DVA-C02 Practice Test 44 — 15 Questions

Question 1

A company uses AWS CodeBuild for building and testing their application. They have a build project that runs on a Linux environment. They want to run a build in a custom Docker image that is stored in Amazon ECR. How should they configure the build project?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the environment configuration, set the 'Image' field to the ECR image URI.. AWS CodeBuild allows you to specify a custom Docker image from Amazon ECR by entering its URI directly in the 'Image' field under the environment configuration. This enables the build to run in a container that includes all necessary dependencies, without requiring a Dockerfile in the source code or a managed image.

Answer

Add a 'Dockerfile' to the source code and specify it in the buildspec.

Answer

Use a managed image provided by AWS CodeBuild.

Answer

Configure the pipeline to pass the image URI as an environment variable.

Question 2

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 3

A developer is running a web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs to store user session state that must be available across all instances. The session data is small and temporary but must survive individual instance failures. Which AWS service should the developer use to store this session state?

Accepted Answer

Store session state in an Amazon ElastiCache cluster. Amazon ElastiCache (e.g., using Redis or Memcached) provides a centralized, in-memory data store that is external to the EC2 instances. This allows all instances behind the ALB to read and write the same session state, ensuring consistency across the fleet. Because the data is stored in a managed cluster, it survives individual instance failures and is ideal for small, temporary session data that requires low-latency access.

Answer

Store session state in the /tmp directory of each EC2 instance

Answer

Use an Amazon SQS queue to persist session data

Answer

Store session state in an Amazon S3 bucket

Question 4

A company uses AWS CloudFormation to manage infrastructure. The development team wants to implement a CI/CD pipeline that automatically updates a CloudFormation stack when code is pushed to a CodeCommit repository. The pipeline should also run tests before deploying. Which THREE services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can compile source code, run tests, and produce artifacts that are ready for deployment. In this CI/CD pipeline, CodeBuild executes the test suite after code is pushed to CodeCommit, ensuring that only validated code proceeds to update the CloudFormation stack.

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 5

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function and an Amazon API Gateway REST API. The developer wants to configure the API Gateway stage to enable logging and set the stage name based on the SAM parameter Stage. In the SAM template, which property of the AWS::Serverless::Api resource should the developer use to set the stage name?

Accepted Answer

StageName. The `StageName` property of the `AWS::Serverless::Api` resource directly sets the stage name for the API Gateway REST API. By using a SAM parameter like `Stage` (e.g., `StageName: !Ref Stage`), the developer can dynamically control the stage name at deployment time. This is the intended and simplest way to configure the stage name in an AWS SAM template.

Answer

DefinitionBody

Answer

StageDescription

Answer

EndpointConfiguration

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses a PostgreSQL database on RDS. The security team requires that database credentials never be stored in application code or configuration files. Which solution meets this requirement?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with automatic rotation.. AWS Secrets Manager is designed specifically for securely storing and automatically rotating database credentials. It integrates natively with RDS for PostgreSQL, enabling automatic rotation without code changes. The application retrieves credentials at runtime via the AWS SDK, ensuring they are never stored in code or configuration files.

Answer

Store the credentials in a Systems Manager Parameter Store parameter and retrieve them at application startup.

Answer

Store the credentials in an encrypted S3 bucket and have the application read the config file at startup.

Answer

Hardcode the credentials in a Lambda function that is called to get the credentials.

Question 7

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 8

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon DynamoDB

Question 9

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Accepted Answer

Verify that the Lambda function has network access to the database.. The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager. Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.

Answer

Check VPC Flow Logs for the Lambda function's ENI.

Answer

Ensure the KMS key used to encrypt the secret is rotated.

Question 10

A developer needs to grant an IAM user access to list objects in an S3 bucket named 'app-data'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::app-data"}. The s3:ListBucket action is required to list the objects in an S3 bucket, and the resource ARN must specify the bucket itself (arn:aws:s3:::app-data) without a trailing /*. This grants permission to list the contents of the 'app-data' bucket, which is the exact requirement.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::app-data/*"}

Question 11

A company is implementing a CI/CD pipeline using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to ensure that the pipeline automatically deploys to production only after a manual approval step. Which TWO actions should the developer take?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline.. Both Option B and Option C are correct. In AWS CodePipeline, a manual approval action pauses the pipeline until the specified approver(s) approve or reject the change. To implement this, you add a manual approval action in the pipeline (Option B) and then configure that action to require a specific IAM user or group to approve (Option C). This ensures that only authorized personnel can approve the production deployment. Option A is incorrect because CloudWatch Events and Lambda can automate pipeline execution but do not provide a built-in manual approval mechanism. Option D is incorrect because CodeDeploy lifecycle hooks can pause the deployment process within the deployment group, but the requirement is a pipeline-level manual approval step, which is a native feature of CodePipeline. Option E is incorrect because SNS is used for notifications; while you can notify approvers via SNS, the approval action itself is configured within CodePipeline, not through SNS.

Answer

Create a CloudWatch Events rule to trigger a Lambda function that waits for approval.

Answer

Use a CodeDeploy lifecycle hook to pause the deployment.

Answer

Configure an SNS topic to send an email to the approver.

Question 12

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a recent deployment, the environment health turns 'Severe' and the application becomes unresponsive. The developer checks the logs and finds multiple '502 Bad Gateway' errors from the nginx proxy. The application was working before the deployment. What is the MOST likely cause?

Accepted Answer

The new application code has a bug that causes the application to crash.. A 502 Bad Gateway error from nginx means the reverse proxy cannot communicate with the application backend. Since the application was working before the deployment and became unresponsive immediately after, the most likely cause is a bug in the new code that causes the application process to crash or hang. Elastic Beanstalk's nginx proxy expects a healthy response from the application on the designated port; if the application fails to start or crashes repeatedly, nginx returns 502 errors.

Answer

The Procfile is missing from the application source.

Answer

The environment's load balancer is not configured correctly.

Answer

The environment variables are not set correctly.

Question 13

A developer needs to encrypt secrets (database passwords) that are used by an application running on EC2. The application retrieves the secrets at startup. Which combination of services provides the MOST secure and manageable solution?

Accepted Answer

Store the secrets in AWS Secrets Manager and use an IAM role to access them.. AWS Secrets Manager is designed specifically for managing secrets like database passwords, with built-in rotation capabilities and fine-grained access control via IAM roles. Option B is wrong because storing secrets in S3, even with KMS encryption, does not provide automatic rotation and adds complexity in managing access policies. Option C is wrong because AWS Systems Manager Parameter Store SecureString parameters lack native secret rotation (though can be custom scripted) and are less integrated than Secrets Manager for secrets management. Option D is wrong because hardcoding secrets in application code is insecure and violates best practices, as secrets can be exposed in code repositories or decompiled.

Answer

Encrypt the secrets with AWS KMS and store them in an S3 bucket with a bucket policy.

Answer

Store the secrets in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Hardcode the secrets in the application code and encrypt the code.

Question 14

A developer is setting up a CI/CD pipeline for a Python application using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to trigger the pipeline automatically when code is pushed to the master branch. Which TWO actions are required? (Choose two.)

Accepted Answer

Set the source stage in the pipeline to use AWS CodeCommit as the source provider.. Options B and D are correct because B is necessary: the pipeline source stage must use AWS CodeCommit as the provider to detect pushes to the repository. D is also required: a webhook configured in CodeCommit sends push events to the pipeline, triggering it automatically. Option A is incorrect because CodeDeploy is a deployment stage, not a trigger. Option C is incorrect because a scheduled CloudWatch Events rule would trigger the pipeline on a schedule, not on code pushes. Option E is incorrect because CloudTrail logs API calls but does not trigger pipelines.

Answer

Configure CodeDeploy to run after the build stage.

Answer

Create a CloudWatch Events rule to trigger the pipeline on a schedule.

Answer

Enable AWS CloudTrail to log API calls.

Question 15

A developer configured an S3 bucket to trigger a Lambda function on object creation. The Lambda function processes the object and then deletes it. Some objects are not being processed. What should the developer do to ensure all objects are processed?

Accepted Answer

Send S3 events to an SQS queue and configure the Lambda function to poll the queue.. Sending S3 events to an SQS queue decouples event delivery from Lambda invocation. If the Lambda function fails or throttles, the event remains in the queue and can be retried, ensuring no objects are missed. Without a queue, S3 events that fail to invoke Lambda (e.g., due to concurrency limits) are lost, leading to unprocessed objects.

Answer

Assign a new IAM role to the Lambda function with S3 permissions.

Answer

Enable S3 versioning on the bucket.

Answer

Increase the Lambda function timeout.