DVA-C02 Practice Exam 64 — 20 Questions

Question 1

Match each AWS deployment strategy to its description.

Accepted Answer

Rolling deployment: Incrementally replaces instances of the previous version with new version instances.. Common deployment strategies include Rolling, Blue/Green, and Canary. Rolling deploys incrementally, Blue/Green switches between environments, and Canary tests with a small subset. Distractors often confuse these definitions.

Answer

Rolling deployment: Simultaneously updates all instances.

Answer

Canary deployment: Deploys to a full separate environment and then switches traffic.

Question 2

A developer is using AWS X-Ray to trace requests through a microservices application. The application consists of several AWS Lambda functions that call each other and Amazon DynamoDB. The developer notices that some traces are incomplete and missing segments for downstream calls. What is the MOST likely cause?

Accepted Answer

The Lambda functions do not have the X-Ray SDK imported.. The Lambda functions need to import the X-Ray SDK to create subsegments for downstream calls and propagate the trace header. Without the SDK, traces will be missing segments for DynamoDB calls. DynamoDB does not have a per-table X-Ray tracing setting; tracing is achieved by instrumenting the client in the calling code.

Answer

The downstream DynamoDB table does not have X-Ray tracing enabled.

Answer

The X-Ray daemon is not running on the Lambda execution environment.

Answer

The X-Ray sampling rate is set too low.

Question 3

A company uses AWS CodePipeline with CodeBuild to test and deploy a web application. The pipeline has been failing at the deploy stage with an error: 'Access Denied'. CloudTrail shows the CodePipeline service role is making the call. What is the MOST likely cause?

Accepted Answer

The CodePipeline service role lacks permissions for the deploy action.. The error 'Access Denied' in the deploy stage, with CloudTrail showing the CodePipeline service role making the call, indicates that the IAM role assumed by CodePipeline does not have the necessary permissions to perform the deploy action against the target provider (e.g., ECS, S3, Elastic Beanstalk). CodePipeline uses its service role to invoke the deploy action, and if that role lacks the required `codedeploy:*`, `s3:PutObject`, or `ecs:UpdateService` permissions, the API call will be denied.

Answer

The CodeBuild project does not have internet access.

Answer

The deploy provider (e.g., ECS, S3) is not in the same AWS region.

Answer

The source code repository does not have the correct branch.

Question 4

A company uses AWS KMS customer master keys (CMKs) to encrypt sensitive data in Amazon S3. A compliance requirement mandates that the backing keys for the CMKs be automatically rotated every year. The developer must implement this with minimal operational overhead. Which solution meets the requirement?

Accepted Answer

Enable automatic key rotation for the CMK in AWS KMS.. AWS KMS supports automatic key rotation for customer managed CMKs. When enabled, KMS automatically rotates the backing key annually (approximately every 365 days) with no additional operational overhead. This satisfies the compliance requirement for yearly rotation without manual intervention.

Answer

Create a new CMK every year and update the S3 bucket policy to use the new key.

Answer

Use an AWS managed key (aws/s3) which automatically rotates annually.

Answer

Use SSE-S3 encryption with automatically rotated keys instead of KMS.

Question 5

A developer is working on an application that uses Amazon SQS as a message queue. The application polls the queue using long polling with a wait time of 20 seconds. Recently, the team noticed that messages are being processed multiple times. The application is idempotent, but duplicate processing is causing unnecessary costs. What should the developer do to reduce duplicate message processing?

Accepted Answer

Use a DynamoDB table to track processed message IDs and ignore duplicates.. SQS standard queues provide at-least-once delivery, so duplicates are expected. Since the application is already idempotent, the developer should track processed message IDs in a DynamoDB table (with conditional writes or TTL) and skip messages already processed. This reduces redundant processing and cost without changing the queue type.

Answer

Switch to a FIFO queue to enable exactly-once processing.

Answer

Increase the visibility timeout to a value greater than the maximum processing time.

Question 6

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

Accepted Answer

The SQS visibility timeout is too short for the Lambda function's execution time.. When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Answer

The Lambda function's reserved concurrency is set too high.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The Lambda function's batch size is set to more than 1.

Question 7

A developer is configuring an Amazon S3 bucket for static website hosting. The website includes JavaScript that makes AJAX calls to an API Gateway endpoint. Which TWO actions should the developer take to allow cross-origin requests?

Accepted Answer

Enable CORS on the API Gateway API.. The API Gateway API must have CORS enabled to accept cross-origin requests from the S3-hosted static website. For an API Gateway endpoint backed by a Lambda proxy integration, enabling CORS in API Gateway alone is not enough — the Lambda function must also include the appropriate CORS headers (such as Access-Control-Allow-Origin) in its response. Therefore, the developer should both enable CORS on the API and modify the Lambda function to return CORS headers.

Answer

Use Amazon CloudFront to serve the website and set CORS headers.

Answer

Add a CORS configuration to the S3 bucket.

Answer

Configure the S3 bucket policy to allow cross-origin access.

Question 8

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudWatch logs but finds no logs for the Lambda function. What is the most likely reason?

Accepted Answer

The CloudFormation template has a syntax error.. A CloudFormation template syntax error, such as a missing required property (e.g., 'Handler' or 'Runtime'), can cause the Lambda function resource to fail creation. The error message indicates the specific resource failed, and the absence of CloudWatch logs is expected because the function was never created. Option A is incorrect because code syntax errors do not prevent resource creation; they affect invocation. Option B is incorrect because the function not being invoked is a consequence, not the cause. Option C is incorrect because missing CloudWatch Logs permissions do not prevent creation; they only affect logging during invocation.

Answer

The Lambda function code has a syntax error that prevents creation.

Answer

The Lambda function was never invoked.

Answer

The Lambda function's IAM role does not have permission to write to CloudWatch Logs.

Question 9

A developer is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database. The developer wants to use Amazon RDS for the database and needs to ensure that each microservice can only access its own set of tables. Which approach should the developer take?

Accepted Answer

Use RDS with IAM database authentication and create database users with limited privileges for each microservice.. IAM database authentication allows the developer to create database users with granular, table-level privileges using standard SQL GRANT statements, ensuring each microservice can only access its own set of tables. By combining IAM roles with database user credentials, the developer can enforce least-privilege access without sharing a single database user across services. This approach directly addresses the requirement for per-microservice table isolation while leveraging RDS's native authentication and authorization capabilities.

Answer

Create a single RDS instance with a separate database per microservice.

Answer

Use RDS in a VPC and restrict network access per microservice using security groups.

Answer

Use Amazon RDS Proxy to control access.

Question 10

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a build stage that compiles the website and a deploy stage that syncs the build output to an S3 bucket. After a recent change, the pipeline succeeds but the website does not show the updated content. What is the most likely cause?

Accepted Answer

Amazon CloudFront is caching the old content and needs an invalidation.. Amazon CloudFront is caching the old content and needs an invalidation. Since the pipeline succeeds and the deploy stage syncs the build output to S3, the updated files are likely in the bucket, but CloudFront continues serving cached objects from edge locations until the cache expires or an invalidation is created (e.g., aws cloudfront create-invalidation --distribution-id <ID> --paths "/*"). Option B is unlikely because a silent build failure would typically cause the build stage to fail or produce missing artifacts, and the pipeline reports success. Option C is not a standard CodePipeline deploy behavior for S3 sync actions, which deploy the specified artifacts rather than conditionally skipping unchanged content. Option D would cause access denied errors for website visitors, not stale content, and the pipeline could still succeed.

Answer

The build output is empty because the build failed silently.

Answer

The deploy action is configured to skip if the source content has not changed.

Answer

The S3 bucket policy does not allow public read access.

Question 11

A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks permissions to write to CloudWatch Logs.. The most likely cause is that the Lambda execution role lacks the necessary IAM permissions to write logs to CloudWatch Logs. Without permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`, the Lambda function cannot create the log group or stream, nor can it write log events, resulting in 0 stored bytes despite successful invocations.

Answer

The CloudWatch Logs log group does not exist.

Answer

The Lambda function is failing before any logging code is executed.

Answer

The Lambda function is configured to use a different log group name.

Question 12

Which TWO AWS services can be used to protect an application running on EC2 from common web exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting by inspecting HTTP(S) requests and blocking malicious patterns. AWS Shield Advanced is a DDoS protection service; it does not directly filter for SQL injection or XSS. Therefore, only AWS WAF is the appropriate service for this specific protection.

Answer

Amazon CloudWatch

Answer

Security Groups

Answer

AWS Shield Advanced

Answer

AWS Identity and Access Management (IAM)

Question 13

An IAM policy attached to an IAM user. What is the effect of this policy on the user's ability to delete objects in the bucket my-bucket?

Accepted Answer

The user is denied the ability to delete objects regardless of source IP.. The question cannot be answered as written because the IAM policy text is missing. To determine the effect on s3:DeleteObject, the policy's Effect, Action, and Condition (including any IpAddress or NotIpAddress operators) must be provided. Without the policy, no option can be verified as correct.

Answer

The user can delete objects from any IP address.

Answer

The user can delete objects only if the source IP is not 192.0.2.0/24.

Answer

The user can delete objects only if the source IP is 192.0.2.0/24.

Question 14

A team is using AWS CodeBuild to compile and test code. The build takes longer than expected. The team wants to reduce build times by caching dependencies. Which option should the team use to cache dependencies in CodeBuild?

Accepted Answer

Local caching or Amazon S3 caching. AWS CodeBuild supports two caching modes: local caching and Amazon S3 caching. Local caching stores dependencies on the build host's local file system, while S3 caching stores them in an S3 bucket. Both options reduce build times by reusing previously downloaded dependencies across builds, avoiding redundant downloads.

Answer

Amazon DynamoDB

Answer

Amazon EFS

Answer

Amazon ECR

Question 15

A developer needs to securely expose an API running on an EC2 instance behind an Application Load Balancer. The API should only be accessible to authenticated users via a custom authorization header. Which steps should be taken? (Choose TWO.)

Accepted Answer

Create a Lambda authorizer that validates the custom header. Option A is correct because a Lambda authorizer (formerly custom authorizer) is the API Gateway mechanism designed to validate a custom authorization header by running a Lambda function that returns an IAM policy allowing or denying the request. Option D is correct because Amazon API Gateway natively supports Lambda authorizers and custom authorization headers, whereas an ALB does not provide this capability, so the API must be fronted by API Gateway to enforce header-based authentication. Option B is incorrect because AWS WAF inspects HTTP requests for threats like SQL injection or XSS and cannot perform custom token/header authorization logic. Option C is incorrect because Cognito User Pools validate JWTs issued by Cognito, not arbitrary custom authorization headers. Option E is incorrect because ALBs have no native integration with Lambda authorizers; that feature exists only in API Gateway.

Answer

Enable AWS WAF on the ALB to inspect the header

Answer

Use Amazon Cognito User Pools to validate the header

Answer

Configure the ALB to use the Lambda authorizer

Question 16

A company uses AWS Elastic Beanstalk to run a web application. They want to deploy a new version with zero downtime. They have a production environment running the current version and a staging environment running the new version. After thoroughly testing the staging environment, they want to swap the URLs so that production now points to the new version. Which deployment strategy should they use?

Accepted Answer

Blue/green deployment with CNAME swap. Blue/green deployment with a CNAME swap is the correct strategy because it allows you to run two identical environments (blue = current production, green = new version) and switch traffic atomically by updating the DNS CNAME record. This achieves zero downtime since the production environment remains active until the swap is complete, and the staging environment has been fully tested. Elastic Beanstalk supports this by letting you perform a CNAME swap between environments via the console, CLI, or API.

Answer

Rolling deployment

Answer

Immutable deployment

Answer

All at once deployment

Question 17

A company uses AWS Lambda to process sensitive data. The Lambda function needs to access an RDS database with a password stored in AWS Secrets Manager. The function currently retrieves the secret using the AWS SDK. What is the best practice to secure this setup?

Accepted Answer

Configure the Lambda function to use IAM database authentication for RDS.. IAM database authentication eliminates the need to store or retrieve a password entirely. The Lambda function assumes an IAM role that generates a temporary authentication token (valid for 15 minutes) using the AWS SDK, which is then used to connect to RDS via TLS. This approach follows the principle of least privilege and removes the risk of static credentials being exposed or misused.

Answer

Store the password as a Lambda environment variable encrypted with KMS.

Answer

Use the AWS CLI within the Lambda function to fetch the secret each time.

Answer

Rotate the secret daily using Secrets Manager and cache it in Lambda.

Question 18

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. AWS Secrets Manager provides a secure, auditable service for rotating and managing database credentials. By retrieving secrets at runtime via the AWS SDK, the application avoids embedding sensitive data in code or configuration, which is a key security best practice for Elastic Beanstalk deployments.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.

Question 19

A company uses AWS Lambda functions behind an API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. After a recent deployment, some users report sporadic 502 Bad Gateway errors when calling the API. The Lambda function logs show occasional 'AccessDeniedException' errors. What is the most likely cause and solution?

Accepted Answer

The Lambda execution role lacks permissions to access DynamoDB. Update the role to include the necessary DynamoDB actions.. The 'AccessDeniedException' error in the Lambda logs indicates that the Lambda function's execution role does not have the necessary IAM permissions to perform the requested DynamoDB operation. This is a common misconfiguration after deployments where the role or its attached policies are not updated to include the required DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem). The 502 Bad Gateway from API Gateway is a direct consequence of the Lambda function failing internally due to this permission error.

Answer

The Lambda function is timing out. Increase the timeout value in the Lambda configuration.

Answer

The DynamoDB table is throttling requests. Enable auto-scaling for the table.

Answer

The API Gateway request is too large. Set the payload size limit higher in API Gateway settings.

Question 20

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to cache database query results. The application experiences high latency during cache misses. The developer notices that frequently accessed keys (hot keys) are often missing from the cache, suggesting they are being evicted. Which action should the developer take to reduce cache misses for hot keys?

Accepted Answer

Switch to the 'allkeys-lru' eviction policy.. ElastiCache for Redis defaults to the 'volatile-lru' eviction policy, which considers only keys that have a TTL for eviction. Under memory pressure, Redis may evict frequently accessed TTL-bearing keys while cold keys without TTL cannot be evicted. Switching to 'allkeys-lru' expands the candidate set to include keys without TTL, allowing Redis to evict less-recently-used non-TTL keys first and reducing the likelihood that hot TTL-bearing keys are evicted.

Answer

Increase the number of cache nodes.

Answer

Disable the TTL on all cached keys.

Answer

Increase the size of the cache cluster.