DVA-C02 Practice Test 45 — 15 Questions

Question 1

A developer is building a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO AWS services can be used for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows you to define custom names for your application resources and maintain the updated location of these dynamically changing resources. For Amazon ECS with Fargate, you can register each service instance with Cloud Map, and other services can then discover them via DNS queries or API calls, enabling seamless inter-service communication in a microservices architecture.

Answer

Amazon ECR

Answer

Elastic Load Balancing

Answer

AWS Systems Manager Parameter Store

Question 2

A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals AES256. The condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals alias/aws/s3

Answer

aws:SecureTransport equals true

Answer

s3:object-lock-mode equals GOVERNANCE

Question 3

A company's application uses Amazon S3 to store user-uploaded images. Users report that recently uploaded images are sometimes not immediately available for viewing. The application uses S3 Event Notifications to trigger a Lambda function that processes images and stores metadata in DynamoDB. What is the MOST likely cause of the delay?

Accepted Answer

S3 Event Notifications may have a slight delay, and the application polls for the processed image before the notification triggers Lambda.. S3 Event Notifications are delivered asynchronously and can take seconds to minutes to reach Lambda, so if the application polls for the processed image or metadata immediately after upload, it may query before Lambda has run. This race condition between the upload and the notification-driven processing is the most likely cause of the intermittent delay.

Answer

Lambda function has a cold start that adds several seconds to processing time.

Answer

S3 is eventually consistent for new object writes, so the object may not be immediately available.

Answer

DynamoDB has insufficient read capacity causing throttling on metadata retrieval.

Question 4

An IAM policy is attached to an EC2 instance role. The instance is part of a CodeDeploy deployment group. The deployment fails because the CodeDeploy agent cannot download the revision. What is the most likely reason?

Accepted Answer

The policy does not allow s3:GetObject on the specific bucket where the revision is stored.. The CodeDeploy agent on the EC2 instance downloads the application revision from an S3 bucket. For this to succeed, the IAM role attached to the instance must include an s3:GetObject permission on the specific bucket and object. Without it, the agent cannot retrieve the revision file, causing the deployment to fail. Options A and B are irrelevant because the agent does not call CodeDeploy API actions like GetDeployment or CreateDeployment; those are used by the user or CI/CD pipeline initiating the deployment. Option C is incorrect because IAM policies for S3 actions do not require a region in the resource ARN.

Answer

The policy does not allow the codedeploy:GetDeployment action.

Answer

The policy does not allow the codedeploy:CreateDeployment action.

Answer

The policy does not specify a region in the resource ARN.

Question 5

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Accepted Answer

An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role. Cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.

Answer

An S3 bucket policy granting access to the external account

Answer

An IAM user policy in the external account allowing sts:AssumeRole

Answer

An AWS Organizations service control policy allowing cross-account access

Question 6

A developer is creating an AWS Lambda function that needs to access files from an Amazon EFS file system. The Lambda function must be configured to access the VPC. Which of the following is required to allow the Lambda function to mount the EFS file system?

Accepted Answer

The Lambda function must have the AWSLambdaVPCAccessExecutionRole managed policy attached.. The AWSLambdaVPCAccessExecutionRole managed policy provides the necessary permissions for Lambda to manage elastic network interfaces (ENIs) in a VPC, which is required for Lambda to connect to an EFS file system via mount targets. Without this policy, the Lambda function cannot create or manage the ENI needed to route traffic to the EFS mount target within the VPC.

Answer

The Lambda function must be in the same Availability Zone as the EFS mount target.

Answer

The Lambda function must have the AmazonElasticFileSystemClientReadWriteAccess managed policy attached.

Answer

The Lambda function must have the efs:MountFileSystem permission in its execution role.

Question 7

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 8

A company uses AWS CodeBuild to run tests and build artifacts for a Java application. The build process is taking longer than expected. The developer wants to speed up the build by caching dependencies. What should the developer do?

Accepted Answer

Enable local caching in the CodeBuild project configuration.. CodeBuild's local caching feature allows the build environment to cache dependencies (e.g., Maven local repository) in a local directory that persists across build runs for the same project. This eliminates the need to re-download dependencies on every build, significantly reducing build time. The cache is stored on the build instance's local storage and is automatically managed by CodeBuild.

Answer

Use a CodeCommit repository to store dependencies.

Answer

Store dependencies in an S3 bucket and download them in each build.

Answer

Mount an Amazon EFS file system to the build environment and store dependencies there.

Question 9

A developer is building an application that needs to read a secret API key from AWS Secrets Manager. The application runs on an EC2 instance that is part of an Auto Scaling group. The developer wants to ensure that only this application can retrieve the secret. Which set of steps should the developer take?

Accepted Answer

Store the secret in Secrets Manager, attach an IAM role to the EC2 instance that grants permission to read the secret, and configure the application to retrieve the secret using the AWS SDK. It follows the principle of least privilege and uses IAM roles, which are the secure and recommended way to grant EC2 instances permissions to access AWS Secrets Manager. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret using the AWS SDK without embedding long-term credentials in code or configuration files. This ensures that only instances with that role can read the secret, and the credentials are automatically rotated by AWS.

Answer

Store the secret in Secrets Manager, create an IAM user with a policy to read the secret, and embed the user's credentials in the application code

Answer

Store the secret as an environment variable in the EC2 user data

Answer

Store the secret in a configuration file on the instance and restrict file permissions

Question 10

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Amazon SQS FIFO queues guarantee first-in, first-out delivery and exactly-once processing, which ensures messages are processed in the order they were sent. By configuring the Lambda function to poll the FIFO queue with a batch size of 1, each message is processed individually, preserving strict ordering without concurrency issues. The Lambda function's idempotency further ensures that any duplicate messages are handled safely, but the FIFO queue's inherent ordering is the key mechanism for maintaining sequence.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 11

A developer is optimizing a DynamoDB table for a gaming leaderboard. The table stores player scores and is read-heavy. Queries often fetch the top 10 scores. Which indexing strategy best reduces RCU consumption?

Accepted Answer

Create a global secondary index with score as the sort key.. A global secondary index (GSI) with score as the sort key allows efficient retrieval of the top 10 scores by querying the index in descending order, reading only the required items. This minimizes read capacity unit (RCU) consumption compared to scanning the base table, as each query reads exactly 10 items (or fewer) rather than consuming RCUs for a full table scan or filtering large result sets.

Answer

Create a sparse index on player ID.

Answer

Use a local secondary index on score.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Question 12

A developer needs to securely store database credentials for a serverless application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials, and it enforces encryption at rest using AWS KMS. For a serverless application, Secrets Manager provides a simple API call (e.g., GetSecretValue) to retrieve credentials without hardcoding them in code or environment variables.

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Answer

AWS Systems Manager Parameter Store

Question 13

A developer is using AWS CodeDeploy with a blue/green deployment strategy to update an application running on Amazon ECS with the Fargate launch type. After the new (green) task set is created and traffic is shifted to it, users immediately report errors when trying to write data. The developer discovers that the green task set is connecting to a different database than the blue task set. The database endpoints are configured in the ECS task definition. What is the simplest way to prevent this issue in future deployments?

Accepted Answer

Modify the blue/green deployment configuration to use the same database endpoint for both task sets by updating the environment variables in the task definition before deployment.. The issue stems from the green task set using a different database endpoint than the blue task set, which is configured via environment variables in the ECS task definition. By updating the task definition to use the same database endpoint before deployment, both task sets will connect to the same database, ensuring consistency during the traffic shift. This is the simplest fix as it requires no additional infrastructure or complex routing changes.

Answer

Create two separate Amazon RDS databases and use an Amazon Route 53 weighted routing policy to distribute traffic.

Answer

Use an Application Load Balancer (ALB) with stickiness to route each user to the correct task set.

Answer

Use AWS CloudFormation to create a new database stack for each deployment and update the task definition dynamically.

Question 14

A developer needs to encrypt data in an S3 bucket. The company requires that the encryption key be managed by AWS but with the ability to audit key usage. Which S3 encryption option should the developer use?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS).. SSE-KMS uses AWS Key Management Service (KMS) to manage the encryption keys, and it provides audit trails of key usage via AWS CloudTrail. This meets the requirement of AWS-managed keys with auditability. SSE-S3 uses S3-managed keys but does not provide detailed audit logs of key usage. Client-side encryption and SSE-C involve customer-managed keys, which do not meet the 'managed by AWS' requirement.

Answer

Client-side encryption.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Question 15

A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?

Accepted Answer

The bucket's 'Block public access' settings are enabled.. The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.

Answer

The bucket has an ACL that denies read access.

Answer

The bucket policy does not include the 's3:GetObject' action.

Answer

The bucket policy is not correctly attached to the bucket.