DVA-C02 Practice Test 49 — 15 Questions

Question 1

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

aws deploy get-deployment-instance. The `aws deploy get-deployment-instance` command retrieves detailed information about a single instance in a deployment group, including the specific error messages and lifecycle event logs that caused the instance to fail. This allows the developer to diagnose the root cause of the failure on a particular instance, which is exactly what is needed when the overall deployment fails with a generic error message.

Answer

aws deploy get-deployment

Answer

aws deploy list-deployments

Answer

aws deploy list-deployment-instances

Question 2

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The deployment must ensure that a minimum number of instances are always running and healthy. The developer wants to deploy to 10 instances. Which deployment configuration should the developer use?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime, is correct because it ensures that only one instance is updated at a time, which guarantees that a minimum number of instances (9 out of 10) remain healthy and running throughout the deployment. This configuration is ideal for maintaining high availability and meeting strict uptime requirements.

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.MinHealthyHostsPercentage: 90

Question 3

A company runs a stateful web application on EC2 instances in an Auto Scaling group. Users report that their session data is lost when instances are replaced during scaling events. What is the best solution to preserve session state?

Accepted Answer

Use ElastiCache as a centralized session store.. ElastiCache provides a centralized, in-memory session store that is external to the EC2 instances. This ensures session data persists independently of the instance lifecycle, so when an instance is replaced during a scaling event, the new instance can retrieve the session from ElastiCache, preserving user state. This is the best solution because it decouples session state from compute resources, aligning with the stateless application pattern recommended for Auto Scaling groups.

Answer

Enable sticky sessions on the Application Load Balancer.

Answer

Store sessions in the Application Load Balancer.

Answer

Use an S3 bucket to store session data.

Question 4

A developer is deploying a serverless application using AWS SAM. The application includes an AWS Lambda function that is triggered by an S3 bucket event when an object is created. The developer wants to ensure that the Lambda function has the correct permissions to be invoked by S3. Which resource should the developer define in the SAM template?

Accepted Answer

AWS::Lambda::Permission. AWS::Lambda::Permission is the correct resource because it explicitly grants the S3 service principal permission to invoke the Lambda function when an object is created. In AWS SAM, this resource is automatically generated when you define an S3 event source on a Lambda function, but if you need to declare it manually or override permissions, you use AWS::Lambda::Permission with a SourceArn pointing to the S3 bucket and a SourceAccount to prevent confused deputy attacks.

Answer

AWS::S3::BucketPolicy

Answer

AWS::Lambda::EventSourceMapping

Answer

AWS::IAM::Role

Question 5

Which of the following are valid ways to secure access to an Amazon S3 bucket? (Choose TWO.)

Accepted Answer

Bucket policies. Bucket policies are a form of resource-based policy that you attach directly to an S3 bucket. They allow you to grant or deny access to the bucket and its objects for principals (users, roles, or AWS accounts) using the AWS JSON policy language. This is a primary and native way to control access to S3 resources, making option A correct.

Answer

CloudFront distribution

Answer

Network ACLs

Answer

Security groups

Question 6

Which THREE are valid methods to handle application configuration in AWS? (Choose three.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is a valid method for handling application configuration because it securely stores and manages sensitive configuration data such as database credentials, API keys, and other secrets. It supports automatic rotation of secrets, fine-grained access control via IAM policies, and integrates with AWS services like RDS, Redshift, and Lambda. This makes it ideal for managing dynamic configuration values that require high security and lifecycle management.

Answer

AWS CloudFormation template parameters

Answer

AWS IAM roles

Question 7

A developer is using AWS Elastic Beanstalk to deploy a web application. The environment uses an Application Load Balancer (ALB). The developer wants to perform a blue/green deployment to minimize downtime. Which TWO steps should the developer take? (Choose two.)

Accepted Answer

Deploy the new version to a separate Elastic Beanstalk environment.. Blue/green deployment requires a separate, isolated environment running the new version. Elastic Beanstalk supports this by allowing you to create a second environment (green) alongside the existing one (blue), ensuring zero overlap and no risk to the live application during deployment.

Answer

Terminate the old environment after the new environment is deployed.

Answer

Add more EC2 instances to the existing environment.

Answer

Update the existing environment with the new version.

Question 8

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with the error 'no basic authentication credentials'. The build project has an IAM role with the AmazonEC2ContainerRegistryPowerUser policy. What is the most likely cause?

Accepted Answer

The buildspec does not include the pre_build step to authenticate with ECR.. AWS CodeBuild does not automatically authenticate to Amazon ECR. The buildspec must include a pre_build phase that runs 'aws ecr get-login-password' piped to 'docker login' (or uses the ECR credential helper) to obtain temporary credentials. The IAM role's AmazonEC2ContainerRegistryPowerUser policy grants the necessary permissions, but the Docker client still needs explicit authentication before pushing.

Answer

The build project is not configured to use a VPC that can reach ECR.

Answer

The build environment does not have Docker installed.

Answer

The IAM role does not have sufficient permissions to push to ECR.

Question 9

A company is using AWS CloudFormation to deploy infrastructure. The developer needs to update a stack but wants to avoid downtime for a critical database. Which THREE strategies should the developer consider?

Accepted Answer

Use the UpdateReplace policy to create a new resource before deleting the old one.. The `UpdateReplace` policy (specifically using a `CreationPolicy` and `UpdatePolicy` with `AutoScalingReplacingUpdate`) instructs CloudFormation to create a replacement resource before deleting the original, ensuring zero downtime during a stack update that requires resource replacement. This is critical for a database where continuous availability is required.

Answer

Set the DeletionPolicy attribute to Retain on the database resource.

Answer

Use the Parameters section to set a conditional update flag.

Question 10

A developer wants to trigger an AWS Lambda function every time a new object is created in an Amazon S3 bucket. Which S3 event notification configuration should be used?

Accepted Answer

s3:ObjectCreated:*. The `s3:ObjectCreated:*` event type captures all object creation events in an S3 bucket, including PUT, POST, COPY, and multipart upload completions. This is the appropriate event notification to trigger an AWS Lambda function when a new object is created.

Answer

s3:ObjectRestore:*

Answer

s3:ReducedRedundancyLostObject:*

Answer

s3:ObjectRemoved:*

Question 11

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest and in transit. Which THREE measures should be implemented?

Accepted Answer

Use HTTPS for all requests to S3. HTTPS encrypts data in transit between the client and S3 using TLS, ensuring confidentiality and integrity during transmission. This satisfies the requirement for encryption in transit, as HTTP requests would send data in plaintext.

Answer

Use client-side encryption

Answer

Enable MFA Delete on the bucket

Question 12

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which IAM policy statement should be attached?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]}. It grants read-only access by allowing the `s3:GetObject` action (to read objects) and the `s3:ListBucket` action (to list objects in the bucket). The resources are correctly specified: `arn:aws:s3:::my-bucket` for the bucket-level `ListBucket` action and `arn:aws:s3:::my-bucket/*` for the object-level `GetObject` action. This combination provides the minimal permissions needed for read-only access without allowing write or delete operations.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 13

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to restrict access to the API so that only authenticated users can invoke it. Which API Gateway feature should be used?

Accepted Answer

API Gateway Lambda authorizer. A Lambda authorizer (formerly custom authorizer) is correct because it allows API Gateway to invoke a Lambda function that validates a token or request parameters and returns an IAM policy granting or denying access. This is the standard way to implement custom authentication logic (e.g., JWT validation, OAuth) for API Gateway REST or HTTP APIs. It directly restricts invocation to authenticated users based on the authorizer's decision.

Answer

AWS WAF

Answer

API Gateway usage plan

Answer

API Gateway resource policy

Question 14

A developer is building a RESTful API using AWS Lambda and Amazon API Gateway. The API needs to support HTTP methods GET, POST, and DELETE. The developer wants to minimize code and operational overhead. Which API Gateway integration type should the developer use?

Accepted Answer

Lambda proxy integration. Lambda proxy integration is correct because API Gateway passes the entire HTTP request (method, path, headers, query string, body) directly to the Lambda function as a structured event, and the function returns a formatted response object. This eliminates the need to write mapping templates or configure method/request/response transformations, minimizing both code and operational overhead. It natively supports GET, POST, DELETE, and any other HTTP method without per-method configuration.

Answer

Lambda custom integration

Answer

HTTP integration

Answer

Mock integration

Question 15

An organization wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The security team needs to deny any console access if MFA is not enabled. Which IAM policy statement should be used?

Accepted Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false.. It uses a Deny statement with the condition 'aws:MultiFactorAuthPresent' set to 'false', which explicitly blocks any action when MFA is not present. This is the standard approach to enforce MFA for console access, as it overrides any Allow policies by default. The Deny effect ensures that even if other policies grant access, the lack of MFA results in denial.

Answer

Deny action '*' unless 'aws:MultiFactorAuthPresent' is true.

Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false using BoolIfExists.

Answer

Allow action '*' if 'aws:MultiFactorAuthPresent' is true.