DVA-C02 Practice Exam 67 — 20 Questions

Question 1

A developer is deploying an application with AWS CodeDeploy. The application needs to access a database password. Which service should be used to securely store and retrieve the password?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for securely storing, rotating, and retrieving secrets such as database passwords, API keys, and tokens. It integrates natively with AWS services like RDS and provides fine-grained access control via IAM. CodeDeploy deployments can retrieve secrets at runtime using the Secrets Manager API or SDK.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption at rest

Question 2

A developer is troubleshooting a CloudFront distribution that serves static content from an S3 bucket. Users in some geographic locations report slow load times. The developer checks the CloudFront metrics and sees a high number of cache misses. What is the MOST likely cause?

Accepted Answer

The object TTL is set to a very low value (e.g., 0 seconds).. A very low or zero TTL (e.g., 0 seconds) causes CloudFront to treat every request as a cache miss, forcing it to fetch the object from S3 on each request. This increases latency for users, especially in distant geographic locations, because the edge location must repeatedly retrieve the object from the origin. Setting a reasonable TTL allows edge locations to serve cached content and reduces origin fetches.

Answer

The CloudFront distribution is configured with Price Class 100, which uses only the US and Europe edge locations.

Answer

The S3 bucket is configured with signed URLs for access.

Answer

The CloudFront distribution is not configured to compress objects.

Question 3

A developer is creating a deployment pipeline using AWS CodePipeline. The pipeline includes a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CloudFormation. The developer wants to ensure that the pipeline can automatically create the CloudFormation stack if it does not exist. Which action mode should the developer use in the CloudFormation deploy action?

Accepted Answer

CREATE_UPDATE. The CREATE_UPDATE action mode in AWS CodePipeline's CloudFormation deploy action creates the stack if it does not exist and updates it if it does. This is the default and most flexible mode, ensuring the pipeline can handle both initial deployment and subsequent updates without manual intervention.

Answer

UPDATE_ONLY

Answer

REPLACE_ON_FAILURE

Answer

CREATE_ONLY

Question 4

A developer is deploying a containerized application on Amazon ECS with the Fargate launch type. The application needs to read data from an Amazon S3 bucket. The developer wants to follow the principle of least privilege. How should the developer grant the necessary permissions to the ECS tasks?

Accepted Answer

Create an IAM task role and reference it in the task definition using the 'taskRoleArn' parameter.. Amazon ECS with the Fargate launch type supports IAM task roles, which allow you to assign an IAM role to the ECS task itself. By referencing the IAM task role in the task definition using the 'taskRoleArn' parameter, the containerized application can securely obtain temporary credentials from the ECS container agent via the AWS STS service, adhering to the principle of least privilege without embedding long-lived credentials.

Answer

Store AWS access keys as environment variables in the task definition.

Answer

Create an IAM user and embed its credentials in the container image.

Answer

Use an S3 bucket policy that grants access based on the security group of the ECS tasks.

Question 5

A company is implementing a CI/CD pipeline for a containerized application using Amazon ECS and AWS CodePipeline. The team wants to ensure zero-downtime deployments. Which THREE strategies should the team implement? (Choose THREE.)

Accepted Answer

Use a blue/green deployment strategy with an Application Load Balancer.. Option A is correct because a blue/green deployment with an Application Load Balancer lets CodeDeploy shift traffic from the original ECS task set to the new (green) task set only after the new tasks pass health checks, and it can roll back instantly if validation fails, so users never hit a failed deployment. Option C is correct because ECS service auto scaling keeps the desired task count at the level the service needs during and after deployment, ensuring enough healthy tasks remain registered with the load balancer to absorb traffic while replacements are being launched. Option D is correct because the health check grace period prevents ECS from killing newly started tasks before they have finished booting and begun responding to ALB health checks, avoiding false unhealthy verdicts that would otherwise cause task churn and downtime. Option B is not appropriate because a rolling update with a batch size of 100% replaces all tasks at once, which removes all healthy capacity simultaneously and can cause an outage. Option E is not appropriate because stopping all existing tasks before starting new ones creates a hard outage, directly violating the zero-downtime requirement.

Answer

Use a rolling update with a fixed batch size of 100% of tasks.

Answer

Stop all existing tasks before starting new tasks.

Question 6

A developer is debugging an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function fails with an 'AccessDenied' error when trying to read an object from the same bucket. What should the developer check first?

Accepted Answer

Review the Lambda function's execution role for s3:GetObject permission.. The developer should first review the Lambda function's execution role for s3:GetObject permission. The 'AccessDenied' error indicates the function lacks permission to read the object. The execution role must have an IAM policy granting s3:GetObject on the bucket or object. This is the most direct cause.

Answer

Check if S3 bucket versioning is enabled.

Answer

Verify that the S3 bucket uses server-side encryption with AWS KMS.

Answer

Ensure the S3 bucket is not blocked by S3 Block Public Access.

Question 7

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. What is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create an IAM execution role for Lambda with permissions to read from S3 and write to DynamoDB.. The most secure and AWS-recommended pattern is to create an IAM execution role for the Lambda function that grants least-privilege access to the specific S3 bucket and DynamoDB table. Lambda assumes this role at invocation, so no long-lived credentials exist and permissions are centrally managed.

Answer

Attach a resource-based policy to the S3 bucket and DynamoDB table allowing access from the Lambda function.

Answer

Configure the S3 bucket policy to allow the Lambda function's ARN.

Answer

Store AWS access keys in the Lambda environment variables.

Question 8

Why is the Lambda function not being invoked?

Accepted Answer

The S3 bucket does not have a notification configuration for the Lambda function.. The most likely reason the Lambda function is not being invoked is that the S3 bucket does not have a notification configuration for the Lambda function. For S3 to invoke a Lambda function, you must configure an event notification on the bucket that specifies the Lambda function as the destination. Without this configuration, S3 will not send events to Lambda, and the function will never be invoked.

Answer

The Lambda execution role does not have permission to be invoked by S3.

Answer

The Lambda permission does not specify the correct source account.

Answer

The Lambda function has a runtime that is not supported.

Question 9

A developer is troubleshooting an AWS CloudFormation stack creation failure. The stack creation failed with the error: 'Resource creation cancelled'. What does this error typically indicate?

Accepted Answer

Another resource in the stack failed, causing a rollback.. 'Resource creation cancelled' is CloudFormation's generic message when a resource's creation is aborted because another resource in the same stack failed and CloudFormation initiated a rollback. By default, stack creation uses rollback-on-failure, so once any resource fails, all in-progress creations are cancelled and successfully created resources are deleted. The error is a symptom of a sibling resource failure, not a problem with the cancelled resource itself.

Answer

The IAM user does not have permission to create the resource.

Answer

The template has a syntax error.

Answer

The resource type is not supported by CloudFormation.

Question 10

A developer is troubleshooting access to an Amazon S3 bucket. The bucket policy allows access to the developer's IAM role, but the developer receives an Access Denied error when trying to upload objects. The developer is using an IAM user with access keys for API calls. What is the most likely cause?

Accepted Answer

The bucket policy allows the role ARN, but the developer is using user credentials. The bucket policy grants access to the developer's IAM role ARN, but the developer is authenticating as an IAM user with access keys. IAM roles and IAM users are distinct principals, so the role-based grant in the bucket policy does not apply to the user's credentials, resulting in Access Denied. The fix is either to assume the role or to add the IAM user ARN to the bucket policy.

Answer

The developer’s IAM user does not have s3:PutObject permission

Answer

The bucket policy does not include a Principal element

Answer

The S3 bucket is in a different region from the developer's API endpoint

Question 11

A developer is troubleshooting an S3 bucket policy that is denying all access. The policy has an explicit Deny for s3:PutObject. What is the most likely reason for the denial even though an Allow exists?

Accepted Answer

IAM evaluates explicit Deny before Allow.. IAM policy evaluation logic explicitly states that an explicit Deny always overrides any Allow. In S3 bucket policies, if any statement includes an explicit Deny for s3:PutObject that matches the principal and resource, the request is denied regardless of other Allow statements. This is the core reason the denial occurs even when an Allow exists.

Answer

The bucket policy has an explicit Deny for all actions.

Answer

The user is not authorized because the bucket is in a different account.

Answer

The AWS account root user has denied access.

Question 12

A developer is troubleshooting an AWS Lambda function that is timing out. The function processes S3 events and writes to DynamoDB. The average execution time is 5 seconds, but the function times out after 3 seconds. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds.. The function's average execution time is 5 seconds, but it times out at 3 seconds — this mismatch directly indicates the Lambda function's configured timeout value is set to 3 seconds, which is lower than the actual runtime. The timeout setting is a per-function configuration (default 3 seconds, max 15 minutes) that terminates execution when exceeded. Since the workload legitimately needs ~5 seconds, the fix is to increase the timeout to a value above the observed runtime.

Answer

The S3 bucket is not configured to send event notifications.

Answer

DynamoDB write capacity is insufficient.

Answer

The Lambda function concurrency limit is exceeded.

Question 13

A developer is optimizing an AWS Lambda function that processes streaming data from Amazon Kinesis. The function is CPU-bound. Which TWO actions should the developer take to improve performance?

Accepted Answer

Rewrite the function in a compiled language like Go.. Option A is correct because rewriting a CPU-bound Lambda function in a compiled language such as Go reduces execution time: Go compiles to native machine code, avoids the JIT warm-up and higher memory overhead of interpreted runtimes like Python or Node.js, and typically delivers significantly faster CPU throughput for the same work. Option C is correct because in AWS Lambda, CPU power scales proportionally with the configured memory allocation; increasing memory from, say, 512 MB to 1769 MB grants roughly one full vCPU, which directly speeds up CPU-bound processing. Option B is wrong because reserved concurrency only caps or guarantees the number of simultaneous invocations; it does not make any single invocation faster and can even throttle throughput if set too low. Option D is wrong because increasing Kinesis shard count raises stream throughput and parallelism across records, but it does not accelerate the CPU-bound work inside one function invocation. Option E is wrong because AWS Lambda does not support GPU acceleration; GPU-backed compute requires services like Amazon EC2, ECS, or SageMaker.

Answer

Increase the function's reserved concurrency.

Answer

Increase the Kinesis stream's shard count.

Answer

Enable GPU acceleration for the function.

Question 14

A developer wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving sensitive credentials such as database passwords. It integrates natively with Lambda via the AWS SDK, supports automatic rotation using Lambda rotation functions, and encrypts secrets with KMS. For database credentials specifically, Secrets Manager's built-in RDS/Redshift/DocumentDB rotation templates make it the recommended service.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB

Question 15

The exhibit shows an IAM policy attached to a Lambda function's execution role. When the Lambda function tries to decrypt data using the KMS key, it receives an access denied error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The most likely cause is that the KMS key policy does not grant the Lambda execution role permission to use the key. Even if the IAM policy attached to the role includes kms:Decrypt, the KMS key policy must also allow the role to use the key. KMS requires both identity-based and resource-based policies to grant access.

Answer

The policy uses an incorrect action name for decryption.

Answer

The policy does not include kms:DescribeKey permission.

Answer

The policy does not include kms:Decrypt permission.

Question 16

A developer is running a Docker container on Amazon ECS with Fargate. The container logs are not appearing in CloudWatch Logs even though the task definition has a logConfiguration specifying the awslogs driver and a log group. What is the MOST likely missing configuration?

Accepted Answer

The task execution role lacks the necessary IAM permissions to write to CloudWatch Logs.. For Fargate tasks, the awslogs driver uses the task execution role (not the task role) to call logs:CreateLogStream and logs:PutLogEvents. If that role lacks these permissions, the container starts but log delivery silently fails, which is the most common cause of missing CloudWatch logs.

Answer

The container image does not have the awslogs log driver installed.

Answer

The CloudWatch Logs log group does not exist.

Answer

The EC2 instance profile does not have CloudWatch Logs permissions.

Question 17

A developer is building a serverless application using API Gateway and Lambda. The API must be accessible only from a specific VPC. How can the developer achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. To restrict an API Gateway REST API to a specific VPC, the correct pattern is a VPC endpoint (interface endpoint) for API Gateway combined with a resource policy on the API that allows only that endpoint. The resource policy uses aws:sourceVpce to whitelist the endpoint, and clients inside the VPC reach the API via the private DNS name of the endpoint. This is the documented AWS approach for private API access.

Answer

Use security groups to restrict access to the API Gateway.

Answer

Create the API Gateway inside the VPC.

Answer

Use CloudFront with an origin access identity to restrict access.

Question 18

A developer receives an AccessDenied error when trying to upload a file to an S3 bucket that has a bucket policy requiring encryption in transit. What is the most likely cause?

Accepted Answer

The request is not using HTTPS. A bucket policy that requires encryption in transit typically uses a condition like aws:SecureTransport: true, which evaluates to false for HTTP requests. If the SDK or client sends the PutObject request over HTTP instead of HTTPS, the condition fails and S3 returns AccessDenied. The most likely cause is that the request is not using HTTPS.

Answer

The object is not encrypted with server-side encryption

Answer

The IAM user does not have s3:PutObject permission

Answer

The request signature is expired

Question 19

A developer is deploying a web application using AWS Elastic Beanstalk. The application requires a relational database. The developer wants the database to be automatically created and configured as part of the Elastic Beanstalk environment. Which approach should they use?

Accepted Answer

Configure the Elastic Beanstalk environment to include an RDS database instance.. The correct approach is to configure the Elastic Beanstalk environment to include an RDS database instance. Elastic Beanstalk allows you to provision an RDS database as part of the environment, automatically handling creation, configuration, and connection details. This integrates the database lifecycle with the environment, simplifying management.

Answer

Use Amazon DynamoDB as the database and configure it in the Elastic Beanstalk environment.

Answer

Create an RDS database manually and configure the application to connect to it using environment properties.

Answer

Embed a SQLite database file in the application deployment package.

Question 20

Refer to the exhibit. A developer attempted to update a CloudFormation stack that includes an EC2 instance. The update failed and the stack is rolling back. The event shows that the EC2 instance update failed with reason 'Resource update cancelled: stack update cancelled'. What is the most likely cause of this failure?

Accepted Answer

A stack policy is preventing updates to the EC2 instance resource.. A CloudFormation stack policy is an explicit guardrail that denies Update:Modify (or Update:Replace) actions on specified resources. When the update attempts to modify the EC2 instance, the policy blocks the change, CloudFormation cancels the resource update, and the stack begins rolling back — producing exactly the 'Resource update cancelled: stack update cancelled' event. This is the only option that directly produces a cancellation rather than an authorization, template, or runtime-state error.

Answer

The IAM user does not have permission to update EC2 instances.

Answer

The template has a missing required parameter for the EC2 instance.

Answer

The EC2 instance is in a stopped state and cannot be updated.