DVA-C02 Practice Exam 68 — 20 Questions

Question 1

A developer is building a serverless application that uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The workflow involves three steps: validate input, process data, and store results. The developer notices that the workflow occasionally fails due to transient errors in the process data step. The developer wants to implement error handling so that the workflow retries the process data step up to three times with an exponential backoff. Additionally, if all retries fail, the workflow should send a notification to an Amazon SNS topic and transition to a failure state. The developer has defined the state machine in Amazon States Language (ASL). How should the developer configure the state machine?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the process data state definition, add a Retry field with MaxAttempts: 3 and BackoffRate: 2, and add a Catch field that transitions to a failure state and sends an SNS notification.. In Amazon States Language (ASL), retry and error handling are configured per-state, not at the workflow level. The process data state should include a Retry block with MaxAttempts: 3 and BackoffRate: 2 (which produces exponential backoff: 1s, 2s, 4s by default), and a Catch block that matches the error and transitions to a failure state. The failure state can be a Task state invoking SNS Publish, or the Catch can route to a state that publishes to SNS before ending in a Fail state.

Answer

Write custom retry logic inside the Lambda function code and catch exceptions there.

Answer

Modify the IAM execution role to allow the state machine to call SNS and then use a ResultPath to handle errors.

Answer

Add a Retry field at the workflow level and a Catch field at the workflow level.

Question 2

A developer is troubleshooting an issue where an S3 bucket policy is not granting cross-account access to a user in another AWS account. The bucket policy uses a Principal element with the AWS account ID. What is the most likely reason for the failure?

Accepted Answer

The IAM user in the other account does not have an IAM policy that allows the S3 action.. The most likely reason is that the IAM user in the other account does not have an IAM policy that allows the S3 action. For cross-account access, both the bucket policy (resource-based) and the IAM policy (identity-based) must grant the necessary permissions. Even if the bucket policy allows the account, the user's IAM policy must also allow the action.

Answer

The bucket is encrypted with SSE-S3, which blocks cross-account access.

Answer

The bucket policy must use the user's ARN instead of the account ID.

Answer

The bucket policy cannot grant access to users in another account.

Question 3

A developer is using AWS CodeBuild to compile and test code. The build phase fails with the error: 'BUILD_FAILED: Error: No such file or directory.' What is the most likely cause?

Accepted Answer

The buildspec.yml file references a file or directory that does not exist in the source code.. The error 'No such file or directory' during the build phase almost always means a command in buildspec.yml (or a referenced script/artifact path) points to a file that is not present in the checked-out source. CodeBuild runs each phase command in the container's working directory, so a typo or missing file in the repo produces exactly this error.

Answer

The build environment has a network timeout when accessing external dependencies.

Answer

The IAM role for CodeBuild does not have permissions to access the source repository.

Answer

The build environment does not have the required environment variables set.

Question 4

An application uses an Auto Scaling group with a launch configuration that includes a user data script to configure instances. After a scaling event, new instances launch but fail to register with the target group. The existing instances continue to work. What should the developer do to resolve this issue?

Accepted Answer

Create a new launch configuration with corrected user data and update the Auto Scaling group. Launch configurations are immutable — once created, they cannot be modified. To fix incorrect user data, the developer must create a new launch configuration with the corrected script and update the Auto Scaling group to reference it. Existing instances keep running with the old configuration, but new instances launched after the update will use the corrected user data and register successfully.

Answer

Modify the existing launch configuration with the correct user data

Answer

Update the Auto Scaling group to use the latest launch configuration version

Answer

Delete and recreate the Auto Scaling group

Question 5

A company wants to encrypt data at rest in an Amazon RDS for PostgreSQL database. The database is already running, and the company wants to enable encryption without significant downtime. Which approach should be taken?

Accepted Answer

Take a snapshot, copy the snapshot with encryption, and restore a new encrypted instance from the encrypted snapshot.. RDS encryption at rest can only be enabled at instance creation time, so an existing unencrypted instance must be migrated. The supported path is to snapshot the instance, copy the snapshot with encryption enabled, then restore a new encrypted DB instance from that encrypted snapshot — this yields an encrypted database with only the downtime of the cutover.

Answer

Take a snapshot of the database and enable encryption on the snapshot.

Answer

Modify the RDS instance and enable encryption in the configuration.

Answer

Create a read replica with encryption and promote it.

Question 6

A developer is building a mobile backend using Amazon API Gateway and AWS Lambda. The API has a single endpoint that accepts POST requests with a JSON payload and stores the data in an Amazon DynamoDB table. The developer wants to implement caching to reduce latency and costs. The data is user-specific and should not be shared between users. The developer configures API Gateway caching with a TTL of 300 seconds. After testing, the developer notices that users are seeing other users' data. What should the developer do to fix this issue?

Accepted Answer

Enable cache key parameters in API Gateway, such as the Authorization header.. API Gateway caching by default uses only the request path and method as the cache key, so all POST requests to the same endpoint share a single cache entry. Since the data is user-specific, the cache must include a unique user identifier in the cache key. Enabling cache key parameters (e.g., the Authorization header or a custom user ID header) ensures that each user's request generates a distinct cache key, preventing cross-user data leakage. This is the correct and minimal fix because it directly addresses the root cause—the cache key not being user-specific—while retaining the performance benefits of API Gateway caching.

Answer

Store cached responses in DynamoDB and retrieve them based on user ID.

Answer

Use Lambda@Edge to cache responses at the CloudFront level.

Answer

Disable API Gateway caching and use DynamoDB Accelerator (DAX) instead.

Question 7

A developer has an AWS Lambda function that needs to read objects from an S3 bucket in another account. The Lambda function's execution role includes an IAM policy that allows s3:GetObject on the bucket. The bucket owner has added a bucket policy that grants s3:GetObject to the Lambda execution role. However, the Lambda function receives Access Denied errors. The S3 bucket uses SSE-KMS for encryption. What is the most likely cause?

Accepted Answer

The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.. When an S3 bucket uses SSE-KMS, the Lambda function must have explicit kms:Decrypt permission on the KMS key to decrypt the object after s3:GetObject retrieves the encrypted data. Even though the bucket policy and execution role allow s3:GetObject, the missing KMS permission causes an Access Denied error because S3 returns the encrypted object and the Lambda runtime cannot decrypt it without the key.

Answer

The S3 bucket does not have versioning enabled.

Answer

The Lambda function's execution role does not have an explicit allow for s3:GetObject.

Answer

The Lambda function is not in the same AWS region as the S3 bucket.

Question 8

An organization uses AWS CodeBuild to run tests for a Node.js application. The build environment is Linux. The buildspec.yml includes a pre_build phase that runs 'npm install'. Occasionally, the build fails with an error 'npm ERR! code EINTEGRITY'. The developer wants to resolve this issue without compromising security. Which action should be taken?

Accepted Answer

Add 'npm cache verify' to the pre_build phase before 'npm install'.. The EINTEGRITY error occurs when npm's local cache contains corrupted or mismatched package data, causing integrity checks to fail. Running 'npm cache verify' in the pre_build phase validates the cache, removes corrupted entries, and garbage collects unnecessary data, ensuring subsequent 'npm install' operations use a clean cache. This resolves the issue without disabling security features like integrity checking or switching to insecure HTTP.

Answer

Create a separate CodeBuild project to run npm install.

Answer

Add 'npm config set registry http://registry.npmjs.org/' to use HTTP.

Answer

Use 'npm install --prefer-offline' to avoid fetching from registry.

Question 9

A developer is building a web application that must encrypt data in transit between the client and the server. Which AWS service should be used to offload SSL/TLS termination?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) is ideal for web applications (HTTP/HTTPS) to offload SSL/TLS termination. It decrypts HTTPS traffic from clients at Layer 7 and forwards it to backend targets, reducing CPU load on application servers and centralizing certificate management via AWS Certificate Manager (ACM). While Network Load Balancer (NLB) also supports TLS termination at Layer 4, ALB is specifically designed for HTTP/HTTPS application-level routing and features.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 10

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The bucket policy allows s3:GetObject for the instance's IAM role, but the application is still getting access denied errors. What is the MOST likely cause?

Accepted Answer

The S3 bucket is encrypted with SSE-KMS and the instance does not have kms:Decrypt permissions.. When an S3 bucket is encrypted using SSE-KMS, any entity attempting to retrieve an object (s3:GetObject) must also have permission to decrypt the object using the KMS key (kms:Decrypt). If the IAM role has the correct S3 permissions but lacks the kms:Decrypt permission on the KMS key, AWS S3 will return an 'Access Denied' error.

Why other options are incorrect:
- A: Security group restrictions on outbound traffic would cause the connection to time out, not return an 'Access Denied' error.
- C: Block Public Access settings prevent anonymous/public access, but access via an authorized IAM role is not public access.
- D: If the EC2 instance did not have an instance profile associated, the AWS SDK would fail locally with a credentials lookup error (e.g., 'Unable to locate credentials') rather than receiving an 'Access Denied' response from the S3 service.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Answer

The S3 bucket has a block public access setting enabled.

Answer

The EC2 instance does not have an instance profile associated with the IAM role.

Question 11

A company is using Amazon S3 to store sensitive documents. The security team requires that all access to the bucket be logged for audit purposes, but the company wants to avoid AWS CloudTrail data event charges and needs detailed HTTP request/response records. Which feature should be enabled?

Accepted Answer

S3 server access logging. S3 server access logging provides detailed records for requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. Unlike AWS CloudTrail data events, which incur additional charges per 100,000 events, S3 server access logging is free to enable (you only pay for the storage of the log files). This makes it the ideal choice for detailed HTTP-level logging without extra service costs.

Answer

Amazon CloudWatch Logs

Answer

S3 Inventory

Answer

AWS CloudTrail

Question 12

A company has a requirement to automatically rotate database credentials every 30 days. Which AWS service can meet this requirement with minimal development effort?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it provides built-in, automated rotation of database credentials without custom code. You can define a rotation schedule (e.g., every 30 days) and Secrets Manager will automatically update the secret and the database password using a Lambda function, meeting the requirement with minimal development effort.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Systems Manager Parameter Store

Question 13

A developer is deploying a serverless application using AWS SAM. The developer runs 'sam deploy' but receives an error that the S3 bucket does not exist. How should the developer fix this?

Accepted Answer

Create an S3 bucket and specify it with --s3-bucket.. AWS SAM requires an S3 bucket to store the packaged application artifacts (Lambda code, nested stacks) during deployment. If the bucket specified (or the default SAM-managed bucket) does not exist, the developer must create an S3 bucket and pass it via the --s3-bucket parameter to sam deploy.

Answer

Use sam publish to deploy the application.

Answer

Run sam build to generate the bucket.

Answer

Run sam package to create the bucket automatically.

Question 14

Refer to the exhibit. A developer tried to create a CloudFormation stack that includes an EC2 instance. The stack creation failed and rolled back. What should the developer do to get more details about the failure?

Accepted Answer

Run `aws cloudformation describe-stack-events` for the stack.. When a CloudFormation stack fails and rolls back, the authoritative source of failure details is the stack events log. Running aws cloudformation describe-stack-events returns the ordered event stream, including the specific resource that failed and the status reason containing the underlying error message.

Answer

Review the CloudFormation template syntax.

Answer

Use the `detect-stack-drift` command.

Answer

Update the stack with the same template to see the error.

Question 15

A company uses AWS Elastic Beanstalk to deploy a Python web application. After a recent deployment, the environment health turns 'Severe' and the application becomes unresponsive. The developer checks the logs and finds multiple '502 Bad Gateway' errors from the nginx proxy. The application was working before the deployment. What is the MOST likely cause?

Accepted Answer

The new application code has a bug that causes the application to crash.. A 502 Bad Gateway error from nginx means the reverse proxy cannot communicate with the application backend. Since the application was working before the deployment and became unresponsive immediately after, the most likely cause is a bug in the new code that causes the application process to crash or hang. Elastic Beanstalk's nginx proxy expects a healthy response from the application on the designated port; if the application fails to start or crashes repeatedly, nginx returns 502 errors.

Answer

The Procfile is missing from the application source.

Answer

The environment's load balancer is not configured correctly.

Answer

The environment variables are not set correctly.

Question 16

A developer is using AWS CodeDeploy to deploy an application to an EC2 Auto Scaling group. The developer wants the deployment to automatically roll back if any of the new instances fail a health check within the first 10 minutes after deployment. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Configure a CloudWatch alarm and enable alarm-based automatic rollback in the AutoRollbackConfiguration.. CodeDeploy's AutoRollbackConfiguration allows you to specify CloudWatch alarms as triggers for automatic rollback. By creating a CloudWatch alarm that monitors the EC2 Auto Scaling group's health check failures and setting the alarm's evaluation period to 10 minutes, the deployment will automatically roll back if any new instance fails a health check within that window. This directly meets the requirement without custom scripting or manual intervention.

Answer

Set the DeploymentStyle to 'BLUE_GREEN' and configure the 'LoadBalancerInfo' with the target group.

Answer

Create a lifecycle hook for the Auto Scaling group to trigger a rollback script.

Answer

Set a TriggerConfiguration in the deployment group to send notifications on deployment failure.

Question 17

Which TWO actions should a developer take to securely manage database credentials in a serverless application?

Accepted Answer

Store credentials in AWS Secrets Manager and enable automatic rotation.. Option A is correct because AWS Secrets Manager is purpose-built for storing and retrieving secrets such as database credentials, and enabling automatic rotation ensures credentials are periodically changed without manual intervention, reducing the risk of long-lived credential exposure. Option B is correct because IAM database authentication for Amazon RDS lets the Lambda function use its IAM role to generate a short-lived authentication token instead of a static password, eliminating the need to store database credentials at all. Option C is incorrect because embedding credentials in a text file inside the Lambda deployment package exposes them to anyone with access to the code artifact and provides no rotation or auditing. Option D is incorrect because hardcoding credentials in environment variables leaves them in plaintext and visible in the Lambda configuration, and they cannot be rotated automatically. Option E is incorrect because security groups only control network-level access to the database and do not manage or protect the credentials themselves.

Answer

Store credentials in a text file within the Lambda deployment package.

Answer

Hardcode credentials in environment variables.

Answer

Use security groups to allow only the Lambda function to access the database.

Question 18

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which THREE actions are required?

Accepted Answer

Instruct users to use their MFA device when logging in. Option D is correct because MFA must first be enabled/assigned for each IAM user (via the IAM console, CLI, or API, associating a virtual or hardware MFA device) before it can be enforced. Option A is correct because users must actually supply the MFA code at sign-in; the AWS Management Console login flow prompts for the MFA token after the password, and without that second factor the session cannot be established. Option E is correct because an IAM policy using the aws:MultiFactorAuthPresent condition key (typically with a Deny statement, e.g., denying all actions when aws:MultiFactorAuthPresent is false) enforces MFA programmatically for console access. Option B is not correct because a password policy controls password complexity, length, reuse, and expiration—it has no MFA enforcement capability. Option C is not correct because SCPs apply only to AWS Organizations accounts (setting permission guardrails) and do not enforce MFA for individual IAM users in a single account.

Answer

Configure a password policy that requires MFA

Answer

Create a service control policy (SCP) to enforce MFA

Question 19

Which TWO security best practices should be applied when using AWS Lambda? (Choose TWO.)

Accepted Answer

Attach an IAM execution role with least privilege permissions.. Option A is correct because every Lambda function assumes an IAM execution role to call other AWS services, and granting only the specific actions and resources the function needs (least privilege) limits the blast radius if the function is compromised or misused. Option E is correct because AWS Secrets Manager stores credentials and other secrets encrypted and lets the function retrieve them at runtime via the AWS SDK, so secrets are not embedded in code or configuration and can be rotated automatically. Option B is not a security best practice in this context; CloudWatch Logs is primarily for observability and monitoring, and logging sensitive data can even increase exposure. Option C is wrong because hardcoding database credentials in function code exposes secrets in source control, deployment packages, and logs. Option D is wrong because Lambda environment variables are not a secure secret store—they are visible in the function configuration and can be exposed through console access, APIs, or misconfigured permissions.

Answer

Enable CloudWatch Logs for the Lambda function.

Answer

Hardcode database credentials in the function code.

Answer

Store sensitive data in Lambda environment variables.

Question 20

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Accepted Answer

Enable default encryption.. Option B (Enable default encryption) is correct because it ensures that all objects written to the bucket are encrypted at rest using SSE-S3, SSE-KMS, or SSE-C, so even if objects are inadvertently exposed or accessed without authorization, the data remains unreadable without the appropriate keys. Option D (Block public access at the bucket level) is correct because S3 Block Public Access settings override bucket policies and ACLs to prevent any public exposure, which is the primary vector for S3 data leaks. Option A (Enable versioning) only preserves object versions and aids recovery from overwrites or deletions; it does not prevent unauthorized access or public exposure. Option C (Enable MFA Delete) adds protection against accidental or malicious deletion of object versions but does not stop data from being read or leaked. Option E (Configure cross-region replication) copies objects to another region for durability and latency, but it does not restrict access and can even widen the exposure surface if the destination bucket is misconfigured.

Answer

Enable versioning.

Answer

Enable MFA Delete.

Answer

Configure cross-region replication.