypted traffic.

Answer

Use Amazon API Gateway and AWS Lambda

Answer

Use Amazon Route 53 private hosted zones and enable DNSSEC

Answer

Use an Application Load Balancer for each service and enable TLS termination

Question 8

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails in CodeBuild with the error 'BUILD FAILED: Unable to find a Java installation.' The buildspec.yml file includes a 'runtime-versions' section specifying Java 11. The CodeBuild project uses the 'aws/codebuild/amazonlinux2-x86_64-standard:4.0' image. What is the MOST likely cause of the failure?

Accepted Answer

The runtime-versions section in buildspec.yml is not correctly formatted.. The error 'Unable to find a Java installation' indicates that the CodeBuild environment does not have Java available at runtime. When using a standard managed image like 'aws/codebuild/amazonlinux2-x86_64-standard:4.0', Java must be explicitly declared in the 'runtime-versions' section of buildspec.yml. The most likely cause is that the 'runtime-versions' section is incorrectly formatted (e.g., using 'java: 11' instead of the correct 'java: corretto11'), causing CodeBuild to skip installing Java.

Answer

The CodeBuild project does not have sufficient permissions to download Java.

Answer

The buildspec.yml file is not in the root of the source directory.

Answer

The build commands reference a non-existent Maven dependency.

Question 9

A developer notices that an S3 bucket used for static website hosting returns 403 Forbidden for anonymous requests. The bucket policy allows s3:GetObject for Principal "*". What is the most likely issue?

Accepted Answer

The S3 Block Public Access settings are enabled.. D is correct because S3 Block Public Access settings, when enabled at the account or bucket level, override any bucket policy or ACL that grants public access. Even though the bucket policy allows s3:GetObject for Principal "*", the Block Public Access settings explicitly deny all public requests, resulting in a 403 Forbidden error for anonymous users.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket ACL does not allow public read.

Answer

The bucket policy is not attached to the correct bucket.

Question 10

A developer is deploying a static website to Amazon S3. The website uses client-side JavaScript to make API calls to an AWS Lambda function via Amazon API Gateway. The developer wants to enable cross-origin resource sharing (CORS) on the API Gateway to allow the S3 website to make requests. After enabling CORS on the API Gateway and redeploying the API, the browser still reports CORS errors. The developer checks the API Gateway configuration and sees that the OPTIONS method is not defined. The developer has already enabled CORS via the API Gateway console, which should have created the OPTIONS method. However, it did not appear. What should the developer do to resolve the issue?

Accepted Answer

Manually add an OPTIONS method to the API Gateway resource and configure the CORS headers in the integration response.. When API Gateway's CORS console feature fails to create the OPTIONS method (often due to permissions, resource policy conflicts, or the resource already having a mock integration), the developer must manually create an OPTIONS method on the resource, set the integration type to MOCK, and configure the integration response with the Access-Control-Allow-Origin, Access-Control-Allow-Headers, and Access-Control-Allow-Methods headers. The browser's preflight request (OPTIONS) must receive those headers before the actual GET/POST is sent, so a missing OPTIONS method guarantees CORS failure regardless of what the backend returns.

Answer

Update the JavaScript in the website to use a different HTTP method.

Answer

Update the S3 bucket policy to allow cross-origin requests from any origin.

Answer

Modify the Lambda function to return CORS headers in its response.

Question 11

A developer is using CloudFront to serve content from an S3 bucket. The bucket contains sensitive data and should only be accessible through CloudFront. How can the developer enforce this?

Accepted Answer

Create an origin access identity (OAI) and grant it read access in the bucket policy.. An Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant read access only to that OAI, you ensure that content can only be retrieved via CloudFront, not directly from the S3 endpoint. This enforces the requirement that the bucket is accessible exclusively through CloudFront.

Answer

Set the bucket policy to allow access only from CloudFront IP addresses.

Answer

Set the bucket policy to allow access only from AWS services.

Answer

Set the bucket policy to allow public read access and use CloudFront signed URLs.

Question 12

Refer to the exhibit. A developer invoked a Lambda function and received this response. What does the FunctionError field indicate?

Accepted Answer

The function threw an unhandled exception.. FunctionError: Unhandled indicates that the function threw an exception that was not caught by the code. Option A is wrong because StatusCode 200 means invocation succeeded. Option C is wrong because throttling would return 429. Option D is wrong because configuration errors would return 400.

Answer

The function executed successfully.

Answer

The function was throttled.

Answer

The function timed out.

Question 13

A developer receives an Access Denied error when trying to download an object from an S3 bucket. The developer's IAM policy is shown in the exhibit. The bucket policy also grants access. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.. If the bucket is encrypted with a KMS key, the user must also have kms:Decrypt permission. Option A is wrong because the policy explicitly allows s3:GetObject. Option C is wrong because the bucket policy also grants access, so it's not a bucket policy issue. Option D is wrong because public access is not required if IAM policies allow access.

Answer

The S3 bucket has block public access enabled.

Answer

The IAM policy does not allow s3:GetObject.

Answer

The bucket policy denies access to the user.

Question 14

A development team wants to automate the deployment of a microservices application on Amazon ECS with Fargate. The team uses AWS CodePipeline for CI/CD. Each microservice has its own source repository and Dockerfile. The team wants to build Docker images, push them to Amazon ECR, and deploy them to ECS. Which approach minimizes manual effort and follows best practices?

Accepted Answer

Use AWS CodePipeline with a build stage in CodeBuild and a deploy stage that uses the ECS deploy provider.. AWS CodePipeline provides a fully automated CI/CD pipeline. With the ECS deploy provider, CodePipeline can update the ECS service with the new task definition directly, eliminating manual steps. Option A is incorrect because adding CodeDeploy for blue/green deployments introduces unnecessary complexity for a basic ECS deployment; the ECS deploy provider in CodePipeline handles it without additional services. Option B is incorrect because it requires manual triggering of CloudFormation updates, which does not achieve full automation. Option D is incorrect because it requires manual intervention to update the ECS service, contradicting the goal of minimizing manual effort.

Answer

Use AWS CodeDeploy to deploy to ECS with a blue/green deployment.

Answer

Use AWS CloudFormation to create the infrastructure and manually trigger updates.

Answer

Use AWS CodeBuild to build and push images, then manually update the ECS service.

Question 15

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a 'OneAtATime' deployment configuration. The developer notices that the deployment is taking a long time. What is the most likely reason?

Accepted Answer

The Auto Scaling group has a large number of instances, and deploying one at a time is slow.. The 'OneAtATime' deployment configuration deploys to one instance at a time, so if the Auto Scaling group has a large number of instances, the deployment will take a long time. Option A is incorrect because the load balancer configuration does not directly affect deployment speed when using 'OneAtATime'. Option C is incorrect because the deployment configuration is correctly set to 'OneAtATime', not 'AllAtOnce'. Option D is incorrect because if the CodeDeploy agent were not running, the deployment would likely fail entirely, not just be slow.

Answer

The deployment group is configured with an incorrect load balancer.

Answer

The deployment configuration is set to 'AllAtOnce', but the developer intended 'OneAtATime'.

Answer

The CodeDeploy agent on the instances is not running.