DVA-C02 Practice Questions 2 — 50 Questions

Question 1

A team wants CloudFormation to prevent accidental deletion of a production DynamoDB table during stack updates. What should they configure?

Accepted Answer

DeletionPolicy or UpdateReplacePolicy Retain as appropriate. The DeletionPolicy attribute with a value of Retain instructs AWS CloudFormation to preserve the DynamoDB table when its stack resource is deleted during a stack update or stack deletion. Similarly, UpdateReplacePolicy Retain ensures that if a resource replacement is required during an update, the existing table is kept rather than deleted. This directly prevents accidental data loss by overriding CloudFormation's default behavior of deleting resources that are removed from the template or replaced.

Answer

A larger write capacity setting

Answer

A Lambda layer

Answer

An API Gateway usage plan

Question 2

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

Accepted Answer

Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.. AWS Batch with a Fargate launch type is the ideal solution because it is purpose-built for batch processing jobs that run to completion. By scheduling the job with Amazon EventBridge, you can trigger the job once per day, and AWS Batch automatically provisions the Fargate compute environment only when the job runs, then scales down to zero after completion—eliminating costs during idle periods. This approach directly addresses the requirement to reduce costs by stopping the ECS service when not in use, without manual intervention.

Answer

Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

Answer

Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

Answer

Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

Question 3

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

Accepted Answer

Use the ephemeral storage provided by Fargate.. Fargate provides ephemeral storage (up to 20 GB by default) that persists data across container restarts within the same task but is automatically deleted when the task stops. This matches the requirement for temporary data that does not need to be shared across tasks and is cleaned up upon task termination.

Answer

Attach an Amazon EBS volume to the task.

Answer

Mount an Amazon EFS file system to the container.

Answer

Create a Docker volume using the 'tmpfs' driver.

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB health checks are failing for a few instances, but the instances themselves are running and have healthy application processes. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances is not allowing traffic from the ALB.. The ALB health checks are failing despite the instances and application processes being healthy, which indicates a network-level issue. The most likely cause is that the EC2 instances' security group is not allowing inbound traffic from the ALB's security group on the health check port (e.g., HTTP/HTTPS). Without this rule, the ALB cannot reach the health check endpoint, marking the instances as unhealthy and causing intermittent 503 errors when traffic is routed to those instances.

Answer

The ALB is not scaled to handle the traffic.

Answer

The DNS resolution via Route53 is misconfigured.

Answer

Sticky sessions are not enabled on the ALB.

Question 5

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application uses environment variables for database credentials. What is the BEST way to securely provide these credentials to the application?

Accepted Answer

Set environment properties in the Elastic Beanstalk environment configuration.. Elastic Beanstalk allows you to set environment properties in the environment configuration, which are injected as environment variables into the application's runtime. This approach keeps sensitive credentials out of the source code and deployment artifacts, adhering to the principle of least privilege and secure credential management. For a Node.js application, these environment variables can be accessed via `process.env`, providing a secure and flexible way to manage database credentials without hardcoding or storing them in files.

Answer

Store the credentials in a file in the source code repository.

Answer

Store the credentials in the application's configuration file within the deployment package.

Answer

Hardcode the credentials in the application code.

Question 6

A developer is building a serverless application using AWS Lambda and API Gateway. The Lambda function needs to access a DynamoDB table that stores sensitive customer data. The developer wants to follow the principle of least privilege. Which IAM role configuration should be used?

Accepted Answer

Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.. It adheres to the principle of least privilege by granting only the specific DynamoDB actions (e.g., GetItem, PutItem) required by the Lambda function, scoped to the exact table. The Lambda execution role is an IAM role that the Lambda service assumes, and attaching a custom policy with fine-grained permissions ensures minimal access. This approach avoids over-permissioning and follows AWS security best practices for serverless applications.

Answer

Configure a resource-based policy on the Lambda function to allow DynamoDB access.

Answer

Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

Answer

Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

Question 7

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance.. The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Answer

The Lambda function timeout is set too low for the database query.

Answer

The SAM template does not support RDS as an event source.

Answer

The Lambda function uses a runtime that is not compatible with the MySQL client.

Question 8

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. The function times out because it cannot reach S3. Since the function is in a VPC, it does not have internet access by default. To access S3, it requires either a NAT gateway/instance and an internet gateway, or a VPC endpoint for S3. Option A is incorrect because Lambda functions can be configured inside a VPC; they just need proper networking. Option B is incorrect because the question states the function has the necessary IAM permissions, so the execution role is not the issue. Option D is incorrect because security groups are stateful and typically allow outbound traffic; the more likely cause is missing routing to S3. Option C correctly identifies the missing route or endpoint.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 9

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 10

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?

Accepted Answer

Attach an IAM execution role with CloudWatch Logs permissions.. AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.

Answer

Use AWS KMS to encrypt the log data and grant permissions.

Answer

Create a resource-based policy on the Lambda function.

Answer

Store AWS access keys in environment variables.

Question 11

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.

Question 12

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.

Question 13

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 14

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

Accepted Answer

No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.. AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.

Answer

Enable encryption in the SAM template using the 'Encrypt' property.

Answer

Modify the Lambda function's code to encrypt environment variables before deployment.

Answer

Create a customer managed KMS key and specify it in the SAM template.

Question 15

A developer is deploying a microservices architecture on Amazon ECS with Fargate. Each service needs to store sensitive configuration data such as database passwords. The developer wants to avoid hardcoding secrets in the application code. Which approach should the developer use?

Accepted Answer

Store the secrets in AWS Systems Manager Parameter Store or AWS Secrets Manager and reference them in the ECS task definition using the 'secrets' parameter.. AWS Systems Manager Parameter Store and AWS Secrets Manager are purpose-built services for securely storing and managing sensitive configuration data. By referencing secrets via the `secrets` parameter in the ECS task definition, the secrets are injected into the container at runtime without being exposed in the application code, task definition plaintext, or Docker image. This approach integrates natively with ECS Fargate and supports automatic rotation of secrets.

Answer

Store the secrets in an Amazon S3 bucket and use a pre-signed URL to download them at startup.

Answer

Define the secrets as environment variables in the ECS task definition.

Answer

Encrypt the secrets using AWS KMS and store the encrypted blob in a configuration file within the Docker image.

Question 16

A developer is troubleshooting a CloudFormation stack that fails to create. The stack includes an Auto Scaling group with a launch template. The error message says 'Value (null) for parameter groupId is invalid.' What is the MOST likely cause?

Accepted Answer

The launch template references a SecurityGroupId parameter that is not provided or is misspelled.. The error 'Value (null) for parameter groupId is invalid' indicates that a SecurityGroupId parameter referenced in the launch template is either not provided or misspelled. CloudFormation resolves parameters at stack creation; if the parameter is missing or has a typo, it evaluates to null, causing the launch template to fail validation because a security group ID is required for the network interface.

Answer

The Auto Scaling group does not specify a VPC subnet.

Answer

The Auto Scaling group's user data script contains a syntax error.

Answer

The launch template specifies an invalid key pair name.

Question 17

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 18

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that allows microservices to dynamically discover each other using DNS or HTTP API calls. It integrates natively with Amazon ECS, enabling services to register themselves and resolve other services by logical names, which simplifies service discovery and load balancing across containers.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53

Question 19

A company is using AWS CodeDeploy with an in-place deployment to an Auto Scaling group. The deployment fails with the error 'Deployment failed because the deployment group does not have enough instances to deploy to'. The Auto Scaling group has a minimum size of 2, maximum size of 5, and desired capacity of 2. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

Accepted Answer

The instances in the Auto Scaling group are not passing health checks.. The error 'Deployment failed because the deployment group does not have enough instances to deploy to' occurs when there are zero healthy instances in the deployment group at the start of deployment. With CodeDeployDefault.AllAtOnce, the minimum number of healthy hosts is 0, so a single instance failure during deployment would not trigger this error. The most likely cause is that the instances in the Auto Scaling group are not passing health checks, resulting in no healthy instances available for deployment. Option C is correct.

Answer

The Auto Scaling group needs to have at least 3 instances to use AllAtOnce.

Answer

The deployment configuration is not compatible with Auto Scaling groups.

Answer

The deployment group has only 2 instances, and the deployment failed on one instance, causing the minimum healthy hosts threshold to be violated.

Question 20

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Accepted Answer

Enable default encryption.. Options B and D are correct. Enabling default encryption (B) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data from unauthorized access if the bucket is misconfigured or accessed improperly. Blocking public access at the bucket level (D) prevents accidental public exposure of data. Option A (versioning) helps recover from accidental deletions or overwrites but does not prevent data leaks. Option C (MFA Delete) adds an extra authentication step for deleting objects or changing versioning, which protects against unauthorized deletions, not leaks. Option E (cross-region replication) provides data redundancy and disaster recovery, but does not prevent data leaks.

Answer

Enable versioning.

Answer

Enable MFA Delete.

Answer

Configure cross-region replication.