DVA-C02 Practice Exam 63 — 20 Questions

Question 1

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The deployment must follow a rolling update, deploying to exactly 50% of the instances at a time. Which built-in deployment configuration should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CodeDeployDefault.HalfAtATime. CodeDeployDefault.HalfAtATime, is correct because it instructs CodeDeploy to deploy to exactly 50% of the instances in the Auto Scaling group at a time during a rolling update. This built-in configuration ensures that half the instances are updated before the other half, matching the requirement for a 50% rolling deployment.

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.LambdaAllAtOnce

Question 2

A developer is creating an AWS Lambda function that processes events from an Amazon S3 bucket. The function writes logs to Amazon CloudWatch Logs. The developer wants to ensure that the Lambda function has the minimum required permissions. Which IAM policy should be attached to the Lambda execution role?

Accepted Answer

A policy that includes 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:GetObject' on the specific bucket.. It grants the minimum required permissions for the Lambda function to read objects from the specific S3 bucket (s3:GetObject) and to write logs to CloudWatch Logs (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). The s3:GetObject action is necessary to process events from S3, and the three logs actions are the minimum needed for the Lambda runtime to create a log group, create a log stream, and write log events. This policy follows the principle of least privilege by scoping permissions to the specific bucket and avoiding wildcards.

Answer

A policy that includes 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:*' on the bucket.

Answer

A policy that includes 'logs:*' and 's3:*' on the bucket.

Answer

A policy that includes 'logs:PutLogEvents' and 's3:ListBucket' on the bucket.

Question 3

A developer notices that an AWS Lambda function, configured to access an Amazon RDS database in the same VPC, is timing out. The function has a 30-second timeout. CloudWatch Logs show that the function starts execution but never reaches the database. The VPC configuration includes private subnets without a NAT gateway. The RDS database is in the same VPC. What is the most likely cause of the timeout?

Accepted Answer

The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.. The Lambda function is timing out when trying to connect to the RDS database, which is in the same VPC. The most likely cause is that the RDS database's security group does not have an inbound rule allowing traffic from the Lambda function's security group on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this rule, the TCP connection attempt is silently dropped or rejected, causing the Lambda function to wait until its 30-second timeout expires.

Answer

The Lambda function does not have internet access because it is in a VPC without a public IP.

Answer

The Amazon RDS database is not publicly accessible and the Lambda function cannot resolve the database endpoint.

Answer

The VPC does not have a VPC endpoint for Amazon RDS, and the Lambda function cannot access the database through the NAT gateway.

Question 4

A developer wants to deploy a serverless application using AWS CloudFormation. The application consists of an API Gateway, Lambda functions, and DynamoDB tables. The developer wants to ensure that the stack can be updated without resource interruption when possible. Which CloudFormation feature should the developer use?

Accepted Answer

Use a Lambda alias with a DeploymentPreference update policy. The `DeploymentPreference` update policy on a Lambda alias enables canary, linear, or all-at-once traffic shifting during stack updates. This allows the developer to update Lambda function versions without interrupting existing invocations, as traffic is gradually routed to the new version while the old version continues to serve requests until the transition completes.

Answer

Use a ChangeSet to review changes before applying them

Answer

Use a StackPolicy to protect critical resources

Answer

Use a Custom Resource to manage updates

Question 5

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 6

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Question 7

A developer is troubleshooting a slow Amazon RDS MySQL database query. The query is frequently executed and takes 5 seconds to complete. Which AWS service should the developer use to analyze the query performance?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service to analyze query performance on an RDS MySQL database. It provides a dashboard that visualizes database load and helps identify the top SQL statements, wait events, and users consuming the most resources. This allows the developer to pinpoint the slow query and understand its impact.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

AWS X-Ray

Question 8

A company has a monolithic application running on an EC2 instance that needs to be migrated to a microservices architecture on AWS. The development team wants to use AWS services to handle service discovery, configuration management, and secrets management. Which combination of AWS services should the team use?

Accepted Answer

Use AWS Cloud Map for service discovery, AWS AppConfig for configuration, and AWS Secrets Manager for secrets.. AWS Cloud Map provides service discovery for microservices by registering service instances and enabling DNS-based or API-based resolution. AWS AppConfig manages application configuration with validation and controlled rollouts, and AWS Secrets Manager handles secrets management with automatic rotation and fine-grained access control. Together, these services meet the specific needs of service discovery, configuration management, and secrets management in a microservices architecture.

Answer

Use Amazon ECS Service Discovery for service discovery, AWS Config for configuration, and AWS Systems Manager Parameter Store for secrets.

Answer

Use AWS Cloud Map for service discovery, AWS Systems Manager Parameter Store for configuration, and AWS Secrets Manager for secrets.

Answer

Use AWS Service Discovery for service discovery, EC2 Image Builder for configuration, and AWS Key Management Service (KMS) for secrets.

Question 9

An application running on EC2 needs to access an S3 bucket. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance. Attaching an IAM role to the EC2 instance (D) is the most secure approach because it delivers temporary, automatically rotated credentials to the instance via the Instance Metadata Service (IMDS), eliminating long-lived access keys stored on disk. The role's trust policy allows EC2 to assume it, and the attached permissions policy scopes exactly which S3 actions and resources the instance can access. This follows AWS least-privilege and credential-hygiene best practices.

Answer

Generate an IAM user access key and store it in a file on the instance

Answer

Use pre-signed URLs for each request

Answer

Make the S3 bucket public

Question 10

A developer needs to allow an EC2 instance to read objects from a specific S3 bucket. Which is the MOST secure way to grant permissions?

Accepted Answer

Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile. Creating an IAM role with S3 read permission and attaching it to the EC2 instance as an instance profile is the most secure way because it provides temporary, automatically rotated credentials to the instance without storing any long-term secrets. The instance profile delivers credentials via the EC2 instance metadata service (IMDS), and the role's policy can be scoped to only the specific S3 bucket and read actions needed. This eliminates the risk of leaked access keys.

Answer

Store AWS access keys in the EC2 instance's user data

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP

Answer

Attach a security group to the EC2 instance that allows S3 access

Question 11

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to define the DynamoDB table and the Lambda function in the SAM template. Which THREE resource types should the developer include in the template? (Choose THREE.)

Accepted Answer

AWS::DynamoDB::Table. The correct options are A (AWS::DynamoDB::Table), D (AWS::Serverless::SimpleTable), and E (AWS::Serverless::Function). In an AWS SAM template, you can define a DynamoDB table using either the standard CloudFormation resource AWS::DynamoDB::Table (for full control) or the SAM shorthand AWS::Serverless::SimpleTable (for simpler use cases). For a Lambda function, the recommended SAM resource is AWS::Serverless::Function, which provides additional SAM features like event mappings and policies. Option B (AWS::Lambda::Function) is a CloudFormation resource that could be used but is not the typical SAM choice; the question asks for resource types to include in a SAM template, so the serverless type is expected. Option C (AWS::Serverless::DynamoDB) is not a valid AWS resource type.

Answer

AWS::Lambda::Function

Answer

AWS::Serverless::DynamoDB

Question 12

A developer is using AWS Elastic Beanstalk to deploy a web application. The application is experiencing high latency. Which TWO steps should the developer take to troubleshoot and optimize the application?

Accepted Answer

Enable AWS X-Ray integration and analyze service maps.. AWS X-Ray integration provides tracing to identify bottlenecks in the application. Option C is correct because enhanced health reporting gives detailed environment health metrics for troubleshooting. Option A is wrong because an RDS read replica is for database read scaling, not directly for latency troubleshooting. Option D is wrong because increasing the instance type is a scaling solution, not a troubleshooting step. Option E is wrong because deploying to a different region does not address latency for existing users.

Answer

Configure an Amazon RDS read replica.

Answer

Increase the instance type to a larger size.

Answer

Deploy the application to a different AWS region.

Question 13

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails, and the rollback is triggered. However, the rollback also fails. What is a likely cause?

Accepted Answer

The rollback deployment uses an AppSpec file that references a lifecycle hook that does not exist in the current environment.. The correct option is A: the rollback deployment uses an AppSpec file that references a lifecycle hook that does not exist in the current environment. During a CodeDeploy rollback, CodeDeploy redeploys the last known good revision, and if that revision's AppSpec file defines a lifecycle event hook (for example, a Lambda validation hook or a script in the wrong location) that is not present or valid in the current environment, the rollback deployment will fail just as the original did. Options B, C, and D are less likely because a misconfigured load balancer target group, a missing S3 artifact bucket, or insufficient Auto Scaling capacity would typically cause the initial deployment to fail rather than specifically explaining why the rollback itself fails due to the prior revision's configuration.

Answer

The target group for the load balancer is not properly configured.

Answer

The Amazon S3 bucket containing the deployment artifacts is missing.

Answer

The Auto Scaling group does not have sufficient capacity to run the rollback.

Question 14

A company is using an Application Load Balancer (ALB) to route traffic to a set of EC2 instances. The security team wants to ensure that only traffic from the ALB can reach the instances. Which security group configuration should be used?

Accepted Answer

Configure the EC2 instance security group to allow traffic from the ALB security group.. Option C is correct because security groups can reference other security groups as a source, so the EC2 instances' security group can allow inbound traffic specifically from the ALB's security group, ensuring only ALB-forwarded traffic reaches the instances. This approach is the AWS-recommended pattern and works regardless of the ALB's changing IP addresses. Option A is wrong because ALB IP addresses are dynamic and not a stable, manageable source. Option B is wrong because network ACLs cannot reference security groups as a source; they only support CIDR-based rules. Option D is wrong because allowing HTTP from 0.0.0.0/0 exposes the instances to the entire internet, not just the ALB.

Answer

Configure the EC2 instance security group to allow traffic from the ALB's private IP address range.

Answer

Configure the network ACL for the EC2 instance subnet to allow traffic from the ALB security group.

Answer

Configure the EC2 instance security group to allow HTTP traffic from 0.0.0.0/0.

Question 15

A developer is building an application that uses Amazon Cognito for user authentication. The application needs to allow users to sign in with their existing Google accounts. Which action should the developer take to enable this?

Accepted Answer

Configure a Cognito user pool with a Google identity provider, providing the Google client ID and client secret.. Cognito user pools natively support federation with Google. Configuring Google as an identity provider in the user pool allows users to sign in with their Google credentials. Cognito handles the OAuth flow, token validation, and user profile creation, simplifying the integration.

Answer

Create a Cognito identity pool and enable the Google authentication provider, specifying the Google client ID.

Answer

Implement a custom OAuth 2.0 flow in the application that directly calls the Google API and then issues AWS credentials.

Answer

Use AWS IAM to create a role for Google users and attach a policy that allows access to the application.

Question 16

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'CREATE_FAILED: The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudFormation events and sees 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

Another resource in the stack failed, triggering a rollback and cancelling the Lambda creation.. When CloudFormation creates a stack, resources are provisioned in dependency order. If any resource fails, CloudFormation initiates a rollback and cancels in-progress creations of other resources — producing the 'Resource creation cancelled' message for MyLambdaFunction. The Lambda itself did not fail; it was cancelled because a sibling resource failed first.

Answer

The Lambda function code is too large and exceeds the deployment limit.

Answer

The Lambda function creation timed out due to a network issue.

Answer

The Lambda function's execution role is missing permissions.

Question 17

A development team is using AWS CodeCommit as a source repository and CodeBuild for build automation. They want to trigger a build automatically whenever a pull request is created or updated in the repository. Which configuration should they use?

Accepted Answer

Use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. The correct option is C: use Amazon EventBridge to capture CodeCommit events and trigger CodeBuild. CodeCommit emits pull request state-change events (e.g., pullRequestCreated and pullRequestSourceBranchUpdated) to the default EventBridge bus, and an EventBridge rule can match those events and invoke CodeBuild as a target, which is the supported way to start builds on pull request creation or updates. Option A is wrong because S3 event notifications apply to S3 buckets, not CodeCommit repositories. Option B is wrong because CodeCommit webhooks are not a native trigger mechanism for CodeBuild in this pull request scenario. Option D is wrong because CodePipeline polling detects branch commits, not pull request creation/update events, and polling is not event-driven.

Answer

Configure an S3 event notification on the repository

Answer

Configure a webhook in CodeCommit to trigger CodeBuild

Answer

Create a CodePipeline that polls CodeCommit for changes

Question 18

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

Accepted Answer

Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.. Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Answer

Check that the application is using HTTPS instead of HTTP.

Answer

Check that the EC2 instance has permissions to decrypt the KMS key used by S3.

Answer

Check that the EC2 instance is in the same VPC as the S3 bucket.

Question 19

A developer is building a real-time chat application using WebSocket APIs in API Gateway and Lambda. The application must handle thousands of concurrent connections. Which TWO actions should the developer take to ensure the application scales properly?

Accepted Answer

Set the Lambda function's reserved concurrency to a high enough value.. Setting reserved concurrency ensures the Lambda function has enough allocated capacity to handle the high volume of concurrent WebSocket connections without being throttled by the account-level concurrency limit. Without reserved concurrency, the function could experience throttling errors (HTTP 429) during traffic spikes, causing dropped connections and poor user experience.

Answer

Use CloudFront to distribute the WebSocket endpoints.

Answer

Place the Lambda function in a VPC to improve security.

Answer

Enable API Gateway caching to reduce Lambda invocations.

Question 20

A company uses AWS CodePipeline to automate deployments. The pipeline source stage uses Amazon S3. The developer wants to automatically trigger the pipeline when a new version of the source file is uploaded. The developer has configured S3 event notifications to invoke a Lambda function that starts the pipeline. However, the pipeline is not triggering. What is the most likely cause?

Accepted Answer

The Lambda function does not have permission to start the pipeline.. The most likely cause is that the Lambda function does not have permission to start the pipeline. S3 event notifications can invoke Lambda regardless of whether S3 versioning is enabled, so versioning is not required. For the pipeline to start, the Lambda function's execution role must have permission to call codepipeline:StartPipelineExecution on the target pipeline. If that permission is missing, the S3 event will invoke Lambda but the pipeline will not start. (Note: the S3 bucket must also allow S3 to invoke the Lambda function; however, among the provided options, the missing Lambda permission to start the pipeline is the most likely cause.)

Answer

S3 versioning is not enabled on the bucket.

Answer

The pipeline execution role does not have permission to read from the S3 bucket.

Answer

The S3 bucket does not have a bucket policy that allows S3 to invoke Lambda.