DVA-C02 Practice Exam 54 — 20 Questions

Question 1

Refer to the exhibit. A developer has the above IAM policy attached. The developer is trying to push code to a CodeCommit repository and trigger a CodePipeline. The push succeeds but the pipeline does not start. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CloudWatch Events rule that triggers the pipeline on code push does not have the necessary IAM role to invoke the pipeline.. The pipeline is triggered by a CloudWatch Events rule that monitors code push events. For the rule to invoke the pipeline, it must have an IAM role with permission to start the pipeline. If that role is missing or lacks permissions, the pipeline won't start even though the developer has push permissions. Option A is incorrect because the developer's policy allows GitPush, so push succeeds. Option C is incorrect because the developer has StartPipelineExecution permission, but that's not how the pipeline is triggered—it's an event-driven trigger. Option D is incorrect because CodeCommit does not require a trigger to be configured; the CloudWatch Events rule handles the event.

Answer

The developer does not have permissions to push to the repository.

Answer

The developer does not have permissions to start the pipeline.

Answer

The CodeCommit repository does not have a trigger configured.

Question 2

A team uses AWS Elastic Beanstalk to deploy a web application. The application experiences intermittent high latency. The team notices that the environment's Auto Scaling group is not scaling out quickly enough. Which configuration change should the team make to improve scaling responsiveness?

Accepted Answer

Decrease the Auto Scaling group's cooldown period. Decreasing the Auto Scaling group's cooldown period reduces the time that the group waits after a scaling activity before it can launch another instance, thereby improving scaling responsiveness. Option A is incorrect because a lighter health check path does not affect scaling speed—it only affects how quickly unhealthy instances are detected. Option B is incorrect; while detailed CloudWatch metrics provide more granular data, they do not directly reduce the cooldown period. Option C is incorrect because increasing instance size improves per-instance capacity but does not change how quickly the group scales out.

Answer

Modify the Elastic Load Balancer health check path to a lighter endpoint

Answer

Enable detailed CloudWatch metrics for the Auto Scaling group

Answer

Increase the instance type to a larger size

Question 3

A developer wants to ensure that an S3 bucket only allows HTTPS requests. What S3 bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition checks whether the request was sent using SSL/TLS, effectively enabling HTTPS-only access. Option A is incorrect because aws:CurrentTime is used to allow or deny access based on the time of the request. Option B is incorrect because aws:MultiFactorAuthPresent checks if the requester authenticated with multi-factor authentication. Option C is incorrect because aws:SourceIp is used to restrict requests based on the source IP address.

Answer

aws:CurrentTime

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceIp

Question 4

Refer to the exhibit. A developer created this IAM policy to allow a CI/CD service to trigger CodePipeline and CodeBuild. However, the pipeline fails with an 'AccessDenied' error when trying to start the CodeBuild project. What is the likely cause?

Accepted Answer

The policy is attached to the developer's IAM user instead of the CodePipeline service role.. The policy is correctly defined to allow 'codebuild:StartBuild' on all resources, so options B and C are incorrect. Option A is incorrect because using 'Deny' would block the action entirely. The actual cause is that the policy is attached to the developer's IAM user, but CodePipeline requires the permissions to be attached to its service role. When CodePipeline tries to start the CodeBuild project on behalf of the pipeline, it uses the service role, not the developer's user. Therefore, the policy must be attached to the CodePipeline service role to grant the necessary permissions.

Answer

The policy should use 'Effect': 'Deny' for the CodeBuild actions.

Answer

The policy does not include 'codebuild:StartBuild' for the specific CodeBuild project ARN.

Answer

The policy must include 'codebuild:BatchGetBuilds' for the specific project.

Question 5

Refer to the exhibit. A CloudFormation stack update resulted in a rollback. What is the most likely reason for the rollback?

Accepted Answer

A user manually cancelled the update of the Lambda function.. The event message 'Resource update cancelled by user' indicates that the Lambda function update was cancelled by a user, triggering the rollback. Options B, C, and D are incorrect because there is no indication of a timeout, insufficient permissions, or invalid code; the error explicitly states user cancellation.

Answer

The Lambda function update timed out.

Answer

The Lambda function's IAM role did not have sufficient permissions.

Answer

The Lambda function code was invalid.

Question 6

A company's application running on Amazon ECS Fargate is experiencing high CPU utilization. The task definition has CPU set to 256 units. What should be done to improve performance?

Accepted Answer

Increase the CPU value in the task definition and redeploy the service.. Increasing CPU units in the task definition and redeploying the service will allocate more CPU to the tasks. Option A is wrong because horizontal scaling can help but the root cause is insufficient CPU per task. Option C is wrong because increasing memory does not affect CPU. Option D is wrong because changing the launch type changes billing but not CPU allocation.

Answer

Increase the desired count of tasks.

Answer

Increase the memory value in the task definition.

Answer

Switch to EC2 launch type.

Question 7

A developer is troubleshooting a slow-running application that uses ElastiCache for Redis as a caching layer. The application frequently reads and writes data to the cache. Which TWO actions should the developer take to improve cache performance?

Accepted Answer

Use optimized data structures like hashes instead of strings for complex data.. Using optimized data structures like hashes instead of strings reduces memory and CPU overhead for complex data, improving cache performance. Option E is correct because enabling ElastiCache auto scaling allows the cluster to adjust the number of nodes based on demand, preventing performance degradation during traffic spikes. Option B is incorrect: LRU eviction policy helps manage memory when full but is not a performance optimization for read/write operations. Option C is incorrect: disabling persistence (appendonly no) improves write performance but is not the primary issue for a slow application and may affect data durability. Option D is incorrect: increasing shards distributes data but does not directly improve performance if the bottleneck is CPU or memory; auto scaling is a more targeted solution.

Answer

Configure the cache to use LRU eviction policy.

Answer

Disable persistence by setting appendonly to no.

Answer

Increase the number of shards to distribute data.

Question 8

A developer is troubleshooting an AWS Lambda function that writes to an S3 bucket. The function is configured with a resource-based policy that allows the S3 service to invoke the function. However, the function fails with an access denied error when trying to write to S3. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have an IAM policy that allows s3:PutObject.. The Lambda function's execution role lacks the necessary IAM permissions (s3:PutObject) to write to the S3 bucket. The resource-based policy only allows S3 to invoke the function, not the function to write. Option A is incorrect because a VPC endpoint would not cause an access denied error for writing if the execution role had permissions. Option C is incorrect because trigger misconfiguration would prevent invocation, not cause access denied during execution. Option D is incorrect because the S3 bucket policy is not required if the execution role grants write access; the bucket policy controls who can access the bucket, but the execution role is the primary mechanism for Lambda permissions.

Answer

The Lambda function is configured in a VPC without an S3 VPC endpoint.

Answer

The Lambda function's trigger (S3 event notification) is misconfigured.

Answer

The S3 bucket policy does not grant the Lambda function write access.

Question 9

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'ScriptMissing' error. What is the most likely cause?

Accepted Answer

The lifecycle event hook script referenced in appspec.yml is not present.. The 'ScriptMissing' error occurs when the appspec.yml file references a lifecycle event hook script that is not present in the application revision. CodeDeploy expects the script to exist at the specified path. Option A is incorrect: the deployment group can be configured for an Auto Scaling group, and that is not the cause of ScriptMissing. Option B is incorrect: buildspec.yml is used by AWS CodeBuild, not CodeDeploy. Option C is incorrect: while the application revision must be stored in S3 (or GitHub), the error is not about the bucket location but about a missing script within the revision.

Answer

The deployment group is not configured for an Auto Scaling group.

Answer

The buildspec.yml file is missing from the application root.

Answer

The application revision is not stored in an S3 bucket.

Question 10

A developer needs to grant an IAM user the ability to create and manage EC2 instances, but only in the us-east-1 region. Which IAM policy statement should be used?

Accepted Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "*", "Condition": {"StringEquals": {"ec2:Region": "us-east-1"}}}. The Condition element with ec2:Region restricts the allowed actions to only the us-east-1 region, while allowing all EC2 actions (ec2:*). Option B is incorrect because it only permits Describe actions, not creating or managing instances. Option C is incorrect because although the Resource ARN includes the region, the ec2:* actions do not support resource-level restrictions with region in the ARN in the same way; a Condition is needed. Option D is incorrect because it allows EC2 actions in all regions with no restriction.

Answer

{"Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "arn:aws:ec2:us-east-1:*:*"}

Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "*"}

Question 11

A developer is using Amazon DynamoDB as the database for a web application. The application experiences occasional spikes in traffic, and some write requests fail with a ProvisionedThroughputExceededException. What is the MOST cost-effective way to handle these spikes without manual intervention?

Accepted Answer

Enable DynamoDB auto scaling for the table.. DynamoDB auto scaling automatically adjusts the provisioned read and write capacity based on actual traffic patterns, handling spikes without manual intervention and only paying for the capacity needed at peak times. Option A (on-demand mode) avoids capacity management but can be more expensive for predictable workloads or sustained traffic. Option C (increasing to peak) leads to over-provisioning and higher cost during low traffic. Option D (DAX) is a caching layer for reads, not writes, and does not address write throughput limitations.

Answer

Switch to on-demand mode for the table.

Answer

Increase the provisioned write capacity to the peak expected value.

Answer

Use DynamoDB Accelerator (DAX) to cache writes.

Question 12

A developer runs the AWS CLI command to decrypt a file using a KMS key. What is the most likely cause of the error?

Accepted Answer

The IAM user lacks kms:Decrypt permission on the key.. The IAM user DevUser does not have kms:Decrypt permission on the specified KMS key.

Answer

The encrypted file is corrupted.

Answer

The CLI cannot read the file.

Answer

The KMS key ID is incorrect.

Question 13

A developer wants to encrypt data in transit between an application and an S3 bucket. Which option achieves this?

Accepted Answer

Use HTTPS when making requests to S3.. HTTPS encrypts data in transit between the application and S3, ensuring confidentiality during transmission. Option A is incorrect because SSE-S3 encrypts data at rest, not in transit. Option B is incorrect because IAM policies control access permissions, not encryption. Option D is incorrect because encrypting data with AWS KMS before upload addresses at-rest encryption, but without HTTPS, data is still transmitted in plaintext.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3).

Answer

Configure an IAM policy to require encryption.

Answer

Use AWS KMS to encrypt the data before upload.

Question 14

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires custom configuration, such as setting environment variables for the EC2 instances. Which file should the developer include in the application source bundle under the appropriate directory to achieve this?

Accepted Answer

Include a .ebextensions/options.config file.. AWS Elastic Beanstalk uses `.ebextensions` directory with `.config` files (e.g., `options.config`) to define custom configuration, including environment variables for EC2 instances. These YAML or JSON files are processed during environment creation and updates, allowing you to set `option_settings` that override or augment the default platform configuration.

Answer

Include a buildspec.yml file in the root directory.

Answer

Include an appspec.yml file.

Answer

Include a cron.yaml file.

Question 15

A company has a REST API running on Amazon EC2 instances behind an Application Load Balancer. The API is accessed by mobile clients. The company wants to add authentication and authorization without modifying the backend code. Which AWS service should be used?

Accepted Answer

Amazon Cognito user pools integrated with the Application Load Balancer. Amazon Cognito user pools can be integrated directly with an Application Load Balancer (ALB) to handle authentication and authorization without modifying backend code. The ALB uses an OIDC-compatible identity provider (Cognito) to authenticate users before forwarding requests to the EC2 instances, allowing the backend to remain unchanged.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon API Gateway with a Lambda authorizer

Answer

Amazon CloudFront with Lambda@Edge

Question 16

A developer is troubleshooting an EC2 instance that cannot connect to the internet. The instance has a public IP address and is in a public subnet with a route to an internet gateway. The security group allows all outbound traffic. What is the most likely cause?

Accepted Answer

The network ACL's outbound rules are blocking traffic.. Network ACLs are stateless and block traffic unless explicitly allowed. The security group allows all outbound traffic, but if the network ACL's outbound rules are too restrictive, traffic can be blocked. Option A is wrong because the subnet has a route to an internet gateway. Option B is wrong because the security group allows all outbound traffic. Option D is wrong because the instance has a public IP address.

Answer

The subnet's route table does not have a route to an internet gateway.

Answer

The security group's outbound rules are too restrictive.

Answer

The instance does not have a public IP address.

Question 17

A developer deploys an application on EC2 instances behind an Application Load Balancer (ALB). The application uses sticky sessions (session affinity) based on a cookie. Users report that they are intermittently logged out during their session. What is the MOST likely cause?

Accepted Answer

The stickiness cookie expiration duration is set too low, causing the cookie to expire before the user's session ends.. If the stickiness cookie expiration duration is set too low, the cookie will expire before the user's session ends, causing the load balancer to route the user to a different instance and losing session state. Option A is wrong because deregistration delay affects how long an instance remains in service during scaling events, but does not directly cause intermittent logouts during a session. Option B is wrong because a short health check interval might cause healthy instances to be marked unhealthy, but this would result in dropped connections, not specifically intermittent logouts due to session stickiness. Option C is wrong because cross-zone load balancing affects traffic distribution across zones, not session stickiness.

Answer

The deregistration delay value is too low, causing connections to be dropped during scaling events.

Answer

The ALB health check interval is too short, causing healthy instances to be marked unhealthy frequently.

Answer

Cross-zone load balancing is disabled, causing uneven traffic distribution.

Question 18

A developer is using AWS CloudFront to serve static content. Users in some geographic regions report slow load times. Which CloudFront feature can the developer use to reduce latency for these users?

Accepted Answer

Change the CloudFront price class to include all edge locations.. CloudFront's price class determines which edge locations are used to serve content. By default, CloudFront may use only a subset of edge locations (Price Class 100 or 200) to reduce costs, which can cause higher latency for users in regions not covered. Changing the price class to 'All Edge Locations' (Price Class All) ensures that CloudFront uses every global edge location, providing lower latency for all users. Option B is incorrect because creating multiple origins in different regions addresses origin distance, not edge location coverage. Option C is incorrect because S3 Transfer Acceleration is for speeding up uploads to S3, not for improving CloudFront content delivery. Option D is incorrect because Lambda@Edge can modify content at edge locations but does not expand the set of edge locations used.

Answer

Create multiple origins in different regions.

Answer

Enable S3 Transfer Acceleration on the origin S3 bucket.

Answer

Use Lambda@Edge to optimize content delivery.

Question 19

A developer is creating a new IAM policy to allow an application to read objects from a specific S3 bucket and write logs to a CloudWatch log group. Which policy statement is correct?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","logs:CreateLogStream","logs:PutLogEvents"],"Resource":["arn:aws:s3:::my-bucket/*","arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:*"]}. It grants the necessary permissions: s3:GetObject to read objects from the bucket, and logs:CreateLogStream and logs:PutLogEvents to write logs to the CloudWatch log group. The resources are correctly specified: the bucket ARN with a wildcard for objects, and the log group ARN with a wildcard for log streams. Option A is incorrect because it uses ec2:DescribeInstances, which is unrelated to S3 or CloudWatch. Option B is incorrect because it only allows s3:ListBucket on the bucket (listing objects) but not reading them (s3:GetObject), and it does not include CloudWatch actions. Option D is incorrect because it only allows s3:PutObject (writing objects) rather than reading, and lacks CloudWatch permissions.

Answer

{"Effect":"Allow","Action":["ec2:DescribeInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 20

Which THREE actions can a developer take to improve the cold start latency of an AWS Lambda function?

Accepted Answer

Use a language runtime with faster startup time, such as Python or Node.js.. Python and Node.js use interpreted runtimes with faster initialization times compared to compiled runtimes like Java or .NET. These runtimes have smaller binary sizes and lower startup overhead, reducing the time from invocation to execution start, which directly improves cold start latency.

Answer

Place the Lambda function inside a VPC.

Answer

Increase the function's timeout setting.