DVA-C02 Practice Test 46 — 15 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to ensure that the deployment does not cause any downtime and that new instances are fully registered with the load balancer before old instances are terminated. Which deployment policy should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Rolling with an additional batch. The Rolling with an additional batch deployment policy launches a new batch of instances in addition to the current ones, registers them with the load balancer, and only then terminates the old instances. This ensures zero downtime because the new instances are fully serving traffic before any old instances are removed, unlike standard rolling deployments which terminate old instances before new ones are fully ready.

Answer

Immutable

Answer

Rolling

Answer

All at once

Question 2

A developer has an Amazon S3 bucket containing private user documents. The application must generate a time-limited URL for users to download their own documents without requiring the users to have AWS credentials. Which solution should the developer use?

Accepted Answer

Create a pre-signed URL for each object using the AWS SDK with an appropriate expiration time.. Pre-signed URLs allow temporary, time-limited access to private S3 objects without requiring the user to have AWS credentials. The developer generates the URL server-side using the AWS SDK, embedding an expiration time, and the user can download the object directly via HTTP GET. This meets the requirement of granting ephemeral access to specific documents for unauthenticated users.

Answer

Use CloudFront signed URLs with an origin access identity (OAI) to restrict access to the S3 bucket.

Answer

Set a bucket policy that allows public read access for the specific users based on their IP addresses.

Answer

Provide the users with IAM user credentials that have read access to the bucket.

Question 3

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 4

Which TWO are valid deployment strategies supported by AWS CodeDeploy? (Choose TWO.)

Accepted Answer

In-place deployment. AWS CodeDeploy supports in-place deployments (option B) where the application is updated on the existing instances without provisioning new ones. This is a valid deployment strategy that updates the current fleet by stopping and starting the application, and it is one of the two core strategies explicitly documented by AWS.

Answer

Immutable deployment

Answer

Canary deployment

Answer

All at once deployment

Question 5

A Lambda function must retrieve feature flags at runtime with low latency and controlled rollout. Which AWS service is most appropriate?

Accepted Answer

AWS AppConfig. AWS AppConfig is the correct choice because it is purpose-built for managing application configuration at runtime, including feature flags, with support for controlled rollouts (e.g., percentage-based deployments, canary releases) and low-latency retrieval via the AppConfig agent or direct API calls. It integrates with AWS Lambda to fetch configuration values on-demand without requiring a full deployment, enabling dynamic feature toggling.

Answer

AWS CloudFormation Parameters

Answer

AWS IAM Access Analyzer

Answer

Amazon Inspector

Question 6

A company uses Amazon CloudFront to distribute content from an S3 bucket. The content is static and rarely changes. The developer wants to reduce the load on the origin and improve performance for users. Which configuration change would achieve this?

Accepted Answer

Increase the TTL (Time to Live) for the cache behavior.. Increasing the TTL for the cache behavior tells CloudFront edge locations to retain cached copies of the static content for a longer period before re-validating with the origin S3 bucket. This reduces the number of requests that reach the origin, lowering load on the S3 bucket, and improves user performance by serving content directly from the edge cache more frequently.

Answer

Disable caching for the distribution.

Answer

Enable Lambda@Edge to process requests at edge locations.

Answer

Decrease the TTL (Time to Live) for the cache behavior.

Question 7

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

Accepted Answer

Implement retry logic with exponential backoff in the Lambda function.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is exceeding the write capacity units (WCUs) provisioned for the DynamoDB table. Implementing retry logic with exponential backoff in the Lambda function allows it to handle throttling gracefully by pausing and retrying failed writes, which is the standard AWS-recommended pattern for managing DynamoDB throttling.

Answer

Decrease the batch size of the Kinesis event source mapping.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the memory allocated to the Lambda function.

Question 8

A CloudFormation stack update fails and rolls back. Which two practices help diagnose and reduce future deployment risk?

Accepted Answer

Review stack events and resource status reasons. Reviewing stack events and resource status reasons in CloudFormation provides detailed error messages for each resource that failed during the update. This allows you to pinpoint the exact cause of the failure, such as insufficient IAM permissions, a resource limit exceeded, or a dependency conflict. Analyzing these events is essential for diagnosing issues and preventing similar failures in future deployments.

Answer

Delete the stack immediately without checking events

Answer

Disable rollback for all production deployments permanently

Question 9

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The Lambda function queries an Amazon RDS database. Under heavy load, the database connection pool is exhausted, causing errors. What is the BEST way to manage database connections in this serverless architecture?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between Lambda and RDS, managing a pool of database connections that can be reused across multiple concurrent Lambda invocations. This prevents connection exhaustion under heavy load without requiring code changes, as the proxy handles connection multiplexing and keeps idle connections warm.

Answer

Migrate the database to Amazon DynamoDB.

Answer

Increase the concurrency limit of the Lambda function.

Answer

Use Amazon ElastiCache to cache database connections.

Question 10

A developer is deploying a microservices application on Amazon ECS with the Fargate launch type. The application uses an Application Load Balancer (ALB) to route traffic. The developer wants to perform a blue/green deployment with automated traffic shifting using AWS CodeDeploy. What is the minimum number of target groups required for this deployment?

Accepted Answer

Two. In a blue/green deployment with AWS CodeDeploy and an Application Load Balancer (ALB) on Amazon ECS (Fargate), two target groups are required: one for the 'blue' (current) environment and one for the 'green' (new) environment. CodeDeploy shifts traffic from the blue target group to the green target group by updating the ALB listener rules, allowing zero-downtime deployments and automated rollback if needed.

Answer

One

Answer

Three

Answer

Four

Question 11

A developer is building a serverless application using AWS SAM. The application includes a Lambda function that needs read-only access to an S3 bucket. The developer wants to use SAM's built-in policy templates to grant this permission. Which policy template should be used in the SAM template?

Accepted Answer

S3ReadPolicy. The S3ReadPolicy template is the correct choice because it grants read-only access to an S3 bucket, which aligns with the requirement for the Lambda function. AWS SAM provides this built-in IAM policy template to simplify attaching least-privilege permissions, specifically allowing s3:GetObject, s3:ListBucket, and similar read operations.

Answer

S3CrudPolicy

Answer

S3FullAccessPolicy

Answer

S3StreamPolicy

Question 12

A developer needs to store application configuration data, such as database connection strings and third-party API keys, securely. The data must be encrypted at rest and automatically rotated. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, encrypt, and automatically rotate secrets such as database connection strings and API keys. It integrates with AWS KMS for encryption at rest and provides built-in rotation capabilities for supported services like Amazon RDS, Redshift, and DocumentDB, meeting the requirement for automatic rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 13

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses a MySQL database. During deployment, the developer needs to apply database schema migrations. Which approach should the developer use to run database migrations as part of the Elastic Beanstalk deployment?

Accepted Answer

Use an .ebextensions configuration file to run a migration script during deployment.. Elastic Beanstalk supports .ebextensions configuration files that can execute custom commands or scripts during deployment. By placing a migration script (e.g., a shell script that runs `mysql` commands or a framework migration tool) in the `.ebextensions` directory and using the `commands` or `container_commands` key, the developer can ensure the migration runs automatically after the application is deployed but before the new environment serves traffic. This approach integrates the migration into the deployment lifecycle without external dependencies.

Answer

Configure an RDS event subscription to trigger a Lambda function that runs migrations.

Answer

Run the migration script as a scheduled task using CloudWatch Events.

Answer

Use AWS CodeDeploy's AppSpec file to run the migration script.

Question 14

A developer is troubleshooting an AWS Lambda function that is triggered by an Amazon SQS queue. The function processes messages but occasionally fails. The failed messages are not being sent to the dead-letter queue (DLQ). What is the most likely reason?

Accepted Answer

The SQS queue's redrive policy is not configured.. When Lambda is triggered by SQS, the recommended approach is to configure a dead-letter queue (DLQ) on the SQS queue itself using a redrive policy. This ensures that messages that fail processing after reaching the maximum receive count are automatically moved to the DLQ. Option B is correct because the absence of a redrive policy means failed messages remain in the main queue or are discarded, not sent to a DLQ. Option D is incorrect; configuring a DLQ on the Lambda function is intended for asynchronous invocations, not SQS-triggered Lambda. Option A is incorrect because the redrive policy does not rely on Lambda's IAM role; it is a configuration on the SQS queue. Option C is incorrect because reserved concurrency set to 0 would prevent all invocations, but the issue described is about occasional failures, not complete lack of invocation.

Answer

The Lambda function's execution role does not have permission to send messages to the DLQ.

Answer

The Lambda function's reserved concurrency is set to 0.

Answer

The Lambda function does not have a dead-letter queue configured.

Question 15

A developer is building a serverless application using AWS Step Functions to orchestrate multiple AWS Lambda functions. One of the Lambda functions occasionally fails due to a transient error. The developer wants the Step Functions execution to automatically retry the failed task up to three times with exponential backoff. Which configuration should the developer set in the Step Functions state machine definition?

Accepted Answer

Use the Amazon States Language (ASL) Retry field in the Task state definition.. The Amazon States Language (ASL) provides a native Retry field within a Task state definition that allows you to specify retry policies, including a maximum retry count and exponential backoff. This is the intended mechanism for handling transient failures in Step Functions without requiring custom code or external retry logic.

Answer

Add a Retry clause in the Lambda function's configuration with a maximum retry count of 3.

Answer

Wrap the Lambda function invocation in a custom while loop within the function code.

Answer

Use the Amazon States Language Catch field in the Task state to redirect to a retry logic.