DVA-C02 Practice Test 40 — 15 Questions

Question 1

A developer is deploying an application using AWS Elastic Beanstalk. The developer wants to ensure that the application is highly available and can recover from an AZ failure. Which TWO configurations should be applied? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the environment to use multiple Availability Zones.. Options A and D are correct. A: Deploying to multiple Availability Zones ensures that if one AZ fails, the application remains available. D: An Elastic Load Balancer distributes traffic across instances in multiple AZs, improving fault tolerance. Option B is incorrect because selecting a larger EC2 instance type increases compute capacity but does not provide AZ redundancy. Option C is incorrect because enabling Multi-AZ for an RDS database improves database availability, but the question asks about application-level high availability; it does not address the compute tier. Option E is incorrect because using a single EC2 instance creates a single point of failure and does not ensure high availability.

Answer

Select a larger EC2 instance type.

Answer

Enable Multi-AZ for the application's Amazon RDS database.

Answer

Use a single EC2 instance for simplicity.

Question 2

A developer deploys a new version of an AWS Lambda function using the AWS CLI. After deployment, the function returns stale results. What is the most likely cause?

Accepted Answer

The Lambda function alias is still pointing to the previous version.. When a developer deploys a new version of a Lambda function using the AWS CLI without updating the function alias, the alias continues to point to the previous version. Invoking the function via the alias (e.g., via an API Gateway endpoint or a CloudFront origin) will execute the old code, returning stale results. The `$LATEST` version is updated, but unless the alias is repointed, it does not automatically use the new code.

Answer

The function's environment variables are cached and not updated.

Answer

The Amazon CloudFront distribution is caching the old response.

Answer

The Lambda function's code is cached by the Lambda service.

Question 3

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function is configured to access a VPC without a NAT gateway.. Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts. Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Answer

The function's reserved concurrency is set to 0.

Answer

The function has a dead-letter queue configured.

Question 4

A company has an Amazon S3 bucket that stores sensitive documents. The security team wants to ensure that all GET requests to the bucket are authenticated and that the requester does not have public access. Which combination of S3 features should the developer implement?

Accepted Answer

Block public access and enable S3 Access Points with a network origin policy. Blocking public access at the bucket level ensures that no anonymous or public requests can reach the bucket, while S3 Access Points with a network origin policy restrict access to requests originating from a specific VPC or on-premises network. This combination enforces that all GET requests must be authenticated (via the Access Point's IAM policies) and cannot come from public internet sources, meeting the security team's requirements.

Answer

Enable S3 Object Lock and versioning

Answer

Use S3 Transfer Acceleration and server-side encryption

Answer

Configure a bucket policy that allows only specific IAM users and enable MFA Delete

Question 5

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.

Question 6

A company stores sensitive data in Amazon S3. A developer needs to implement a solution that automatically encrypts objects at rest using a key that is rotated annually. The developer must minimize operational overhead. Which solution meets these requirements?

Accepted Answer

Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with automatic key rotation.. SSE-KMS with automatic key rotation meets the requirement for annual key rotation with minimal operational overhead because AWS KMS can automatically rotate the customer master key (CMK) every year (365 days) without any manual intervention. This ensures that objects in S3 are encrypted at rest using a key that is rotated on schedule, while the developer does not need to manage the rotation process.

Answer

Use Server-Side Encryption with S3-Managed Keys (SSE-S3) and set key rotation policy.

Answer

Use Server-Side Encryption with Customer-Provided Keys (SSE-C) and manually rotate keys.

Answer

Use Client-Side Encryption with KMS.

Question 7

A company is using AWS KMS to encrypt sensitive data stored in S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants the role the kms:Decrypt permission.. KMS key policies are the most direct and secure way to control who can perform cryptographic operations like kms:Decrypt on a specific CMK. By granting only the specific IAM role the kms:Decrypt permission in the key policy, you ensure that no other principal (including the root user or other roles) can decrypt the data, even if they have S3 access. This follows the principle of least privilege and decouples data access from infrastructure access.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3).

Answer

Enable automatic key rotation for the KMS key.

Answer

Use an S3 bucket policy to restrict access to the role.

Question 8

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 30 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a rotation schedule (e.g., every 30 days) without custom infrastructure. This service integrates directly with Amazon RDS, Redshift, and DocumentDB for seamless credential rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Question 9

A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The developer notices that the function is processing records slowly, and the iterator age is increasing. CloudWatch Logs show that the function is not experiencing errors or throttling, but the execution time per invocation is close to the 5-minute timeout. The stream has 10 shards. What is the most cost-effective way to increase processing throughput?

Accepted Answer

Increase the parallelization factor to 10. Increasing the parallelization factor to 10 allows each shard to be processed by up to 10 concurrent Lambda invocations, which directly increases throughput without additional shard costs. Since the function is not throttled or erroring, the bottleneck is the per-invocation processing time; parallelization reduces the iterator age by processing multiple batches per shard simultaneously.

Answer

Increase the batch size to 1000

Answer

Increase the memory of the Lambda function

Answer

Split the stream into more shards

Question 10

A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals AES256. The condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals alias/aws/s3

Answer

aws:SecureTransport equals true

Answer

s3:object-lock-mode equals GOVERNANCE

Question 11

An IAM policy is attached to an EC2 instance role. The instance is part of a CodeDeploy deployment group. The deployment fails because the CodeDeploy agent cannot download the revision. What is the most likely reason?

Accepted Answer

The policy does not allow s3:GetObject on the specific bucket where the revision is stored.. The CodeDeploy agent on the EC2 instance downloads the application revision from an S3 bucket. For this to succeed, the IAM role attached to the instance must include an s3:GetObject permission on the specific bucket and object. Without it, the agent cannot retrieve the revision file, causing the deployment to fail. Options A and B are irrelevant because the agent does not call CodeDeploy API actions like GetDeployment or CreateDeployment; those are used by the user or CI/CD pipeline initiating the deployment. Option C is incorrect because IAM policies for S3 actions do not require a region in the resource ARN.

Answer

The policy does not allow the codedeploy:GetDeployment action.

Answer

The policy does not allow the codedeploy:CreateDeployment action.

Answer

The policy does not specify a region in the resource ARN.

Question 12

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Accepted Answer

An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role. Cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.

Answer

An S3 bucket policy granting access to the external account

Answer

An IAM user policy in the external account allowing sts:AssumeRole

Answer

An AWS Organizations service control policy allowing cross-account access

Question 13

A developer is creating an AWS Lambda function that needs to access files from an Amazon EFS file system. The Lambda function must be configured to access the VPC. Which of the following is required to allow the Lambda function to mount the EFS file system?

Accepted Answer

The Lambda function must have the AWSLambdaVPCAccessExecutionRole managed policy attached.. The AWSLambdaVPCAccessExecutionRole managed policy provides the necessary permissions for Lambda to manage elastic network interfaces (ENIs) in a VPC, which is required for Lambda to connect to an EFS file system via mount targets. Without this policy, the Lambda function cannot create or manage the ENI needed to route traffic to the EFS mount target within the VPC.

Answer

The Lambda function must be in the same Availability Zone as the EFS mount target.

Answer

The Lambda function must have the AmazonElasticFileSystemClientReadWriteAccess managed policy attached.

Answer

The Lambda function must have the efs:MountFileSystem permission in its execution role.

Question 14

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 15

A company uses AWS CodeBuild to run tests and build artifacts for a Java application. The build process is taking longer than expected. The developer wants to speed up the build by caching dependencies. What should the developer do?

Accepted Answer

Enable local caching in the CodeBuild project configuration.. CodeBuild's local caching feature allows the build environment to cache dependencies (e.g., Maven local repository) in a local directory that persists across build runs for the same project. This eliminates the need to re-download dependencies on every build, significantly reducing build time. The cache is stored on the build instance's local storage and is automatically managed by CodeBuild.

Answer

Use a CodeCommit repository to store dependencies.

Answer

Store dependencies in an S3 bucket and download them in each build.

Answer

Mount an Amazon EFS file system to the build environment and store dependencies there.