DVA-C02 Practice Exam 57 — 20 Questions

Question 1

A company is using AWS CodePipeline to automate the deployment of a microservices application to Amazon ECS. The pipeline has the following stages: Source (GitHub), Build (CodeBuild), Deploy (ECS). The Deploy stage uses an ECS task definition and updates the service. Recently, the pipeline failed at the Deploy stage with the error: 'The task definition family is inactive.' The developer checks the ECS console and sees that the task definition family exists but is inactive. The developer also notices that the pipeline uses a parameter 'TASK_DEFINITION_FAMILY' with the value 'my-app'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pipeline is referencing the task definition family name without a specific revision number, and the latest revision is inactive.. The error 'The task definition family is inactive' indicates that the pipeline is using the task definition family name 'my-app' without specifying a revision number. When a task definition family is marked as inactive, it means the latest revision in that family is inactive. CodePipeline requires a specific active revision number to deploy successfully. Therefore, the most likely cause is that the pipeline is referencing only the family name, and the latest revision is inactive. Option D correctly identifies this issue. Option A is incorrect because the family exists. Option B is incorrect because environment variables are unrelated to the error. Option C is incorrect because the pipeline's IAM role permissions are not the issue; the error is about the task definition state, not permissions.

Answer

The task definition family 'my-app' does not exist in the ECS cluster.

Answer

The environment variables in the task definition are not correctly set.

Answer

The IAM role for ECS does not have permission to register new task definitions.

Question 2

A company has a production application running on AWS Lambda that processes real-time streaming data from Amazon Kinesis Data Streams. The Lambda function is configured with a batch size of 100 and a maximum concurrency of 5. Recently, the application has been experiencing failures with a high number of invocation errors. The errors indicate that the function is timing out. The developer checks the CloudWatch metrics and notices that the IteratorAge metric for the Kinesis stream is increasing rapidly, and there are many Throttles events for the Lambda function. The average execution duration of the function is 30 seconds, and the function timeout is set to 1 minute. The Kinesis stream has 10 shards. The company expects the data volume to double in the next month. Which combination of actions should the developer take to resolve the issue and prepare for future growth?

Accepted Answer

Increase Lambda concurrency to at least 20 and reduce the batch size to 10.. The Lambda function is throttled because the maximum concurrency of 5 is too low for 10 shards. With a batch size of 100 and average duration of 30 seconds, each batch takes too long, leading to timeouts and increasing IteratorAge. Increasing concurrency to at least 20 (2 per shard) allows processing of all shards in parallel. Reducing batch size to 10 reduces the processing time per batch, helping avoid timeouts. Option A is wrong because increasing shards without increasing concurrency would worsen throttling. Option C is wrong because disabling reserved concurrency could lead to uncontrolled scaling, but the main issue is concurrency and batch size; also decreasing batch size to 5 may be too small and inefficient. Option D is wrong because increasing timeout and batch size would not resolve throttling and would increase latency.

Answer

Increase the number of shards in the Kinesis stream to 20 and increase Lambda concurrency to 10.

Answer

Disable the reserved concurrency limit on the Lambda function and decrease the batch size to 5.

Answer

Increase the Lambda function timeout to 5 minutes and increase the batch size to 500.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores user session data in an Amazon ElastiCache for Redis cluster. Recently, users have been experiencing intermittent session timeouts and data loss. The developer examines the application logs and finds errors indicating that the Redis cluster is returning 'READONLY You can't write against a read-only replica.' The ElastiCache cluster is configured as a Redis replication group with one primary and two replicas. The application's connection code uses the primary endpoint. What is the most likely cause of this issue?

Accepted Answer

A failover event occurred, and the application is still trying to write to the old primary node, which is now a replica.. The READONLY error occurs when attempting to write to a Redis replica node. In a replication group with one primary and two replicas, a failover event can promote a replica to become the new primary while the old primary becomes a replica. If the application's connection code uses the primary endpoint (which is a DNS name), DNS caching or a long TTL may cause the application to continue resolving to the old primary's IP address, now a replica. Subsequent write requests to this replica will fail with the READONLY error, causing intermittent session timeouts and data loss. Option B correctly identifies this scenario. Option A is incorrect because scaling down to a single node would not produce this specific error. Option C is incorrect because security groups would block all traffic, not just writes. Option D is incorrect because cluster mode (sharding) is unrelated to the primary-replica configuration causing the error.

Answer

The ElastiCache cluster has been scaled down to a single node, causing the primary to become unavailable.

Answer

The ElastiCache security group is blocking write traffic to the primary endpoint.

Answer

The Redis cluster mode is enabled, and the application is not using the correct cluster endpoint.

Question 4

A developer is deploying an application on Amazon ECS with Fargate. The application needs to access an S3 bucket that contains sensitive data. The developer wants to avoid storing AWS credentials in the container image. What is the MOST secure way to grant the application access to the S3 bucket?

Accepted Answer

Create an IAM task role with a policy that allows S3 access and specify it in the task definition.. An IAM task role for ECS tasks allows the container to assume the role without storing credentials. Option B is wrong because environment variables are not secure. Option C is wrong because mounting credentials in a volume is insecure. Option D is wrong because IAM instance profiles are for EC2 instances, not Fargate tasks.

Answer

Set the AWS credentials as environment variables in the task definition.

Answer

Store the credentials in an EFS volume and mount it to the container.

Answer

Use an IAM instance profile attached to the underlying EC2 instance.

Question 5

A developer is using Amazon CloudFront to distribute content from an S3 bucket. The bucket is configured as an origin with Origin Access Control (OAC). Recently, some users have reported that they receive 403 Forbidden errors when accessing certain objects. The developer checks the CloudFront distribution and confirms that the OAC is set up correctly. The S3 bucket policy allows the CloudFront service principal to get objects. The developer also notes that the objects in question have been updated recently. What is the MOST likely cause of the 403 errors?

Accepted Answer

The objects are encrypted with SSE-C (server-side encryption with customer-provided keys).. The most likely cause is that the objects are encrypted with SSE-C. CloudFront cannot serve objects encrypted with SSE-C because it does not have the encryption key. When CloudFront requests such objects from S3, S3 returns a 403 Forbidden error. The other options are incorrect: Option B is wrong because the OAC is correctly configured; Option C is wrong because the bucket policy allows the CloudFront service principal; Option D is wrong because using the S3 website endpoint would not cause a 403 for encrypted objects—it would cause a different error or redirect.

Answer

The OAC configuration is not correctly associated with the CloudFront distribution.

Answer

The S3 bucket policy denies access to the CloudFront service principal.

Answer

The CloudFront distribution is configured to use the S3 website endpoint instead of the REST endpoint.

Question 6

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the MOST likely cause?

Accepted Answer

Another deployment is currently in progress for the same Lambda function.. The 'ResourceConflictException' error in AWS Lambda occurs when you attempt to update a Lambda function while another update operation is already in progress. Lambda enforces a single in-flight update per function to prevent race conditions and ensure state consistency. The AWS CLI command (e.g., update-function-code) will fail immediately if a previous deployment has not completed, even if the previous deployment was triggered by the same or a different client.

Answer

The Lambda function code exceeds the maximum allowed size.

Answer

The Lambda function has an alias that conflicts with the version number.

Answer

The IAM role associated with the Lambda function does not have sufficient permissions.

Question 7

A developer in Account A has an Amazon S3 bucket that contains sensitive data. The developer wants to grant an IAM user in Account B read-only access to objects in the bucket. The developer has added a bucket policy in Account A that grants s3:GetObject access to the IAM user's ARN. However, the IAM user in Account B still receives Access Denied errors. What additional configuration is required?

Accepted Answer

Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.. Cross-account access to S3 requires both a bucket policy in the source account (Account A) granting the necessary permissions to the target IAM user, and an IAM identity-based policy in the target account (Account B) that explicitly allows the same action (s3:GetObject) on the bucket's ARN. Without the IAM policy in Account B, the user lacks the authorization to initiate the request, even though the bucket policy permits it. This dual-permission model is a fundamental security requirement for cross-account S3 access.

Answer

Create an S3 access point and grant the user access through it.

Answer

Change the bucket policy to grant access to the entire AWS account B instead of the specific user.

Answer

Enable S3 object ownership and set the bucket ACL to grant read access to the user in Account B.

Question 8

A developer optimized an Amazon S3 bucket for high request rates. The bucket receives over 5,000 PUT requests per second. Recently, some requests are failing with a 503 Slow Down error. What is the most likely cause and how should the developer fix it?

Accepted Answer

Add a random prefix to the object keys to distribute across partitions.. S3 returns 503 when request rates exceed partition limits. Prefix randomization spreads requests across partitions. Option A is wrong because 503 is not due to permissions. Option B is wrong because 503 is not a quota limit exceeded error (that would be 400). Option C is wrong because multipart upload is for large objects, not rate limits.

Answer

Use multipart upload for all objects to improve throughput.

Answer

The request rate exceeds the account-level PUT quota; request a quota increase.

Answer

The bucket policy is too permissive; restrict access to prevent abuse.

Question 9

A company uses AWS OpsWorks for configuration management and deployment of applications on EC2 instances. The company wants to migrate to AWS Systems Manager for automation and patching. Which Systems Manager capability should be used to execute scripts and commands on EC2 instances as part of a deployment?

Accepted Answer

AWS Systems Manager Run Command. AWS Systems Manager Run Command is the correct capability because it allows you to remotely and securely execute scripts and commands on EC2 instances as part of a deployment. Run Command is designed for one-time or on-demand execution, which aligns with the need to run deployment scripts. State Manager is for ongoing configuration management, not for one-time deployment tasks.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager State Manager

Answer

AWS Systems Manager Automation

Question 10

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a build stage that uses AWS CodeBuild. The developer wants to run unit tests and only proceed to the deploy stage if the tests pass. Which configuration should the developer use to achieve this?

Accepted Answer

Configure the build stage to run tests and fail the build if tests fail; CodePipeline will automatically stop.. AWS CodeBuild can be configured to run unit tests as part of the build phase. If any test fails, CodeBuild exits with a non-zero status, causing the build to fail. CodePipeline automatically stops the pipeline execution when a stage fails, preventing the deploy stage from running. This is the native and simplest way to gate deployment on test success.

Answer

Configure a manual approval step before the deploy stage.

Answer

Configure Amazon CloudWatch alarms to stop the pipeline if tests fail.

Answer

Configure AWS Lambda to invoke a function that checks test results and manually stops the pipeline.

Question 11

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

Accepted Answer

Increase the compute type of the build project. AWS CodeBuild allows you to increase the compute type (e.g., from BUILD_GENERAL1_SMALL to BUILD_GENERAL1_MEDIUM or LARGE), which provides more memory and CPU resources. This directly addresses the 'OutOfMemoryError: Java heap space' by giving the JVM more physical memory to work with, without requiring any source code changes.

Answer

Add -Xmx1024m to the buildspec commands

Answer

Change the build image to a smaller one

Answer

Set the memory parameter in the build project

Question 12

A developer wants to deploy a new version of an application to an EC2 Auto Scaling group using AWS CodeDeploy. The developer wants to minimize downtime and ensure that if the deployment fails, it automatically rolls back to the previous version. Which deployment type should the developer choose?

Accepted Answer

Blue/green. Blue/green deployment is the correct choice because it creates a separate, new Auto Scaling group (green) alongside the existing one (blue), allowing traffic to be shifted to the new environment after validation. This minimizes downtime by keeping the old environment fully operational during the deployment, and CodeDeploy can automatically roll back by redirecting traffic to the blue environment if the deployment fails.

Answer

In-place

Answer

Canary

Answer

Linear

Question 13

A developer is deploying an application using AWS Elastic Beanstalk. The application reads and writes data to an Amazon RDS database. The developer wants to ensure that database credentials are not stored in the application code or configuration files. What should the developer do?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them in the application code.. AWS Secrets Manager is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) needed to access applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials throughout their lifecycle. Storing credentials in Elastic Beanstalk environment properties (Option A) is a security risk because they are stored in plaintext within the environment configuration, can be exposed via the AWS Console/API to users with Beanstalk permissions, and do not support automatic rotation.

Answer

Store the credentials as environment properties in the Elastic Beanstalk environment configuration.

Answer

Encrypt the credentials and store them in an Amazon S3 bucket. Have the application download them at startup.

Answer

Store the credentials in a separate configuration file and include it in the application source bundle.

Question 14

A company has an S3 bucket that stores sensitive data. The data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to ensure that only a specific IAM role in the same account can decrypt the objects. Which configuration should the developer implement?

Accepted Answer

Add a key policy that allows the IAM role to perform kms:Decrypt and denies all other principals.. KMS key policies directly control who can use the key for cryptographic operations like kms:Decrypt. By explicitly allowing only the specific IAM role and denying all other principals (including the root account), the key policy ensures that only that role can decrypt the S3 objects, regardless of any other IAM or bucket policies. This is the most secure and direct way to restrict decryption at the key level.

Answer

Add a bucket policy that denies s3:GetObject unless the request uses a specific IAM role.

Answer

Configure the S3 bucket with default encryption using the KMS key.

Answer

Create an IAM policy that grants kms:Decrypt only to the specific role.

Question 15

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

Accepted Answer

Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.. A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.

Answer

Use a VPC Link to connect to a private server for validation.

Answer

Validate the token inside the Lambda function integrated with the API.

Answer

Use API Gateway request validation to check the header format.

Question 16

A web application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. Which TWO steps should be taken to diagnose the issue?

Accepted Answer

Check the CPU utilization of the EC2 instances.. High CPU utilization on EC2 instances can cause them to become unresponsive or fail to respond to health checks within the ALB's configured timeout, leading to 503 errors. The ALB routes traffic only to healthy targets; if instances are overwhelmed, they may fail health checks or drop requests, resulting in a 503 response to clients.

Answer

Check the Route 53 health checks for the domain.

Answer

Check the security group rules for the ALB.

Answer

Check the EBS volume type of the EC2 instances.

Question 17

An application running on Amazon ECS with Fargate is experiencing high latency. The application writes logs to Amazon CloudWatch Logs. Which AWS service can be used to analyze the logs to pinpoint the cause of the latency?

Accepted Answer

Amazon CloudWatch Logs Insights. Amazon CloudWatch Logs Insights is the correct choice because it is purpose-built for interactively querying and analyzing log data stored in CloudWatch Logs. It allows you to run SQL-like queries (using a query language) to filter, aggregate, and visualize log events, which is essential for pinpointing latency patterns, such as slow API calls or database queries, without needing to export logs to another service.

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Answer

Amazon S3

Question 18

A company uses AWS CodeBuild for building and testing their application. They have a build project that runs on a Linux environment. They want to run a build in a custom Docker image that is stored in Amazon ECR. How should they configure the build project?

Accepted Answer

In the environment configuration, set the 'Image' field to the ECR image URI.. AWS CodeBuild allows you to specify a custom Docker image from Amazon ECR by entering its URI directly in the 'Image' field under the environment configuration. This enables the build to run in a container that includes all necessary dependencies, without requiring a Dockerfile in the source code or a managed image.

Answer

Add a 'Dockerfile' to the source code and specify it in the buildspec.

Answer

Use a managed image provided by AWS CodeBuild.

Answer

Configure the pipeline to pass the image URI as an environment variable.

Question 19

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 20

A developer is running a web application on multiple Amazon EC2 instances behind an Application Load Balancer (ALB). The application needs to store user session state that must be available across all instances. The session data is small and temporary but must survive individual instance failures. Which AWS service should the developer use to store this session state?

Accepted Answer

Store session state in an Amazon ElastiCache cluster. Amazon ElastiCache (e.g., using Redis or Memcached) provides a centralized, in-memory data store that is external to the EC2 instances. This allows all instances behind the ALB to read and write the same session state, ensuring consistency across the fleet. Because the data is stored in a managed cluster, it survives individual instance failures and is ideal for small, temporary session data that requires low-latency access.

Answer

Store session state in the /tmp directory of each EC2 instance

Answer

Use an Amazon SQS queue to persist session data

Answer

Store session state in an Amazon S3 bucket