DVA-C02 Practice Exam 58 — 20 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The development team wants to implement a CI/CD pipeline that automatically updates a CloudFormation stack when code is pushed to a CodeCommit repository. The pipeline should also run tests before deploying. Which THREE services should be used together to achieve this? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can compile source code, run tests, and produce artifacts that are ready for deployment. In this CI/CD pipeline, CodeBuild executes the test suite after code is pushed to CodeCommit, ensuring that only validated code proceeds to update the CloudFormation stack.

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 2

A developer is using AWS SAM to define a serverless application. The application includes an AWS Lambda function and an Amazon API Gateway REST API. The developer wants to configure the API Gateway stage to enable logging and set the stage name based on the SAM parameter Stage. In the SAM template, which property of the AWS::Serverless::Api resource should the developer use to set the stage name?

Accepted Answer

StageName. The `StageName` property of the `AWS::Serverless::Api` resource directly sets the stage name for the API Gateway REST API. By using a SAM parameter like `Stage` (e.g., `StageName: !Ref Stage`), the developer can dynamically control the stage name at deployment time. This is the intended and simplest way to configure the stage name in an AWS SAM template.

Answer

DefinitionBody

Answer

StageDescription

Answer

EndpointConfiguration

Question 3

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses a PostgreSQL database on RDS. The security team requires that database credentials never be stored in application code or configuration files. Which solution meets this requirement?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with automatic rotation.. AWS Secrets Manager is designed specifically for securely storing and automatically rotating database credentials. It integrates natively with RDS for PostgreSQL, enabling automatic rotation without code changes. The application retrieves credentials at runtime via the AWS SDK, ensuring they are never stored in code or configuration files.

Answer

Store the credentials in a Systems Manager Parameter Store parameter and retrieve them at application startup.

Answer

Store the credentials in an encrypted S3 bucket and have the application read the config file at startup.

Answer

Hardcode the credentials in a Lambda function that is called to get the credentials.

Question 4

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 5

A company uses AWS CodeCommit for source control. A developer needs to automate the build and test process for every commit to the 'develop' branch. The developer creates a CodeBuild project and wants to trigger it automatically. What is the most efficient way to set up this automation?

Accepted Answer

Create a CodePipeline with a source stage from CodeCommit and a build stage from CodeBuild. AWS CodePipeline is the most efficient and fully managed way to orchestrate a continuous integration workflow. It natively integrates CodeCommit as a source action that automatically detects changes on the specified branch (e.g., 'develop') and triggers a CodeBuild build stage without any custom scripting or additional infrastructure. This provides built-in retry, status tracking, and seamless integration with other AWS services.

Answer

Create a CloudWatch Events rule that triggers CodeBuild on code commit events

Answer

Configure a webhook in CodeCommit to call CodeBuild directly

Answer

Use an SQS queue to receive SNS notifications from CodeCommit and trigger CodeBuild

Question 6

A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon DynamoDB

Question 7

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Accepted Answer

Verify that the Lambda function has network access to the database.. The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager. Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.

Answer

Check VPC Flow Logs for the Lambda function's ENI.

Answer

Ensure the KMS key used to encrypt the secret is rotated.

Question 8

A developer needs to grant an IAM user access to list objects in an S3 bucket named 'app-data'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::app-data"}. The s3:ListBucket action is required to list the objects in an S3 bucket, and the resource ARN must specify the bucket itself (arn:aws:s3:::app-data) without a trailing /*. This grants permission to list the contents of the 'app-data' bucket, which is the exact requirement.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::app-data/*"}

Question 9

A company has a multi-account architecture using AWS Organizations. The security team wants to centrally manage IAM policies that apply to all accounts. Which AWS feature should the developer use?

Accepted Answer

Service control policies (SCPs) in AWS Organizations.. Service control policies (SCPs) in AWS Organizations are the only feature that lets you centrally define and enforce permission guardrails across every account in the organization. SCPs are attached at the OU or account level and define the maximum permissions available to IAM principals in member accounts, so a single policy change propagates to all accounts. This directly satisfies the requirement to 'centrally manage IAM policies that apply to all accounts.'

Answer

IAM cross-account roles.

Answer

AWS Config conformance packs.

Answer

IAM policies attached to the root user.

Question 10

A company is implementing a CI/CD pipeline using AWS CodeCommit, CodeBuild, and CodeDeploy. The developer wants to ensure that the pipeline automatically deploys to production only after a manual approval step. Which TWO actions should the developer take?

Accepted Answer

Add a manual approval action in the CodePipeline pipeline.. Option B is correct because AWS CodePipeline natively supports a manual approval action that pauses the pipeline at a chosen stage until an approver acts, which is exactly the mechanism needed to gate production deployments. Option C is correct because the manual approval action can be configured with an IAM principal (user, role, or group) whose members are authorized to approve or reject, enforcing controlled authorization for the production gate. Option A is not appropriate because a CloudWatch Events rule invoking a Lambda function is an event-driven workaround, not the built-in approval mechanism, and Lambda cannot natively 'wait' for human approval without complex polling. Option D is incorrect because CodeDeploy lifecycle hooks pause during a deployment for scripts or validation, not for a human approval gate before the deployment stage. Option E is incorrect because an SNS topic can notify approvers of a pending approval, but notification alone does not implement the required approval gate.

Answer

Create a CloudWatch Events rule to trigger a Lambda function that waits for approval.

Answer

Use a CodeDeploy lifecycle hook to pause the deployment.

Answer

Configure an SNS topic to send an email to the approver.

Question 11

A company is using AWS CodePipeline with a multi-branch strategy. The pipeline includes a source stage from AWS CodeCommit, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The team wants to automatically deploy changes only when a pull request is merged to the 'main' branch. Which configuration should be used?

Accepted Answer

Configure a CodeCommit trigger to start the pipeline on push events to the 'main' branch.. Option A is correct because a CodeCommit repository trigger configured for push events on the 'main' branch will start the pipeline exactly when a merge commit is pushed to main, which is the desired behavior for deploying only merged pull requests. This is the standard, event-driven way to integrate CodeCommit with CodePipeline for branch-specific deployments. Option B is wrong because manual approval is a pipeline action that gates a deployment after it has already started, not a trigger mechanism, and it cannot itself detect a pull request merge. Option C is wrong because hourly scheduled runs are not event-driven and would deploy at arbitrary times, potentially including unmerged or stale changes. Option D is wrong because periodic polling is a legacy change-detection method that does not specifically react to a merge to 'main' and adds latency.

Answer

Create a manual approval step before deployment and require a pull request merge as a trigger.

Answer

Use a scheduled trigger to run the pipeline every hour and check for changes.

Answer

Configure the source stage to use the 'main' branch and enable periodic polling.

Question 12

A developer is designing a system that must meet PCI DSS compliance. Which THREE AWS services can help with logging and monitoring security events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from various AWS resources and applications. For PCI DSS compliance, CloudWatch Logs can ingest security-related logs (e.g., from EC2, Lambda, or on-premises servers) and enable real-time monitoring, metric filters, and alarms to detect and respond to security events. It also supports log retention policies and encryption at rest using AWS KMS, which are required for audit trails under PCI DSS Requirement 10.

Answer

Amazon VPC Flow Logs

Answer

AWS Key Management Service (KMS)

Question 13

An application running on Amazon ECS Fargate is experiencing intermittent high latency and timeout errors. The application makes API calls to an external third-party service. The ECS service is configured with a target group using HTTP health checks. The ALB health check logs show occasional 503 responses. What is the MOST likely cause?

Accepted Answer

The application is not properly handling timeouts to the third-party service, causing the health check endpoint to hang.. The application's health check endpoint is likely hanging because the application does not handle timeouts when calling the third-party service. This causes the ALB health check to time out and return 503, leading to tasks being marked unhealthy and potentially restarted, which increases latency and timeouts.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS tasks are running out of CPU credits, causing slow response times.

Answer

The ECS service is configured with a task placement strategy that is causing tasks to be stopped and restarted frequently.

Question 14

A developer configured an S3 bucket to trigger a Lambda function on object creation. The Lambda function processes the object and then deletes it. Some objects are not being processed. What should the developer do to ensure all objects are processed?

Accepted Answer

Send S3 events to an SQS queue and configure the Lambda function to poll the queue.. Sending S3 events to an SQS queue decouples event delivery from Lambda invocation. If the Lambda function fails or throttles, the event remains in the queue and can be retried, ensuring no objects are missed. Without a queue, S3 events that fail to invoke Lambda (e.g., due to concurrency limits) are lost, leading to unprocessed objects.

Answer

Assign a new IAM role to the Lambda function with S3 permissions.

Answer

Enable S3 versioning on the bucket.

Answer

Increase the Lambda function timeout.

Question 15

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 16

A developer is building a real-time chat application using WebSockets via API Gateway. The backend uses AWS Lambda functions to handle connect, disconnect, and message events. The application needs to broadcast messages to all connected clients. What is the most scalable and cost-effective way to maintain the list of connection IDs and broadcast messages?

Accepted Answer

Store connection IDs in a DynamoDB table. Use a Lambda function to query all connection IDs and send messages using the API Gateway Management API.. DynamoDB is the canonical serverless store for WebSocket connection IDs in API Gateway WebSocket APIs. Each Lambda handler writes or deletes the connection ID on connect/disconnect, and to broadcast, a Lambda scans or queries the table and calls the API Gateway Management API's PostToConnection for each ID. This scales horizontally and is pay-per-use.

Answer

Use an SQS FIFO queue to store connection IDs and have a Lambda function poll the queue to broadcast.

Answer

Maintain an in-memory list of connection IDs in a global variable of a single Lambda function.

Answer

Use Amazon ElastiCache Redis to store connection IDs and use Redis Pub/Sub for broadcasting.

Question 17

A team uses AWS CodeBuild to run automated tests. The buildspec.yaml file contains a 'pre_build' phase that sets environment variables. During a build, the build fails with 'Error: Cannot find module 'express' when running a Node.js application. The application's package.json is in the source root. What is the most likely cause?

Accepted Answer

The buildspec does not include a command to run 'npm install' in the install or pre_build phase.. AWS CodeBuild runs each phase in the buildspec in order: install, pre_build, build, post_build. If the buildspec does not include an 'npm install' (or 'npm ci') command in the install or pre_build phase, the Node.js dependencies listed in package.json — including express — are never downloaded into node_modules. The build then fails when it tries to require('express'). The fix is to add 'npm install' to the install phase.

Answer

The Node.js runtime version is incompatible with the express module.

Answer

The environment variable NODE_ENV is set to production, which skips devDependencies.

Answer

The package.json file is not in the source root directory.

Question 18

A developer is troubleshooting an AWS Lambda function that returns timeout errors when calling an external HTTPS API. The function is configured with a 30-second timeout and runs in a VPC with a public subnet and NAT Gateway. The developer checks CloudWatch logs and sees that the function is timing out at exactly 30 seconds. What is the most likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic.. Lambda functions running in a VPC do not automatically get internet access; they require a route to a NAT Gateway or NAT instance. Even with a NAT Gateway, the Lambda function's security group must allow outbound traffic (e.g., HTTPS on port 443) to reach the external API. Without this rule, outbound packets are dropped, causing the function to hang until the configured timeout (30 seconds) expires, resulting in a timeout error.

Answer

The NAT Gateway is not configured with a route to the internet.

Answer

The external API's response time exceeds 30 seconds.

Answer

The Lambda function's VPC does not have an internet gateway.

Question 19

A developer needs to encrypt secrets (database passwords) that are used by an application running on EC2. The application retrieves the secrets at startup. Which combination of services provides the MOST secure and manageable solution?

Accepted Answer

Store the secrets in AWS Secrets Manager and use an IAM role to access them.. Storing secrets in AWS Secrets Manager and using an IAM role to access them provides the most secure and manageable solution. Secrets Manager is designed for secret management, supports automatic rotation, and integrates with IAM for fine-grained access control. Using an IAM role for EC2 eliminates the need to embed credentials in the application, enhancing security.

Answer

Encrypt the secrets with AWS KMS and store them in an S3 bucket with a bucket policy.

Answer

Store the secrets in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Hardcode the secrets in the application code and encrypt the code.

Question 20

A developer is troubleshooting performance issues in an application that uses Amazon DynamoDB as the primary data store. The application reads a large set of items using a Query operation on a Global Secondary Index (GSI). The developer notices high read latency and throttled requests on the GSI. The base table has sufficient read capacity. The GSI is projected with KEYS_ONLY. Which action would most likely reduce the latency and throttling?

Accepted Answer

Increase the read capacity units (RCU) of the GSI.. A Global Secondary Index (GSI) has its own provisioned read capacity, separate from the base table. When a Query operation reads from a GSI, it consumes RCUs from the GSI's capacity, not the base table's. Since the base table has sufficient read capacity but the GSI is experiencing throttling and high latency, increasing the GSI's RCU directly addresses the bottleneck by allowing more read requests per second against the index.

Answer

Increase the read capacity units (RCU) of the base table.

Answer

Change the GSI projection to ALL.

Answer

Create a Local Secondary Index instead.