DVA-C02 Practice Exam 62 — 20 Questions

Question 1

A developer is designing a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. Which security group configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from web tier SG on port 8080.. Application tier security group should allow inbound traffic only from the web tier security group, not from the internet or CIDR ranges.

Answer

Web tier SG allows inbound from application tier SG.

Answer

Both SGs allow inbound 0.0.0.0/0 on necessary ports.

Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from 0.0.0.0/0 on port 443.

Question 2

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The developer wants to ensure that the new version is stable before routing all traffic to it. The developer has already published version 1 and version 2 of the function. The developer wants to send 10% of the traffic to version 2 and 90% to version 1. The developer then plans to gradually increase the traffic to version 2. Which approach should the developer use?

Accepted Answer

Create a Lambda alias named 'prod' and update the alias's routing configuration to send 10% traffic to version 2 and 90% to version 1.. AWS Lambda aliases allow you to create a named reference to a specific function version and configure weighted routing between two versions. By creating an alias (e.g., 'prod') and setting its routing configuration to send 10% of traffic to version 2 and 90% to version 1, the developer can gradually shift traffic. This is the standard approach for canary deployments with Lambda. The alias can be updated to adjust weights as confidence in the new version grows.

Answer

Use the Lambda function's versioning feature to set the traffic weight directly on the function.

Answer

Configure the API Gateway endpoint to route 10% of requests to version 2 and 90% to version 1.

Answer

Create a new alias and assign the traffic weights to the versions in the alias configuration.

Question 3

A developer needs to securely store database credentials used by an application running on EC2. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It offers automatic rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in integration, and it encrypts secrets at rest using AWS KMS. For an EC2 application, Secrets Manager can be accessed via the AWS SDK or CLI using IAM roles attached to the EC2 instance, ensuring credentials are never hardcoded or stored in plaintext.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Certificate Manager (ACM)

Question 4

A developer reports that an AWS Lambda function is timing out after 3 seconds. The function reads from an Amazon SQS queue. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds, which is too low.. The Lambda function is timing out after exactly 3 seconds because its configured timeout is set to 3 seconds, which is too low for the workload. Lambda has a maximum execution timeout of 15 minutes (900 seconds), but the default timeout is 3 seconds. Since the function reads from an SQS queue, it likely needs more time to process messages, and increasing the timeout value will resolve the issue.

Answer

The Lambda function memory is set too low, causing slow execution.

Answer

The Lambda execution role lacks permissions to poll SQS.

Answer

The SQS queue is empty, causing the function to wait indefinitely.

Question 5

A company uses AWS CodePipeline to deploy a web application. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The developer wants to add a manual approval step before the Deploy stage. Which TWO configurations are required?

Accepted Answer

An IAM role that allows CodePipeline to publish to the SNS topic.. CodePipeline requires an IAM role with permissions to publish to an SNS topic in order to send notifications for manual approval actions. This role is assumed by CodePipeline to invoke the SNS Publish API, which delivers the approval request message to the configured topic. Without this role, the pipeline cannot notify the approver, and the approval step will fail. Option E is correct because an SNS topic is the mechanism used to send the approval notification to the approver. The SNS topic is configured in the approval stage of the pipeline, and it publishes a message that is sent to the subscribed approvers (e.g., via email). Both the SNS topic and the IAM role allowing CodePipeline to publish to it are required for the manual approval action to function.

Answer

An Amazon SES identity to send emails.

Answer

An AWS Lambda function to send approval emails.

Answer

An Amazon CloudWatch alarm to trigger the approval.

Question 6

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment group has a deployment configuration of CodeDeployDefault.AllAtOnce. During a deployment, some instances fail the deployment. Which THREE actions should the developer take to improve the deployment health?

Accepted Answer

Change the deployment configuration to CodeDeployDefault.OneAtATime.. The correct options are B, C, and E.

- Option A is incorrect: Increasing the minimum number of healthy instances in the Auto Scaling group does not affect CodeDeploy's deployment health checks; it only controls ASG scaling behavior.
- Option B is correct: Changing the deployment configuration to CodeDeployDefault.OneAtATime reduces risk by deploying to one instance at a time, allowing you to detect and halt failures before affecting more instances.
- Option C is correct: Configuring a lifecycle hook to run validation tests ensures that an instance is only marked healthy after passing critical checks, preventing unhealthy instances from receiving traffic.
- Option D is incorrect: Using a larger instance type does not address the underlying cause of deployment failures (e.g., script errors, misconfigurations) and is not a direct mechanism to improve deployment health.
- Option E is correct: Adding an Elastic Load Balancer health check to the deployment group allows CodeDeploy to verify that instances are healthy before completing the deployment, enabling automatic rollback if checks fail.

Answer

Increase the minimum number of healthy instances in the Auto Scaling group.

Answer

Use a larger instance type to handle the deployment load.

Question 7

A company wants to deploy a serverless application using AWS Lambda and API Gateway. The deployment process must support automatic rollbacks if the new version fails CloudWatch alarms. Which AWS service should be used to orchestrate this deployment?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is the correct choice because it natively supports deployment strategies like canary, linear, and all-at-once, and can be configured with CloudWatch alarms to automatically trigger rollbacks when a new version fails. This makes it ideal for serverless applications using Lambda and API Gateway, where you need safe, automated deployments with health-check-driven rollback capabilities.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation with a change set

Answer

AWS CodePipeline

Question 8

Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)

Accepted Answer

Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers. CORS requires a preflight OPTIONS request to determine if the actual request is safe to send. By adding an OPTIONS method to the API Gateway resource and configuring it to return the required CORS headers (such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers), the API can respond to the browser's preflight request and enable cross-origin requests.

Answer

Modify the Lambda function to return CORS headers in the response

Answer

Configure Amazon CloudFront to add CORS headers

Answer

Configure an S3 bucket CORS policy

Question 9

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The deployment configuration is CodeDeployDefault.AllAtOnce. What is the most likely cause?

Accepted Answer

The new application revision contains an error that prevents it from running.. The error 'too many individual instances failed deployment' with the AllAtOnce deployment configuration indicates that the deployment failed on all instances simultaneously. The most likely cause is that the new application revision contains an error that prevents it from running, such as a syntax error, missing dependency, or misconfiguration. Since AllAtOnce deploys to all instances at once, a faulty revision causes all to fail.

Answer

The application is not running on the instances before the deployment.

Answer

The Auto Scaling group has more than 100 instances.

Answer

The deployment group is not associated with the correct Amazon EC2 instances.

Question 10

Refer to the exhibit. A developer created an IAM role for a Lambda function. When the Lambda function invokes, it fails with an access denied error when trying to write logs to CloudWatch Logs. What is the most likely cause?

Accepted Answer

The role lacks a permissions policy that allows CloudWatch Logs actions.. The Lambda function's IAM role must include a permissions policy that grants the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. Without these permissions, the Lambda runtime cannot write logs to CloudWatch Logs, resulting in an access denied error. The error occurs at invocation time when the Lambda service attempts to create or write to the log stream on behalf of the function.

Answer

The trust policy does not allow the Lambda service to assume the role.

Answer

The CloudWatch Logs log group has a resource-based policy that denies the Lambda function.

Answer

The Lambda function is not associated with this role.

Question 11

A developer is deploying a new version of a Lambda function using AWS CodeDeploy with a linear canary deployment. The function is part of a serverless application. After the deployment starts, the developer notices that the new version is receiving only 10% of traffic initially, but after 10 minutes, the traffic increases to 100%. What should the developer do to ensure a more gradual traffic shift?

Accepted Answer

Modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes instead of canary.. The developer is using a canary deployment configuration that shifts 10% of traffic immediately and then waits 10 minutes before shifting to 100%. To achieve a more gradual traffic shift, the developer should modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes, which will increment traffic by 10% every 5 minutes, taking 50 minutes to reach 100%.

Answer

Use Lambda function aliases with weighted traffic shifting.

Answer

Use multiple Lambda function versions and update the alias gradually.

Answer

Configure AWS CloudFormation to update the Lambda alias.

Question 12

A developer deploys a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the most likely cause?

Accepted Answer

Another deployment is currently in progress for the same Lambda function.. `ResourceConflictException` in Lambda indicates a conflict with the function's current state — most commonly that another deployment or configuration update is already in progress on the same function. Lambda serializes updates per function, so concurrent deployments collide. The fix is to wait for the in-flight operation to complete and retry.

Answer

The function's handler name is incorrect in the deployment package.

Answer

The Lambda function's IAM role is missing necessary permissions.

Answer

The Lambda function's memory limit is set too low for the deployment package.

Question 13

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS with Fargate. The pipeline has a deploy stage that uses Amazon ECS Blue/Green deployment. The deployment fails intermittently with a 'Task failed to start' error. The developer needs to troubleshoot the issue. Which THREE steps should the developer take? (Choose three.)

Accepted Answer

Check the Amazon ECS service events for the task failure reason.. Option B is correct because Amazon ECS service events provide the most direct diagnostic messages for tasks that fail to start, including reasons such as image pull failures, resource constraints, or unhealthy load balancer targets. Option C is correct because a malformed task definition JSON or an incorrect container image reference will prevent ECS from launching the task, producing exactly the 'Task failed to start' symptom. Option E is correct because the task execution IAM role must have permissions such as ecr:GetAuthorizationToken and ecr:BatchGetImage to pull the image from ECR; missing permissions cause task startup failures. Option A is not appropriate because CodeBuild logs relate to the build stage, not the ECS deploy stage where the task fails to start. Option D is not appropriate because the pipeline uses Amazon ECS Blue/Green deployment, not a CloudFormation stack, so CloudFormation stack events would not explain the ECS task failure.

Answer

Review the CodeBuild build logs for errors.

Answer

Check the CloudFormation stack events for the ECS service.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. The developer has updated the application code and wants to deploy the new version with a rolling deployment strategy to minimize downtime. Which configuration should the developer use?

Accepted Answer

Set the deployment policy to 'Rolling'. The 'Rolling' deployment policy in AWS Elastic Beanstalk updates instances in batches, moving the new application version into a subset of instances while keeping the rest serving traffic, which minimizes downtime by ensuring capacity is never fully reduced. This is the correct choice for a rolling update that balances speed and availability without requiring a full parallel environment.

Answer

Set the deployment policy to 'Immutable'

Answer

Set the deployment policy to 'All at once'

Answer

Set the deployment policy to 'Blue/green'

Question 15

A developer needs to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances across different Availability Zones. This makes it the ideal choice for shared persistent storage when containers running on separate EC2 instances need to access the same data simultaneously.

Answer

Amazon S3

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon RDS

Question 16

Which THREE practices help protect data at rest in Amazon S3?

Accepted Answer

Enable MFA Delete.. MFA Delete (B) is correct because it requires multi-factor authentication to permanently delete object versions or change the versioning state of the bucket, protecting stored data from unauthorized deletion or tampering. Server-side encryption (C) is correct because SSE-S3, SSE-KMS, or SSE-C encrypts objects at rest within S3, rendering the stored data unreadable without the appropriate keys. Bucket policies that deny uploads without encryption headers (E) are correct because they enforce encryption at write time, ensuring objects cannot be stored unencrypted in the bucket. Versioning (A) only preserves object versions and aids recovery; it does not itself encrypt or otherwise protect data at rest. Cross-region replication (D) copies objects to another region for durability and availability, but it does not protect the data at rest from unauthorized access.

Answer

Enable versioning.

Answer

Enable cross-region replication.

Question 17

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 10. The SQS queue receives a burst of 1000 messages. The Lambda function processes each message in about 5 seconds. What is the most likely behavior of the system?

Accepted Answer

Lambda processes up to 10 messages concurrently, and the rest remain in the queue until processing capacity is available.. Lambda's reserved concurrency of 10 caps the maximum number of concurrent executions. When the SQS queue receives 1000 messages, Lambda polls the queue and invokes the function with up to 10 messages at a time (based on batch size, default 1). The remaining messages stay in the queue and are retried after the visibility timeout expires, as Lambda processes messages in batches limited by the reserved concurrency.

Answer

Lambda rejects the messages and sends them to the dead-letter queue.

Answer

Lambda automatically scales up to 1000 concurrent executions to process all messages quickly.

Answer

Lambda increases the reserved concurrency to accommodate the burst.

Question 18

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

Accepted Answer

Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.. AWS Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on a simple scaling policy that uses the Average CPU Utilization metric. By setting a scale-out threshold at >70% and a scale-in threshold at <30%, the application can dynamically handle peak-hour traffic while reducing costs during low usage. This directly addresses the developer's requirement to scale based on CPU utilization.

Answer

Configure an Auto Scaling step scaling policy based on MemoryReservation metric.

Answer

Use AWS CloudFront to cache responses and reduce load on the application.

Answer

Configure an Auto Scaling target tracking policy based on NetworkIn metric.

Question 19

A developer is troubleshooting a DynamoDB table that is experiencing high write throttling (ProvisionedThroughputExceededException) on certain days. The table has provisioned write capacity of 1000 WCU. The table has a partition key of 'user_id' which is a UUID. The table is accessed by multiple services. CloudWatch metrics show that the WriteThrottleEvents are spiking during specific hours, and the ConsumedWriteCapacityUnits often reaches 1000. What is the most likely cause of the throttling?

Accepted Answer

The provisioned write capacity is insufficient to handle the traffic spikes.. The ConsumedWriteCapacityUnits consistently reaches the provisioned 1000 WCU during specific hours, and WriteThrottleEvents spike at those same times. This indicates that the provisioned capacity is insufficient to handle peak traffic, causing requests to be throttled. The partition key (UUID) is well-distributed, so a hot partition is unlikely.

Answer

The partition key is not distributed evenly, causing a hot partition.

Answer

The table does not have DynamoDB Accelerator (DAX) enabled.

Answer

The table is configured with eventual consistency, which throttles writes.

Question 20

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3 with S3 Server Access Logs