DVA-C02 Practice Exam 56 — 20 Questions

Question 1

A developer is deploying a containerized application on Amazon ECS with Fargate. The application needs to read configuration data from AWS Systems Manager Parameter Store. The developer wants to ensure that the ECS task definition can access the parameter without hardcoding the value. What should the developer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'secrets' field in the task definition to reference the parameter ARN.. The 'secrets' field in an ECS task definition allows you to reference AWS Systems Manager Parameter Store (or AWS Secrets Manager) parameters by their ARN. This enables the container to retrieve the configuration value at runtime without hardcoding it in the task definition or container image, maintaining security and flexibility.

Answer

Store the configuration in Amazon ECR as a label and reference it in the task definition.

Answer

Use the 'configs' section in the task definition to load from Parameter Store.

Answer

Add a 'parameters' section in the task definition to load from Parameter Store.

Question 2

A company is using Amazon CloudFront to serve content from an Application Load Balancer (ALB) origin. The ALB is configured as an internal load balancer in a VPC. Users are getting HTTP 502 errors when accessing the CloudFront distribution. What is the MOST likely cause?

Accepted Answer

The ALB is not internet-facing, so CloudFront cannot reach it.. The ALB is configured as an internal load balancer, meaning it only has private IP addresses and is accessible only within the VPC. CloudFront, being an AWS edge service outside the VPC, cannot route traffic to a private IP address without additional configuration such as a VPC origin or a public-facing ALB. This results in HTTP 502 errors because CloudFront cannot establish a connection to the origin.

Answer

The ALB has AWS WAF enabled, blocking CloudFront IP addresses.

Answer

The CloudFront distribution's cache behavior is set to cache all objects.

Answer

The CloudFront distribution is not associated with a VPN connection to the VPC.

Question 3

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage from GitHub and a deploy stage to Elastic Beanstalk. The deploy stage fails with the error 'The S3 bucket does not allow access to the artifact'. Which THREE actions could resolve this issue?

Accepted Answer

Add a bucket policy that grants the pipeline's service role access to the artifact bucket.. The deploy stage fails because the CodePipeline service role cannot access the artifact S3 bucket. To resolve this, you can: (1) Attach a bucket policy that grants the pipeline's service role access to the bucket (Option B). (2) Ensure the pipeline's IAM role has the necessary S3 permissions: s3:GetObject and s3:PutObject on the artifact bucket (Option C). (3) If the artifact bucket uses AWS KMS encryption, the pipeline role also needs kms:Decrypt permission to read the encrypted artifacts (Option D). Option A is not a direct fix — specifying a different bucket may avoid the issue but does not address the access problem with the current bucket. Option E is irrelevant because bucket versioning does not affect access permissions.

Answer

Specify a different artifact bucket in the pipeline configuration.

Answer

Enable versioning on the artifact bucket.

Question 4

A team uses AWS CodePipeline to deploy a microservices application to Amazon ECS. The pipeline has a Source stage (GitHub), a Build stage (CodeBuild), and a Deploy stage (ECS). During a deployment, the pipeline fails at the Deploy stage with the error: 'Action execution failed: Deployment failed. The service my-service has reached the maximum number of tasks.' The service is configured with a desired count of 2 and a maximum percent of 200%. What is the most likely cause of this failure?

Accepted Answer

There are already 4 tasks running for the service, which is the maximum allowed by the deployment configuration.. With a desired count of 2 and a maximum percent of 200%, ECS allows up to 4 tasks during a deployment (2 × 200% = 4). If there are already 4 tasks running (e.g., from a previous deployment that did not complete or a manual scaling action), the new deployment cannot start additional tasks because it would exceed the maximum allowed. Option A is incorrect because insufficient memory would cause a different error, such as a task failing to start. Option C is incorrect because a high minimum healthy percent would prevent task replacement but would not directly cause a 'maximum number of tasks' error. Option D is incorrect because the error is about task count, not EC2 instance limits.

Answer

The task definition references a memory value that exceeds the available container instance memory.

Answer

The service's minimum healthy percent is set too high, preventing new tasks from starting.

Answer

The pipeline is trying to deploy to an ECS cluster that has reached its Amazon EC2 instance limit.

Question 5

A developer is troubleshooting an AWS Lambda function that is failing with an 'AccessDenied' error when trying to write to an S3 bucket. The function's execution role has the following policy. What is the most likely cause of the failure? (Policy: { 'Version': '2012-10-17', 'Statement': [ { 'Effect': 'Allow', 'Action': 's3:PutObject', 'Resource': 'arn:aws:s3:::my-bucket/*' } ] })

Accepted Answer

The S3 bucket has a bucket policy that denies the Lambda role access.. The IAM policy attached to the Lambda execution role correctly allows s3:PutObject on the bucket's objects. However, when a bucket policy explicitly denies access to the role or does not grant the required permissions, it takes precedence over the identity-based policy, resulting in an 'AccessDenied' error. Therefore, the most likely cause is a restrictive bucket policy.

Answer

The resource ARN does not include the bucket itself; it only includes objects

Answer

The action 's3:PutObject' is not allowed for Lambda execution roles

Answer

The action 's3:PutObject' is not sufficient; need 's3:*'

Question 6

Refer to the exhibit. An IAM policy allows s3:GetObject for a bucket only from a specific IP range. A developer accesses the bucket from a laptop with IP address 192.0.2.55, but access is denied. What is the most likely reason?

Accepted Answer

The request is made from an AWS service, such as the AWS Management Console, which does not use the laptop's public IP.. When a request is made via the AWS Management Console, the console itself acts as an intermediary. The console's requests originate from AWS service IPs, not the user's laptop public IP. Therefore, the `aws:SourceIp` condition in the IAM policy evaluates against the console's IP, which is not in the allowed range, causing the denial even though the laptop's IP is valid.

Answer

The policy includes an explicit deny statement elsewhere.

Answer

The condition key should be 'aws:SourceIp' without the 'IpAddress' wrapper.

Answer

The laptop's IP address is not within the allowed range.

Question 7

A developer needs to deploy a new version of a Lambda function that uses environment variables for database credentials. Which AWS service should be used to securely store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the best choice because it is designed specifically for securely storing secrets like database credentials and offers automatic rotation. Option C (AWS Systems Manager Parameter Store) can store secrets but lacks automatic rotation and is not as feature-rich for secret management. Option A (DynamoDB) and Option B (S3) are not intended for secret storage and lack native secret management capabilities such as rotation and fine-grained access control for secrets.

Answer

Amazon DynamoDB with encryption at rest

Answer

Amazon S3 with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 8

A developer is using AWS Elastic Beanstalk to deploy a web application. The developer needs to update the environment's configuration to use a larger instance type. What is the most efficient way to apply this change with minimal downtime?

Accepted Answer

Update the environment configuration through the Elastic Beanstalk console or CLI, and use a rolling update strategy to apply the change to instances in batches.. Elastic Beanstalk supports rolling updates, which allow you to change the instance type by updating instances in batches, minimizing downtime. Options B, C, and D are incorrect: B involves blue/green deployment, which is more complex and not the most efficient for a simple configuration change; C is wrong because directly modifying the Auto Scaling group launch configuration may be overwritten by Elastic Beanstalk and does not leverage Elastic Beanstalk's managed rolling update; D causes full downtime by terminating and recreating the environment.

Answer

Perform a blue/green deployment by creating a new environment with the larger instance type, then swap the environment URLs.

Answer

Modify the Auto Scaling group launch configuration directly to use the larger instance type, then manually terminate each instance.

Answer

Terminate the current environment and create a new one with the larger instance type.

Question 9

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with user data. The user data script installs software and configures the application. The developer wants to ensure that the stack creation waits for the user data script to complete before marking the stack as CREATE_COMPLETE. What should the developer do?

Accepted Answer

Add a CreationPolicy with a timeout to the EC2 instance resource and use cfn-signal in the user data.. The correct approach is to add a CreationPolicy to the EC2 instance resource and use cfn-signal in the user data script. The CreationPolicy tells CloudFormation to wait for a signal from the instance before considering the resource created. The user data script runs, installs software, and then calls cfn-signal to indicate success. If the signal is not received within the timeout, the stack creation fails. Option A (DependsOn) only orders resource creation, not waits for user data. Option B (WaitCondition) is a legacy method that is more complex; CreationPolicy is the recommended modern approach. Option D (running as a service) does not send any signal to CloudFormation.

Answer

Add a DependsOn attribute to the EC2 instance resource.

Answer

Use a CloudFormation WaitCondition and a WaitConditionHandle.

Answer

Configure the EC2 instance to run the user data script as a service.

Question 10

A company has a production environment using AWS Elastic Beanstalk with a multi-container Docker platform. The application consists of a PHP web server and a Redis cache, each running in separate containers. The deployment uses a rolling update policy with a batch size of 1. Recently, during deployments, some users experience intermittent 502 Bad Gateway errors for about 30 seconds. The errors occur when the old containers are terminated and new containers are not yet ready to serve traffic. The development team wants to eliminate this downtime without increasing the deployment time significantly. The team has access to modify the Elastic Beanstalk environment configuration and the Dockerrun.aws.json file. Which action should the team take to resolve the issue?

Accepted Answer

Configure a health check grace period in the Elastic Beanstalk environment to delay load balancer registration until the containers are healthy.. Configuring a health check grace period allows new containers time to become healthy before the load balancer routes traffic to them, preventing the 502 errors during the transition. Option A is incorrect because increasing the batch size would cause more containers to be replaced simultaneously, potentially increasing downtime. Option C is incorrect because 'All at once' deployment would terminate all old containers before starting new ones, causing full downtime. Option D is incorrect because reducing the health check interval would make the load balancer check more frequently, which could cause premature routing to unhealthy instances and exacerbate the issue.

Answer

Increase the batch size to 2 to reduce the number of deployment cycles.

Answer

Change the deployment policy to 'All at once' to complete the deployment faster.

Answer

Reduce the health check interval on the load balancer to detect healthy instances faster.

Question 11

A developer is deploying a CloudFormation stack and sees the event above. What should the developer do to fix the error?

Accepted Answer

Change the runtime to a supported version like nodejs18.x.. The error indicates that the runtime (Node.js 12.x) used in the Lambda function is deprecated and no longer supported by AWS. To fix this, the developer must update the CloudFormation template to specify a supported runtime version, such as nodejs18.x, and redeploy the stack. Option C correctly identifies this solution. Option A is incorrect because the programming language itself is not the issue; the runtime version needs updating. Option B is incorrect because increasing the timeout does not address the unsupported runtime. Option D is incorrect because adding permissions does not resolve the runtime deprecation error.

Answer

Update the Lambda function code to use a different programming language.

Answer

Increase the Lambda function timeout in the template.

Answer

Add permissions to the Lambda function's execution role.

Question 12

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The application is deployed to a t2.micro instance with 1 GB of RAM. The deployment uses an in-place update with a deployment configuration that has a minimum of 1 healthy host. What is the most likely cause of the failure?

Accepted Answer

The application uses too much memory, causing the instance to become unhealthy during deployment.. The most likely cause is option A: the application uses too much memory, causing the instance to become unhealthy during deployment. The t2.micro instance has only 1 GB of RAM. If the web application consumes significant memory, deploying a new version can trigger out-of-memory (OOM) errors, leading the instance to fail health checks. The deployment configuration requires a minimum of 1 healthy host, so when the instance becomes unhealthy, the deployment fails with the error about too few healthy instances. Option B (insufficient disk space) is unlikely because t2.micro instances typically have at least 8 GB of EBS storage, which is usually sufficient for downloading application revisions. Option C (CodeDeploy agent timeout) would produce a different error, such as 'deployment timed out,' not a message about healthy instances. Option D (insufficient IAM permissions) would result in authorization failures, such as 'AccessDenied' errors, not a health-related failure. Therefore, memory exhaustion due to the small instance size is the best explanation.

Answer

The instance does not have enough disk space to download the application revision.

Answer

The CodeDeploy agent timed out because the deployment took longer than 30 minutes.

Answer

The IAM role for the CodeDeploy agent does not have sufficient permissions to deploy the application.

Question 13

A company is using AWS CloudFormation to deploy and manage infrastructure. The developer wants to implement a CI/CD pipeline that automatically deploys CloudFormation stacks. The pipeline should be able to create, update, and delete stacks. Which THREE AWS services should the developer use together?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can be used as a build and test action within a pipeline to run custom scripts (e.g., using the AWS CLI) that create, update, or delete CloudFormation stacks. In a CI/CD pipeline, CodeBuild can execute `aws cloudformation deploy` or `aws cloudformation delete-stack` commands, providing the flexibility to handle stack operations beyond simple template deployment.

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 14

Which TWO actions should a developer take to improve the security of an AWS Lambda function that processes sensitive data?

Accepted Answer

Encrypt environment variables using AWS KMS. Encrypting environment variables with AWS KMS ensures that sensitive data, such as database credentials or API keys, is protected at rest and in transit during function deployment. This is a critical security best practice because environment variables are visible in plaintext in the Lambda console and API responses unless encrypted. KMS provides envelope encryption, where a customer master key (CMK) encrypts the data key that encrypts the environment variables, giving you full control over access and key rotation.

Answer

Use a dead-letter queue (DLQ) for failed invocations

Answer

Grant the Lambda function full access to all S3 buckets

Answer

Store secrets in the Lambda function code

Question 15

A developer is using AWS CodePipeline to automate a multi-stage pipeline. The pipeline includes a manual approval step before deploying to production. The developer wants to receive an email notification when the pipeline reaches the approval step. Which service should the developer use?

Accepted Answer

Use Amazon CloudWatch Events to detect the pipeline state change and trigger an SNS notification. CloudWatch Events (now part of Amazon EventBridge) can detect pipeline state changes such as a manual approval step entering a 'waiting' state. You can create a rule that matches this event and targets an Amazon SNS topic to send an email notification. Option A is incorrect because CodePipeline does not have an 'Email' action built-in. Option B is incorrect because CloudWatch Logs is used for monitoring log data, not for triggering notifications directly. Option C is incorrect because while Amazon SES can send emails, it is not directly integrated with CodePipeline; the recommended approach is to use CloudWatch Events with SNS for notifications.

Answer

Configure CodePipeline to send an email using the 'Email' action

Answer

Use Amazon CloudWatch Logs to monitor the pipeline logs and trigger an alarm

Answer

Use Amazon Simple Email Service (SES) to send an email from the pipeline

Question 16

A company uses AWS Elastic Beanstalk to deploy a web application. The development team wants to deploy a new version of the application to a separate environment for testing before switching production traffic. Which deployment strategy should be used?

Accepted Answer

Blue/green deployment.. Blue/green deployment (Option C) creates a separate, independent environment (green) for the new version, allowing thorough testing before swapping the environment's URLs to route production traffic to the green environment. This minimizes risk and enables quick rollback. Option A (immutable) launches a new Auto Scaling group in the same environment but does not isolate the new version in a separate environment; Option B (all at once) updates all instances simultaneously in the same environment, causing downtime; Option D (rolling) updates instances in batches in the same environment, exposing some users to the new version during deployment.

Answer

Immutable deployment.

Answer

All at once deployment.

Answer

Rolling deployment.

Question 17

A developer needs to allow a user to deploy AWS CloudFormation stacks but restrict the user from creating or modifying IAM resources. Which IAM policy should the developer attach to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"},{"Effect":"Deny","Action":"iam:*","Resource":"*"}]}. It grants full access to CloudFormation actions via an Allow statement while explicitly denying all IAM actions via a Deny statement, ensuring the user can deploy stacks but cannot create or modify IAM resources. Option B is incorrect because it allows all IAM actions, granting excessive permissions. Option C is incorrect because it allows CloudFormation but does not explicitly deny IAM, which could permit IAM actions if other policies allow. Option D is incorrect because it denies all CloudFormation actions, preventing stack deployment.

Answer

{"Effect":"Allow","Action":"iam:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"}

Answer

{"Effect":"Deny","Action":"cloudformation:*","Resource":"*"}

Question 18

A developer is deploying a new version of a Lambda function using the AWS CLI. The developer wants to shift 10% of traffic to the new version and then gradually increase to 100% over 10 minutes. Which CLI command should the developer use?

Accepted Answer

aws lambda update-alias --function-name my-function --name prod --function-version 2 --routing-config AdditionalVersionWeights={"1":0.9}. The `update-alias` command with the `--routing-config` parameter allows you to implement canary deployments by assigning a percentage of traffic to a new Lambda function version. In this case, `AdditionalVersionWeights={"1":0.9}` routes 10% of traffic to version 2 (the new version) and 90% to version 1. However, note that this command only sets a static routing configuration; to gradually increase traffic to 100% over 10 minutes, you must update the alias multiple times (e.g., via a script) to adjust the weights progressively. The command shown is the correct initial step to start the canary deployment.

Answer

aws lambda publish-version --function-name my-function

Answer

aws lambda create-function --function-name my-function --zip-file fileb://my-code.zip

Answer

aws lambda invoke --function-name my-function --payload '{}'

Question 19

A company has an S3 bucket that stores log files. The bucket policy grants the AWSServiceRoleForSSO service role write access. However, the logs are not being written. What is the MOST likely reason?

Accepted Answer

The bucket policy uses a service role ARN that is not a valid principal for S3 bucket policies.. The bucket policy uses the ARN of the AWSServiceRoleForSSO service-linked role as the principal, but S3 bucket policies do not accept service role ARNs as valid principals. Instead, you must use the AWS service principal (e.g., sso.amazonaws.com) when granting permissions to an AWS service that uses a service role. Therefore, the policy fails to grant write access. Options A, C, and D are incorrect: S3 Block Public Access settings only block public access, not access from service roles; bucket ACLs are not effective when a bucket policy exists and private ACLs do not prevent authorized writes; default encryption with SSE-S3 does not block writes from any principal.

Answer

The bucket has S3 Block Public Access enabled, which blocks all service role access.

Answer

The bucket ACL is set to private, which prevents service role writes.

Answer

The bucket has default encryption enabled using SSE-S3, which prevents writes from service roles.

Question 20

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails during the 'Install' lifecycle event. The developer checks the logs and finds that the scripts in the 'appspec.yml' file are not being executed because the instances are not in a healthy state. What could be the reason for the instances being unhealthy?

Accepted Answer

The health check grace period on the Auto Scaling group is too short.. If the health check grace period is too short, instances may be marked unhealthy by the Auto Scaling group before the CodeDeploy installation scripts complete. This causes the deployment to fail during the 'Install' lifecycle event. Option B is incorrect because even if the ELB is not configured to route traffic, it would not directly cause instance health check failures during deployment; it would affect traffic routing. Option C is incorrect because an outdated CodeDeploy agent might cause script execution failures, but the logs indicate scripts are not executed because instances are unhealthy, not because of agent issues. Option D is incorrect because IAM permissions affect access to artifacts, but the error is about instance health, not access denied.

Answer

The Elastic Load Balancer is not configured to route traffic to the Auto Scaling group.

Answer

The CodeDeploy agent on the instances is outdated.

Answer

The IAM instance profile does not have permissions to access the S3 bucket where the artifacts are stored.