DVA-C02 Practice Test 41 — 15 Questions

Question 1

A company is deploying a web application on EC2 instances behind an ALB. The application needs to authenticate users using a corporate identity provider that supports SAML 2.0. Which of the following are required to configure this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Obtain the IdP's metadata document to configure the trust.. Options A, B, and E are correct. To enable SAML authentication on an ALB, you need the IdP's metadata to establish trust (A), register the IdP in IAM as a SAML identity provider (B), and configure an ALB listener rule that uses that provider for authentication (E). Option C is incorrect because Amazon Cognito is not required; the ALB can directly authenticate against the SAML IdP. Option D is incorrect because Route 53 is a DNS service and is not involved in SAML authentication.

Answer

Configure Amazon Cognito as an intermediary.

Answer

Register the corporate IdP in Amazon Route 53.

Question 2

A developer is building an application that needs to read a secret API key from AWS Secrets Manager. The application runs on an EC2 instance that is part of an Auto Scaling group. The developer wants to ensure that only this application can retrieve the secret. Which set of steps should the developer take?

Accepted Answer

Store the secret in Secrets Manager, attach an IAM role to the EC2 instance that grants permission to read the secret, and configure the application to retrieve the secret using the AWS SDK. It follows the principle of least privilege and uses IAM roles, which are the secure and recommended way to grant EC2 instances permissions to access AWS Secrets Manager. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret using the AWS SDK without embedding long-term credentials in code or configuration files. This ensures that only instances with that role can read the secret, and the credentials are automatically rotated by AWS.

Answer

Store the secret in Secrets Manager, create an IAM user with a policy to read the secret, and embed the user's credentials in the application code

Answer

Store the secret as an environment variable in the EC2 user data

Answer

Store the secret in a configuration file on the instance and restrict file permissions

Question 3

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 4

A developer is optimizing a DynamoDB table for a gaming leaderboard. The table stores player scores and is read-heavy. Queries often fetch the top 10 scores. Which indexing strategy best reduces RCU consumption?

Accepted Answer

Create a global secondary index with score as the sort key.. A global secondary index (GSI) with score as the sort key allows efficient retrieval of the top 10 scores by querying the index in descending order, reading only the required items. This minimizes read capacity unit (RCU) consumption compared to scanning the base table, as each query reads exactly 10 items (or fewer) rather than consuming RCUs for a full table scan or filtering large result sets.

Answer

Create a sparse index on player ID.

Answer

Use a local secondary index on score.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Question 5

A developer needs to securely store database credentials for a serverless application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials, and it enforces encryption at rest using AWS KMS. For a serverless application, Secrets Manager provides a simple API call (e.g., GetSecretValue) to retrieve credentials without hardcoding them in code or environment variables.

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Answer

AWS Systems Manager Parameter Store

Question 6

A developer is using AWS CodeDeploy with a blue/green deployment strategy to update an application running on Amazon ECS with the Fargate launch type. After the new (green) task set is created and traffic is shifted to it, users immediately report errors when trying to write data. The developer discovers that the green task set is connecting to a different database than the blue task set. The database endpoints are configured in the ECS task definition. What is the simplest way to prevent this issue in future deployments?

Accepted Answer

Modify the blue/green deployment configuration to use the same database endpoint for both task sets by updating the environment variables in the task definition before deployment.. The issue stems from the green task set using a different database endpoint than the blue task set, which is configured via environment variables in the ECS task definition. By updating the task definition to use the same database endpoint before deployment, both task sets will connect to the same database, ensuring consistency during the traffic shift. This is the simplest fix as it requires no additional infrastructure or complex routing changes.

Answer

Create two separate Amazon RDS databases and use an Amazon Route 53 weighted routing policy to distribute traffic.

Answer

Use an Application Load Balancer (ALB) with stickiness to route each user to the correct task set.

Answer

Use AWS CloudFormation to create a new database stack for each deployment and update the task definition dynamically.

Question 7

A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?

Accepted Answer

The bucket's 'Block public access' settings are enabled.. The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.

Answer

The bucket has an ACL that denies read access.

Answer

The bucket policy does not include the 's3:GetObject' action.

Answer

The bucket policy is not correctly attached to the bucket.

Question 8

A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?

Accepted Answer

The request is coming through a VPC endpoint, so the source IP is not the client's IP.. When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.

Answer

The request is routed through CloudFront, which changes the source IP.

Answer

The bucket owner's IAM user policy overrides the bucket policy.

Answer

The condition key 'aws:SourceIp' is misspelled.

Question 9

A developer is building a CI/CD pipeline using AWS CodePipeline. The source stage is an Amazon S3 bucket. The developer wants to automatically start the pipeline when a new file is uploaded to the S3 bucket. What should the developer do?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers on S3 object creation events and targets the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can directly target an AWS CodePipeline pipeline as a rule target. By creating a rule that matches S3 object creation events (e.g., `s3:ObjectCreated:*`), the pipeline is automatically triggered without any intermediate polling, custom code, or additional services. This is the native, serverless integration recommended by AWS.

Answer

Configure the S3 bucket to send events to an SQS queue, and poll the queue from CodePipeline.

Answer

Set up a periodic Lambda function that checks the S3 bucket for new files and starts the pipeline.

Answer

Configure the S3 bucket to send events to an SNS topic, and subscribe CodePipeline to the topic.

Question 10

A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon VPC are allowed. The bucket is in the same AWS account as the VPC. Which configuration should the developer implement?

Accepted Answer

Bucket policy with condition aws:SourceVpc. The `aws:SourceVpc` condition key in an S3 bucket policy allows you to restrict access to requests originating from a specific VPC. This works in conjunction with a VPC endpoint for S3 (Gateway or Interface endpoint), which ensures that traffic from the VPC to S3 stays within the AWS network and does not traverse the public internet. The condition evaluates the VPC ID from which the request originates, providing a secure, network-level access control.

Answer

Bucket policy with condition aws:SourceIp

Answer

Bucket ACL with VPC ID

Answer

VPC Endpoint policy

Question 11

A developer needs to securely store database credentials for a Lambda function that accesses an Amazon RDS instance. The credentials must be automatically rotated every 30 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS. It supports built-in rotation with a configurable schedule (e.g., every 30 days) using a Lambda rotation function, and it integrates directly with RDS to update credentials without manual intervention. This meets the requirement for automatic rotation and secure storage.

Answer

AWS IAM Roles for Lambda

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 12

A Lambda function receives events from EventBridge. The developer wants failed invocations to be retried and then stored for later analysis if retries are exhausted. Which configuration should be used?

Accepted Answer

Configure EventBridge retry policy and a dead-letter queue. EventBridge supports a configurable retry policy (with a maximum event age up to 24 hours and up to 185 retries by default) and can route events that exceed the retry limit to an Amazon SQS dead-letter queue (DLQ). This ensures failed invocations are retried automatically and, if all retries are exhausted, the event is stored durably in the DLQ for later analysis or reprocessing.

Answer

Enable API Gateway access logging

Answer

Increase reserved concurrency to zero

Answer

Store events in CloudFormation outputs

Question 13

A CloudFormation update may replace an RDS database. The developer wants to preview replacement risk before executing. What should be created?

Accepted Answer

A change set. A change set in AWS CloudFormation allows you to preview how proposed changes to a stack will be executed, including whether any resources will be replaced (e.g., an RDS database). By reviewing the change set, you can see if the update will cause replacement (indicated by 'Replacement: True') before you actually apply the changes, enabling risk assessment without modification.

Answer

A stack policy only

Answer

A nested stack output

Answer

A CloudWatch dashboard

Question 14

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer runs 'sam deploy' and receives an error: 'Error: Failed to create changeset for the stack.' What is a common cause of this error?

Accepted Answer

The SAM template contains a syntax error.. The 'Failed to create changeset for the stack' error typically occurs when the SAM template contains a syntax error, such as invalid YAML formatting, missing required properties, or incorrect resource definitions. AWS CloudFormation validates the template before creating a changeset, and any syntax issue will cause the changeset creation to fail immediately. This is the most common cause because SAM templates are YAML-based and prone to indentation or structural mistakes.

Answer

The S3 bucket specified for artifacts does not exist.

Answer

The IAM user does not have permission to create CloudFormation stacks.

Answer

AWS CodeDeploy is not configured for the application.

Question 15

A developer is building a RESTful API that allows clients to query a database and retrieve results. The backend logic is implemented in AWS Lambda, which queries an Amazon DynamoDB table. The developer wants to expose the API over HTTPS and manage authentication and throttling. Which AWS service should the developer use to create and manage the API endpoints?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is the correct choice because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly supports HTTPS endpoints, integrates natively with AWS Lambda for backend logic, and provides built-in features for authentication (e.g., IAM, Cognito, Lambda authorizers) and throttling (usage plans and rate limits). This makes it the ideal service for exposing a Lambda-backed DynamoDB query as a secure, managed API.

Answer

Application Load Balancer

Answer

AWS CloudFront

Answer

Amazon S3