DVA-C02 Practice Test 40 — 15 Questions

Question 1

A development team uses AWS Elastic Beanstalk to deploy a containerized application. They notice that after a successful deployment, the environment's health turns from Green to Red. The application logs show no errors. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ELB health check endpoint returns a 503 status code after the new version is deployed.. After a successful deployment, the environment turns Red if the ELB health check endpoint returns a non-200 status (e.g., 503) on the new version. Elastic Beanstalk uses ELB health checks to determine environment health; if the health check fails, the environment health changes to Red even if application logs show no errors. Option B is incorrect because a missing environment variable typically causes deployment failure or immediate instance health issues, not a post-deployment health change. Option C is incorrect because Docker image incompatibility with the platform version would cause deployment failure or instance launch failure, not a health change after successful deployment. Option D is incorrect because a low Auto Scaling minimum instance count does not directly affect health status after a successful deployment; it would affect scaling behavior.

Answer

The deployment failed due to a missing environment variable.

Answer

The application's Docker image is not compatible with the platform version.

Answer

The Auto Scaling group's minimum instance count is too low.

Question 2

A developer needs to allow an IAM user to stop and start EC2 instances but not terminate them. Which IAM policy effect and action combination should be used?

Accepted Answer

Allow ec2:StopInstances and ec2:StartInstances. It explicitly allows ec2:StopInstances and ec2:StartInstances, which grants the needed permissions without allowing ec2:TerminateInstances. Option B is incorrect because it includes ec2:TerminateInstances, which would allow termination, contrary to the requirement. Option C is incomplete: although it denies ec2:TerminateInstances, it does not allow ec2:StopInstances or ec2:StartInstances, so the user would not have the required start/stop permissions. Option D is incorrect because it allows ec2:TerminateInstances.

Answer

Allow ec2:StopInstances, ec2:StartInstances, and ec2:TerminateInstances

Answer

Deny ec2:TerminateInstances

Answer

Allow ec2:StartInstances and ec2:TerminateInstances

Question 3

A developer needs to grant an IAM user the ability to create and manage CloudFormation stacks. Which IAM policy action should be allowed?

Accepted Answer

cloudformation:CreateStack. Option A (cloudformation:CreateStack). This action allows the IAM user to create and manage CloudFormation stacks. Option B (lambda:CreateFunction) is for creating Lambda functions, option C (ec2:RunInstances) is for launching EC2 instances, and option D (s3:CreateBucket) is for creating S3 buckets. None of these other actions are related to CloudFormation stack management.

Answer

lambda:CreateFunction

Answer

ec2:RunInstances

Answer

s3:CreateBucket

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer. The security team discovers that the application is vulnerable to SQL injection attacks. The team wants to implement a web application firewall (WAF) to block these attacks. The architecture includes an ALB, EC2 instances in an Auto Scaling group, and an RDS database. The ALB currently has a listener on port 443 with an SSL certificate. The developer must integrate AWS WAF with minimal changes to the existing infrastructure. Which action should the developer take?

Accepted Answer

Associate AWS WAF directly with the Application Load Balancer.. AWS WAF can be directly associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS requests and block SQL injection attacks. This requires minimal changes to the existing infrastructure because no additional components like CloudFront or agents are needed. Option A is incorrect because AWS Shield Advanced is a DDoS protection service, not a WAF, and does not include SQL injection rules. Option B is incorrect because WAF is a managed service that operates at the edge or load balancer level, not as an agent on EC2 instances. Option C is incorrect because while you could place CloudFront in front of the ALB and attach WAF to CloudFront, it adds unnecessary complexity and cost when the ALB already supports direct WAF association.

Answer

Subscribe to AWS Shield Advanced and enable automatic mitigation.

Answer

Install a WAF agent on each EC2 instance in the Auto Scaling group.

Answer

Place a CloudFront distribution in front of the ALB and associate WAF with CloudFront.

Question 5

Which THREE factors should a developer consider when designing a stateless application on AWS? (Choose 3)

Accepted Answer

Avoid storing data on the local file system of the instances. A stateless application should not store session state locally, so option A is correct. Session state should be stored in an external shared datastore like ElastiCache (option B) or a shared database like DynamoDB (option E). Storing state in instance memory (C) or using sticky sessions (D) would introduce statefulness, which is not desired in a stateless architecture.

Answer

Store session state in the instance memory for low latency

Answer

Use sticky sessions on the load balancer to maintain session affinity

Question 6

A company is using Amazon Cognito for user authentication. The developers need to add multi-factor authentication (MFA) for security. Which Cognito feature should be enabled?

Accepted Answer

Cognito User Pools with MFA configuration. Amazon Cognito User Pools support multi-factor authentication (MFA) configurations, including SMS and TOTP. Option A is incorrect because Cognito Sync is used for synchronizing user data across devices, not for authentication or MFA. Option C is incorrect because Developer Authenticated Identities is a feature for custom authentication flows, not directly for enabling MFA. Option D is incorrect because Cognito Identity Pools provide federated identities for accessing AWS resources, but MFA is configured at the User Pool level.

Answer

Cognito Sync

Answer

Cognito Developer Authenticated Identities

Answer

Cognito Identity Pools

Question 7

A company is designing a secure CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The pipeline must securely store and access sensitive parameters (e.g., API keys) used during the build. Which TWO services can be used to securely store and retrieve these parameters?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store secrets and can be accessed by CodeBuild via IAM roles.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS) alone

Answer

AWS CloudFormation parameter store

Question 8

A company is using AWS CodePipeline for CI/CD. The pipeline has a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The deployment is failing with 'Error: Health checks failed'. Which TWO steps should the developer take to troubleshoot this issue? (Select TWO.)

Accepted Answer

Verify that the target group's health check path and port are correctly configured.. Options A and C are correct. Verifying the target group's health check path and port (A) ensures that the load balancer's health check matches the application's actual endpoint, which is a common cause of health check failures. Checking the CodeDeploy deployment logs (C) provides detailed error messages from the deployment process, which can pinpoint why the health checks are failing. Option B (checking S3 bucket) is not directly related to health check failures, as artifacts are typically stored correctly if the build succeeded. Option D (checking CodeBuild logs) is irrelevant because the build stage succeeded. Option E (increasing instances) does not address the root cause of health check failures.

Answer

Check the S3 bucket where the build artifacts are stored.

Answer

Check the CodeBuild build logs for errors.

Answer

Increase the number of EC2 instances in the Auto Scaling group.

Question 9

A developer is building a RESTful API using Amazon API Gateway and AWS Lambda. The API needs to support custom domain names with SSL/TLS certificates. The developer has created the custom domain name in API Gateway and uploaded the certificate to AWS Certificate Manager (ACM) in the same region. However, when accessing the custom domain, users get an SSL error. What is the most likely cause?

Accepted Answer

The custom domain name's DNS record does not point to API Gateway's regional domain name.. The most likely cause is that the custom domain name's DNS record does not point to API Gateway's regional domain name. When using a custom domain name with API Gateway, you must create a DNS record (typically a CNAME or A record using Route 53 alias) that maps your custom domain to the API Gateway-generated regional domain name (e.g., d-xxxxx.execute-api.region.amazonaws.com). Without this correct DNS mapping, the SSL/TLS handshake fails because the certificate presented by API Gateway does not match the domain name the client is connecting to, resulting in an SSL error.

Answer

The certificate was not issued by a trusted certificate authority.

Answer

The API Gateway API is not deployed to a stage that is mapped to the custom domain name.

Answer

The certificate is in the wrong region relative to the API Gateway regional endpoint.

Question 10

A developer is designing a serverless application that processes user-uploaded images. The images are uploaded to an S3 bucket, which triggers a Lambda function to create a thumbnail and store metadata in DynamoDB. The thumbnail creation is CPU-intensive and can take up to 10 seconds. The developer wants to minimize costs and ensure that the thumbnail is created as soon as possible. Which approach should the developer choose?

Accepted Answer

Use S3 event notifications to directly invoke the Lambda function.. S3 event notifications directly invoke the Lambda function asynchronously, which is the simplest, fastest, and most cost-effective approach for this use case. The Lambda function's 15-minute timeout easily accommodates the 10-second thumbnail creation, and direct invocation eliminates the cost and latency of additional intermediate services like SQS or Step Functions, ensuring the thumbnail is processed as soon as the image is uploaded.

Answer

Use AWS Step Functions to orchestrate the Lambda function and DynamoDB update.

Answer

Use an ECS Fargate task to process the images, triggered by S3 events.

Answer

Use an SQS queue between S3 and Lambda to buffer requests.

Question 11

A developer is using an S3 bucket to store sensitive files. The bucket policy includes a condition that requires TLS for all requests. A user reports that they can access the bucket via the AWS Management Console but not via an application using HTTP. What is the likely issue?

Accepted Answer

The bucket policy denies HTTP requests via aws:SecureTransport condition.. The condition aws:SecureTransport requires HTTPS; the application uses HTTP, which violates the policy.

Answer

The application is using an expired IAM access key.

Answer

The S3 bucket is in a different region.

Answer

The application is not signing requests with Signature Version 4.

Question 12

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the BeforeInstall lifecycle event. What should the developer do to troubleshoot the issue?

Accepted Answer

Check the appspec.yml file for errors in the BeforeInstall hook.. The BeforeInstall hook scripts are defined in the appspec.yml file, and a failure during that lifecycle event typically indicates an error in the script or the hook configuration. Option A is wrong because the deployment group configuration (e.g., Auto Scaling group, tags) does not directly cause a script failure in the BeforeInstall hook. Option B is wrong because the build output from CodeBuild is already successful and not related to the deployment failure. Option D is wrong because deployment configuration settings (e.g., deployment type, rollback triggers) do not affect the execution of the BeforeInstall hook scripts.

Answer

Check the deployment group configuration.

Answer

Verify the build output from CodeBuild.

Answer

Review the deployment configuration settings.

Question 13

A developer uses AWS SAM (Serverless Application Model) to define a serverless application. The developer wants to run the application locally for testing. Which AWS SAM CLI command should be used?

Accepted Answer

sam local start-api. `sam local start-api` starts a local HTTP server that emulates the API Gateway endpoint and invokes your Lambda functions defined in the SAM template. This allows you to test API requests and responses locally without deploying to AWS, making it the appropriate command for local testing of a serverless application.

Answer

sam build

Answer

sam deploy

Answer

sam package

Question 14

A company stores sensitive customer data in Amazon S3. The security policy requires that all data be encrypted at rest using server-side encryption with a customer-managed AWS KMS key. Which S3 server-side encryption option should the developer use?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it provides server-side encryption with a customer-managed AWS KMS key, allowing the company to control key rotation, access policies, and audit usage via AWS CloudTrail. This meets the security policy requirement for encryption at rest using a customer-managed key, which SSE-S3 (using AWS-managed keys) and SSE-C (using customer-provided keys) do not fulfill.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 15

Match each AWS service to its port number (if applicable).

Accepted Answer

Amazon RDS (MySQL engine): 3306. Default ports are important for configuring security groups and connecting to databases.

Answer

Amazon RDS (MySQL engine): 5439

Answer

Amazon Redshift: 3306