DVA-C02 Practice Exam 51 — 20 Questions

Question 1

A developer needs to encrypt secrets (database passwords) that are used by an application running on EC2. The application retrieves the secrets at startup. Which combination of services provides the MOST secure and manageable solution?

Accepted Answer

Store the secrets in AWS Secrets Manager and use an IAM role to access them.. Option B is correct because AWS Secrets Manager is designed for rotating secrets and integrates with IAM. Option A is wrong because SSM Parameter Store does not have native rotation. Option C is wrong because S3 with KMS lacks automatic rotation. Option D is wrong because environment variables are not secure.

Answer

Encrypt the secrets with AWS KMS and store them in an S3 bucket with a bucket policy.

Answer

Store the secrets in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Hardcode the secrets in the application code and encrypt the code.

Question 2

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)

Accepted Answer

Encryption at rest can be enabled when you create the DB instance.. Options A, C, and E are correct. Encryption at rest can be enabled when creating the DB instance, and it encrypts data, backups, read replicas, and snapshots. Option B is wrong because encryption cannot be enabled after creation. Option D is wrong because read replicas must be encrypted if the source is encrypted.

Answer

Encryption at rest can be enabled on an existing unencrypted DB instance.

Answer

Read replicas of an encrypted instance can be unencrypted.

Question 3

A developer is deploying a serverless application using AWS SAM. The developer wants to define a Lambda function that is invoked by an Amazon API Gateway REST API. Which SAM resource type should the developer use to define the API?

Accepted Answer

AWS::Serverless::Api. Option B is correct because AWS::Serverless::Api defines an API Gateway REST API in SAM. Option A is wrong because AWS::Serverless::Function defines a Lambda function. Option C is wrong because AWS::ApiGateway::RestApi is a raw CloudFormation resource, not a SAM shorthand. Option D is wrong because AWS::Serverless::SimpleTable defines a DynamoDB table.

Answer

AWS::Serverless::SimpleTable

Answer

AWS::ApiGateway::RestApi

Answer

AWS::Serverless::Function

Question 4

A developer is using AWS Elastic Beanstalk to deploy a Python web application. The developer wants to run database migrations before the application starts. Which TWO methods can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Use an .ebextensions configuration file with container_commands.. Options B and D are correct. Option B: .ebextensions with container_commands can run commands during deployment. Option D: A Procfile can define a command that runs migrations as part of the web process. Option A is wrong because cron.yaml is for scheduled tasks. Option C is wrong because an AWS Lambda function is not automatically integrated. Option E is wrong because it is not a standard Elastic Beanstalk mechanism.

Answer

Use an AWS Lambda function that triggers on deployment.

Answer

Add a pre-deployment hook to the application source code.

Answer

Add a cron.yaml file to schedule the migration.

Question 5

A company uses AWS Elastic Beanstalk to deploy a PHP application. The application requires write access to the /tmp directory on the EC2 instances. The deployment uses a custom platform. After a recent deployment, the application fails to write to /tmp. The operations team verifies that the instance security group and NACLs allow all outbound traffic. What is the MOST likely cause?

Accepted Answer

The custom platform has a read-only root filesystem.. Option B is correct: Elastic Beanstalk uses instance profiles; if the profile lacks permissions to write to /tmp (though /tmp is local filesystem, but if using EFS or similar, it might be an issue; however, /tmp is typically writable by default. But the question implies a permissions issue: the instance profile might not have permissions to mount or access certain resources. Actually, /tmp is local, so permissions are OS-level. The likely cause is that the custom platform has read-only root filesystem or the application user does not have write permission. Option B (instance profile) is plausible if /tmp is mounted from an external source. But a better answer: Option C (read-only root filesystem) is a common Elastic Beanstalk custom platform issue. However, standard Elastic Beanstalk environments have writable /tmp. Given the custom platform, the most likely is that the platform configuration sets root filesystem as read-only. So Option C is correct.

Answer

The application is running as an unprivileged user without write access to /tmp.

Answer

The security group is blocking outbound traffic to the S3 bucket.

Answer

The instance profile does not have permissions to write to the S3 bucket.

Question 6

A company wants to deploy a microservices application on Amazon ECS. They need to update services with zero downtime and automatic rollback on failure. Which deployment controller should they use?

Accepted Answer

Rolling update (ECS default). The correct answer is B. ECS supports rolling update (default) which gradually replaces tasks. With minimum healthy percent and maximum percent settings, zero downtime is possible, and rollback can be configured via CloudWatch alarms. Option A (Blue/green) is available via CodeDeploy, not native ECS controller. Option C (External) is for external deployments. Option D (Daemon) runs one task per instance.

Answer

External deployment controller

Answer

Daemon scheduling strategy

Answer

Blue/green deployment

Question 7

A developer runs the AWS CLI command shown in the exhibit. The deployment is created successfully, but the CodeDeploy agent on the target instances does not download the revision. What is the most likely cause?

Accepted Answer

The S3 object version is not specified.. Option B is correct. The command does not specify the 'etag' or 'version' parameter. If the S3 bucket has versioning enabled, the revision might be ambiguous. Option A is incorrect; the command creates a deployment, which is correct. Option C is incorrect; the bundle type is specified. Option D is incorrect; the bucket name is provided.

Answer

The bundle type should be 'tar' instead of 'zip'.

Answer

The bucket name is incorrect.

Answer

The deployment group name is misspelled.

Question 8

A company is deploying a new microservice using AWS Lambda. The deployment pipeline uses AWS CodeBuild and AWS CodePipeline. The team wants to automatically roll back to the previous function version if the new version fails CloudWatch alarms. Which deployment strategy should they implement?

Accepted Answer

Canary deployment with a CloudWatch alarm-based rollback. Option D is correct because AWS Lambda supports traffic shifting with canary deployments, and the team can configure CloudWatch alarms to trigger a rollback to the previous version. Option A is incorrect because a rolling update is not natively supported by Lambda. Option B is incorrect because Blue/Green deployment is a separate concept but not the standard term for Lambda traffic shifting. Option C is incorrect because immutable deployments are not automatically rolled back based on alarms.

Answer

Rolling update with a pre-traffic hook

Answer

Immutable deployment with an automated rollback

Answer

Blue/Green deployment with an AWS CodeDeploy configuration

Question 9

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift traffic gradually. Which SAM resource attribute should they configure?

Accepted Answer

DeploymentPreference. Option A is correct because the DeploymentPreference attribute in the AWS::Serverless::Function resource allows configuring canary deployments with CodeDeploy. Option B is incorrect because AutoPublishAlias is used for automatic alias creation but not for canary traffic shifting. Option C is incorrect because StageName is for API Gateway stage name. Option D is incorrect because Events define event sources.

Answer

StageName

Answer

Events

Answer

AutoPublishAlias

Question 10

A team is deploying a containerized application on Amazon ECS using Fargate. The application requires high availability and must be deployed across multiple Availability Zones. The team wants to automate the deployment process using AWS CodePipeline. What is the most efficient way to update the ECS service with a new task definition?

Accepted Answer

Use the ECS deploy action in CodePipeline with the 'Immediate' deployment option to update the service.. Option D is correct because CodePipeline can use the ECS deploy action with the 'Immediate' deployment option to update the ECS service to use the new task definition without downtime. Option A is wrong because manually updating the service is not automated. Option B is wrong because using CloudFormation to update the stack is possible but less efficient for frequent updates. Option C is wrong because Lambda updating the service requires custom code and is more complex.

Answer

Use an AWS Lambda function that calls the ECS UpdateService API with the new task definition.

Answer

Use the AWS Management Console to update the ECS service with the new task definition.

Answer

Use AWS CloudFormation to update the ECS service by updating the stack with the new task definition.

Question 11

Refer to the exhibit. A developer ran the AWS CLI command and received the output shown. What is the most likely cause of the UPDATE_FAILED status?

Accepted Answer

The CloudFormation template specified an unsupported runtime for the Lambda function.. Option B is correct because the error message indicates that the runtime nodejs18.x is not supported. The developer likely specified an unsupported runtime in the CloudFormation template. Option A is incorrect because IAM permissions would give a different error. Option C is incorrect because the function name is valid. Option D is incorrect because timeout is not a runtime issue.

Answer

The Lambda function's execution role does not have sufficient permissions.

Answer

The Lambda function's timeout value is too high.

Answer

The Lambda function name conflicts with an existing function.

Question 12

A team uses AWS Elastic Beanstalk to deploy a web application. The application experiences intermittent high latency. The team notices that the environment's Auto Scaling group is not scaling out quickly enough. Which configuration change should the team make to improve scaling responsiveness?

Accepted Answer

Decrease the Auto Scaling group's cooldown period. Option B is correct because lowering the Auto Scaling cooldown period allows the group to start new instances sooner after a scaling activity. Option A is incorrect because adjusting the health check path affects routing, not scaling speed. Option C is incorrect because increasing instance size does not improve scaling responsiveness. Option D is incorrect because pushing metrics more frequently to CloudWatch can help but does not directly reduce cooldown.

Answer

Modify the Elastic Load Balancer health check path to a lighter endpoint

Answer

Enable detailed CloudWatch metrics for the Auto Scaling group

Answer

Increase the instance type to a larger size

Question 13

A developer is using AWS CodeBuild to compile and package a Java application. The build process takes longer than expected. The developer wants to speed up the build by reusing dependencies that have not changed between builds. Which feature should the developer enable?

Accepted Answer

Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage. Option D is correct because caching in CodeBuild allows reusing previously downloaded dependencies. Option A is incorrect because build artifacts are outputs, not dependencies. Option B is incorrect because S3 is used for artifacts, not dependencies. Option C is incorrect because concurrent builds run separate builds, not reuse dependencies.

Answer

Configure the build project to run builds concurrently

Answer

Enable build artifacts in the CodeBuild project

Answer

Store the build's output artifacts in an S3 bucket

Question 14

A developer is deploying a serverless application using AWS SAM. The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to ensure that the Lambda function has the minimum required permissions to read from the table. Which THREE statements about SAM policy templates are correct? (Choose THREE.)

Accepted Answer

SAM policy templates are AWS-managed policies that can be applied to Lambda function roles. Options A, D, and E are correct. SAM policy templates provide managed policies, can be used in the Globals section, and DynamoDBReadPolicy grants read access. Option B is incorrect because policy templates do not support custom resources. Option C is incorrect because templates are for common use cases, not fine-grained resource-level permissions.

Answer

SAM policy templates allow fine-grained resource-level permissions by specifying ARNs

Answer

SAM policy templates can be used to grant permissions to custom resources

Question 15

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of several Lambda functions and an API Gateway. The developer wants to enable gradual deployment of Lambda function versions with automatic rollback based on CloudWatch alarms. What should the developer add to the SAM template?

Accepted Answer

Add 'AutoPublishAlias' and 'DeploymentPreference' properties to the Lambda function resource, specifying a canary deployment with a CloudWatch alarm for rollback.. Option B is correct because SAM supports canary deployments through the 'AutoPublishAlias' property combined with 'DeploymentPreference' that specifies a canary percent and interval, along with alarms for rollback. Option A is wrong because 'CodeDeployLambdaAlias' is not a SAM resource. Option C is wrong because 'DeploymentPreference' with 'Linear' shifts traffic linearly, but the question asks for gradual deployment with automatic rollback, which canary also provides; but canary is more commonly used for gradual. Option D is wrong because 'Version' and 'Alias' alone do not provide automatic rollback.

Answer

Use 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' resources to manually shift traffic and set up CloudWatch alarms to revert the alias if needed.

Answer

Add a 'DeploymentPreference' property with 'Type' set to 'Linear' and specify a 'Alarms' list for rollback.

Answer

Add a 'CodeDeployLambdaAlias' resource to the template and configure the deployment group with a canary deployment configuration.

Question 16

Refer to the exhibit. A developer is creating an IAM policy for a CI/CD service to deploy to CodeDeploy. The policy allows creating deployments and registering application revisions. However, deployments fail with an access denied error. What is the missing permission?

Accepted Answer

codedeploy:UpdateDeploymentGroup. Option D is correct because to update a deployment group, the codedeploy:UpdateDeploymentGroup permission is required. The CI/CD service may need to update the deployment group configuration. Option A is incorrect because codedeploy:ListDeployments is read-only. Option B is incorrect because codedeploy:StopDeployment is not needed for creation. Option C is incorrect because codedeploy:BatchGetDeployments is read-only.

Answer

codedeploy:ListDeployments

Answer

codedeploy:BatchGetDeployments

Answer

codedeploy:StopDeployment

Question 17

A company deploys a containerized application on Amazon ECS with Fargate launch type. The application needs to read sensitive configuration data at startup. The company requires that the data be encrypted at rest and in transit, and that the application use least-privilege permissions. Which solution meets these requirements?

Accepted Answer

Store the configuration data in AWS Systems Manager Parameter Store with a SecureString parameter and retrieve it using the task IAM role. Option D is correct because AWS Systems Manager Parameter Store supports encryption via KMS and can be accessed from ECS tasks using IAM roles. Option A is incorrect because environment variables may be visible in plaintext. Option B is incorrect because Secrets Manager is overkill for configuration data and more expensive. Option C is incorrect because S3 does not enforce transit encryption by default and requires additional setup.

Answer

Store the configuration data in AWS Secrets Manager and retrieve it at startup using the Secrets Manager API

Answer

Store the configuration data in an Amazon S3 bucket and use a pre-signed URL to download it at startup

Answer

Store the configuration data in environment variables within the ECS task definition

Question 18

A company uses AWS OpsWorks to manage a stack of EC2 instances. The operations team needs to deploy a new configuration file to all instances in a layer. Which approach should the team use to automate this deployment?

Accepted Answer

Add a Chef recipe to the layer's custom cookbooks that copies the configuration file to the instances. Option C is correct because OpsWorks uses Chef recipes to automate configuration management. Option A is incorrect because CloudFormation is for infrastructure provisioning, not configuration. Option B is incorrect because CodeDeploy is for application deployment, not system configuration. Option D is incorrect because Systems Manager Run Command can be used but is not native to OpsWorks.

Answer

Use AWS Systems Manager Run Command to execute a script that deploys the file

Answer

Create a new AWS CloudFormation stack to update the instances

Answer

Use AWS CodeDeploy to deploy the configuration file

Question 19

A company is deploying a new microservice on AWS Lambda behind an API Gateway. The development team wants to ensure that new versions of the Lambda function can be rolled out gradually and automatically rolled back if error rates exceed a threshold. Which deployment strategy should the team use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment strategy that shifts 10% of traffic to the new version for 5 minutes, then shifts the remaining 90%. Configure a CloudWatch alarm to automatically roll back if error rates exceed 2%.. Option C is correct because AWS CodeDeploy supports canary deployments with automatic rollback based on CloudWatch alarms. Option A is wrong because blue/green deployment with an NLB is more complex than needed and does not natively support gradual traffic shifting for Lambda. Option B is wrong because a linear deployment using CodeDeploy also works, but the question emphasizes automatic rollback based on error rates, which is more directly supported with canary alarms. Option D is wrong because manual traffic shifting via Route53 is not automated and does not provide automatic rollback.

Answer

Use AWS Lambda function aliases with weighted alias traffic shifting. Update the weights manually and monitor error rates using CloudWatch. Roll back by reverting the alias weights.

Answer

Use AWS CodeDeploy with a linear deployment strategy that shifts 10% of traffic every 5 minutes. Configure a CloudWatch alarm to monitor error rates and manually roll back if needed.

Answer

Use AWS CodeDeploy with a blue/green deployment and an Application Load Balancer (ALB) to shift traffic to the new version. Configure CloudWatch alarms to trigger a rollback if errors exceed 5%.

Question 20

A company is using AWS CodeBuild to compile and test code before deploying to Amazon S3. The build process must be triggered automatically whenever a developer pushes code to the 'main' branch of an AWS CodeCommit repository. Which resource should be used to trigger the build?

Accepted Answer

Use AWS CodePipeline with a source stage that connects to the CodeCommit repository and a build stage that invokes the CodeBuild project.. Option B is correct because CodePipeline can be used to automatically start a build in CodeBuild when a code change is pushed to CodeCommit. Option A is wrong because CloudWatch Events can trigger builds, but it requires setting up a rule; CodePipeline is the recommended service for CI/CD. Option C is wrong because S3 events are used for S3 buckets, not CodeCommit. Option D is wrong because CodeDeploy is for deployment, not for triggering builds.

Answer

Set up an AWS CodeDeploy trigger to start the build when a deployment is created.

Answer

Configure an Amazon S3 event notification to invoke the CodeBuild project when a new object is created.

Answer

Create an Amazon CloudWatch Events rule that triggers the CodeBuild project when a repository event occurs.