DVA-C02 Practice Test 40 — 15 Questions

Question 1

A company is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for configuration. The development team wants to ensure that the environment variables are not exposed in the source code or in the deployment logs. Which TWO actions should the team take? (Choose TWO.)

Accepted Answer

Store sensitive environment variables in AWS Systems Manager Parameter Store and retrieve them at runtime.. Options A and D are correct: Using AWS Systems Manager Parameter Store or Secrets Manager to store environment variables and retrieving them at runtime prevents exposure. Option B (environment properties) stores them in plaintext in the environment configuration. Option C (logging) is not relevant. Option E (environment variables in source) is bad practice.

Answer

Enable detailed logging for the Elastic Beanstalk environment and filter out sensitive data.

Answer

Set environment variables using Elastic Beanstalk environment properties in the console.

Answer

Embed the environment variables in the application package as a .env file.

Question 2

A company is using AWS CloudFormation to deploy a stack with a Lambda function and an API Gateway REST API. The deployment must be updated without downtime. The current stack has a Lambda function with an alias 'prod'. Which THREE steps should the developer take to achieve a zero-downtime deployment? (Choose THREE.)

Accepted Answer

Create a new Lambda function version and assign it to a new alias 'blue'.. Options A, C, and E are correct: Using a second alias for the new version, updating the API Gateway stage to point to the new alias, and then switching traffic gradually. Option B (changing alias directly) causes downtime. Option D (deleting old version) is not part of update.

Answer

Update the existing 'prod' alias to point to the new function version.

Answer

Delete the old Lambda function version after the update.

Question 3

A company uses AWS CodeBuild to compile and test a Java application. The build process takes a long time because dependencies are downloaded every time. Which TWO actions can reduce build time? (Choose TWO.)

Accepted Answer

Enable local caching in the CodeBuild project to reuse dependency files between builds.. Options A and D are correct: Caching dependencies in a local cache or in S3 reduces download time. Option B (increase compute) does not reduce dependency download. Option C (parallel builds) is for multiple builds. Option E (change runtime) is not relevant.

Answer

Increase the compute type of the build environment to have more CPU and memory.

Answer

Change the build runtime to a language that compiles faster.

Answer

Configure the build project to run builds in parallel.

Question 4

A developer is writing a Lambda function that needs to access an RDS database. The function currently fails with a timeout. What is the most likely cause?

Accepted Answer

The Lambda function is not in the same VPC as the RDS instance. If the Lambda function is in a VPC without a proper VPC configuration (NAT Gateway or VPC endpoints), it cannot access the RDS database. Option A is possible but less likely than network issues. Option C (wrong permissions) would cause access denied, not timeout. Option D (cold start) would not cause a timeout to RDS.

Answer

The Lambda function has a cold start delay

Answer

The RDS instance is not publicly accessible

Answer

The Lambda function does not have an IAM role granting RDS access

Question 5

A developer receives the above error when trying to launch an EC2 instance. What is the most likely cause?

Accepted Answer

An SCP at the organizational level denies ec2:RunInstances. The error message explicitly mentions a service control policy (SCP) that denies the action. SCPs are applied at the organizational level. Option A is incorrect because IAM policy would not mention SCP. Option C is incorrect because the error is about authorization, not service limits. Option D is incorrect because the error does not mention VPC.

Answer

The account has reached its EC2 instance limit

Answer

The developer is trying to launch the instance in a restricted VPC

Answer

The developer's IAM policy does not allow ec2:RunInstances

Question 6

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. Which AWS service can the developer use to analyze the database queries and identify the root cause?

Accepted Answer

Amazon RDS Performance Insights. Option B is correct because Performance Insights provides database performance analysis with query-level metrics. Option A is wrong because CloudWatch Logs is for log data, not query analysis. Option C is wrong because X-Ray traces application requests, not database queries. Option D is wrong because Trusted Advisor provides cost and security checks, not query analysis.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 7

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

Accepted Answer

aws lambda update-function-code. The correct answer is B. The update-function-code command updates the code of a Lambda function. Option A (update-function-configuration) updates configuration settings only. Option C (create-function) is for creating a new function, not updating. Option D (invoke) is for invoking the function.

Answer

aws lambda update-function-configuration

Answer

aws lambda invoke

Answer

aws lambda create-function

Question 8

A company wants to encrypt data at rest in Amazon S3. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Option C is correct because AWS KMS manages encryption keys for S3 SSE-KMS. Option A is wrong because CloudHSM is for hardware-based key management but not directly integrated with S3. Option B is wrong because IAM is for access control, not key management. Option D is wrong because ACM is for SSL/TLS certificates.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 9

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. Option B is correct because a Deny statement for ec2:TerminateInstances will explicitly block termination, overriding any Allow. Option A is wrong because it allows termination. Option C is wrong because it allows both. Option D is wrong because ec2:RebootInstances is unrelated.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

Question 10

A developer runs the commands above. The key is disabled. An application that uses this key to encrypt S3 objects starts failing. What should the developer do to fix the issue?

Accepted Answer

Enable the KMS key. The key is disabled, so enabling it will restore functionality. Option A (create new key) would require updating the application. Option B (rotate key) is not necessary. Option D (delete key) would make things worse.

Answer

Delete the key and recreate it

Answer

Create a new KMS key and update the application to use it

Answer

Enable automatic key rotation

Question 11

A developer is creating a new IAM policy to allow an application to read objects from a specific S3 bucket and write logs to a CloudWatch log group. Which policy statement is correct?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","logs:CreateLogStream","logs:PutLogEvents"],"Resource":["arn:aws:s3:::my-bucket/*","arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:*"]}. Option D is correct because it grants both s3:GetObject on the bucket and logs:CreateLogStream and logs:PutLogEvents on the log group. Option A is wrong because it uses s3:ListBucket instead of s3:GetObject. Option B is wrong because it uses s3:PutObject instead of GetObject. Option C is wrong because it uses ec2:DescribeInstances which is irrelevant.

Answer

{"Effect":"Allow","Action":["ec2:DescribeInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 12

A developer is building a serverless application using AWS Lambda and needs to securely store database credentials. Which AWS service should be used to store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed to securely store and automatically rotate secrets such as database credentials. Option A is wrong because SSM Parameter Store can store parameters but lacks automatic rotation. Option C is wrong because KMS is for encryption keys, not credential storage. Option D is wrong because CloudFormation is for infrastructure as code.

Answer

AWS CloudFormation

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 13

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'ScriptMissing' error. What is the most likely cause?

Accepted Answer

The lifecycle event hook script referenced in appspec.yml is not present.. The correct answer is D. CodeDeploy requires a scripts directory with lifecycle event hooks. If the appspec.yml references a script that is missing, the deployment fails with ScriptMissing. Option A is incorrect because CodeDeploy does not require a buildspec.yml. Option B is incorrect because the deployment group can be for an ASG. Option C is incorrect because the revision must be in a bucket in the same region.

Answer

The deployment group is not configured for an Auto Scaling group.

Answer

The buildspec.yml file is missing from the application root.

Answer

The application revision is not stored in an S3 bucket.

Question 14

A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?

Accepted Answer

Enable automatic key rotation in the KMS key settings. For customer managed KMS keys, automatic rotation can be enabled in the key management console or via the AWS CLI. Option A is incorrect because automatic rotation is not automatic for customer managed keys; it must be enabled. Option C is incorrect because rotation does not require creating a new key. Option D is incorrect because AWS managed keys rotate automatically, but customer managed keys require enabling rotation.

Answer

Use AWS managed keys instead of customer managed keys

Answer

Rotation is enabled by default for all KMS keys

Answer

Create a new key and update the alias to point to the new key annually

Question 15

An application running on EC2 needs to access an S3 bucket. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance. Using an IAM role attached to the EC2 instance is the most secure because it provides temporary credentials and avoids hardcoding keys. Option B (IAM user keys on the instance) is less secure. Option C (bucket policy with public access) is insecure. Option D (pre-signed URLs) is not suitable for ongoing access.

Answer

Generate an IAM user access key and store it in a file on the instance

Answer

Use pre-signed URLs for each request

Answer

Make the S3 bucket public