DVA-C02 Practice Test 43 — 15 Questions

Question 1

An organization uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. The build process needs to run integration tests that require a MySQL database. The team wants to ensure the database is provisioned only during the build and cleaned up afterward to minimize costs. What is the most efficient solution?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a Docker container running MySQL within the CodeBuild environment.. Using CodeBuild's built-in support for Docker, you can run a MySQL container as part of the build. This provides an ephemeral database only during the build process, minimizing cost. Option A is wrong because keeping an RDS instance running incurs ongoing costs even when not in use. Option B is wrong because using CloudFormation to provision an RDS instance at the start of each build and delete it at the end is slower than running a Docker container and may hit API rate limits. Option D is wrong because DynamoDB is a NoSQL database and may not support the SQL queries required by the integration tests.

Answer

Provision a small RDS MySQL instance and keep it running for the build process.

Answer

Use AWS CloudFormation to create an RDS instance at the start of the build and delete it at the end.

Answer

Use Amazon DynamoDB as a substitute for MySQL for the integration tests.

Question 2

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that the encryption keys be rotated every 90 days and that access to the keys be auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation.. SSE-KMS with a customer managed key and automatic key rotation meets the requirements with the least operational overhead. SSE-KMS provides auditable access to keys via AWS CloudTrail, and automatic key rotation satisfies the 90-day rotation requirement without manual intervention. Option A (SSE-S3) is incorrect because S3-managed keys cannot be rotated on a schedule. Option B (client-side encryption) adds significant operational overhead for key management and rotation. Option C (SSE-C) requires the company to manage and rotate its own encryption keys, increasing complexity.

Answer

Use SSE-S3 with default encryption enabled.

Answer

Use client-side encryption with the AWS Encryption SDK.

Answer

Use SSE-C with keys stored in AWS Secrets Manager.

Question 3

A company has a DynamoDB table that stores personally identifiable information (PII). A developer needs to allow a Lambda function to read and write to this table. What is the MOST secure way to grant the Lambda function access?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read/write access and attach it to the Lambda function.. An IAM role with an attached policy granting the necessary permissions is the most secure and best practice. Option B is wrong because resource-based policies on DynamoDB are not supported. Option C is wrong because IAM users should not be used for applications. Option D is wrong because temporary credentials from STS are not needed when using a role.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's IAM role.

Answer

Create an IAM user with programmatic access and embed the credentials in the Lambda environment variables.

Answer

Have the Lambda function assume a role using AWS STS each time it runs.

Question 4

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 5

A company has a REST API running on Amazon EC2 instances behind an Application Load Balancer. The API is accessed by mobile clients. The company wants to add authentication and authorization without modifying the backend code. Which AWS service should be used?

Accepted Answer

Amazon Cognito user pools integrated with the Application Load Balancer. Amazon Cognito user pools can be integrated directly with an Application Load Balancer (ALB) to handle authentication and authorization without modifying backend code. The ALB uses an OIDC-compatible identity provider (Cognito) to authenticate users before forwarding requests to the EC2 instances, allowing the backend to remain unchanged.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon API Gateway with a Lambda authorizer

Answer

Amazon CloudFront with Lambda@Edge

Question 6

A developer is deploying a new version of a Lambda function using the AWS CLI. The developer wants to shift 10% of traffic to the new version and then gradually increase to 100% over 10 minutes. Which CLI command should the developer use?

Accepted Answer

aws lambda update-alias --function-name my-function --name prod --function-version 2 --routing-config AdditionalVersionWeights={"1":0.9}. The `update-alias` command with the `--routing-config` parameter allows you to implement canary deployments by assigning a percentage of traffic to a new Lambda function version. In this case, `AdditionalVersionWeights={"1":0.9}` routes 10% of traffic to version 2 (the new version) and 90% to version 1. However, note that this command only sets a static routing configuration; to gradually increase traffic to 100% over 10 minutes, you must update the alias multiple times (e.g., via a script) to adjust the weights progressively. The command shown is the correct initial step to start the canary deployment.

Answer

aws lambda publish-version --function-name my-function

Answer

aws lambda create-function --function-name my-function --zip-file fileb://my-code.zip

Answer

aws lambda invoke --function-name my-function --payload '{}'

Question 7

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the MOST likely cause?

Accepted Answer

Another deployment is currently in progress for the same Lambda function.. The 'ResourceConflictException' error in AWS Lambda occurs when you attempt to update a Lambda function while another update operation is already in progress. Lambda enforces a single in-flight update per function to prevent race conditions and ensure state consistency. The AWS CLI command (e.g., update-function-code) will fail immediately if a previous deployment has not completed, even if the previous deployment was triggered by the same or a different client.

Answer

The Lambda function code exceeds the maximum allowed size.

Answer

The Lambda function has an alias that conflicts with the version number.

Answer

The IAM role associated with the Lambda function does not have sufficient permissions.

Question 8

A developer in Account A has an Amazon S3 bucket that contains sensitive data. The developer wants to grant an IAM user in Account B read-only access to objects in the bucket. The developer has added a bucket policy in Account A that grants s3:GetObject access to the IAM user's ARN. However, the IAM user in Account B still receives Access Denied errors. What additional configuration is required?

Accepted Answer

Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.. Cross-account access to S3 requires both a bucket policy in the source account (Account A) granting the necessary permissions to the target IAM user, and an IAM identity-based policy in the target account (Account B) that explicitly allows the same action (s3:GetObject) on the bucket's ARN. Without the IAM policy in Account B, the user lacks the authorization to initiate the request, even though the bucket policy permits it. This dual-permission model is a fundamental security requirement for cross-account S3 access.

Answer

Create an S3 access point and grant the user access through it.

Answer

Change the bucket policy to grant access to the entire AWS account B instead of the specific user.

Answer

Enable S3 object ownership and set the bucket ACL to grant read access to the user in Account B.

Question 9

A company uses AWS OpsWorks for configuration management and deployment of applications on EC2 instances. The company wants to migrate to AWS Systems Manager for automation and patching. Which Systems Manager capability should be used to execute scripts and commands on EC2 instances as part of a deployment?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows you to remotely and securely execute scripts and commands on EC2 instances as part of a deployment. Run Command is designed for one-time or on-demand execution, which aligns with the need to run deployment scripts. State Manager is for ongoing configuration management, not for one-time deployment tasks.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager State Manager

Answer

AWS Systems Manager Automation

Question 10

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a build stage that uses AWS CodeBuild. The developer wants to run unit tests and only proceed to the deploy stage if the tests pass. Which configuration should the developer use to achieve this?

Accepted Answer

Configure the build stage to run tests and fail the build if tests fail; CodePipeline will automatically stop.. AWS CodeBuild can be configured to run unit tests as part of the build phase. If any test fails, CodeBuild exits with a non-zero status, causing the build to fail. CodePipeline automatically stops the pipeline execution when a stage fails, preventing the deploy stage from running. This is the native and simplest way to gate deployment on test success.

Answer

Configure a manual approval step before the deploy stage.

Answer

Configure Amazon CloudWatch alarms to stop the pipeline if tests fail.

Answer

Configure AWS Lambda to invoke a function that checks test results and manually stops the pipeline.

Question 11

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

Accepted Answer

Increase the compute type of the build project. AWS CodeBuild allows you to increase the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM or LARGE), which provides more memory and CPU resources. This directly addresses the 'OutOfMemoryError: Java heap space' by giving the JVM more physical memory to work with, without requiring any source code changes.

Answer

Add -Xmx1024m to the buildspec commands

Answer

Change the build image to a smaller one

Answer

Set the memory parameter in the build project

Question 12

A developer wants to deploy a new version of an application to an EC2 Auto Scaling group using AWS CodeDeploy. The developer wants to minimize downtime and ensure that if the deployment fails, it automatically rolls back to the previous version. Which deployment type should the developer choose?

Accepted Answer

Blue/green. Blue/green deployment is the correct choice because it creates a separate, new Auto Scaling group (green) alongside the existing one (blue), allowing traffic to be shifted to the new environment after validation. This minimizes downtime by keeping the old environment fully operational during the deployment, and CodeDeploy can automatically roll back by redirecting traffic to the blue environment if the deployment fails.

Answer

In-place

Answer

Canary

Answer

Linear

Question 13

A company has an S3 bucket that stores sensitive data. The data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to ensure that only a specific IAM role in the same account can decrypt the objects. Which configuration should the developer implement?

Accepted Answer

Add a key policy that allows the IAM role to perform kms:Decrypt and denies all other principals.. KMS key policies directly control who can use the key for cryptographic operations like kms:Decrypt. By explicitly allowing only the specific IAM role and denying all other principals (including the root account), the key policy ensures that only that role can decrypt the S3 objects, regardless of any other IAM or bucket policies. This is the most secure and direct way to restrict decryption at the key level.

Answer

Add a bucket policy that denies s3:GetObject unless the request uses a specific IAM role.

Answer

Configure the S3 bucket with default encryption using the KMS key.

Answer

Create an IAM policy that grants kms:Decrypt only to the specific role.

Question 14

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

Accepted Answer

Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.. A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.

Answer

Use a VPC Link to connect to a private server for validation.

Answer

Validate the token inside the Lambda function integrated with the API.

Answer

Use API Gateway request validation to check the header format.

Question 15

An application running on Amazon ECS with Fargate is experiencing high latency. The application writes logs to Amazon CloudWatch Logs. Which AWS service can be used to analyze the logs to pinpoint the cause of the latency?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights is the correct choice because it is purpose-built for interactively querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) to filter, aggregate, and visualize log events, which is essential for pinpointing latency patterns, such as slow API calls or database queries, without needing to export logs to another service.

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Answer

Amazon S3