DVA-C02 Practice Exam 64 — 20 Questions

Question 1

A developer is optimizing costs for an AWS account. The account has multiple EC2 instances running different workloads. Some instances are used for development and are only needed during business hours. Which THREE actions can the developer take to reduce costs? (Select THREE.)

Accepted Answer

Purchase Reserved Instances for the production instances.. Options A, B, and D are correct. Using Spot Instances (A) reduces costs for fault-tolerant workloads. Scheduling instances to stop during off-hours (B) saves money. Reserving instances (D) provides discounts for steady-state workloads. Option C (increasing instance size) increases costs. Option E (using EBS gp3) may reduce storage costs but is not specific to the described scenario.

Answer

Use EBS gp3 volumes instead of gp2 to save on storage costs.

Answer

Increase the instance size to handle peak load more efficiently.

Question 2

A developer is troubleshooting a slow-running application that uses ElastiCache for Redis as a caching layer. The application frequently reads and writes data to the cache. Which TWO actions should the developer take to improve cache performance?

Accepted Answer

Use optimized data structures like hashes instead of strings for complex data.. Option A is correct: enabling auto scaling for ElastiCache can adjust capacity based on demand. Option D is correct: optimizing data structures reduces memory and CPU overhead. Option B is wrong: TTL eviction is already handled by Redis. Option C is wrong: more nodes increase complexity and may not help if the bottleneck is CPU. Option E is wrong: disabling persistence improves write performance but may not be the primary issue.

Answer

Configure the cache to use LRU eviction policy.

Answer

Disable persistence by setting appendonly to no.

Answer

Increase the number of shards to distribute data.

Question 3

A developer is running a Docker container on Amazon ECS with Fargate. The container logs are not appearing in CloudWatch Logs even though the task definition has a logConfiguration specifying the awslogs driver and a log group. What is the MOST likely missing configuration?

Accepted Answer

The task execution role lacks the necessary IAM permissions to write to CloudWatch Logs.. Option A is correct because the task execution role must have permissions to write to CloudWatch Logs. Option B is wrong because the container is running in Fargate, so there is no EC2 instance profile. Option C is wrong because the log driver is specified in the task definition, not in the container image. Option D is wrong because the log group already exists in the configuration.

Answer

The container image does not have the awslogs log driver installed.

Answer

The CloudWatch Logs log group does not exist.

Answer

The EC2 instance profile does not have CloudWatch Logs permissions.

Question 4

A company's DynamoDB table has a read capacity of 10,000 RCUs and receives consistent traffic. Recently, users have reported increased latency for read requests. The application uses strongly consistent reads. The developer checks CloudWatch metrics and sees that 'ConsumedReadCapacityUnits' is at 9,500 but 'ThrottledRequests' is high. What is the most likely cause?

Accepted Answer

A hot partition is exceeding its partition-level read capacity.. Strongly consistent reads consume twice the RCUs of eventually consistent reads. If the application requests strongly consistent reads, the actual consumed capacity is double the read request units, so 9,500 RCUs consumed may represent only 4,750 read requests, but the provisioned capacity is 10,000. However, throttling occurs because the partition-level capacity may be exceeded. Option C is correct: a hot partition causes throttling even if table-level capacity is not exhausted. Option A is incorrect because the table has capacity. Option B is incorrect because RCUs are sufficient. Option D is incorrect as strongly consistent reads are working.

Answer

The application is using eventually consistent reads but expecting strongly consistent results.

Answer

The DynamoDB table has auto scaling enabled and is scaling down too aggressively.

Answer

The provisioned read capacity is too low for the traffic.

Question 5

An application running on Amazon ECS with Fargate is experiencing intermittent failures when connecting to an Amazon RDS database. The security group for the RDS instance allows inbound traffic from the security group attached to the ECS tasks. Which TWO additional checks should the developer perform to troubleshoot the connectivity issue?

Accepted Answer

Verify that the security group for the RDS instance has an inbound rule allowing traffic from the security group used by the ECS tasks.. Options A and D are correct. Option A: The RDS security group must allow inbound traffic from the ECS task security group; this is already stated, but verifying the exact configuration is important. Option D: The NACL for the subnets must allow ephemeral ports for the response traffic. Option B is wrong because the ECS tasks are in a private subnet, so an Internet Gateway is not used for RDS connectivity. Option C is wrong because the database credentials are not related to network connectivity. Option E is wrong because VPC Flow Logs are useful for analyzing traffic but not a first check; the question asks for additional checks after security group.

Answer

Enable VPC Flow Logs to capture dropped packets.

Answer

Check that the database credentials are correctly stored in AWS Secrets Manager.

Answer

Ensure that the ECS tasks have a route to the internet through an Internet Gateway.

Question 6

A company's API Gateway REST API is experiencing high latency. The API integrates with a Lambda function that queries an RDS database. The developer notices that the Lambda function's duration metric is low, but the API Gateway integration latency is high. What is the most likely cause?

Accepted Answer

The Lambda function is in a VPC, causing additional network hops.. API Gateway integration latency includes network overhead and other factors. Option C is correct: if the Lambda function is in a VPC, the network traversal between API Gateway and the VPC can cause latency. Option A is wrong because the Lambda duration is low. Option B is wrong because caching would reduce latency, not increase it. Option D is wrong because the database is not queried directly by API Gateway.

Answer

The Lambda function has reached the concurrency limit.

Answer

The API Gateway cache is enabled and causing a cache miss for every request.

Answer

The RDS database is in a different region than the API Gateway.

Question 7

A developer is using Amazon API Gateway with a Lambda authorizer to protect a REST API. The authorizer is configured with a TTL of 300 seconds. After updating the IAM policy attached to the authorizer's execution role, some users still receive 403 Forbidden errors for requests that should be allowed. What is the MOST likely cause?

Accepted Answer

The authorizer's cached results are still valid, so the old policy is being applied.. Option C is correct because the Lambda authorizer result is cached for 300 seconds, so old permissions are enforced until the cache expires. Option A is wrong because the authorizer function itself does not have an execution timeout issue. Option B is wrong because the IAM policy update is immediate for the role, but the authorizer result is cached. Option D is wrong because the deployment does not affect authorizer caching.

Answer

The Lambda authorizer function has a timeout that prevents it from evaluating the new policy.

Answer

The IAM policy update has not propagated to all regions.

Answer

The API Gateway endpoint was not redeployed after the policy change.

Question 8

A developer deployed a web application using AWS Elastic Beanstalk. The application uses an RDS MySQL database. After a recent deployment, the application's health status turned from 'Ok' to 'Severe'. The developer checks the environment events and sees that the database connection is failing. The RDS instance is in the same VPC and security group. The developer confirms that the database endpoint and credentials are correct. What is the MOST likely cause of the connection failure?

Accepted Answer

The security group for the Elastic Beanstalk environment no longer allows outbound traffic to the RDS database port.. Option B is correct because a recent deployment may have changed the environment's security group configuration, removing or modifying the inbound rule for the database port. Option A is wrong because the database endpoint is correct. Option C is wrong because the application is failing to connect, not failing to start. Option D is wrong because the RDS instance is in the same VPC, so it is not an internet routing issue.

Answer

The RDS database endpoint changed after the deployment.

Answer

The RDS instance is not publicly accessible.

Answer

The application code is failing to start due to a bug.

Question 9

A developer is debugging an issue where an IAM user cannot list objects in an S3 bucket. The user has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example-bucket" } ] }. What is missing?

Accepted Answer

The policy needs to also allow s3:GetObject on the objects.. The IAM policy only grants the s3:ListBucket permission, which allows listing the objects in the bucket but not reading their contents. To actually list objects, the s3:ListBucket action is sufficient; however, the question implies the user cannot list objects at all. The missing permission is s3:GetObject, which is required to retrieve object metadata and data when using certain S3 operations like GetObject or HeadObject. Without s3:GetObject, the user may fail to list objects if the bucket policy or ACLs require read access for the listing operation to succeed.

Answer

The Resource ARN is incorrect.

Answer

The bucket has a bucket policy that denies access.

Answer

The user needs to enable S3 ACLs.

Question 10

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. Which permissions are required for the CodeBuild service role? (Choose THREE.)

Accepted Answer

ecr:PutImage. Option A is correct because `ecr:PutImage` is the permission required to push a Docker image to an Amazon ECR repository. When CodeBuild completes a build and runs `docker push`, it calls the ECR API `PutImage` to upload the image manifest. Without this permission, the push operation will fail with an access denied error.

Answer

ecr:CreateImage

Answer

ecr:BatchGetImage

Question 11

A company has an AWS Lambda function that processes sensitive financial data. The function uses environment variables to store database connection strings. A security audit requires that all sensitive data be encrypted at rest and in transit. The developer must ensure that the environment variables are encrypted with a customer-managed key that is rotated quarterly. What should the developer do?

Accepted Answer

Store the connection string in AWS Secrets Manager and enable automatic rotation with a custom Lambda function. Option B is correct because AWS Secrets Manager natively supports automatic rotation of secrets using a custom Lambda function, which meets the quarterly rotation requirement. Secrets Manager also encrypts secrets at rest using KMS, and the customer can specify a customer-managed key (CMK) for encryption, satisfying the encryption-at-rest and customer-managed key requirements. Additionally, Secrets Manager enforces encryption in transit via TLS when retrieving secrets, fulfilling the full security audit mandate.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter using an AWS managed key

Answer

Encrypt the environment variables using the Lambda service key

Answer

Use AWS KMS to encrypt the environment variables and set a manual rotation policy

Question 12

A developer is building a serverless application using AWS Step Functions. The workflow must execute hundreds of thousands of short-lived tasks per day, each taking less than 30 seconds. The tasks need to run in parallel, and a small number of duplicate executions are acceptable. Which type of Step Functions workflow should the developer choose?

Accepted Answer

Express Workflow. Express Workflows are designed for high-volume, short-duration (under 5 minutes) event-processing workloads, executing hundreds of thousands of state transitions per second with at-least-once semantics. Since the tasks are short-lived (under 30 seconds), run in parallel, and tolerate a small number of duplicate executions, Express Workflow is the correct choice because it offers lower cost and higher throughput than Standard Workflow, which guarantees exactly-once execution and is better suited for long-running, auditable workflows.

Answer

Standard Workflow

Answer

AWS Lambda function with synchronous invocation

Answer

Amazon Simple Workflow Service (SWF)

Question 13

A developer is using AWS CodePipeline to deploy a web application. The pipeline has stages: Source, Build, Staging Deploy, Staging Test, and Prod Deploy. The developer wants to ensure that if the Staging Test stage fails, the pipeline automatically stops and does not proceed to Prod Deploy. Which action should the developer take?

Accepted Answer

No action is needed; CodePipeline automatically stops on stage failure. Option A is correct because AWS CodePipeline's default behavior is to stop execution when a stage fails, preventing the pipeline from proceeding to subsequent stages. When the Staging Test stage fails, the pipeline transitions to a 'Failed' status and does not automatically continue to Prod Deploy. No additional configuration is required for this behavior.

Answer

Add a manual approval step before Prod Deploy

Answer

Disable the transition from Staging Test to Prod Deploy

Answer

Configure the pipeline execution mode to 'Superseded'

Question 14

A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime and roll forward if successful. They have two environments: a production environment (current version) and a staging environment (new version). After verifying the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?

Accepted Answer

Blue/green deployment with environment CNAME swap. Option A is correct because blue/green deployment with an environment CNAME swap allows you to run two separate Elastic Beanstalk environments (production and staging) simultaneously. After verifying the new version in the staging environment, you swap the CNAME records so that the production URL points to the staging environment, achieving zero downtime and a roll-forward strategy. This approach decouples the deployment from the existing environment, ensuring no disruption to live traffic during the swap.

Answer

All at once deployment

Answer

Rolling deployment with additional batch

Answer

Immutable deployment

Question 15

A developer is deploying a multi-container Docker application on Amazon ECS using the Fargate launch type. The application consists of a web server and a background worker. The web server must be scaled independently and must be accessible from the internet via an Application Load Balancer. The worker should not be accessible from the internet. Which ECS configuration should the developer use?

Accepted Answer

Create two separate ECS services, each with its own task definition, and place the web server in a public subnet with the worker in a private subnet.. Option B is correct because it uses two separate ECS services, each with its own task definition, allowing independent scaling of the web server and worker. Placing the web server in a public subnet with an Application Load Balancer makes it internet-accessible, while the worker in a private subnet is isolated from direct internet traffic, meeting the security requirement.

Answer

Create one ECS service with both containers in the same task definition, but only expose the web server port.

Answer

Create one ECS service with two tasks, each containing one container.

Answer

Create one ECS service with two containers in the same task, and use a service discovery to expose the worker.

Question 16

A developer is deploying a web application using AWS Elastic Beanstalk. The application runs on multiple Amazon EC2 instances behind an Application Load Balancer. The developer wants to deploy a new version with zero downtime and the ability to quickly roll back if issues are discovered. Which deployment policy should the developer choose?

Accepted Answer

Immutable. Immutable deployment is the correct choice because it launches a completely new set of EC2 instances in a new Auto Scaling group with the updated application version, then swaps the load balancer target group to point to the new instances. This ensures zero downtime during deployment and provides an instant rollback by simply reverting the target group to the old instances if issues are detected.

Answer

All at once

Answer

Rolling

Answer

Rolling with additional batch

Question 17

A developer is deploying a microservice using AWS CodeDeploy with an Amazon ECS compute platform. The service must be updated with a blue/green deployment strategy. The developer wants to ensure that if the deployment fails, the new task set is automatically terminated and the original task set continues to serve traffic. Which configuration should the developer set?

Accepted Answer

Set the deployment group's 'Rollback configuration' to automatically roll back failed deployments and configure the 'Deployment configuration' to terminate the original task set on success, but keep it on failure.. Option C is correct because AWS CodeDeploy for Amazon ECS blue/green deployments allows you to configure automatic rollback on failure within the deployment group settings. By enabling 'Rollback configuration' to automatically roll back failed deployments and setting the 'Deployment configuration' to terminate the original task set only on success (keeping it on failure), you ensure that if the deployment fails, the new task set is automatically terminated and the original task set continues to serve traffic. This directly meets the requirement without manual intervention.

Answer

Set the deployment configuration to 'AllAtOnce' and enable termination of the original task set

Answer

Define a blue/green deployment using an AppSpec file with a 'Hooks' section to specify a 'BeforeAllowTraffic' hook that checks health. If the check fails, CodeDeploy automatically rolls back.

Answer

Use a manual approval step in the pipeline to decide whether to terminate the new task set.

Question 18

A developer is using AWS Elastic Beanstalk to deploy a Node.js application. The application requires an environment variable that contains a secret (e.g., a database password). The developer wants to store the secret securely and make it available to the application instances. Which Elastic Beanstalk feature should be used?

Accepted Answer

Use the AWS Secrets Manager integration in Elastic Beanstalk.. AWS Elastic Beanstalk has a native integration with AWS Secrets Manager that allows you to retrieve secrets and inject them as environment variables into your application instances without exposing the secret in plaintext. This integration handles the secure retrieval and rotation of secrets automatically, making it the correct choice for securely storing and accessing a database password.

Answer

Store the secret in an environment property with the value set in plaintext.

Answer

Use an .ebextensions configuration file to set the environment variable.

Answer

Use Elastic Beanstalk platform hooks to retrieve the secret at startup.

Question 19

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The deployment must be rolled back automatically if any instance in the deployment fails a health check within 10 minutes after the deployment. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Configure a deployment group with automatic rollback enabled and set the rollback trigger to instance failure.. Option D is correct because the developer needs to configure the CodeDeploy deployment group with automatic rollback enabled and set the rollback trigger to 'instance failure'. This configuration ensures that if any instance fails a health check within the specified monitoring period (10 minutes after deployment), CodeDeploy automatically rolls back the deployment to the last known good revision. The 'instance failure' trigger specifically monitors the health of each instance and initiates a rollback when a health check fails, meeting the requirement exactly.

Answer

Set the deployment style to in-place and enable automatic rollback with event triggers.

Answer

Configure a deployment configuration with a minimum healthy hosts of 90% and enable CloudWatch alarm-based rollback.

Answer

Set the deployment style to blue/green and enable automatic rollback for deployment failure.

Question 20

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket and an AWS Lambda function. The Lambda function needs to be granted permission to read objects from the S3 bucket. Which resource should the developer define in the CloudFormation template to provide these permissions?

Accepted Answer

AWS::IAM::Role. Option A is correct because the Lambda function requires an IAM role (AWS::IAM::Role) with a policy that grants s3:GetObject permissions on the S3 bucket. This role is assumed by the Lambda service at runtime, allowing the function to read objects from the bucket. The role must include a trust policy that allows lambda.amazonaws.com to assume it.

Answer

AWS::Lambda::Permission

Answer

AWS::S3::BucketPolicy

Answer

AWS::IAM::ManagedPolicy