DVA-C02 Practice Test 44 — 15 Questions

Question 1

A company wants to audit access to their S3 buckets. Which TWO services can be used to log and monitor S3 API calls?

Accepted Answer

S3 server access logs. S3 server access logs (Option B) provide detailed records about requests made to an S3 bucket, including object-level API calls. AWS CloudTrail (Option C) logs management events for S3, such as bucket creation or configuration changes, and can also be configured to log data events for object-level operations. Option A (AWS Config) is used for resource configuration tracking, not API call logging. Option D (AWS KMS) manages encryption keys. Option E (Amazon CloudWatch Logs) can store logs but does not directly capture S3 API calls; it works with CloudTrail or other sources.

Answer

AWS Config

Answer

AWS KMS

Answer

Amazon CloudWatch Logs

Question 2

A developer needs to deploy a containerized application on AWS. The application requires persistent storage for stateful data. Which AWS compute service should the developer choose?

Accepted Answer

Amazon ECS with Fargate. Amazon ECS with Fargate is the best choice for deploying a containerized application with persistent storage. Fargate supports persistent storage by integrating with Amazon EFS. While Amazon EKS with Fargate also supports persistent storage, ECS with Fargate offers simpler management and is often preferred for stateful containers. AWS Elastic Beanstalk can run containers but is more opinionated and less flexible for stateful configurations. AWS Lambda is stateless and ephemeral, not suitable for persistent storage.

Answer

AWS Elastic Beanstalk

Answer

Amazon EKS with Fargate

Answer

AWS Lambda

Question 3

A developer deploys a new version of an AWS Lambda function using the AWS CLI. After deployment, the function returns stale results. What is the most likely cause?

Accepted Answer

The Lambda function alias is still pointing to the previous version.. When a developer deploys a new version of a Lambda function using the AWS CLI without updating the function alias, the alias continues to point to the previous version. Invoking the function via the alias (e.g., via an API Gateway endpoint or a CloudFront origin) will execute the old code, returning stale results. The `$LATEST` version is updated, but unless the alias is repointed, it does not automatically use the new code.

Answer

The function's environment variables are cached and not updated.

Answer

The Amazon CloudFront distribution is caching the old response.

Answer

The Lambda function's code is cached by the Lambda service.

Question 4

Which TWO of the following are best practices for securing AWS account root user?

Accepted Answer

Delete the root user access keys.. Option A is correct because AWS best practice is to remove (delete) any access keys associated with the root user, since long-term programmatic credentials on the root account pose a severe risk if leaked and root should not be used for API/CLI access. Option E is correct because enabling MFA on the root user adds a critical second authentication factor, protecting the account from password compromise and required for sensitive root-only operations. Options B, C, and D are not best practices: the root user should not be used for daily administrative tasks (use IAM users/roles instead), AWS does not provide an account-level password policy that locks the root user after failed attempts, and sharing the root password with developers violates least privilege and accountability.

Answer

Use the root user for daily administrative tasks.

Answer

Set a password policy that locks the root user after 10 failed attempts.

Answer

Share the root user password with senior developers for emergencies.

Question 5

A developer wants to encrypt data in an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). Which TWO steps are required?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS.. Option A is correct because configuring the bucket's default encryption to SSE-KMS ensures that objects uploaded without an explicit encryption header are automatically encrypted with AWS KMS keys (aws:kms), which is the core requirement for using SSE-KMS at the bucket level. Option D is correct because any principal writing or reading SSE-KMS-encrypted objects must have kms:GenerateDataKey (to obtain a data key for encryption) and kms:Decrypt (to decrypt the data key) permissions on the relevant KMS key; without these, S3 requests fail with AccessDenied. Option B is not required because MFA Delete only protects object version deletion and does not relate to enabling SSE-KMS. Option C is not required because a deny-unencrypted-requests bucket policy is an optional hardening measure, not a prerequisite for SSE-KMS. Option E is not required because versioning is independent of server-side encryption configuration.

Answer

Enable MFA Delete on the bucket.

Answer

Create a bucket policy that denies unencrypted requests.

Answer

Enable versioning on the bucket.

Question 6

A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)

Accepted Answer

Add a manual approval step before the deploy stage.. Option C is correct because inserting a manual approval action (an Approval action in CodePipeline, typically using Amazon SNS to notify approvers) between the build stage and the ECS deploy stage gates production deployment so that only changes a human explicitly approves proceed to production. Option D is correct because using separate pipelines for dev, staging, and prod isolates environments, so a change must pass through the earlier pipelines before a production pipeline is triggered, preventing unvetted commits from reaching production. Option E is correct because adding integration tests in the CodeBuild build stage (via buildspec.yml commands) validates the microservices against their dependencies and fails the pipeline on errors, so broken or unapproved-quality changes never reach the deploy stage. Option A is incorrect because automatically deploying every commit to production removes any approval gate and directly contradicts the requirement that only approved changes be deployed. Option B is incorrect because deploying all feature branches directly to production bypasses review, testing, and approval, which is exactly the risk the developer wants to eliminate.

Answer

Configure the pipeline to automatically deploy every commit to production.

Answer

Deploy all feature branches directly to production.

Question 7

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function is configured to access a VPC without a NAT gateway.. Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts. Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Answer

The function's reserved concurrency is set to 0.

Answer

The function has a dead-letter queue configured.

Question 8

A company has an Amazon S3 bucket that stores sensitive documents. The security team wants to ensure that all GET requests to the bucket are authenticated and that the requester does not have public access. Which combination of S3 features should the developer implement?

Accepted Answer

Block public access and enable S3 Access Points with a network origin policy. Blocking public access at the bucket level ensures that no anonymous or public requests can reach the bucket, while S3 Access Points with a network origin policy restrict access to requests originating from a specific VPC or on-premises network. This combination enforces that all GET requests must be authenticated (via the Access Point's IAM policies) and cannot come from public internet sources, meeting the security team's requirements.

Answer

Enable S3 Object Lock and versioning

Answer

Use S3 Transfer Acceleration and server-side encryption

Answer

Configure a bucket policy that allows only specific IAM users and enable MFA Delete

Question 9

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.

Question 10

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation. AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.

Answer

Manually rotate the KMS key every year

Answer

Create a new KMS key and update all applications to use it

Answer

Use AWS CloudWatch Events to trigger a Lambda function that rotates the key

Question 11

A company stores sensitive data in Amazon S3. A developer needs to implement a solution that automatically encrypts objects at rest using a key that is rotated annually. The developer must minimize operational overhead. Which solution meets these requirements?

Accepted Answer

Use Server-Side Encryption with AWS KMS-Managed Keys (SSE-KMS) with automatic key rotation.. SSE-KMS with automatic key rotation meets the requirement for annual key rotation with minimal operational overhead because AWS KMS can automatically rotate the customer master key (CMK) every year (365 days) without any manual intervention. This ensures that objects in S3 are encrypted at rest using a key that is rotated on schedule, while the developer does not need to manage the rotation process.

Answer

Use Server-Side Encryption with S3-Managed Keys (SSE-S3) and set key rotation policy.

Answer

Use Server-Side Encryption with Customer-Provided Keys (SSE-C) and manually rotate keys.

Answer

Use Client-Side Encryption with KMS.

Question 12

A company is using AWS KMS to encrypt sensitive data stored in S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants the role the kms:Decrypt permission.. KMS key policies are the most direct and secure way to control who can perform cryptographic operations like kms:Decrypt on a specific CMK. By granting only the specific IAM role the kms:Decrypt permission in the key policy, you ensure that no other principal (including the root user or other roles) can decrypt the data, even if they have S3 access. This follows the principle of least privilege and decouples data access from infrastructure access.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3).

Answer

Enable automatic key rotation for the KMS key.

Answer

Use an S3 bucket policy to restrict access to the role.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager.. Option B is correct because AWS Secrets Manager is purpose-built to store and retrieve secrets such as database connection strings, supporting encryption at rest with KMS and fine-grained access via IAM, so the application can fetch the string at runtime instead of hard-coding it. Option C is correct because Elastic Beanstalk environment properties are injected into the application as environment variables (for example, RDS_HOSTNAME, RDS_USERNAME, RDS_PASSWORD that Beanstalk itself sets for attached RDS instances), letting the code read the connection string from the environment rather than embedding it. Option E is correct because AWS Systems Manager Parameter Store can hold the connection string as a SecureString parameter encrypted with KMS, and the application can retrieve it via the SSM API or the EC2/Beanstalk instance role. Option A is not appropriate because RDS tags are metadata for resource organization, cost allocation, and access control, not a secure mechanism for delivering secrets to an application. Option D is not appropriate because a configuration file inside the application bundle is still effectively hard-coded and travels with the source artifact, so it does not securely externalize the connection string.

Answer

Read the connection string from Amazon RDS tags.

Answer

Store the connection string in a configuration file in the application bundle.

Question 14

Which TWO actions are required to enable server-side encryption for an Amazon RDS instance? (Choose 2)

Accepted Answer

Use AWS KMS to manage the encryption key. Option D is correct because Amazon RDS encryption at rest is implemented using AWS Key Management Service (KMS) customer master keys (CMKs), so you must use AWS KMS to manage the encryption key that protects the DB instance's storage and snapshots. Option E is correct because RDS encryption at rest can only be enabled at the moment of DB instance creation (via the console, CLI --storage-encrypted, or API StorageEncrypted=true); you cannot turn it on afterward. Option A is wrong because an existing unencrypted RDS instance cannot simply have encryption enabled after creation—you must create a new encrypted instance from a snapshot. Option B is wrong because client-side encryption is an application-level concern and does not enable RDS server-side encryption at rest. Option C is wrong because placing the DB instance in a VPC is a networking configuration and has no bearing on enabling storage encryption.

Answer

Enable encryption on the database after creation

Answer

Use client-side encryption in the application

Answer

Configure the DB instance to use a VPC

Question 15

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 30 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a rotation schedule (e.g., every 30 days) without custom infrastructure. This service integrates directly with Amazon RDS, Redshift, and DocumentDB for seamless credential rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM