DVA-C02 Practice Test 46 — 15 Questions

Question 1

A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?

Accepted Answer

The request is coming through a VPC endpoint, so the source IP is not the client's IP.. When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.

Answer

The request is routed through CloudFront, which changes the source IP.

Answer

The bucket owner's IAM user policy overrides the bucket policy.

Answer

The condition key 'aws:SourceIp' is misspelled.

Question 2

A developer is building a CI/CD pipeline using AWS CodePipeline. The source stage is an Amazon S3 bucket. The developer wants to automatically start the pipeline when a new file is uploaded to the S3 bucket. What should the developer do?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers on S3 object creation events and targets the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can directly target an AWS CodePipeline pipeline as a rule target. By creating a rule that matches S3 object creation events (e.g., `s3:ObjectCreated:*`), the pipeline is automatically triggered without any intermediate polling, custom code, or additional services. This is the native, serverless integration recommended by AWS.

Answer

Configure the S3 bucket to send events to an SQS queue, and poll the queue from CodePipeline.

Answer

Set up a periodic Lambda function that checks the S3 bucket for new files and starts the pipeline.

Answer

Configure the S3 bucket to send events to an SNS topic, and subscribe CodePipeline to the topic.

Question 3

A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon VPC are allowed. The bucket is in the same AWS account as the VPC. Which configuration should the developer implement?

Accepted Answer

Bucket policy with condition aws:SourceVpc. The `aws:SourceVpc` condition key in an S3 bucket policy allows you to restrict access to requests originating from a specific VPC. This works in conjunction with a VPC endpoint for S3 (Gateway or Interface endpoint), which ensures that traffic from the VPC to S3 stays within the AWS network and does not traverse the public internet. The condition evaluates the VPC ID from which the request originates, providing a secure, network-level access control.

Answer

Bucket policy with condition aws:SourceIp

Answer

Bucket ACL with VPC ID

Answer

VPC Endpoint policy

Question 4

A developer needs to securely store database credentials for a Lambda function that accesses an Amazon RDS instance. The credentials must be automatically rotated every 30 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS. It supports built-in rotation with a configurable schedule (e.g., every 30 days) using a Lambda rotation function, and it integrates directly with RDS to update credentials without manual intervention. This meets the requirement for automatic rotation and secure storage.

Answer

AWS IAM Roles for Lambda

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 5

A Lambda function receives events from EventBridge. The developer wants failed invocations to be retried and then stored for later analysis if retries are exhausted. Which configuration should be used?

Accepted Answer

Configure EventBridge retry policy and a dead-letter queue. EventBridge supports a configurable retry policy (with a maximum event age up to 24 hours and up to 185 retries by default) and can route events that exceed the retry limit to an Amazon SQS dead-letter queue (DLQ). This ensures failed invocations are retried automatically and, if all retries are exhausted, the event is stored durably in the DLQ for later analysis or reprocessing.

Answer

Enable API Gateway access logging

Answer

Increase reserved concurrency to zero

Answer

Store events in CloudFormation outputs

Question 6

A CloudFormation update may replace an RDS database. The developer wants to preview replacement risk before executing. What should be created?

Accepted Answer

A change set. A change set in AWS CloudFormation allows you to preview how proposed changes to a stack will be executed, including whether any resources will be replaced (e.g., an RDS database). By reviewing the change set, you can see if the update will cause replacement (indicated by 'Replacement: True') before you actually apply the changes, enabling risk assessment without modification.

Answer

A stack policy only

Answer

A nested stack output

Answer

A CloudWatch dashboard

Question 7

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer runs 'sam deploy' and receives an error: 'Error: Failed to create changeset for the stack.' What is a common cause of this error?

Accepted Answer

The SAM template contains a syntax error.. The 'Failed to create changeset for the stack' error typically occurs when the SAM template contains a syntax error, such as invalid YAML formatting, missing required properties, or incorrect resource definitions. AWS CloudFormation validates the template before creating a changeset, and any syntax issue will cause the changeset creation to fail immediately. This is the most common cause because SAM templates are YAML-based and prone to indentation or structural mistakes.

Answer

The S3 bucket specified for artifacts does not exist.

Answer

The IAM user does not have permission to create CloudFormation stacks.

Answer

AWS CodeDeploy is not configured for the application.

Question 8

A company's DynamoDB table has a read capacity of 10,000 RCUs and receives consistent traffic. Recently, users have reported increased latency for read requests. The application uses strongly consistent reads. The developer checks CloudWatch metrics and sees that 'ConsumedReadCapacityUnits' is at 9,500 but 'ThrottledRequests' is high. What is the most likely cause?

Accepted Answer

A hot partition is exceeding its partition-level read capacity.. The correct answer is B: a hot partition is exceeding its partition-level read capacity. Even though the table's total consumed read capacity (9,500 of 10,000 RCUs) is below the provisioned limit, DynamoDB distributes capacity across partitions, and a single partition can only support a maximum of 3,000 RCUs (or 1,000 WCUs); if one partition key receives disproportionate traffic, that partition throttles requests while overall table capacity remains underutilized, which matches the high ThrottledRequests with consumed capacity below the table maximum. Option D is wrong because the table-level provisioned capacity is not exhausted (9,500 < 10,000), so low capacity is not the cause. Option A is wrong because the scenario states the application uses strongly consistent reads, and switching consistency would not explain throttling. Option C is wrong because auto scaling scaling down would reduce provisioned capacity, but the metric shows consumed capacity still below the provisioned 10,000 RCUs, and aggressive scale-down is not the typical cause of partition-level throttling.

Answer

The application is using eventually consistent reads but expecting strongly consistent results.

Answer

The DynamoDB table has auto scaling enabled and is scaling down too aggressively.

Answer

The provisioned read capacity is too low for the traffic.

Question 9

A developer is building a RESTful API that allows clients to query a database and retrieve results. The backend logic is implemented in AWS Lambda, which queries an Amazon DynamoDB table. The developer wants to expose the API over HTTPS and manage authentication and throttling. Which AWS service should the developer use to create and manage the API endpoints?

Accepted Answer

Amazon API Gateway. Amazon API Gateway is the correct choice because it is a fully managed service that enables developers to create, publish, maintain, monitor, and secure RESTful APIs at any scale. It directly supports HTTPS endpoints, integrates natively with AWS Lambda for backend logic, and provides built-in features for authentication (e.g., IAM, Cognito, Lambda authorizers) and throttling (usage plans and rate limits). This makes it the ideal service for exposing a Lambda-backed DynamoDB query as a secure, managed API.

Answer

Application Load Balancer

Answer

AWS CloudFront

Answer

Amazon S3

Question 10

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API is experiencing high latency. The developer suspects cold starts are contributing to the latency. Which action would be MOST effective in reducing cold start latency?

Accepted Answer

Increase the memory allocation of the Lambda function.. Increasing the memory allocation of a Lambda function directly correlates to allocating more CPU power, which reduces the initialization time during a cold start. AWS Lambda provisions CPU proportionally to the configured memory, so a higher memory setting speeds up the runtime environment setup and code loading, thereby lowering cold start latency.

Answer

Place the Lambda function in a VPC to improve network latency.

Answer

Enable Lambda@Edge to cache responses.

Answer

Increase the function timeout to 15 minutes.

Question 11

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a successful deployment, the environment's health turns 'Severe' and the application returns HTTP 502 errors. What is the most likely cause?

Accepted Answer

The application's requirements.txt file is missing a required dependency.. A missing dependency in requirements.txt causes the Python application to fail during startup, leading to the EC2 instances reporting an unhealthy status to the Elastic Load Balancer. Elastic Beanstalk relies on the application process to respond to health checks; if the app crashes due to an ImportError, the load balancer receives no valid HTTP response and returns 502 Bad Gateway errors. The environment health turns 'Severe' because the platform detects that the application process is not running or is failing repeatedly.

Answer

The EC2 instances have insufficient storage for the deployment.

Answer

The load balancer's health check path is incorrectly configured.

Answer

The RDS database connection string is incorrect.

Question 12

A company is using an S3 bucket to store sensitive data. They want to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What is the most secure way to enforce this?

Accepted Answer

Create a bucket policy that denies PutObject unless the x-amz-server-side-encryption header is set to aws:kms.. A bucket policy that denies PutObject unless the x-amz-server-side-encryption header equals aws:kms actively rejects any upload that does not explicitly request SSE-KMS, making it the strongest enforcement mechanism for this scenario. This policy-level Deny cannot be bypassed by users or roles, and it ensures every object is encrypted with AWS KMS keys rather than weaker or default encryption. Option A only sets a default that can be overridden by an uploader specifying a different encryption method, so it does not truly enforce SSE-KMS. Option B is too vague because it does not specify the required encryption type, allowing SSE-S3 or other algorithms, and Option D addresses public access, not encryption at rest.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Create a bucket policy that denies PutObject without encryption.

Answer

Enable S3 Block Public Access on the bucket.

Question 13

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?

Accepted Answer

Create a custom buildspec.yml file in the source code that installs the dependencies in the install phase.. The buildspec.yml file defines the build phases for AWS CodeBuild, including the install phase where you can specify commands to install dependencies (e.g., using package managers like pip, npm, or apt-get). By placing this file in the source code, the build environment automatically executes these commands on every build, ensuring all required dependencies are present and consistent across runs, which resolves intermittent failures caused by missing dependencies.

Answer

Configure environment variables in CodePipeline to set dependency paths.

Answer

Manually install dependencies on the CodeBuild build server each time.

Answer

Use AWS CodeCommit as the source repository instead of S3.

Question 14

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

Accepted Answer

S3 is not a suitable store for session state due to its higher latency compared to in-memory stores like ElastiCache or DynamoDB.. Amazon S3 now provides strong read-after-write consistency, so eventual consistency is not the cause. However, S3's higher latency compared to in-memory stores like ElastiCache or DynamoDB makes it unsuitable for session management, which requires fast, frequent reads and writes. The higher latency can cause delays in session retrieval, leading to timeouts and the login page being displayed again.

Answer

The EC2 instances do not have internet access to reach S3.

Answer

The ALB does not have sticky sessions enabled.

Answer

The application is not scaling properly, causing session loss.

Question 15

A developer has set up an AWS CodePipeline pipeline that automatically deploys a web application through a series of stages: Source, Build, Staging, and Production. The developer wants to require a manual approval before the pipeline proceeds to the Production stage. How should the developer implement this?

Accepted Answer

Add a manual approval action between the Staging and Production stages. AWS CodePipeline supports manual approval actions that can be added as a stage or between stages to pause the pipeline and require explicit approval before proceeding. By placing the manual approval action between the Staging and Production stages, the pipeline will halt after the Staging stage completes and wait for an approver to manually approve the transition to the Production stage, ensuring no automatic deployment to production occurs without human oversight.

Answer

Add a manual approval action in the Staging stage

Answer

Configure the Production stage to use a CloudFormation change set with execution role

Answer

Use an SNS topic to notify developers of the deployment