DVA-C02 Practice Exam 53 — 20 Questions

Question 1

An application running on Amazon EC2 generates logs that need to be streamed to Amazon CloudWatch Logs. The developer installs and configures the CloudWatch agent. However, logs are not appearing in the log group. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The EC2 instance does not have an IAM role with CloudWatch Logs write permissions.. The CloudWatch agent requires IAM permissions to call CloudWatch Logs APIs (CreateLogGroup, CreateLogStream, PutLogEvents). On EC2, these permissions are provided via an instance profile attached to the instance. If the instance lacks an IAM role with CloudWatch Logs write permissions, the agent cannot publish logs, and they will not appear in the log group.

Answer

The CloudWatch agent cannot be installed on Amazon Linux 2.

Answer

The CloudWatch agent must be configured from the AWS Management Console.

Answer

The log group must be created manually before the agent can send logs.

Question 2

Which THREE are best practices for deploying applications with AWS Elastic Beanstalk? (Choose THREE.)

Accepted Answer

Use environment configuration files (.ebextensions) to manage settings.. Ebextensions configuration files allow you to define environment settings, software configurations, and custom resources declaratively, ensuring consistent and repeatable deployments without manual intervention. This aligns with the best practice of infrastructure as code, as Elastic Beanstalk automatically applies these settings during environment creation and updates.

Answer

Manually update EC2 instances in the environment.

Answer

Always use the default Elastic Beanstalk domain for production.

Question 3

A developer is troubleshooting an AccessDenied error when a Lambda function tries to write to CloudWatch Logs. The function's IAM role includes the following policy. Which TWO missing permissions are causing the error? (Choose TWO.)

Accepted Answer

logs:CreateLogStream. A Lambda function must call logs:CreateLogStream before it can write log events to a specific log stream. Without this permission, the function cannot create a new log stream when one does not already exist, resulting in an AccessDenied error. Option E is correct because logs:PutLogEvents is the permission required to actually write log events to an existing log stream; without it, the function cannot send log data to CloudWatch Logs.

Answer

logs:DescribeLogStreams

Answer

logs:CreateLogGroup

Answer

logs:GetLogEvents

Question 4

A developer is troubleshooting a slow-running query in Amazon RDS for MySQL. The query is used by a reporting dashboard. Which AWS service should the developer use to identify the bottleneck?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides a detailed analysis of database performance, including wait events and SQL query performance, helping identify bottlenecks.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 5

A developer is using an Amazon SQS queue with a Lambda function as a consumer. Messages are being sent to the queue but the Lambda function is not processing them. Which THREE of the following are possible causes?

Accepted Answer

The SQS queue policy denies access to the Lambda function.. The SQS queue policy is a resource-based policy that controls which principals (like Lambda's execution role) can perform actions on the queue. If the policy explicitly denies the Lambda function's access, the function will not be able to poll or delete messages from the queue, even if its own execution role grants those permissions.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The SQS queue has a rate limit that prevents Lambda from polling.

Question 6

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with SSE-S3. What is the MOST effective way to enforce this?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketEncryption unless the encryption algorithm is AES256.. AWS Organizations allows you to create service control policies (SCPs) that can be applied to all accounts in the organization. An SCP can deny the s3:PutBucketEncryption action unless the encryption algorithm is AES256 (SSE-S3). This centrally enforces encryption across all accounts. Option A is incorrect because IAM policies must be attached to each user or group individually, and they cannot be enforced across all accounts centrally. Option B is reactive (detection only) and does not prevent non-compliant actions. Option D can enforce encryption on object uploads but does not prevent configuration of bucket-level encryption settings.

Answer

Create an IAM policy that denies non-SSE-S3 encryption and attach it to all users.

Answer

Use AWS Config rules to detect buckets without SSE-S3 and send alerts.

Answer

Use S3 bucket policies to deny PutObject if encryption is not SSE-S3.

Question 7

A company is using AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only the company's AWS account can access the KMS key. What should be done?

Accepted Answer

Modify the key policy to remove any statements that allow access from external AWS accounts.. Modifying the key policy to remove any statements that allow access from external AWS accounts ensures that only the company's AWS account can use the KMS key. The key policy explicitly defines who can access the key, and removing external account access restricts it to the key owner's account. Option A is incorrect because disabling the key prevents all use, not just external access. Option C is incorrect because an S3 bucket policy cannot control access to the KMS key itself; it only governs S3 operations. Option D is incorrect because IAM policies can grant or deny access, but the key policy must also allow the account; however, the key policy already allows the account's IAM users by default if they have the right permissions, but the requirement is to ensure only the company's account can access, which is achieved by removing external account access from the key policy.

Answer

Disable the KMS key and re-enable it only when needed.

Answer

Use an S3 bucket policy to deny access to any user not from the company's account.

Answer

Attach an IAM policy to the key that denies access to external accounts.

Question 8

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError'. Which configuration change would most likely resolve this issue?

Accepted Answer

Increase the compute type to a larger instance size.. CodeBuild allows configuring the compute type (e.g., BUILD_GENERAL1_MEDIUM, BUILD_GENERAL1_LARGE) which determines the memory and CPU available. An 'OutOfMemoryError' indicates insufficient memory, so increasing the compute type to a larger instance size provides more memory and resolves the issue. Option A is incorrect because CodeBuild does not support custom AMIs; it uses managed container images. Option B is incorrect because enabling detailed CloudWatch logs only increases logging, not memory. Option D is incorrect because splitting the build adds complexity and does not address the memory shortage in the current build.

Answer

Use a custom AMI with more memory.

Answer

Enable detailed CloudWatch logs for the build.

Answer

Split the build into multiple CodeBuild projects.

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. The developer wants to perform a blue/green deployment to minimize downtime. The developer creates a new environment and deploys the new version. After verifying the new environment is healthy, the developer needs to swap the URLs so that traffic is routed to the new environment. Which AWS Elastic Beanstalk feature should the developer use?

Accepted Answer

Use the 'Swap environment URLs' feature in the Elastic Beanstalk console.. Use the 'Swap environment URLs' feature in the Elastic Beanstalk console. This feature swaps the CNAME records between two environments, allowing you to route traffic to the new, healthy environment with minimal downtime. Option B is not recommended because deleting the old environment before fully verifying the new one is risky. Option C involves Route 53 weighted routing, which is not an Elastic Beanstalk feature and requires manual DNS management outside of Elastic Beanstalk. Option D is incorrect because environment CNAMEs are managed by Elastic Beanstalk and cannot be changed manually.

Answer

Delete the old environment and update the DNS record to point to the new environment.

Answer

Use Amazon Route 53 weighted routing policies to shift traffic.

Answer

Change the environment's CNAME to point to the new environment.

Question 10

A company wants to audit all API calls made to AWS. Which service should be used to collect and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls and can store logs in S3. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) can store logs but is not the primary service for API auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 11

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 12

A developer is using AWS X-Ray to trace requests through a microservices application. One of the services, Service B, is not appearing in the trace map. What is the MOST likely reason?

Accepted Answer

Service B is not instrumented with the X-Ray SDK.. For X-Ray to trace requests across services, each service must be instrumented with the X-Ray SDK. If Service B is not instrumented, it won't send trace data, and it won't appear in the trace map.

Answer

Service B is using HTTP/2, which is not supported by X-Ray.

Answer

Service B is running in a different AWS region.

Answer

The X-Ray sampling rate is set too low.

Question 13

A company is using AWS CodeCommit for source control. Developers need to access the repository from their local machines. Which authentication method is recommended for secure access?

Accepted Answer

Generate and use SSH keys paired with an IAM user.. SSH keys provide secure access without storing credentials on the machine and can be paired with an IAM user for CodeCommit. Option A is wrong because IAM user password is for console access, not Git. Option B is wrong because while access keys can be used for Git credentials, they are long-term credentials and less secure than SSH keys. Option C is wrong because Cognito is for end-user authentication, not developer access to CodeCommit.

Answer

Use IAM user name and password for Git credentials.

Answer

Use IAM access key and secret key for authentication.

Answer

Use Amazon Cognito user pools for authentication.

Question 14

A developer is deploying a microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other using service discovery. The developer wants to use AWS Cloud Map for service discovery. Which configuration is required for the services to register and discover each other?

Accepted Answer

Create a Cloud Map namespace and service; then configure ECS tasks to register with the service.. AWS Cloud Map requires a namespace (either HTTP or DNS) and a service resource. ECS tasks configured with service discovery can register themselves with the Cloud Map service, and other tasks can discover them via DNS queries or the Cloud Map API. Option A is incorrect because an Application Load Balancer is used for load balancing traffic, not for service discovery. Option B is incorrect because VPC endpoints provide private connectivity to AWS services, not service registration and discovery. Option C is incorrect because Security Groups control network traffic but do not facilitate service discovery.

Answer

Create an Application Load Balancer and register each service as a target group.

Answer

Create a VPC endpoint for each service.

Answer

Configure Security Groups to allow traffic between services.

Question 15

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application needs to read environment-specific configuration variables. Which configuration file should the developer use to define these variables within the Elastic Beanstalk environment?

Accepted Answer

.ebextensions/*.config. Ebextensions/*.config files in YAML or JSON format are used to define environment-specific configuration, including environment variables, in Elastic Beanstalk. Option A is wrong because package.json is for Node.js dependencies and cannot set environment variables. Option C is wrong because Dockerfile is for Docker containers, not Elastic Beanstalk configuration. Option D is wrong because buildspec.yml is used by AWS CodeBuild, not Elastic Beanstalk.

Answer

package.json

Answer

Dockerfile

Answer

buildspec.yml

Question 16

A developer is creating an IAM policy to allow access to an Amazon DynamoDB table. The policy must allow the user to read and write items, but not to delete the table or modify its schema. Which TWO DynamoDB actions should be included in the policy?

Accepted Answer

GetItem. GetItem and PutItem are the actions for reading and writing individual items. DeleteTable and UpdateTable are administrative actions that should not be allowed.

Answer

UpdateTable

Answer

Scan

Answer

DeleteTable

Question 17

A developer runs the above command and gets the output shown. What is the developer verifying?

Accepted Answer

The size and ETag of an object in S3. The command retrieves attributes of an object, including its size and ETag. Option A is incorrect because encryption is not checked by this command. Option C is incorrect because version ID is not part of the output shown. Option D is incorrect because the command does not test permissions; it just returns the object metadata if the user has read access.

Answer

Whether the object is encrypted

Answer

The version ID of the object

Answer

Whether the user has permissions to access the object

Question 18

A developer wants to deploy a static website to AWS. The website consists of HTML, CSS, and JavaScript files. Which combination of services provides the most cost-effective and scalable solution?

Accepted Answer

Amazon S3 and Amazon CloudFront. Amazon S3 can host static websites, and CloudFront provides CDN for low latency and scalability. Option A is correct. Option B (EC2) is more expensive and requires management. Option C (Elastic Beanstalk) is overkill. Option D (Lightsail) is a VPS but not as scalable for static content.

Answer

Amazon Lightsail

Answer

Amazon EC2 and Application Load Balancer

Answer

AWS Elastic Beanstalk

Question 19

Refer to the exhibit. A developer invoked a Lambda function and received the response shown. What does the response indicate?

Accepted Answer

The function was invoked but returned an error.. The response includes a 'FunctionError' field with value 'Unhandled' and an 'error' object, indicating that the Lambda function was invoked successfully (StatusCode 200) but the function itself encountered an error during execution. Option A is incorrect because a permissions error would result in a 4xx or 5xx StatusCode, not 200. Option B is incorrect because the function did not execute successfully—it returned an error. Option C is incorrect because a timeout would typically produce a 'null' FunctionError or a specific timeout error, not an explicit error object. Option D is correct: the function was invoked, but it returned an error.

Answer

The function was not invoked due to a permissions error.

Answer

The function executed successfully but did not return any logs.

Answer

The invocation timed out.

Question 20

A company's security policy requires that all data in transit between an Application Load Balancer (ALB) and its backend EC2 instances be encrypted. The ALB currently uses HTTPS listeners. What configuration ensures encryption between the ALB and targets?

Accepted Answer

Configure the target group to use HTTPS protocol.. To encrypt traffic between the ALB and backend EC2 instances, the target group protocol must be set to HTTPS, which uses TLS encryption. Option A is incorrect: security group rules control access but do not encrypt traffic. Option C is incorrect: while a Network Load Balancer with a TLS listener encrypts client-to-ALB traffic, it does not affect ALB-to-target encryption, and the question specifically asks about an Application Load Balancer. Option D is incorrect: setting the listener protocol to HTTPS with a certificate encrypts client-to-ALB traffic, not the traffic between ALB and targets.

Answer

Add a security group rule allowing port 443 from the ALB to the instances.

Answer

Use a Network Load Balancer with a TLS listener.

Answer

Set the listener protocol to HTTPS with a certificate.