DVA-C02 Practice Questions 2 — 50 Questions

Question 1

A company is using AWS CloudFormation to deploy and manage infrastructure. The developer wants to implement a CI/CD pipeline that automatically deploys CloudFormation stacks. The pipeline should be able to create, update, and delete stacks. Which THREE AWS services should the developer use together?

Accepted Answer

AWS CodeBuild. Options A, B, and E are correct because CodePipeline orchestrates the pipeline, CodeBuild can run scripts or validate templates, and CloudFormation performs the stack operations. Option C is wrong because CodeDeploy is for application deployment, not CloudFormation. Option D is wrong because Lambda can be used but is not required.

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 2

Refer to the exhibit. An IAM policy is attached to an IAM role used by an EC2 instance in a CodeDeploy deployment group. The deployment fails with 'Access Denied' when the CodeDeploy agent tries to register the application revision. What is the most likely cause?

Accepted Answer

The policy does not include the 'codedeploy:PutApplicationRevision' action.. Option A is correct because the policy is missing 'codedeploy:PutApplicationRevision' permission. The 'RegisterApplicationRevision' action is not a valid CodeDeploy API call; the correct action is 'PutApplicationRevision'. Option B is wrong because the actions are allowed, not denied. Option C is wrong because the policy uses '*' resource. Option D is wrong because the instance profile role is for EC2, not CodeDeploy.

Answer

The resource is set to '*' which is not allowed for CodeDeploy actions.

Answer

The role is not associated with the CodeDeploy service.

Answer

The policy is missing an explicit deny for other actions.

Question 3

Refer to the exhibit. A developer creates this CloudFormation template and tries to deploy it. The deployment fails with 'CREATE_FAILED' for the S3 bucket resource. What is the most likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. Option D is correct because bucket names must be globally unique, and 'my-app-data-12345' may already exist. Option A is wrong because S3 buckets can be created without a bucket policy. Option B is wrong because the template does not include versioning configuration. Option C is wrong because the bucket name is not required to be in a specific format.

Answer

The template does not enable versioning on the bucket.

Answer

The bucket name must be in all lowercase letters.

Answer

The template does not specify a bucket policy.

Question 4

Refer to the exhibit. A developer is troubleshooting a failed CodeDeploy deployment to an EC2 Auto Scaling group. The instance logs show that the 'BeforeInstall' script failed with exit code 1. What should the developer do to resolve the issue?

Accepted Answer

Review the BeforeInstall script for errors and fix them.. Option C is correct because the BeforeInstall hook script failed, and the developer should review the script's logic and fix any errors. Option A is wrong because the scripts location is correct if the error is exit code 1. Option B is wrong because the IAM role likely has sufficient permissions if the script runs. Option D is wrong because the CodeDeploy agent is running if it executes scripts.

Answer

Ensure the CodeDeploy agent is installed and running on the instance.

Answer

Verify that the scripts location in the AppSpec file is correct.

Answer

Check that the instance's IAM role has permissions to download the revision.

Question 5

A development team is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'HealthCheck' error. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). What is the MOST likely cause of this error?

Accepted Answer

The ALB target group health check is misconfigured or the application is not responding to health check requests.. Option B is correct because CodeDeploy uses the ALB health check to determine instance health during deployment. If the health check fails, CodeDeploy considers the instance unhealthy and may fail the deployment. Option A is wrong because CodeDeploy does not require IAM roles for EC2 instances? Actually it does, but missing role would cause different error. Option C is wrong because the deployment group is correctly configured with the ALB. Option D is wrong because an incorrect deployment configuration would not cause a health check error specifically.

Answer

The EC2 instances do not have the correct IAM instance profile attached.

Answer

The deployment configuration is set to 'AllAtOnce' which does not support health checks.

Answer

The deployment group is not configured with the ALB target group.

Question 6

A company wants to deploy a serverless application using AWS Lambda and API Gateway. The deployment process must support automatic rollbacks if the new version fails CloudWatch alarms. Which AWS service should be used to orchestrate this deployment?

Accepted Answer

AWS CodeDeploy. Option D is correct. AWS CodeDeploy can be used with Lambda to perform canary or linear deployments and automatically roll back based on CloudWatch alarms. Option A is wrong because CloudFormation does not natively support canary deployments or automatic rollback based on alarms for Lambda. Option B is wrong because AWS Elastic Beanstalk is for web applications, not serverless. Option C is wrong because AWS CodePipeline orchestrates build/test/deploy but does not handle canary deployments and rollback itself.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation with a change set

Answer

AWS CodePipeline

Question 7

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?

Accepted Answer

Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.. Option C is correct. The easiest and most efficient way is to add a CloudFront invalidation step in the pipeline to invalidate the cache after the S3 deploy. Option A is wrong because reducing TTL is not immediate and still may serve stale content. Option B is wrong because updating the S3 bucket policy does not affect CloudFront cache. Option D is wrong because manually invalidating is one-time but not automated for future deployments.

Answer

Manually create a CloudFront invalidation after each deployment.

Answer

Reduce the CloudFront distribution's default TTL to 0.

Answer

Update the S3 bucket policy to allow public read access.

Question 8

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The deployment must ensure zero downtime. Which ECS deployment configuration should be used?

Accepted Answer

Blue/green deployment using AWS CodeDeploy. Option D is correct. Blue/green deployment with CodeDeploy allows you to shift traffic gradually and automatically roll back if issues arise, ensuring zero downtime. Option A is wrong because rolling update can cause downtime if not configured properly? Actually rolling update can also achieve zero downtime if you have enough capacity, but the question asks for config that ensures zero downtime, and blue/green is more reliable. Option B is wrong because 'DAEMON' scheduling strategy is for running one task per instance, not for zero-downtime deployment. Option C is wrong because 'REPLICA' is a task placement strategy, not a deployment type.

Answer

Rolling update with a minimum healthy percent of 50% and maximum percent of 200%

Answer

Set the task placement strategy to REPLICA

Answer

Use the DAEMON scheduling strategy with a deployment circuit breaker

Question 9

A developer is using AWS SAM to deploy a serverless application. The SAM template defines an API Gateway REST API and several Lambda functions. During deployment, the developer receives an error: 'Resource creation cancelled' for the API Gateway resource. The developer has sufficient IAM permissions. What is the MOST likely cause?

Accepted Answer

A stack policy is preventing the creation of the API Gateway resource.. Option C is correct. AWS SAM uses AWS CloudFormation to deploy resources. If a resource creation is cancelled, it often indicates a stack policy that prevents creation or modification of certain resources. Option A is wrong because a missing AWS::Serverless::Api would cause a different error. Option B is wrong because invalid YAML would cause a template validation error. Option D is wrong because Lambda function limit would cause a different error.

Answer

The AWS account has reached the limit of API Gateway REST APIs.

Answer

The SAM template has a syntax error in the YAML file.

Answer

The SAM template does not include an AWS::Serverless::Api resource.

Question 10

A developer is deploying a web application using AWS Elastic Beanstalk. The application experiences high traffic during peak hours. The developer wants to ensure that the environment can scale out quickly without manual intervention. Which Elastic Beanstalk configuration should be used?

Accepted Answer

Configure Auto Scaling triggers based on CloudWatch alarms.. Option B is correct. Auto Scaling triggers based on CloudWatch alarms allow automatic scaling. Option A is wrong because fixed number of instances does not scale. Option C is wrong because time-based scaling is not dynamic. Option D is wrong because manual scaling is not automatic.

Answer

Use a scheduled scaling action to increase capacity during peak hours.

Answer

Manually add EC2 instances during peak hours.

Answer

Set the environment to use a fixed number of EC2 instances.

Question 11

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. Options A and C are correct. The '--rollback-configuration' parameter can specify CloudWatch alarm thresholds that trigger rollback. Option C: Setting '--disable-rollback' to false (i.e., not disabling rollback) means rollback is enabled. Option B is wrong because '--on-failure' is only for stack creation, not update. Option D is wrong because a stack policy does not control rollback behavior. Option E is wrong because change sets do not enable automatic rollback.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 12

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. Options A, B, and D are correct. CodeDeploy requires a CodeDeploy application and deployment group. An ECS service with a load balancer is also required. Option C is wrong because an ECS cluster is required, but the question asks for components, and the cluster is implicit; however, the deployment group references the ECS service, so the cluster is needed. But among options, A, B, D are explicitly required. Option E is wrong because a target tracking scaling policy is not required for blue/green deployment.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 13

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Accepted Answer

Configure automatic rollback based on CloudWatch alarms.. Options B and D are correct. Gradual traffic shifting (canary or linear) and automatic rollback based on CloudWatch alarms reduce risk. Option A is wrong because deploying to all instances at once increases risk. Option C is wrong because skipping health checks increases risk. Option E is wrong because manual approval gate introduces delay but does not reduce risk of failure; it can help catch issues but not specifically reduce deployment failure risk.

Answer

Disable health checks to prevent false positives.

Answer

Require a manual approval step before deployment.

Answer

Deploy to all instances at once to ensure consistency.

Question 14

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails, and the rollback is triggered. However, the rollback also fails. What is a likely cause?

Accepted Answer

The rollback deployment uses an AppSpec file that references a lifecycle hook that does not exist in the current environment.. Option D is correct because if the rollback tries to deploy the previous version, but that version's AppSpec file references a hook that no longer exists in the environment (e.g., a previously deleted directory), the rollback fails. Options A, B, and C are incorrect: insufficient capacity would cause the original deployment to fail differently, a misconfigured target group would affect traffic but not rollback, and a missing S3 bucket would cause the original deployment to fail, not the rollback specifically.

Answer

The target group for the load balancer is not properly configured.

Answer

The Amazon S3 bucket containing the deployment artifacts is missing.

Answer

The Auto Scaling group does not have sufficient capacity to run the rollback.

Question 15

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer runs 'sam deploy' and receives an error: 'Error: Failed to create changeset for the stack.' What is a common cause of this error?

Accepted Answer

The SAM template contains a syntax error.. Option C is correct because the SAM template must be valid JSON or YAML; malformed syntax causes the changeset creation to fail. Options A, B, and D are incorrect: missing S3 bucket causes a different error, insufficient IAM permissions cause an authorization error, and CodeDeploy is not involved in SAM deployments.

Answer

The S3 bucket specified for artifacts does not exist.

Answer

The IAM user does not have permission to create CloudFormation stacks.

Answer

AWS CodeDeploy is not configured for the application.

Question 16

A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the encryption condition is not met.. Option A is correct because an S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.

Answer

Configure default encryption on the bucket with SSE-KMS.

Answer

Enable S3 Object Lock.

Answer

Use a CloudTrail trail to monitor uploads.

Question 17

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 18

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a successful deployment, the environment's health turns 'Severe' and the application returns HTTP 502 errors. What is the most likely cause?

Accepted Answer

The application's requirements.txt file is missing a required dependency.. Option A is correct because if the application's dependencies (e.g., Python packages) are not included or installed, the application fails to start, causing a 502 error. Option B is incorrect because an incorrectly configured load balancer would cause 503 or 504 errors. Option C is incorrect because exceeding instance storage would cause disk full errors, not 502. Option D is incorrect because RDS connection string misconfiguration would cause application errors but not necessarily 502; the web server would still respond.

Answer

The EC2 instances have insufficient storage for the deployment.

Answer

The load balancer's health check path is incorrectly configured.

Answer

The RDS database connection string is incorrect.

Question 19

A developer is using AWS CodeBuild to compile and test code. The build phase fails with the error: 'BUILD_FAILED: Error: No such file or directory.' What is the most likely cause?

Accepted Answer

The buildspec.yml file references a file or directory that does not exist in the source code.. Option C is correct because the error indicates that a file referenced in the buildspec.yml does not exist, often due to an incorrect path. Options A and B are incorrect: missing environment variables cause different errors, and insufficient permissions cause access denied errors. Option D is incorrect because network timeout errors are not related to file not found.

Answer

The build environment has a network timeout when accessing external dependencies.

Answer

The IAM role for CodeBuild does not have permissions to access the source repository.

Answer

The build environment does not have the required environment variables set.

Question 20

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?

Accepted Answer

No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.. Option A is correct because SAM automatically enables encryption at rest for environment variables using AWS KMS. Option B is wrong because the encryption is done by default. Option C is wrong because manual KMS key creation is not required for default encryption. Option D is wrong because the serverless function handler does not affect encryption.

Answer

Enable encryption in the SAM template using the 'Encrypt' property.

Answer

Modify the Lambda function's code to encrypt environment variables before deployment.

Answer

Create a customer managed KMS key and specify it in the SAM template.