DVA-C02 Practice Exam 52 — 20 Questions

Question 1

Which TWO AWS services can be used to decouple components of a microservices architecture?

Accepted Answer

Amazon EventBridge. Amazon EventBridge (Option B) is correct because it provides a serverless event bus that decouples microservices by allowing them to communicate asynchronously via events. Services publish events to EventBridge, and other services consume them without direct coupling, enabling loose coupling and scalability.

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Answer

Amazon CloudWatch

Question 2

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with a 'no basic auth credentials' error when trying to push the image. Which TWO actions should the developer take to resolve this issue? (Choose two.)

Accepted Answer

Add a pre-build command to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. The 'aws ecr get-login-password' command retrieves a temporary authentication token from AWS, which is then piped to 'docker login' to authenticate the Docker client with the Amazon ECR registry. This is the standard method for authenticating Docker to ECR, and it must be executed in the pre-build phase to ensure credentials are available before the 'docker push' command runs.

Answer

Install the AWS CLI in the buildspec.yml file.

Answer

Install Docker in the buildspec.yml file.

Answer

Configure SSH key-based authentication for ECR.

Question 3

A developer is designing a serverless application that processes orders. The order processing must be transactional: either all steps succeed or none. Which TWO AWS services can be combined to achieve this?

Accepted Answer

AWS Step Functions. AWS Step Functions is correct because it provides a state machine that can coordinate multiple AWS services (e.g., Lambda, DynamoDB) in a defined workflow. It supports error handling, retries, and a 'catch' mechanism to roll back or compensate for failed steps, enabling transactional order processing where all steps succeed or none do.

Answer

Amazon SNS with filtering

Answer

Amazon SQS with FIFO queues

Answer

AWS Lambda with DLQ

Question 4

A company is using AWS Lambda to process sensitive data. The Lambda function needs to access an S3 bucket in the same account. What is the BEST practice for granting permissions?

Accepted Answer

Create an IAM role with a policy granting S3 access and attach it to the Lambda function.. The AWS best practice for granting a Lambda function access to other AWS services is to create an IAM role with the required permissions and assign it as the function's execution role. Lambda assumes this role at runtime and the function receives temporary credentials via the environment, so no long-lived secrets are needed. This follows least-privilege and avoids credential management overhead.

Answer

Use an S3 bucket policy that allows access from the Lambda function's ARN.

Answer

Generate a key pair and use it to authenticate the Lambda function to S3.

Answer

Store the AWS access key ID and secret access key in the Lambda environment variables.

Question 5

Which TWO AWS services can be used to build a serverless event-driven application that processes data from Amazon S3 and stores results in Amazon DynamoDB? (Choose 2.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered directly by S3 events (e.g., ObjectCreated) to process data as soon as it arrives, and it can write the processed results to DynamoDB via the AWS SDK. This creates a fully serverless, event-driven pipeline without provisioning any servers.

Answer

Amazon Kinesis Data Streams

Answer

Amazon EC2

Answer

Amazon EMR

Question 6

Which TWO approaches can a developer use to automate the deployment of a microservices application to Amazon ECS with Fargate, ensuring that each microservice is independently deployable and can scale based on demand?

Accepted Answer

Define each microservice as a separate ECS service with its own task definition. Defining each microservice as a separate ECS service with its own task definition allows independent deployment, scaling, and lifecycle management. Each service can be updated, rolled back, or scaled based on its own demand without affecting other microservices, which aligns with microservices architecture principles.

Answer

Define all microservices in a single task definition and run them as one service

Answer

Use a single ECS service with multiple containers per task definition

Answer

Use a single CodePipeline that builds all microservices together

Question 7

A company is designing a microservices architecture using AWS Lambda. Each microservice has its own DynamoDB table. The Lambda functions need to perform CRUD operations on their respective tables. Which TWO IAM best practices should be applied? (Choose TWO.)

Accepted Answer

Scope the IAM policy resource to the specific DynamoDB table ARN.. Scoping the IAM policy resource to the specific DynamoDB table ARN follows the principle of least privilege, ensuring each Lambda function can only access its own table. Option E is correct because creating a separate IAM role for each Lambda function isolates permissions, preventing a compromised function from affecting others. Together, these practices enforce granular access control in a microservices architecture.

Answer

Grant access to all DynamoDB tables using a wildcard in the resource ARN.

Answer

Use a single IAM role shared by all Lambda functions.

Answer

Attach the IAM policy to the AWS account instead of the role.

Question 8

Drag and drop the steps to set up a DynamoDB table with auto scaling in the correct order.

Accepted Answer

Create DynamoDB table, then Create scaling target, then Define scaling policies, then Apply scaling policies. The correct order for setting up DynamoDB auto scaling is: first create the DynamoDB table with provisioned capacity, then create an Application Auto Scaling target for the table, then define the scaling policies (for read and write capacity), and finally apply the policies to the target. The target must be registered before policies can be defined.

Answer

Create DynamoDB table, then Define scaling policies for read and write, then Create scaling target, then Apply scaling policies

Answer

Define scaling policies, then Create scaling target, then Create DynamoDB table, then Apply scaling policies

Answer

Create DynamoDB table, then Create scaling target, then Apply scaling policies, then Define scaling policies

Question 9

Which TWO AWS services can be used to deploy and manage containerized applications? (Choose two.)

Accepted Answer

Amazon ECS. Amazon ECS (Elastic Container Service) is a fully managed container orchestration service that allows you to run Docker containers at scale. It integrates with AWS Fargate for serverless compute or EC2 for more control, and it handles cluster management, scheduling, and scaling of containerized applications.

Answer

Amazon EC2

Answer

Amazon RDS

Answer

AWS Lambda

Question 10

A developer is deploying an application on EC2 that must access an S3 bucket. The developer wants to avoid hard-coding credentials. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. Attaching an IAM role to the EC2 instance profile lets the instance obtain temporary, automatically rotated credentials from the EC2 instance metadata service (IMDS), so no long-lived secrets exist on the instance or in code. This is the AWS-recommended best practice for EC2-to-S3 access and eliminates the risk of credential leakage. The SDKs and CLI automatically retrieve and refresh these credentials.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Answer

Set the AWS credentials as environment variables in the user data script.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance.

Question 11

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other securely. Which THREE methods can be used to enable service-to-service authentication?

Accepted Answer

Use AWS App Mesh with mutual TLS (mTLS) authentication.. AWS App Mesh with mutual TLS (mTLS) provides service-to-service authentication by requiring each side of a connection to present and validate X.509 certificates. This ensures both the caller and the receiver are authenticated, preventing unauthorized services from communicating within the mesh.

Answer

Use Amazon API Gateway as a proxy for inter-service communication.

Answer

Use security group rules to allow traffic only between services.

Question 12

A company is using AWS KMS to encrypt data in S3. Which TWO actions are required to allow an IAM user to decrypt objects in a specific S3 bucket?

Accepted Answer

Attach a policy to the user allowing s3:GetObject on the bucket.. To decrypt an object stored in S3 using server-side encryption with AWS KMS (SSE-KMS), the IAM user must have the s3:GetObject permission to retrieve the encrypted object from the bucket. Without this permission, the user cannot even initiate the GetObject request, regardless of KMS permissions.

Answer

Attach a policy to the user allowing kms:Encrypt.

Answer

Attach a policy to the user allowing s3:PutObject.

Answer

Attach a policy to the user allowing kms:GenerateDataKey.

Question 13

Match each AWS tool or feature to its description.

Accepted Answer

AWS CodeDeploy: Automates code deployments to any instance. AWS CodeDeploy automates code deployments, while Amazon CloudWatch provides monitoring. The distractors swap these definitions to test understanding of each service's purpose.

Answer

AWS CodeDeploy: Monitors AWS resources and applications

Answer

Amazon CloudWatch: Automates code deployments to any instance

Question 14

The developer invokes a Lambda function using the AWS CLI and gets the output shown. What is the most likely cause of the error?

Accepted Answer

The event payload does not contain the expected data.. When a Lambda function is invoked with a payload that does not match the handler's expected schema, the function raises a runtime error such as KeyError or TypeError, which surfaces as a function error in the CLI output. The most likely cause is a malformed or unexpected event payload rather than an infrastructure issue.

Answer

The Lambda function code has a syntax error.

Answer

The Lambda function's execution role lacks permissions.

Answer

The Lambda function timed out.

Question 15

A company deploys a microservices application using AWS CloudFormation. Each microservice is deployed as a separate stack. The developer wants to pass the output values (e.g., API endpoint URLs) from one stack to another. Which CloudFormation feature should be used?

Accepted Answer

Cross-stack references using Export and ImportValue. Cross-stack references using Export and ImportValue allow you to share values between CloudFormation stacks. You export a value from one stack and import it into another, enabling loose coupling. This is the standard way to pass outputs between separate stacks.

Answer

Custom resources with Lambda

Answer

Stack outputs

Answer

Nested stacks

Question 16

A developer is encrypting an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). What is a benefit of using SSE-KMS over SSE-S3?

Accepted Answer

Ability to control access to the encryption key separately. SSE-KMS allows you to use AWS KMS customer master keys (CMKs) to encrypt objects, giving you control over key access through KMS key policies and IAM. This separation of key management from data management is a key benefit over SSE-S3, where AWS manages the keys entirely. Thus, the ability to control access to the encryption key separately is the correct benefit.

Answer

Reduced latency for encrypted object retrieval

Answer

Lower cost than SSE-S3

Answer

Automatic encryption of objects at rest

Question 17

A developer attaches the above S3 bucket policy to my-bucket. A user tries to upload an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload is denied. The bucket policy includes a Deny effect for requests where aws:SecureTransport is false (i.e., HTTP). Since the user is uploading via HTTP, the condition is true, so the Deny statement applies and the upload is denied. Explicit Deny always overrides any Allow.

Answer

The upload succeeds because the Deny effect only applies if the condition is true

Answer

The upload succeeds if the user also has an Allow in another policy

Answer

The upload succeeds because there is no Allow statement

Question 18

A developer is deploying a web application on Amazon ECS with a Fargate launch type. The application needs to securely access an Amazon DynamoDB table. How should the developer grant permissions?

Accepted Answer

Define a task role for the ECS task with DynamoDB permissions. The developer should define a task role for the ECS task with DynamoDB permissions. In ECS with Fargate, the task role is an IAM role that containers can assume to make AWS API calls. This provides secure, temporary credentials without embedding secrets in the container image.

Answer

Store AWS credentials in the container image

Answer

Assign an IAM role to the ECS service and use it from the container

Answer

Use an EC2 instance profile and mount it to the container

Question 19

Which TWO AWS services can be used to decouple microservices in a distributed application? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables microservices to communicate asynchronously by broadcasting messages to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints). This decouples the producer from the consumers, allowing each microservice to scale and fail independently without blocking the sender.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancer (ELB)

Answer

Amazon Route 53

Question 20

A developer needs to allow an EC2 instance to read items from a DynamoDB table. Which is the best practice for granting permissions?

Accepted Answer

Attach an IAM role with the required permissions to the EC2 instance. Attaching an IAM role to the EC2 instance is the AWS best practice because it provides temporary, automatically rotated credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys. The role's policy grants only the required DynamoDB read permissions, following least privilege. This is the standard, secure, and auditable approach for EC2-to-AWS-service authentication.

Answer

Store IAM user access keys on the instance

Answer

Use root user credentials

Answer

Apply a service control policy (SCP) to the instance