DVA-C02 Practice Exam 53 — 20 Questions

Question 1

A developer is troubleshooting a deployment failure in AWS CodePipeline. The deploy stage uses the above IAM policy for the service role. The pipeline fails when trying to update the Elastic Beanstalk environment. What is the most likely cause?

Accepted Answer

The policy restricts the UpdateEnvironment action to a specific environment ARN, but the pipeline is updating a different environment.. Option C is correct because the policy allows 'UpdateEnvironment' only on a specific environment ARN, but the pipeline may be trying to update a different environment (e.g., if the environment name changed). Option A is wrong because 'DeleteEnvironment' is denied but not used. Option B is wrong because 'DescribeEnvironmentResources' is allowed. Option D is wrong because 'DeleteEnvironment' denial does not affect updates.

Answer

The policy does not allow DescribeEnvironmentResources, which is required for the deployment.

Answer

The policy denies all actions on the environment, preventing the update.

Answer

The policy denies DeleteEnvironment, which is required for the update.

Question 2

A team uses AWS CloudFormation to manage infrastructure. They want to deploy a stack that includes an Amazon RDS DB instance. During deployment, the stack creation fails because the DB instance creation times out. The team wants to ensure that subsequent stack creation attempts do not recreate the DB instance from scratch but instead continue from the failed state. Which CloudFormation feature should they use?

Accepted Answer

Use a CloudFormation custom resource to check for an existing DB instance and create it only if it does not exist.. Option B is correct. CloudFormation stack creation rollback triggers with '--on-failure DO_NOTHING' or '--disable-rollback' will leave the failed resources in place so they can be resumed? Actually, CloudFormation does not support resuming a failed stack creation; it will roll back and delete resources. To avoid this, you can use a custom resource to check if the DB instance already exists, but the question asks for a feature to continue from failed state. The best approach is to use a custom resource or separate stack for the DB instance. Among options, only 'Custom resource' (Option A) can handle such logic, but the correct answer is B: Use a custom resource to check for existing DB instance and skip creation if it exists. However, Option A is also custom resource. Let's re-evaluate: The feature that allows you to conditionally create resources based on existing resources is 'Conditions' but that requires knowing the DB instance ID. 'Custom resource' can query existing DB and return a value to use in conditions. So Option B is correct. Option A (WaitCondition) is for signaling completion, not for conditional creation. Option C (Stack policy) protects resources but does not help with continuation. Option D (Change sets) are for updates, not creation rollback.

Answer

Use a CloudFormation WaitCondition to pause stack creation until the DB instance is available.

Answer

Create the DB instance using a separate CloudFormation stack and reference it using Fn::ImportValue.

Answer

Apply a stack policy that prevents the DB instance from being deleted during stack updates.

Question 3

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to deploy updates to the production environment gradually and automatically roll back if health checks fail. Which AWS service and deployment configuration should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment and a CloudWatch alarm to trigger automatic rollback.. Option B is correct because AWS CodeDeploy with a canary deployment allows gradual traffic shifting and automatic rollback on CloudWatch alarm failure. Option A is incorrect because CloudFormation with a blue/green deployment requires manual rollback. Option C is incorrect because Elastic Beanstalk with rolling updates does not support canary-based traffic shifting. Option D is incorrect because CodePipeline alone does not handle deployment strategies or health check-based rollbacks.

Answer

Use AWS CloudFormation with a blue/green deployment and a CloudWatch alarm to trigger rollback.

Answer

Use AWS Elastic Beanstalk with a rolling update and a CloudWatch alarm to trigger rollback.

Answer

Use AWS CodePipeline with a manual approval step and a CloudWatch alarm to trigger rollback.

Question 4

A developer needs to deploy a new version of a Lambda function that uses environment variables for database credentials. Which AWS service should be used to securely store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store secrets such as database credentials and can automatically rotate them. Option B is correct because it provides encryption and access control. Option A (SSM Parameter Store) can store secrets but lacks automatic rotation. Option C (S3) is not secure for secrets. Option D (DynamoDB) is not intended for secret storage.

Answer

Amazon DynamoDB with encryption at rest

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 5

The developer tries to deploy this stack but receives an error: 'CREATE_FAILED: LambdaExecutionRole - Resource creation cancelled'. The Lambda function is not created. What is the most likely cause?

Accepted Answer

The IAM user does not have permission to create IAM roles. The error 'Resource creation cancelled' often occurs when a dependent resource (the Lambda function) references a resource that hasn't been created yet. In this template, the Lambda function depends on the role (via !GetAtt), but the role creation might fail due to permissions. However, the error says the role itself had creation cancelled. The most likely cause is that the role creation was cancelled due to a dependency on a resource that doesn't exist. But in this case, the role has no dependencies. The error might be due to a missing permission to create the role. Option A is correct because the role creation fails due to missing iam:CreateRole permission. Option B (Lambda function error) would show a different error. Option C (S3 bucket) would affect the Lambda function, not the role. Option D (incorrect role name) would cause a different error.

Answer

The S3 bucket is in a different region

Answer

The Lambda function handler name is incorrect

Answer

The Lambda function code is missing from the S3 bucket

Question 6

A company is using AWS CloudFormation to manage infrastructure. The developer wants to update a stack that includes an RDS database. The update requires replacing the database with a new one. Which stack update policy should the developer use to minimize downtime?

Accepted Answer

Use a 'Replacement with snapshot' update policy.. Option A is correct because 'Replacement with snapshot' creates a new DB instance from a snapshot of the old one, minimizing data loss and downtime. Option B is wrong because 'Update with snapshot' does not exist. Option C is wrong because 'Delete and recreate' would cause data loss. Option D is wrong because 'Rolling update' is not applicable to RDS.

Answer

Use a 'Rolling update' update policy.

Answer

Use a 'Delete and recreate' update policy.

Answer

Use an 'Update with snapshot' update policy.

Question 7

A development team uses AWS CodeCommit for source control and AWS CodePipeline for CI/CD. The team wants to automatically deploy changes to a staging environment when a pull request is merged into the main branch. Which CodePipeline trigger configuration should be used?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers the pipeline on a 'Reference Created' event for the main branch.. Option C is correct because the CloudWatch Events rule on a pull request merge event can trigger the pipeline. Option A is wrong because a webhook on push events would trigger on every push, not specifically on pull request merge. Option B is wrong because CodePipeline does not have a built-in pull request trigger; it uses CloudWatch Events. Option D is wrong because polling is not recommended and is less efficient.

Answer

Set up a periodic polling schedule in CodePipeline to check for changes.

Answer

Configure a webhook in CodeCommit to trigger the pipeline on push events.

Answer

Use the 'Start pipeline execution' API in CodePipeline on pull request creation.

Question 8

A company uses AWS CodeDeploy to deploy an application to EC2 instances. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group consists of 4 EC2 instances. The deployment configuration is 'CodeDeployDefault.OneAtATime'. The CodeDeploy agent logs on the failed instance show: 'Error: Script at specified location: scripts/install_dependencies.sh failed with exit code 1.' What should the developer do to resolve this issue?

Accepted Answer

Review the install_dependencies.sh script for errors and correct them.. Option A is correct. The script failed with exit code 1, indicating a bug in the script. The developer should fix the script based on the logs. Option B is wrong because the deployment configuration is already OneAtATime; changing to AllAtOnce would make it worse. Option C is wrong because increasing instance count does not fix the script error. Option D is wrong because the error is in the script, not the agent.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Reinstall the CodeDeploy agent on the failed instance.

Answer

Increase the number of EC2 instances in the deployment group.

Question 9

A company is deploying a critical application using AWS CloudFormation. The stack creation fails with a 'ROLLBACK_COMPLETE' status. The engineer wants to troubleshoot the failure without deleting the stack. What should the engineer do?

Accepted Answer

Use the 'aws cloudformation describe-stack-events' command to view the error messages.. Option D is correct because CloudFormation retains the stack after a rollback, and the engineer can view the events in the AWS Management Console or CLI to see the specific error messages. Options A and B are incorrect because stack deletion is not required. Option C is incorrect because rollback triggers are for rollback, not troubleshooting.

Answer

Use the 'aws cloudformation create-change-set' command with a rollback trigger.

Answer

Recreate the stack using the '--on-failure DO_NOTHING' option.

Answer

Delete the stack and recreate it with the '--disable-rollback' flag.

Question 10

A developer uses CodePipeline to deploy a new task definition to an ECS service. The pipeline fails with an access denied error when updating the service. Which missing permission is the most likely cause?

Accepted Answer

Missing iam:PassRole permission for the task execution role used by the new task definition. The error occurs when updating the ECS service with a new task definition. The ecs:UpdateService action requires the iam:PassRole permission for the task execution role that the new task definition uses. The policy only allows iam:PassRole for a specific role, but the new task definition might reference a different role. Option B is correct because the policy does not allow passing the specific role referenced in the new task definition. Option A is incorrect because ecs:UpdateService is allowed. Option C is incorrect because there is no condition. Option D is incorrect because describe is allowed.

Answer

Missing ecs:UpdateService permission for the service resource

Answer

Missing ecs:DescribeServices permission

Answer

Missing ecs:RegisterTaskDefinition permission for the new task definition

Question 11

Which THREE steps should a developer include in a CI/CD pipeline to deploy a serverless application using AWS SAM? (Choose three.)

Accepted Answer

Run 'sam build' to prepare the application. A typical SAM CI/CD pipeline includes building the app (A), packaging and uploading to S3 (B), and deploying the CloudFormation stack (C). Option D (update alias) is not a standard step. Option E (configure API Gateway) is part of deployment.

Answer

Manually configure API Gateway stages

Answer

Run 'aws lambda update-alias' to shift traffic

Question 12

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon ECS service. The developer wants to ensure that the ECS service is updated with a new task definition before the old tasks are stopped. Which deployment controller type should be used?

Accepted Answer

ECS (rolling update).. Option C is correct because the 'ECS' deployment controller (rolling update) updates tasks gradually, ensuring new tasks are running before old ones are stopped. Option A is wrong because 'CodeDeploy' is for blue/green deployments. Option B is wrong because 'External' means updates are managed externally. Option D is wrong because 'Recreate' stops all tasks before starting new ones.

Answer

Recreate.

Answer

CodeDeploy (blue/green).

Answer

External.

Question 13

A team uses AWS CodeBuild to run automated tests. The buildspec.yaml file contains a 'pre_build' phase that sets environment variables. During a build, the build fails with 'Error: Cannot find module 'express' when running a Node.js application. The application's package.json is in the source root. What is the most likely cause?

Accepted Answer

The buildspec does not include a command to run 'npm install' in the install or pre_build phase.. Option A is correct because if the npm install command is missing in the buildspec, dependencies are not installed. Option B is wrong because package.json is present. Option C is wrong because the environment variable would affect the install command, not cause missing module. Option D is wrong because Node.js runtime is available.

Answer

The Node.js runtime version is incompatible with the express module.

Answer

The environment variable NODE_ENV is set to production, which skips devDependencies.

Answer

The package.json file is not in the source root directory.

Question 14

A developer wants to deploy a serverless application using AWS SAM. The application consists of multiple Lambda functions, an API Gateway REST API, and a DynamoDB table. The developer wants to define the application in a single template and deploy it using the AWS CLI. Which command should the developer use to package and deploy the application?

Accepted Answer

sam package and sam deploy. Option B is correct because 'sam package' uploads the artifacts to S3 and generates a packaged template, and 'sam deploy' deploys it. Option A is wrong because 'aws cloudformation package' requires manual deploy. Option C is wrong because 'sam build' is for building locally but not for packaging. Option D is wrong because 'aws s3 cp' only uploads files, not a template.

Answer

sam build and sam deploy

Answer

aws cloudformation package and aws cloudformation deploy

Answer

aws s3 cp and aws cloudformation create-stack

Question 15

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is configured with a 'OneAtATime' deployment configuration. The developer notices that the deployment is taking a long time. What is the most likely reason?

Accepted Answer

The Auto Scaling group has a large number of instances, and deploying one at a time is slow.. Option C is correct because 'OneAtATime' deploys to one instance at a time, which can be slow for large groups. Option A is wrong because the deployment configuration is correct. Option B is wrong because the agent is not the issue. Option D is wrong because the deployment group is correctly configured.

Answer

The deployment group is configured with an incorrect load balancer.

Answer

The deployment configuration is set to 'AllAtOnce', but the developer intended 'OneAtATime'.

Answer

The CodeDeploy agent on the instances is not running.

Question 16

A developer attempted to create a CloudFormation stack. The stack creation failed and rolled back. Based on the exhibit, which resource caused the failure?

Accepted Answer

The EC2Instance resource. The error message indicates that EC2Instance failed to create, and that caused the WaitCondition to fail. Option A is correct because EC2Instance is listed as failed. Option B is incorrect because WaitCondition failed as a consequence. Option C is incorrect because the stack status is ROLLBACK_COMPLETE. Option D is incorrect because the rollback was automatic.

Answer

The WaitCondition resource

Answer

The user who requested the rollback

Answer

The stack itself

Question 17

A developer is deploying a Lambda function using CloudFormation. The function code is stored in an S3 bucket. The developer wants to automatically update the function when the S3 object is updated. Which approach should be used?

Accepted Answer

Use the 'S3ObjectVersion' property in the Lambda function's 'Code' property to reference the specific version of the S3 object.. Option C is correct because setting the 'S3ObjectVersion' property in the CloudFormation template triggers a stack update when the object version changes. Option A is wrong because CloudFormation does not automatically detect S3 updates. Option B is wrong because 'DeletionPolicy' controls what happens on stack deletion, not updates. Option D is wrong because 'DependsOn' only sets dependencies, not triggers.

Answer

Set the 'DeletionPolicy' attribute to 'Retain' on the Lambda function resource.

Answer

Use an S3 event notification to invoke a Lambda function that updates the CloudFormation stack.

Answer

Set a 'DependsOn' attribute on the Lambda function to the S3 bucket.

Question 18

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

Accepted Answer

The new application revision contains an error that prevents it from running.. Option D is correct because with AllAtOnce, all instances are targeted simultaneously. If the new revision has a critical error, all instances fail, causing the overall deployment to fail. Option A is wrong because CodeDeploy does not have a hard limit on instances. Option B is wrong because the deployment group is the Auto Scaling group itself, not individual instances. Option C is wrong because if the application was not running, the deployment would fail on each instance but not necessarily all at once.

Answer

The application is not running on the instances before the deployment.

Answer

The Auto Scaling group has more than 100 instances.

Answer

The deployment group is not associated with the correct Amazon EC2 instances.

Question 19

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The stack creation fails because the DB instance creation takes longer than the CloudFormation timeout. Which THREE steps can the developer take to resolve this issue? (Choose THREE.)

Accepted Answer

Use a CloudFormation wait condition or a waiter to pause the stack creation until the DB instance is ready.. Options A, C, and E are correct. A: Increasing the timeout gives more time for the resource creation. C: A waiter can poll until the DB instance is available. E: A custom resource with a Lambda function can handle the creation asynchronously. Option B is wrong because changing the instance class might not speed up creation; it could even take longer. Option D is wrong because reducing the timeout would make it fail sooner.

Answer

Change the DB instance class to a smaller size.

Answer

Reduce the stack creation timeout to trigger a rollback faster.

Question 20

A developer is setting up a CI/CD pipeline for a Python application using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to trigger the pipeline automatically when code is pushed to the master branch. Which TWO actions are required? (Choose two.)

Accepted Answer

Set the source stage in the pipeline to use AWS CodeCommit as the source provider.. Options A and D are correct because a webhook (or event) from CodeCommit triggers the pipeline, and the source stage must use CodeCommit as the provider. Option B is wrong because CodeDeploy does not trigger the pipeline. Option C is wrong because a schedule is not needed. Option E is wrong because AWS CloudTrail is not required for pipeline triggers.

Answer

Configure CodeDeploy to run after the build stage.

Answer

Create a CloudWatch Events rule to trigger the pipeline on a schedule.

Answer

Enable AWS CloudTrail to log API calls.

DVA-C02 Practice Exam 53 — 20 Questions

Exhibit

DVA-C02 Practice Exam 53 — 20 Questions

Exhibit