DVA-C02 Practice Test 48 — 15 Questions

Question 1

A company has a centralized logging solution where all EC2 instances send logs to a CloudWatch Logs group in a central account. The EC2 instances are in a different account (App Account). The developer configures the CloudWatch agent on the instances with the necessary IAM role. However, logs are not appearing in the central account's log group. The IAM role in the App Account has permissions to put logs to the central account's log group. What is the most likely missing configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.. For cross-account CloudWatch Logs, the central account's log group must have a resource-based policy that grants the App Account's IAM role permission to put logs. Even if the IAM role in the App Account has permissions, the destination log group must also allow the source. This is a common missing configuration.

Answer

CloudWatch Logs must be encrypted with the same KMS key in both accounts.

Answer

The log group must be in the same region as the EC2 instances.

Answer

The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

Question 2

An application uses an Amazon SQS queue to decouple microservices. The producer is sending messages, but the consumer is not processing them. The consumer is an Auto Scaling group of EC2 instances. The SQS queue's ApproximateNumberOfMessagesVisible metric is increasing. What is the MOST likely cause?

Accepted Answer

The consumer instances are not polling the SQS queue.. If the ApproximateNumberOfMessagesVisible metric keeps rising while the consumer Auto Scaling group is running, the most likely cause is that the consumer instances are not polling the queue at all. Without active long-polling ReceiveMessage calls, messages accumulate and are never processed, even though the queue and permissions may be fine. This is the most direct explanation for a growing visible-message count with no consumption.

Answer

The SQS queue policy denies access to the consumer.

Answer

The visibility timeout is set too low.

Answer

The SQS queue has a dead-letter queue configured.

Question 3

A developer is creating an IAM policy for an Amazon S3 bucket that must allow read access to a specific object only. Which policy element should be used to restrict access to the object?

Accepted Answer

Resource. The Resource element in an IAM policy specifies the object or bucket to which the policy applies. To allow read access to a specific object only, you must specify the object's ARN (e.g., arn:aws:s3:::bucket-name/object-key) in the Resource element. This restricts the policy's effect to that object.

Answer

Action

Answer

Condition

Answer

Principal

Question 4

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with an attached Amazon EBS volume. The developer wants to ensure that the EBS volume is deleted when the EC2 instance is terminated. The developer has set the DeletionPolicy attribute on the EBS volume resource to Delete. However, after terminating the EC2 instance through the console, the EBS volume is still present. The stack still exists. What is the most likely reason the volume was not deleted?

Accepted Answer

The DeletionPolicy attribute only takes effect when the CloudFormation stack is deleted, not when an individual resource is terminated.. The DeletionPolicy attribute in CloudFormation governs what happens to a resource when it is removed from the stack template or when the stack itself is deleted — not when the underlying resource (the EC2 instance) is terminated by other means. Terminating the EC2 instance through the console does not trigger CloudFormation to evaluate the DeletionPolicy on the EBS volume, so the volume persists. To have the volume deleted on instance termination, the volume must have DeleteOnTermination=true on the block device mapping, which is an EC2-level attribute, not a CloudFormation DeletionPolicy concern.

Answer

The EBS volume has a DeleteOnTermination attribute set to false.

Answer

The EBS volume is the root device of the EC2 instance.

Answer

The EC2 instance was terminated manually, not through a stack update.

Question 5

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint that invokes a Lambda function. The developer wants to pass a stage name as a parameter to the Lambda function. How should the developer define the Lambda function's environment variable in the SAM template?

Accepted Answer

Use the parameter reference 'Ref: StageName' in the environment variable mapping.. The developer should use the parameter reference 'Ref: StageName' in the environment variable mapping. In AWS SAM, you can reference parameters defined in the template using the Ref intrinsic function. This allows the stage name to be passed as an environment variable to the Lambda function.

Answer

Define the environment variable as 'Stage: dev' in the Lambda function configuration.

Answer

Use 'Fn::GetAtt: [AWS::StackName, Outputs.StageName]' to get the stage name.

Answer

Use 'Fn::ImportValue: StageName' to import from another stack.

Question 6

A developer is deploying a static website to Amazon S3. The developer wants to enable versioning to easily roll back to a previous version if the new deployment has issues. After enabling versioning on the bucket, the developer uploads the new files. How can the developer roll back to the previous version?

Accepted Answer

Copy the previous version of the object to the same key, making it the current version.. When S3 versioning is enabled, each object key holds a stack of versions with the latest one served by default. To roll back, you copy the desired previous version onto the same key; S3 creates a new 'current' version whose content matches the old one, so GET requests immediately serve the rolled-back content without deleting history. This is the standard, non-destructive rollback pattern.

Answer

Delete the current version of the object from the bucket.

Answer

Use the S3 console 'Restore' action on the bucket.

Answer

Enable 'Show versions' and then select the previous version to make it current.

Question 7

A developer notices that an RDS MySQL instance's CPU utilization is consistently above 80% during peak hours. Which AWS service can be used to analyze the database queries and identify the root cause?

Accepted Answer

RDS Performance Insights. RDS Performance Insights is purpose-built for database performance analysis: it collects and visualizes database load (Average Active Sessions) broken down by SQL statement, wait event, user, and host, so you can pinpoint which query is driving CPU above 80%. It retains up to 2 years of performance data and requires no agent installation on the DB instance. This directly answers the question of identifying the root-cause query.

Answer

RDS Enhanced Monitoring

Answer

AWS X-Ray

Answer

CloudWatch Logs Insights

Question 8

A company runs a critical application on AWS Lambda that processes real-time financial transactions. The Lambda function is triggered by an SQS queue that receives messages from an API Gateway. Recently, the team has observed an increase in processing errors and occasional data loss. Upon investigation, they find that the Lambda function's concurrency limit is set to 5, and the SQS queue has a visibility timeout of 30 seconds. The function typically takes 2 seconds to process a message, but during peak hours, the queue depth grows to thousands of messages. The errors occur when the Lambda function throws an exception, causing the message to return to the queue after the visibility timeout expires. However, some messages are never processed again and are eventually lost. The team suspects that the messages are being sent to the dead-letter queue (DLQ) after multiple retries, but the DLQ is not configured. The team needs to ensure that no messages are lost and that processing errors are handled appropriately. What should the team do to resolve this issue?

Accepted Answer

Configure a dead-letter queue on the SQS source queue and set the maximum receives to 3. Implement error handling in the Lambda function to catch exceptions and log them.. Messages are lost because the SQS source queue has no dead-letter queue and the Lambda function has no error handling, so after repeated failed receives messages are discarded or expire. Configuring a DLQ on the source queue with a maximumReceiveCount of 3 preserves failed messages, and adding try/catch error handling in the function ensures exceptions are logged and handled rather than silently failing. This directly addresses both the data loss and the error-handling requirement.

Answer

Increase the Lambda concurrency limit to 100 and set the SQS visibility timeout to 60 seconds.

Answer

Configure an Amazon CloudWatch alarm on the queue depth and set a Lambda function as the on-failure destination for asynchronous invocations.

Answer

Change the Lambda invocation mode to synchronous and use API Gateway as a proxy to invoke the function directly.

Question 9

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to write logs to CloudWatch Logs. Which of the following is required to allow this?

Accepted Answer

Attach an IAM policy to the Lambda execution role with CloudWatch Logs permissions. The Lambda execution role is the IAM role that Lambda assumes when the function runs, and it defines what AWS services and resources the function can access. To write logs to CloudWatch Logs, the execution role must have an IAM policy attached that grants permissions for actions like logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Without these permissions, the function cannot write logs, even if it has the necessary code. Therefore, attaching an IAM policy to the Lambda execution role with CloudWatch Logs permissions is required.

Answer

Add a resource-based policy to the Lambda function

Answer

Configure the S3 bucket to trigger Lambda, and Lambda automatically logs to CloudWatch

Answer

Create an IAM role for CloudWatch Logs and assign it to the Lambda function

Question 10

A developer is tasked with rotating database credentials stored in AWS Secrets Manager for an RDS MySQL instance. The rotation must occur automatically every 30 days. What is the BEST approach?

Accepted Answer

Configure automatic rotation in Secrets Manager using a rotation Lambda function.. Secrets Manager natively supports automatic rotation via a Lambda rotation function, and for RDS MySQL it provides a built-in rotation template that handles the two-step process of creating a new password and updating both the database and the secret. Configuring rotation with a 30-day schedule is a single setting in the console or CLI. This is the purpose-built, lowest-effort solution.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled Lambda to rotate them.

Answer

Use RDS automatic password rotation and have the application fetch the new password from RDS.

Answer

Use an IAM role for the RDS instance and rotate the role's credentials.

Question 11

A developer is troubleshooting a slow-running Amazon RDS for MySQL query. The query performance has degraded over time. Which approach should the developer take first to identify the cause?

Accepted Answer

Enable Performance Insights and review the database load. Amazon RDS Performance Insights is the first-line diagnostic tool for identifying why a query has degraded — it visualizes database load (DBLoad) sliced by SQL statement, wait event, user, and host, showing exactly which query and which wait state is consuming resources. Enabling it is non-invasive and provides the evidence needed before making any infrastructure change. The other options are remediation steps that should only follow diagnosis.

Answer

Upgrade the DB instance to a larger instance class

Answer

Create a read replica to offload read traffic

Answer

Enable the MySQL query cache

Question 12

A company is building a serverless application using AWS Lambda and Amazon API Gateway. The application needs to process user uploads to an S3 bucket. The Lambda function should be invoked only when new objects are created in the bucket. Which service should be used to trigger the Lambda function?

Accepted Answer

Amazon S3 event notifications. Amazon S3 event notifications can be configured to trigger AWS Lambda functions when specific events occur in an S3 bucket, such as when a new object is created (e.g., s3:ObjectCreated:*). This is the native and most direct way to invoke a Lambda function in response to S3 object uploads. It requires no additional polling or infrastructure and is highly scalable.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Events

Answer

Amazon Simple Queue Service (SQS)

Question 13

A company uses AWS OpsWorks for configuration management. They want to migrate to AWS Systems Manager for patching and automation. They have a fleet of EC2 instances running Amazon Linux 2. Which Systems Manager capability should they use to automate patching?

Accepted Answer

Patch Manager. AWS Systems Manager Patch Manager is the capability specifically designed to automate the process of patching managed nodes, including EC2 instances running Amazon Linux 2. It uses patch baselines to define approved patches and can apply them on a schedule via maintenance windows or on demand. This directly replaces the patching functionality previously provided by OpsWorks.

Answer

State Manager

Answer

Run Command

Answer

Maintenance Windows

Question 14

A company is using AWS CodePipeline to deploy a web application. The pipeline must securely store and use database credentials. Which AWS service should the developer use to store the credentials and retrieve them during deployment?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving sensitive credentials like database passwords. It integrates natively with CodePipeline/CodeBuild via the AWS CLI or SDK, supports automatic rotation via Lambda, and provides fine-grained IAM access control and encryption with KMS. This makes it the correct choice for securely storing and retrieving database credentials during deployment.

Answer

IAM role attached to the CodePipeline service role.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Amazon DynamoDB with server-side encryption.

Question 15

A company is deploying a critical application using AWS CloudFormation. The stack creation fails with a 'ROLLBACK_COMPLETE' status. The engineer wants to troubleshoot the failure without deleting the stack. What should the engineer do?

Accepted Answer

Use the 'aws cloudformation describe-stack-events' command to view the error messages.. When a CloudFormation stack enters ROLLBACK_COMPLETE, the stack is in a terminal state and cannot be updated or re-created directly. The only way to troubleshoot without deleting the stack is to inspect the stack events, which contain detailed error messages for each resource failure. The 'aws cloudformation describe-stack-events' command returns a chronological list of events, including the exact reason why resource creation failed, such as insufficient permissions, invalid AMI ID, or dependency issues. This allows the engineer to diagnose the root cause while preserving the stack for further analysis.

Answer

Use the 'aws cloudformation create-change-set' command with a rollback trigger.

Answer

Recreate the stack using the '--on-failure DO_NOTHING' option.

Answer

Delete the stack and recreate it with the '--disable-rollback' flag.