DVA-C02 Practice Exam 66 — 20 Questions

Question 1

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During peak hours, users report receiving HTTP 503 (Service Unavailable) errors. The developer checks Amazon CloudWatch metrics and finds that the ALB's request count is high but below the limit, and the target group's healthy host count drops to zero intermittently. The Auto Scaling group for the instances is configured with a minimum of 2, maximum of 10, and a simple scaling policy to add 2 instances when CPU utilization exceeds 70% for 5 consecutive minutes. What is the most likely cause of the 503 errors?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes. The 503 errors occur because the simple scaling policy has a cooldown period (default 300 seconds) that prevents the Auto Scaling group from launching new instances during rapid traffic spikes. When CPU exceeds 70% for 5 minutes, the policy adds 2 instances, but the cooldown blocks further scaling actions until it expires, even if the newly launched instances are still initializing and the healthy host count drops to zero. This mismatch between traffic demand and scaling responsiveness causes the ALB to have no healthy targets, resulting in 503 errors.

Answer

The ALB's idle timeout is set too low, causing dropped connections

Answer

The Auto Scaling group's maximum capacity of 10 is insufficient

Answer

The health check grace period is preventing instances from being marked healthy

Question 2

A developer is building a serverless application and wants to invoke an AWS Lambda function every hour to perform a cleanup task. Which AWS service should the developer use to schedule the invocation?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) is the correct service for scheduling AWS Lambda invocations on a recurring basis. It provides a cron or rate expression to trigger a Lambda function at a defined interval, such as every hour, without the need for managing any servers or additional infrastructure.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon SQS

Question 3

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to improve performance. The application periodically experiences high latency during peak hours. The developer checks the ElastiCache metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster has a single node with a cache.t3.small instance type. Which action will most likely improve the cache hit rate and reduce latency?

Accepted Answer

Scale up to a larger node type (e.g., cache.t3.medium) to increase available memory.. The high 'Evictions' and low 'CacheHitRate' metrics indicate that the Redis node is running out of memory, forcing it to evict keys to make room for new data. Scaling up to a larger node type (cache.t3.medium) increases the available memory, allowing more data to be cached and reducing evictions, which directly improves the cache hit rate and reduces latency.

Answer

Enable cluster mode and distribute data across multiple shards to reduce memory pressure.

Answer

Change the eviction policy to 'allkeys-lfu' to better manage which keys are evicted.

Answer

Add a read replica for the Redis cluster to offload read traffic.

Question 4

A DynamoDB application receives ProvisionedThroughputExceededException during predictable daily peaks. The workload is not cacheable. What should be changed?

Accepted Answer

Use on-demand capacity or configure autoscaling/scheduled scaling for the table. The ProvisionedThroughputExceededException indicates that the table's read/write capacity is insufficient during peak loads. Since the workload is predictable but not cacheable, the correct solution is to either switch to on-demand capacity mode, which automatically scales to handle any traffic level, or configure auto scaling with scheduled scaling to match the predictable peaks. This directly addresses the capacity shortfall without requiring application changes.

Answer

Enable S3 Transfer Acceleration

Answer

Disable CloudWatch metrics

Answer

Move all reads to strongly consistent mode

Question 5

A developer is creating a new IAM policy to allow users to list objects in a specific S3 bucket. The policy must follow the principle of least privilege. Which policy statement should the developer use?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}. The s3:ListBucket action controls the ability to list the objects within a specific bucket, and it must be granted on the bucket resource itself (arn:aws:s3:::example-bucket), not on the objects inside it. Option B correctly pairs the least-privilege action with the correct resource ARN, allowing the user to list objects in only that one bucket. This satisfies the principle of least privilege because it grants no access to other buckets and no object-level read/write permissions.

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}

Question 6

Drag and drop the steps to authenticate a user using Amazon Cognito User Pools in the correct order.

Accepted Answer

Create the user pool and app client, then authenticate to receive tokens, then use tokens for authorization.. First create the user pool and app client, then authenticate to receive tokens, and use tokens for authorization.

Answer

Authenticate to receive tokens, then create the user pool and app client, then use tokens for authorization.

Answer

Create the user pool and app client, then use tokens for authorization, then authenticate to receive tokens.

Answer

Use tokens for authorization, then create the user pool and app client, then authenticate to receive tokens.

Question 7

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are purpose-built services for storing and retrieving secrets securely, with encryption at rest via KMS, fine-grained IAM access control, and native integration with ECS/Fargate task definitions. Secrets Manager additionally supports automatic rotation. This is the AWS-recommended approach for injecting secrets into containerized workloads without hardcoding them.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 8

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero status.. The error message explicitly states that the CodeDeploy agent logs show the BeforeInstall lifecycle event script returned a non-zero exit code. This directly indicates that the script itself failed during execution, which is the most likely cause of the deployment failure. The BeforeInstall script is a custom script run by the CodeDeploy agent on each instance, and a non-zero exit code signals an error condition that halts the deployment for that instance.

Answer

The application revision is missing from the S3 bucket.

Answer

The IAM instance profile does not have permissions to call CodeDeploy APIs.

Answer

The CodeDeploy agent is not running on the instances.

Question 9

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift 10% of traffic to the new version for 5 minutes before routing all traffic. Which configuration should the developer add to the SAM template?

Accepted Answer

DeploymentPreference with Type: Canary10Percent5Minutes. The `DeploymentPreference` property with `Type: Canary10Percent5Minutes` instructs AWS SAM to use AWS CodeDeploy to shift 10% of traffic to the new Lambda version for 5 minutes, then automatically route the remaining 90% after the canary period ends. This matches the requirement exactly, leveraging SAM's built-in integration with CodeDeploy for canary deployments.

Answer

Add a CodeDeploy application and deployment group manually

Answer

DeploymentPreference with Type: Linear10PercentEvery1Minute

Answer

DeploymentPreference with Type: AllAtOnce

Question 10

Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)

Accepted Answer

A security group rule allowing inbound traffic on port 443. A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.

Answer

Server Name Indication (SNI) support

Answer

An HTTP to HTTPS redirect rule

Question 11

A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing sensitive configuration parameters such as database credentials and API keys throughout their lifecycle. It offers automatic rotation of secrets with built-in integration for Amazon RDS, Redshift, and DocumentDB, and enforces fine-grained access control via IAM policies. This makes it the most suitable service for the developer's requirement of securely storing and managing database credentials and API keys for a Lambda function.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 12

A developer needs to package and deploy a serverless application with Lambda functions, API Gateway, and DynamoDB using concise syntax. Which framework is AWS-native for this purpose?

Accepted Answer

AWS Serverless Application Model. The AWS Serverless Application Model (SAM) is an AWS-native framework that uses a simplified YAML or JSON syntax to define and deploy serverless resources such as Lambda functions, API Gateway, and DynamoDB. It extends AWS CloudFormation, allowing developers to package and deploy with concise syntax using the `sam build` and `sam deploy` commands, making it the correct choice for this purpose.

Answer

AWS Control Tower

Answer

Amazon Macie

Answer

AWS Backup

Question 13

A company has an S3 bucket with a policy that denies access to all users. The bucket owner wants to grant read access to a specific IAM user. What must be done?

Accepted Answer

Remove the Deny statement from the bucket policy.. In S3 bucket policies, an explicit Deny always overrides any Allow. Since the bucket policy currently denies access to all users, simply adding an Allow statement for the specific IAM user will not work—the Deny will still take precedence. Therefore, the Deny statement must be removed or modified to exclude that user before an Allow can be effective. Option C is correct because it addresses the root cause: the explicit Deny must be eliminated to permit any access.

Answer

Create a new bucket and copy objects there.

Answer

Add an Allow statement in the bucket policy for the user.

Answer

Add the user to the bucket ACL with read permission.

Question 14

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a relational database. The developer wants to ensure that the database is not accidentally deleted when the Elastic Beanstalk environment is terminated. Which approach should the developer take?

Accepted Answer

Create the RDS instance outside of Elastic Beanstalk and configure the application to connect to it using environment variables.. Creating the RDS instance outside of Elastic Beanstalk decouples the database lifecycle from the environment lifecycle. When the Elastic Beanstalk environment is terminated, the external RDS instance remains intact and is not deleted. The application can connect to it using environment variables configured in the Elastic Beanstalk environment, ensuring persistence of data.

Answer

Create the database as part of the Elastic Beanstalk environment by adding an RDS database configuration in the .ebextensions.

Answer

Use an Amazon DynamoDB table instead of a relational database.

Answer

Configure a retention policy on the RDS instance within the Elastic Beanstalk environment.

Question 15

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Accepted Answer

Scan and sort results client-side, then take first 10. Scanning all items and sorting them client-side by score descending gives the global top 10, regardless of partition keys. Option E is correct if the table is designed with a single partition key (e.g., a constant value like 'Leaderboard'), because a Query with ScanIndexForward=false and Limit=10 then retrieves the top 10 items from that partition efficiently. Options A, C, and D are incorrect because they cannot return the top 10 items sorted globally.

Answer

TransactGetItems

Answer

BatchGetItem

Answer

GetItem

Question 16

A company uses AWS Secrets Manager to rotate database credentials for an RDS MySQL instance. The rotation Lambda function fails with the error: 'Secret is scheduled for deletion.' What is the MOST likely cause?

Accepted Answer

The secret has been marked for deletion and is in the waiting period.. The error 'Secret is scheduled for deletion' indicates that the secret has been marked for deletion and is currently in the mandatory waiting period (default 7 to 30 days). During this period, AWS Secrets Manager prevents any operations on the secret, including rotation, to ensure the deletion is intentional. The rotation Lambda function fails because it cannot access or modify a secret that is pending deletion.

Answer

The secret's rotation schedule has been disabled.

Answer

The Lambda function does not have permission to access the secret.

Answer

The RDS instance is not in the same VPC as the Lambda function.

Question 17

A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?

Accepted Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.. To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.

Answer

Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.

Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.

Answer

Enable client certificate authentication on the ALB.

Question 18

A developer needs to grant cross-account access to an Amazon S3 bucket. The developer's AWS account (Account A) owns the bucket, and a user in another account (Account B) needs to write objects to it. The developer has already added a bucket policy that grants the user in Account B permissions. What additional step is required?

Accepted Answer

The administrator of Account B must attach an IAM policy to the user that allows the required S3 actions.. Cross-account access to S3 requires both a resource-based policy (the bucket policy in Account A) and a user-based policy (an IAM identity-based policy in Account B). The bucket policy grants permissions to the Account B user, but that user cannot perform actions unless their own account explicitly allows those actions via an IAM policy. Without this, the request is denied by the user's own account's implicit deny, even if the bucket policy permits it.

Answer

No additional steps are needed; the bucket policy alone is sufficient.

Answer

Create a new IAM role in Account B and have the user assume the role.

Answer

Enable S3 ACLs on the bucket and grant write access to the Account B user.

Question 19

A developer needs to allow an Amazon EC2 instance to send messages to an Amazon SQS queue. What is the most secure way to grant this access?

Accepted Answer

Assign an IAM role to the EC2 instance with permissions to send messages to SQS. The most secure way to grant an EC2 instance access to SQS is to attach an IAM role to the instance with a policy allowing sqs:SendMessage on the specific queue. IAM roles provide temporary credentials via the instance metadata service (IMDS), eliminating the need to store long-lived access keys on the instance.

Answer

Create a bucket policy on S3 to allow EC2 to access SQS

Answer

Use a resource-based policy on the SQS queue allowing the EC2 instance's security group

Answer

Create an IAM user and store the credentials in the application configuration file

Question 20

A developer is optimizing a Node.js Lambda function that processes CSV files from S3. The function reads the entire file into memory, processes it, and writes results to DynamoDB. For large files, the function runs out of memory. What is the MOST effective optimization?

Accepted Answer

Use the AWS SDK's S3 GetObject with a stream and process in chunks.. The core issue is that the Lambda function loads the entire CSV file into memory, causing out-of-memory errors for large files. Streaming the S3 object and processing it in chunks avoids holding the whole file in memory, keeping memory usage low and constant regardless of file size. This directly addresses the root cause—memory exhaustion—rather than just increasing resources or time limits. It also allows the function to start processing immediately as data arrives, improving efficiency.

Answer

Increase the Lambda timeout to allow more processing time.

Answer

Increase the Lambda function memory to 3008 MB.

Answer

Use S3 Select to retrieve only necessary columns.