DVA-C02 Practice Exam 51 — 20 Questions

Question 1

A developer needs to monitor the performance of an Amazon RDS for MySQL database. Which TWO metrics should the developer monitor to detect a potential CPU bottleneck?

Accepted Answer

DatabaseConnections. High CPUUtilization (Option C) directly indicates the CPU is under heavy load, which is the primary symptom of a CPU bottleneck. DatabaseConnections (Option B) is correct because an excessive number of concurrent connections can overwhelm the CPU as each connection requires context switching and query processing, leading to CPU saturation. Monitoring both metrics together helps distinguish between a CPU bottleneck caused by high query load versus one caused by connection overhead.

Answer

FreeStorageSpace

Answer

NetworkThroughput

Answer

ReadLatency

Question 2

A company uses AWS CloudTrail to log all API calls. The security team wants to be notified immediately when an IAM user creates a new access key. Which solution is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers a Lambda function to send an SNS notification.. CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail and trigger a Lambda function to send an SNS notification in near real-time. This is the most efficient solution as it avoids the overhead of log ingestion, metric filters, or periodic queries, providing immediate notification with minimal latency.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable CloudTrail log file validation and periodically check the logs.

Answer

Use Amazon Athena to query CloudTrail logs daily.

Question 3

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should be taken?

Accepted Answer

Add a condition in the key policy that allows decrypt only when the principal matches the desired IAM roles.. Key policies in AWS KMS are resource-based policies that directly control access to the CMK. By adding a condition that restricts the `kms:Decrypt` action to only specific IAM roles (using the `aws:PrincipalArn` or `kms:CallerPrincipal` condition key), the security team can ensure that only those roles can decrypt data encrypted with that key. This approach is more secure than relying solely on IAM policies, as key policies are evaluated first and can explicitly deny access even if an IAM policy grants it.

Answer

Grant all IAM users decrypt permission and rely on S3 bucket policies.

Answer

Use separate CMKs for each IAM role to isolate access.

Question 4

A developer attaches the IAM policy shown to a user. The user attempts to upload an object to example-bucket using the AWS CLI with the command: `aws s3 cp file.txt s3://example-bucket/`. The upload fails. What is the MOST likely reason?

Accepted Answer

The user did not specify server-side encryption in the request.. The IAM policy shown (not provided in the question but implied by the context) likely includes a condition that requires server-side encryption (e.g., `s3:x-amz-server-side-encryption: AES256`). The `aws s3 cp` command by default does not set the `--sse` flag, so the request lacks the required encryption header, causing S3 to deny the upload with an AccessDenied error.

Answer

The user does not have permission to perform s3:PutObject on the bucket.

Answer

The bucket policy overrides the IAM policy and denies the request.

Answer

The resource ARN does not include the bucket itself.

Question 5

A developer is deploying a serverless application using AWS SAM. The application includes multiple Lambda functions and an API Gateway. Which THREE AWS CLI commands are part of the typical SAM deployment workflow? (Choose THREE.)

Accepted Answer

sam deploy. `sam deploy` is the AWS SAM CLI command that deploys the packaged application to AWS, creating or updating the CloudFormation stack with the Lambda functions and API Gateway resources. It reads the `template.yaml` and the packaged artifacts (from `sam package`) to provision the infrastructure. This command is the final step in the standard SAM deployment workflow.

Answer

sam init

Answer

aws s3 cp

Question 6

A company wants to securely store database credentials for a Lambda function. The credentials must be automatically rotated. Which TWO services should be used together?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It integrates natively with AWS Lambda and supports automatic rotation via a built-in rotation function or a custom Lambda function, meeting the requirement for automated credential rotation without manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 7

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Amazon Cognito User Pools is a fully managed identity service that provides user sign-up, sign-in, and access control for web and mobile applications. It integrates directly with third-party identity providers (IdPs) such as Facebook, Google, or SAML-based providers, making it the correct choice for managing user authentication in a serverless application with API Gateway and Lambda.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 8

The exhibit shows the output of a command. What does this output indicate about the bucket?

Accepted Answer

Versioning is enabled, and MFA delete is not required. The command output shows `MFA Delete: disabled` and `Versioning: Enabled`. This directly indicates that versioning is enabled on the bucket, but MFA delete is not required. Option D is correct because it matches both displayed fields exactly.

Answer

Versioning is enabled, and MFA delete is required

Answer

Versioning is suspended

Answer

Versioning is disabled

Question 9

A developer is implementing a solution to store application logs from multiple EC2 instances. The logs must be stored in a centralized location for analysis. Which services can the developer use to achieve this? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from EC2 instances. By installing the CloudWatch Logs agent on each EC2 instance, logs are automatically streamed to CloudWatch Logs, where they can be analyzed, searched, and retained for auditing or troubleshooting.

Answer

AWS CloudTrail

Answer

Amazon Kinesis Data Analytics

Answer

Amazon DynamoDB

Question 10

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user tries to upload an object to s3://example-bucket/secret/file.txt?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the secret/ prefix.. The Deny statement in the IAM policy explicitly denies the s3:PutObject action for any object with the prefix secret/ in the example-bucket. Since the user is trying to upload to s3://example-bucket/secret/file.txt, which matches the Deny condition, the request is denied regardless of any Allow statements. AWS IAM policy evaluation is explicit deny by default, meaning a Deny always overrides an Allow.

Answer

The upload fails only if the user is not the bucket owner.

Answer

The upload succeeds because the Deny statement does not match the specific action.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Question 11

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway REST API and a Lambda function. The developer wants to enable access logging for the API Gateway. Which THREE resources or configurations are required? (Choose THREE.)

Accepted Answer

A stage with access logging enabled in the API Gateway.. API Gateway access logging is configured at the stage level. The developer must enable access logging on a specific stage (e.g., prod, dev) and specify a destination CloudWatch Logs log group and a logging format (e.g., JSON or CLF). Without enabling it on the stage, no access logs are generated regardless of other configurations.

Answer

A Lambda function that processes the access logs.

Answer

An IAM role for the Lambda function with logs:PutLogEvents permission.

Question 12

A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)

Accepted Answer

Create an AWS KMS customer-managed key.. SSE-KMS requires a customer-managed AWS KMS key to encrypt objects at rest. By creating a customer-managed key, the developer gains control over key rotation, access policies, and audit trails, which satisfies the compliance team's requirement for server-side encryption with a customer-managed key.

Answer

Configure the bucket ACL to require encryption.

Answer

Enable S3 default encryption with SSE-S3.

Question 13

A company uses AWS CodePipeline to deploy a web application to an EC2 instance. The deployment often fails because the application is still running when new files are copied. Which THREE actions can be combined to achieve zero-downtime deployments?

Accepted Answer

Use AWS CodeDeploy with an in-place deployment configuration.. AWS CodeDeploy with an in-place deployment configuration can be combined with lifecycle hooks (such as BeforeInstall and AfterInstall) to stop the application before new files are copied and start it afterward, enabling zero-downtime deployments when properly orchestrated with a load balancer to drain traffic. Option B is correct because configuring EC2 instances behind an Auto Scaling group with a rolling update allows new instances to be launched with the updated application while old instances are terminated, ensuring continuous service availability. Option C is correct because defining an AppSpec file with BeforeInstall and AfterInstall hooks provides the mechanism to gracefully stop and start the application, preventing file conflicts and downtime.

Answer

Use AWS CodeBuild to build and deploy the application.

Answer

Use Amazon Inspector to check the application before deployment.

Question 14

Which TWO actions can improve the performance of an Amazon DynamoDB table that experiences frequent throttling due to hot partitions? (Choose TWO.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching. DynamoDB Accelerator (DAX) is an in-memory cache that reduces the number of read requests hitting the underlying table, thereby alleviating pressure on hot partitions. By serving frequently accessed items from DAX, the table experiences fewer throttled read requests, improving overall performance without changing the data model.

Answer

Disable auto scaling to provision fixed capacity

Answer

Increase the read capacity units (RCUs) of the table

Answer

Use a global secondary index (GSI) with a different partition key

Question 15

Which TWO are best practices for optimizing DynamoDB performance? (Choose two.)

Accepted Answer

Use SQS to decouple write-heavy workloads and handle spikes.. Using SQS to decouple write-heavy workloads allows DynamoDB to absorb traffic spikes by buffering writes in a queue, preventing throttling and enabling batch processing. This pattern, often called 'queue-based load leveling,' ensures that DynamoDB's provisioned capacity is not overwhelmed by sudden bursts, improving overall system resilience and cost efficiency.

Answer

Provision maximum write capacity units to handle any spike.

Answer

Use Scan operations instead of Query for retrieving data.

Answer

Enable strongly consistent reads for all read operations.

Question 16

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function is triggered by S3 events. The developer notices that the function sometimes processes the same file multiple times. Which TWO steps should the developer take to make the processing idempotent? (Choose TWO.)

Accepted Answer

Check if the file has already been processed by storing a marker in DynamoDB.. Storing a marker in DynamoDB (e.g., a record with the S3 object key as the partition key) allows the Lambda function to check if a file has already been processed before performing the work. This ensures that even if the same S3 event is delivered multiple times (due to retries or duplicate notifications), the function will skip reprocessing, making the operation idempotent.

Answer

Reduce the S3 event batch size in the Lambda trigger.

Answer

Increase the Lambda function's timeout.

Answer

Enable S3 versioning on the bucket.

Question 17

A developer is designing a serverless application that processes streaming data from IoT devices. The application must be able to handle data from millions of devices and store the data in a durable, scalable data store. Which AWS services should the developer use? (Choose THREE.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time streaming of large volumes of data, such as from millions of IoT devices. It can ingest and store data durably for up to 365 days, making it ideal for the ingestion layer of this serverless application.

Answer

Amazon RDS

Answer

Amazon SQS

Question 18

A developer is designing a messaging system where orders are placed into an SQS queue and processed by a Lambda function. The developer wants to ensure that failed messages are not lost and can be analyzed later. Which TWO steps should the developer take? (Choose 2.)

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Configuring a dead-letter queue (DLQ) for the SQS queue ensures that messages that cannot be processed successfully after a specified number of attempts are moved to a separate queue. This prevents message loss and allows the developer to analyze the failed messages later, fulfilling the requirement to not lose failed messages and to enable analysis.

Answer

Enable Lambda function retries on failure.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Set up a CloudWatch alarm to monitor the queue depth.

Question 19

A company is deploying a new microservice using AWS Lambda and Amazon API Gateway. Which THREE steps should be included in the deployment pipeline? (Choose three.)

Accepted Answer

Deploy the API Gateway API to a stage.. Deploying the API Gateway API to a stage is essential because it makes the API publicly available at a specific URL (e.g., https://api-id.execute-api.region.amazonaws.com/prod). Without a stage deployment, any updates to the API resources and methods remain in draft state and are not accessible to clients.

Answer

Invalidate the Amazon CloudFront cache.

Answer

Update the Route 53 DNS record to point to the new API.

Question 20

A developer is building a RESTful API using AWS Lambda and Amazon API Gateway. The API will be accessed by external customers. The developer needs to implement authentication and authorization. Which THREE steps should the developer take to secure the API? (Choose three.)

Accepted Answer

Use Amazon Cognito user pools for user authentication and to generate JWT tokens.. Amazon Cognito user pools provide a fully managed service for user authentication, allowing users to sign in and receive JSON Web Tokens (JWT). These tokens can then be used to authorize API requests, integrating directly with API Gateway as a built-in authorizer to secure the RESTful API.

Answer

Configure the API to use AWS IAM roles for authentication by passing the role ARN in the request.

Answer

Attach a resource policy to the API Gateway that allows only specific IAM users.