DVA-C02 Practice Exam 55 — 20 Questions

Question 1

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option A and Option C are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store are both secure services for storing secrets. Option B is wrong because environment variables can be exposed. Option D is wrong because hardcoding is insecure. Option E is wrong because storing in S3 without encryption is insecure.

Answer

Store credentials in an Amazon S3 bucket with server-side encryption.

Answer

Hardcode credentials in the application configuration file.

Answer

Store credentials as environment variables in the Elastic Beanstalk environment.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Option D is correct because viewing the logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Option A is wrong because SSH access may not be configured. Option B is wrong because CloudFormation is not directly related. Option C is wrong because the environment may not be load-balanced.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 3

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Options A and C are correct. A: The Events tab shows error messages for each resource. C: The stack template can be reviewed to check for logical errors. Option B is wrong because deleting the stack removes all resources and logs. Option D is wrong because CloudTrail logs API calls, not CloudFormation-specific errors. Option E is wrong because the outputs are only available after successful creation.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 4

The exhibit shows an IAM policy attached to a user who needs to deploy applications using AWS CodeDeploy. The user reports that they cannot create a deployment for the MyApplication/MyDeploymentGroup. What is the most likely reason?

Accepted Answer

The policy does not include permission on the application resource.. Option D is correct because the CreateDeployment action requires permission on the deployment group resource, but also requires permission on the application resource (arn:aws:codedeploy:region:account:application:MyApplication). The policy only grants on the deployment group, not the application. Option A is wrong because the actions are allowed. Option B is wrong because GetDeployment and GetDeploymentGroup are allowed. Option C is wrong because the policy does not restrict the deployment group; it grants on the specific group.

Answer

The policy restricts the user to a different deployment group.

Answer

The user does not have permission to call the codedeploy:CreateDeployment action.

Answer

The user does not have permission to call codedeploy:GetDeployment and codedeploy:GetDeploymentGroup.

Question 5

A company uses AWS Elastic Beanstalk to deploy a web application. The developer wants to perform a blue/green deployment to minimize downtime. The developer creates a new environment and deploys the new version. After verifying the new environment is healthy, the developer needs to swap the URLs so that traffic is routed to the new environment. Which AWS Elastic Beanstalk feature should the developer use?

Accepted Answer

Use the 'Swap environment URLs' feature in the Elastic Beanstalk console.. Option C is correct because Elastic Beanstalk's 'Swap environment URLs' feature allows swapping the CNAME records between two environments. Option A is wrong because Route 53 weighted routing is not managed by Elastic Beanstalk. Option B is wrong because the environment URL cannot be changed manually. Option D is wrong because updating DNS manually is not recommended and not a built-in feature.

Answer

Delete the old environment and update the DNS record to point to the new environment.

Answer

Use Amazon Route 53 weighted routing policies to shift traffic.

Answer

Change the environment's CNAME to point to the new environment.

Question 6

A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)

Accepted Answer

Add a manual approval step before the deploy stage.. Options A, B, and D are correct. Manual approval gates, separate pipelines, and integration testing are best practices. Option C is wrong because automatic deployment bypasses approval. Option E is wrong because deploying all branches to production is risky.

Answer

Configure the pipeline to automatically deploy every commit to production.

Answer

Deploy all feature branches directly to production.

Question 7

Refer to the exhibit. A developer tried to create a CloudFormation stack that includes an EC2 instance. The stack creation failed and rolled back. What should the developer do to get more details about the failure?

Accepted Answer

Run `aws cloudformation describe-stack-events` for the stack.. Option B is correct because the `describe-stack-events` command shows detailed events including resource status reasons. Option A is wrong because the template itself is not the issue. Option C is wrong because the stack has rolled back. Option D is wrong because there is no drift on a failed creation.

Answer

Review the CloudFormation template syntax.

Answer

Use the `detect-stack-drift` command.

Answer

Update the stack with the same template to see the error.

Question 8

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application needs to read environment-specific configuration variables. Which configuration file should the developer use to define these variables within the Elastic Beanstalk environment?

Accepted Answer

.ebextensions/*.config. Option A is correct because .ebextensions configuration files in YAML or JSON format are used to set environment properties in Elastic Beanstalk. Option B is wrong because Dockerfile is for Docker containers, not for environment variables. Option C is wrong because the application's package.json is not used for environment-specific configuration. Option D is wrong because the buildspec.yml is for CodeBuild, not Elastic Beanstalk.

Answer

package.json

Answer

Dockerfile

Answer

buildspec.yml

Question 9

A developer is using AWS CodeDeploy to deploy an application to an Amazon EC2 Auto Scaling group. The deployment fails because the CodeDeploy agent on the instances is not running. Which TWO steps should the developer take to resolve this issue? (Choose TWO.)

Accepted Answer

Install the CodeDeploy agent on the instances.. Options A and C are correct. A: Installing the agent ensures it's present. C: Starting the agent makes it operational. Option B is wrong because user data runs at launch, not on existing instances. Option D is wrong because restarting the instance may not start the agent if it's not installed. Option E is wrong because IAM roles are necessary but don't start the agent.

Answer

Attach an IAM role to the instances that allows CodeDeploy actions.

Answer

Reboot the instances.

Answer

Add a script in the Auto Scaling group's launch configuration user data to install the agent.

Question 10

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to define the DynamoDB table and the Lambda function in the SAM template. Which THREE resource types should the developer include in the template? (Choose THREE.)

Accepted Answer

AWS::DynamoDB::Table. Options A, B, and D are correct. In a SAM template, 'AWS::Serverless::Function' (option A) defines a Lambda function, 'AWS::Serverless::SimpleTable' (option B) defines a DynamoDB table, and 'AWS::DynamoDB::Table' (option D) can also be used for more advanced configurations. Option C, 'AWS::Serverless::DynamoDB', is not a valid SAM resource type (the correct one is 'AWS::Serverless::SimpleTable' or 'AWS::DynamoDB::Table'). Option E, 'AWS::Lambda::Function', is a CloudFormation resource, but SAM templates typically use 'AWS::Serverless::Function' for simplicity, though both are valid. However, since the question asks for SAM template, the recommended approach is to use serverless types.

Answer

AWS::Lambda::Function

Answer

AWS::Serverless::DynamoDB

Question 11

The exhibit shows the output of the describe-instances command. An Elastic Beanstalk environment is configured to use this EC2 instance as a web server. The application is not accessible. What is the most likely cause?

Accepted Answer

The instance has been terminated.. Option B is correct because the instance state is 'terminated', meaning it is no longer running. Option A is wrong because the instance exists but is terminated. Option C is wrong because the tag is present. Option D is wrong because there is no indication of a security group issue.

Answer

The security group does not allow HTTP traffic.

Answer

The instance does not have the correct Name tag.

Answer

The instance does not exist.

Question 12

A developer is deploying a serverless application using AWS SAM. The developer wants to run integration tests against the deployed API Gateway endpoints before promoting the deployment to production. The developer uses AWS CodePipeline with a canary deployment strategy. How can the developer implement testing in the pipeline?

Accepted Answer

Add a Lambda function as a test action in CodePipeline that runs after the deploy stage and before the final promote.. Option A is correct because CodePipeline can invoke a Lambda function as a test action after the canary deployment. This allows running tests against the canary before full rollout. Option B is wrong because it requires manual step. Option C is wrong because CodeBuild is for build, not test after deployment. Option D is wrong because API Gateway stage variables are not designed for canary testing in this context.

Answer

Use AWS CloudFormation stack outputs to get the endpoint URL and manually test.

Answer

Use API Gateway stage variables to route a percentage of traffic to the new version and monitor.

Answer

Configure CodeBuild to run tests after deployment.

Question 13

A development team wants to automate the deployment of a microservices application on Amazon ECS with Fargate. The team uses AWS CodePipeline for CI/CD. Each microservice has its own source repository and Dockerfile. The team wants to build Docker images, push them to Amazon ECR, and deploy them to ECS. Which approach minimizes manual effort and follows best practices?

Accepted Answer

Use AWS CodePipeline with a build stage in CodeBuild and a deploy stage that uses the ECS deploy provider.. Option D is correct because CodePipeline can directly integrate with ECS using deploy actions that update the ECS service with new task definitions. Option A is wrong because it adds unnecessary manual steps. Option B is wrong because it is not a best practice to bypass CI/CD. Option C is wrong because it adds extra complexity with CodeDeploy when not needed for Fargate.

Answer

Use AWS CodeDeploy to deploy to ECS with a blue/green deployment.

Answer

Use AWS CloudFormation to create the infrastructure and manually trigger updates.

Answer

Use AWS CodeBuild to build and push images, then manually update the ECS service.

Question 14

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Accepted Answer

Enable termination protection on the CloudFormation stack.. Options A, C, and D are correct. DeletionPolicy Retain, TerminationProtection, and StackPolicy can prevent deletion. Option B is wrong because it does not prevent deletion. Option E is wrong because NestedStacks do not protect individual resources.

Answer

Wrap the resource in a nested stack.

Answer

Set the UpdateReplacePolicy attribute to 'Retain' on the resource.

Question 15

A company uses AWS CodeDeploy to deploy applications to an Auto Scaling group. The deployment is failing with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment configuration is CodeDeployDefault.OneAtATime. The Auto Scaling group has 4 instances. What is the most likely cause?

Accepted Answer

The first instance in the deployment fails, and the deployment stops because only one instance is deployed at a time.. Option C is correct because with OneAtATime, if the first instance fails, the deployment stops and fails. Option A is wrong because the error indicates a deployment failure, not an Auto Scaling issue. Option B is wrong because even if CodeDeploy agent is outdated, it would not cause a healthy host error. Option D is wrong because the error mentions too few healthy instances, not misconfigured target groups.

Answer

The CodeDeploy agent on the instances is not running.

Answer

The target group health checks are misconfigured.

Answer

The Auto Scaling group is scaling down during deployment.

Question 16

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager.. Options A, B, and D are correct. A: Environment properties in Elastic Beanstalk are injected into the application. B: AWS Systems Manager Parameter Store provides secure, encrypted storage. D: AWS Secrets Manager is designed for secrets like database credentials. Option C is wrong because the application code should not read from RDS tags; tags are not intended for sensitive data. Option E is wrong because putting the connection string in a file in the deployment package is not secure.

Answer

Read the connection string from Amazon RDS tags.

Answer

Store the connection string in a configuration file in the application bundle.

Question 17

A developer is setting up an IAM role for a CI/CD pipeline. The above IAM policy is attached to the role. The pipeline needs to deploy a revision to an Amazon S3 bucket and then trigger a CodeDeploy deployment. The deployment fails with an access denied error. What is the missing permission?

Accepted Answer

codedeploy:RegisterApplicationRevision. Option C is correct because to trigger a CodeDeploy deployment, the 'codedeploy:RegisterApplicationRevision' permission is required when using S3 as the revision location. Option A is wrong because 's3:ListBucket' is not needed for uploading. Option B is wrong because 'codedeploy:UpdateDeploymentGroup' is for updating configuration, not deployment. Option D is wrong because 's3:GetObjectVersion' is for versioning, not required.

Answer

codedeploy:UpdateDeploymentGroup

Answer

s3:ListBucket

Answer

s3:GetObjectVersion

Question 18

Refer to the exhibit. A CloudFormation stack update resulted in a rollback. What is the most likely reason for the rollback?

Accepted Answer

A user manually cancelled the update of the Lambda function.. Option D is correct because the event shows that the Lambda function update failed with reason 'Resource update cancelled by user'. This indicates that someone cancelled the update. Option A is wrong because there is no permission error shown. Option B is wrong because the error is not about timeout. Option C is wrong because the error is explicit.

Answer

The Lambda function update timed out.

Answer

The Lambda function's IAM role did not have sufficient permissions.

Answer

The Lambda function code was invalid.

Question 19

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. Option B and D are correct because the CodeDeploy agent must be installed on each instance, and the service role must have permissions to access the instances. Option A is wrong because CodeDeploy supports in-place deployments. Option C is wrong because a load balancer is optional. Option E is wrong because CodeDeploy does not require an Application Discovery Service.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 20

A company is migrating a monolithic application to microservices on AWS. They want to use a blue/green deployment strategy for a new version of a service running on Amazon ECS with Fargate. The service is behind an Application Load Balancer. Which combination of actions should be taken to implement blue/green deployment with minimal downtime? (Choose the correct answer.)

Accepted Answer

Use AWS CodeDeploy to orchestrate a blue/green deployment by creating a new task set and shifting traffic.. Option D is correct because AWS CodeDeploy supports blue/green deployments on ECS, creating a new task set and shifting traffic. Option A is wrong because updating the existing service directly causes downtime. Option B is wrong because a second ALB is unnecessary and adds complexity. Option C is wrong because manually updating target groups is error-prone and not automated.

Answer

Create a second ALB pointing to the new service, then update DNS to switch traffic.

Answer

Update the existing ECS service with the new task definition and allow rolling update.

Answer

Manually create a new target group with the new service and update the ALB listener rule.