DVA-C02 Practice Exam 69 — 20 Questions

Question 1

A company is using AWS Lambda functions that access an RDS database. Which THREE practices should be followed to secure the database credentials?

Accepted Answer

Use AWS Secrets Manager to store and automatically rotate the credentials.. Option A is correct because AWS Secrets Manager is purpose-built to store database credentials securely and can automatically rotate RDS credentials on a schedule using a Lambda rotation function, eliminating hard-coded or long-lived secrets. Option C is correct because Lambda environment variables can be encrypted at rest with an AWS KMS customer managed key, so credentials are not stored in plaintext and the function decrypts them at runtime using its execution role permissions. Option E is correct because placing the Lambda function in the same VPC as the RDS instance and using a security group to permit traffic only to the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) restricts network access to the database. Option B is incorrect because security groups are stateful virtual firewalls that filter network traffic; they do not decrypt credentials. Option D is incorrect because embedding credentials in Lambda function code exposes them in source control, deployment packages, and logs, which is an insecure anti-pattern.

Answer

Use a security group to decrypt the credentials.

Answer

Store the credentials in the Lambda function code.

Question 2

Which THREE steps are required to set up a continuous delivery pipeline using AWS CodePipeline, CodeBuild, and CodeDeploy? (Select THREE.)

Accepted Answer

Create a deploy stage with CodeDeploy to deploy the artifacts.. Option B is correct because a CodePipeline continuous delivery pipeline requires a deploy stage, and CodeDeploy is the AWS service used in that stage to deploy the built artifacts to targets such as EC2 instances, Lambda functions, or ECS services. Option D is correct because CodeBuild provides the build stage where the source code is compiled, tested, and packaged into deployable artifacts, which is a core step in a CodePipeline workflow. Option E is correct because every CodePipeline must begin with a source stage that retrieves the code from a repository such as AWS CodeCommit, GitHub, or Amazon S3, which then triggers the pipeline on changes. Option A is incorrect because CodePipeline and CodeDeploy do not require an Amazon RDS database to store deployment logs; logs are handled by CloudWatch Logs and S3 artifacts. Option C is incorrect because CodePipeline is natively triggered by source changes or EventBridge rules, not by a custom Lambda function, so creating a Lambda trigger is not a required setup step.

Answer

Set up an Amazon RDS database to store deployment logs.

Answer

Configure an AWS Lambda function to trigger the pipeline.

Question 3

A developer is troubleshooting a slow Amazon RDS for MySQL database. The application experiences high latency on write operations. Which TWO actions can improve write performance?

Accepted Answer

Increase the allocated storage size to get better I/O performance.. Option B is correct because Amazon RDS storage performance is tied to the allocated storage size: increasing the allocated storage (especially into higher gp2/gp3 or io1/io2 tiers) raises the available IOPS and throughput, which directly reduces write latency. Option D is correct because moving to a larger DB instance class provides more vCPU, memory, and dedicated EBS bandwidth, allowing the database to process write operations faster and relieve resource contention. Option A is not correct because a read replica only offloads read traffic and does not improve write performance on the primary. Option C is not correct because deletion protection is a safety feature that prevents accidental deletion and has no effect on I/O performance. Option E is not correct because Multi-AZ provides high availability via synchronous standby replication, not write performance improvement; in fact, it can add slight write overhead.

Answer

Add a read replica to offload read traffic.

Answer

Enable deletion protection.

Answer

Enable Multi-AZ deployment for high availability.

Question 4

Which TWO statements are true about AWS CodeDeploy deployment groups? (Choose two.)

Accepted Answer

A deployment group can use an Auto Scaling group as its target.. Option B is correct because a CodeDeploy deployment group can target an Auto Scaling group, allowing deployments to scale across the instances managed by that group. Option D is correct because a deployment group is fundamentally defined as a set of deployment targets (such as EC2 instances, on-premises instances, Lambda functions, or ECS services) associated with a single CodeDeploy application. Option A is incorrect because a deployment group can contain many instances, not just one. Option C is incorrect because a deployment group belongs to exactly one CodeDeploy application and cannot be shared across multiple applications. Option E is incorrect because a deployment group can be associated with a load balancer to manage traffic during deployments.

Answer

A deployment group can only target a single EC2 instance.

Answer

A deployment group can be shared across multiple CodeDeploy applications.

Answer

A deployment group cannot be associated with a load balancer.

Question 5

A developer is troubleshooting a slow-running query on an Amazon RDS for MySQL database. The query is used by a reporting application and takes over 30 seconds to complete. The database is a db.r5.large instance with 200 GB of gp2 storage. Which TWO actions should the developer take to improve query performance?

Accepted Answer

Review the slow query log to identify the query and its execution plan.. Option B is correct because the MySQL slow query log captures queries exceeding the long_query_time threshold (default 10 seconds), and reviewing it along with EXPLAIN output reveals the query's execution plan, helping pinpoint full table scans, missing indexes, or inefficient joins. Option D is correct because adding appropriate indexes on the columns used in WHERE, JOIN, and ORDER BY clauses lets MySQL satisfy the query with index lookups instead of full table scans, which is the most direct fix for a slow reporting query. Option A is not appropriate because idle connections consume minimal resources and terminating them does not address query execution inefficiency. Option C is not appropriate because increasing gp2 storage size only raises the baseline IOPS (3 IOPS/GB) and burst balance; it does not fix a poorly optimized query and is a costly workaround. Option E is not appropriate because Multi-AZ is a high-availability feature that maintains a standby replica for failover, not a read-scaling mechanism, so it does not improve query performance.

Answer

Terminate idle connections to free up resources.

Answer

Increase the allocated storage to 500 GB to improve I/O performance.

Answer

Enable Multi-AZ deployment for better read performance.

Question 6

A company runs a Node.js application on AWS Elastic Beanstalk. The application is experiencing high latency. The developer suspects the database queries are slow. Which step should the developer take first to diagnose the issue?

Accepted Answer

Enable enhanced health reporting and monitor CloudWatch metrics for database connection time.. The first step should be to enable enhanced health reporting and monitor CloudWatch metrics for database connection time. This provides visibility into the application's performance and helps identify if the database is indeed the bottleneck.

Answer

Migrate the database to Amazon DynamoDB for better performance.

Answer

Add database indexing to improve query performance.

Answer

Increase the instance size to improve performance.

Question 7

A company uses AWS CodePipeline to automate releases. The pipeline includes a source stage from CodeCommit, a build stage with CodeBuild, and a deploy stage with CodeDeploy. The build stage fails intermittently due to insufficient memory. What should the developer do to resolve this?

Accepted Answer

Increase the compute type of the CodeBuild project.. AWS CodeBuild allows you to increase the compute type of the build project, which provides more memory and CPU resources, directly addressing the insufficient memory issue. Option B (changing deployment configuration) only affects the CodeDeploy stage and not the build stage. Option C (switching source to S3) does not resolve memory constraints. Option D (modifying buildspec.yml to use less memory) may help but is not a reliable solution and might require application changes; increasing the compute type is a more direct and effective fix.

Answer

Change the deployment configuration to CodeDeploy.Default.AllAtOnce.

Answer

Switch the source to an S3 bucket.

Answer

Modify the buildspec.yml to use less memory.

Question 8

A developer is storing secrets such as database passwords. Which TWO AWS services can be used to securely store and retrieve secrets?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (B) is correct because it can store secrets as SecureString parameters, which are encrypted with AWS KMS and can be retrieved programmatically by applications via the SSM API, making it a valid service for storing and retrieving database passwords. AWS Secrets Manager (D) is correct because it is purpose-built for storing, retrieving, and rotating secrets such as database credentials, using KMS encryption and APIs like GetSecretValue. AWS CloudHSM (A) is not correct here because it provides dedicated hardware security modules for cryptographic key operations, not a managed secret storage and retrieval service. AWS Identity and Access Management (C) manages identities, permissions, and policies rather than storing secret values. Amazon S3 (E) is object storage and, while it can be encrypted, it is not designed as a secrets management service for securely storing and retrieving credentials.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 9

A company wants to give a third-party auditor read-only access to their AWS account for compliance purposes. What is the most appropriate way to grant this access?

Accepted Answer

Create an IAM role with the SecurityAudit managed policy and allow the auditor to assume it.. An IAM role with the AWS-managed SecurityAudit policy grants read-only access to configuration and audit metadata across services without allowing data access or mutations. The auditor assumes the role using STS, receiving temporary credentials, which is the AWS-recommended pattern for cross-account or third-party access. This satisfies least privilege and avoids long-lived credentials.

Answer

Attach the AdministratorAccess managed policy to an IAM user.

Answer

Create an IAM user with a custom policy that allows all actions.

Answer

Share the root account credentials with the auditor.

Question 10

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application processes user uploads stored in an S3 bucket. The developer needs to ensure that the Lambda function can read objects from the S3 bucket. Which TWO steps should the developer take to meet this requirement? (Choose two.)

Accepted Answer

Add a bucket policy on the S3 bucket that grants access to the Lambda function's execution role.. Option D is correct because a Lambda function accesses AWS services through its execution role, so attaching an IAM policy that allows s3:GetObject (and typically s3:ListBucket) to that role grants the function the required read access to objects in the bucket. Option C is correct because a bucket policy is a resource-based policy that can explicitly grant the Lambda function's execution role principal access to the S3 bucket and its objects, which is a valid way to authorize the read operations. Option A is incorrect because S3 object-level permissions are ACLs that grant access to AWS accounts or predefined groups, not to a Lambda function directly, and ACLs are not the recommended mechanism for Lambda-to-S3 authorization. Option B is incorrect because KMS is used for encryption key management and does not itself grant S3 data access; KMS permissions would only matter if the objects are encrypted with a customer managed key. Option E is incorrect because Lambda functions should use an execution role, not assume an IAM user with long-term credentials, which is an insecure and unsupported pattern for this scenario.

Answer

Set the S3 bucket's object-level permissions to allow the Lambda function.

Answer

Use AWS Key Management Service (KMS) to grant the Lambda function access to the S3 bucket.

Answer

Create an IAM user with S3 read permissions and configure the Lambda function to assume that user.

Question 11

Refer to the exhibit. A developer runs the AWS CLI command for an EC2 instance. The instance is in the 'running' state, but the application hosted on it is not reachable. What should the developer check first?

Accepted Answer

Check the security group rules for inbound traffic.. When an EC2 instance is in the 'running' state but the application is unreachable, the most common initial cause is that the Security Group associated with the instance does not allow inbound traffic on the application's port (e.g., port 80 or 443). Security groups act as stateful firewalls at the instance level, and by default, they block all inbound traffic unless explicitly allowed.

Answer

Check the ELB health check settings.

Answer

Check the instance status checks in the EC2 console.

Answer

Verify the instance ID is correct.

Question 12

Which TWO approaches can be used to optimize costs for an Amazon DynamoDB table with predictable read/write patterns? (Select TWO.)

Accepted Answer

Use provisioned capacity with auto scaling.. Option B is correct because provisioned capacity with auto scaling lets you set a target utilization and have Application Auto Scaling adjust read/write capacity units to match predictable traffic, so you pay only for the capacity you actually need rather than over-provisioning. Option D is correct because DAX is an in-memory cache for DynamoDB that serves eventually consistent reads from memory, reducing the number of read capacity units consumed on the table and lowering cost for read-heavy, predictable workloads. Option A is not correct because increasing read capacity units raises cost rather than optimizing it, and it addresses throttling, not cost efficiency. Option C is not correct because global tables add multi-region replication and incur extra write and storage costs, which is a resilience feature, not a cost optimization. Option E is not correct because on-demand capacity mode is designed for unpredictable or spiky workloads and typically costs more per request than well-tuned provisioned capacity for predictable patterns.

Answer

Increase the read capacity units to avoid throttling.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use on-demand capacity mode.

Question 13

A developer is troubleshooting a slow-performing Amazon RDS for MySQL database. Which TWO actions should the developer take to improve query performance?

Accepted Answer

Increase the instance size to provide more CPU and memory.. Option C is correct because a slow-performing RDS for MySQL instance is often constrained by CPU, memory, or IOPS, and vertically scaling to a larger instance class provides more vCPU, RAM, and baseline EBS throughput, which directly improves query execution and buffer pool caching. Option D is correct because enabling the MySQL slow query log (via the slow_query_log and long_query_time parameters in a custom parameter group) captures queries exceeding the threshold, letting the developer identify and then optimize the specific poorly performing SQL statements. Option A is not appropriate because deleting indexes generally hurts read performance and only marginally reduces write overhead, and unused indexes are not the typical cause of slow queries. Option B is wrong because Multi-AZ is a high-availability/failover feature that maintains a synchronous standby, not a read-scaling mechanism, so it does not improve read performance. Option E is wrong because purging binary logs only frees storage and does not address query performance, and it can break point-in-time recovery and replication.

Answer

Delete unused indexes to reduce write overhead.

Answer

Enable Multi-AZ deployment for better read performance.

Answer

Delete the binary log files to free up storage.

Question 14

A company is using AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS MySQL database. The development team wants to ensure that database credentials are not exposed in the application code. Which THREE actions should the team take to securely manage and retrieve database credentials? (Choose three.)

Accepted Answer

Configure Elastic Beanstalk to pass the secret ARN to the application as an environment property.. Option E is correct because AWS Secrets Manager is the purpose-built service for storing and rotating sensitive data such as RDS MySQL credentials, keeping them out of source code and enabling fine-grained IAM access control. Option B is correct because passing the secret ARN (not the secret value) as an Elastic Beanstalk environment property lets the application know which secret to fetch without embedding credentials in code or configuration files. Option C is correct because the application must call the Secrets Manager API (e.g., GetSecretValue) at startup to retrieve the credentials dynamically, which completes the secure retrieval workflow. Option A is not appropriate because S3 is object storage, not a secrets management service, and a bucket policy alone does not provide the encryption, rotation, and audit controls of Secrets Manager. Option D is wrong because hardcoding credentials in application code is exactly the insecure practice the team is trying to eliminate, and environment variable overrides do not remove the exposed secrets from the codebase.

Answer

Store the credentials in an S3 bucket with a bucket policy that restricts access to the application.

Answer

Hardcode the credentials in the application code and use environment variables to override them.

Question 15

A developer attaches the following IAM policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": "t2.micro"
        }
      }
    }
  ]
}
```

What happens when the developer attempts to launch a t2.micro instance?

Accepted Answer

The action is allowed because the Allow statement applies and the Deny condition excludes t2.micro.. AWS IAM evaluates all applicable statements, and an explicit Deny always overrides an Allow — but only when the Deny's condition evaluates to true. Here the Deny uses StringNotEquals on ec2:InstanceType with value t2.micro, so for a t2.micro launch the condition is false and the Deny does not apply. The Allow on ec2:RunInstances with Resource '*' therefore takes effect and the launch is permitted.

Answer

The action is denied because ec2:RunInstances requires additional permissions.

Answer

The action is denied because the Deny statement overrides the Allow.

Answer

The action is allowed only if the user has ec2:DescribeInstances as well.

Question 16

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They have a CodePipeline that deploys the built artifacts to an Auto Scaling group using CodeDeploy. Recently, the build stage started failing with the error: 'BUILD FAILED: Could not resolve dependencies for project'. The developer checks the buildspec.yml and sees that it uses Maven to download dependencies from a private repository. The developer also notices that the build environment is a managed Docker image. What is the most likely cause?

Accepted Answer

The build environment does not have network access to the private Maven repository because it is not configured with a VPC.. CodeBuild runs in a managed Docker image that, by default, has internet access but no route to private VPC resources such as an internal Maven repository. To reach a private repository hosted inside a VPC, the CodeBuild project must be configured with VPC settings (VPC ID, subnets, security groups). Without that, Maven cannot resolve dependencies and the build fails.

Answer

The CodeBuild project does not have the necessary IAM permissions to access the private Maven repository.

Answer

The buildspec.yml has a syntax error in the 'phases' section.

Answer

The Java compiler version is incompatible with the project.

Question 17

Refer to the exhibit. An S3 bucket policy is set as shown. A developer tries to download an object from my-bucket using the AWS CLI from an IP address in the 203.0.113.0/24 range. What will happen?

Accepted Answer

The download fails with an AccessDenied error.. In an S3 bucket policy, explicit Deny statements override any Allow statements. Even though the Allow statement grants s3:GetObject to all principals, the Deny statement explicitly denies s3:GetObject when the request originates from the 203.0.113.0/24 IP range. Since the developer's IP falls within that range, the Deny takes precedence, resulting in an AccessDenied error.

Answer

The policy is invalid because of conflicting statements.

Answer

The download succeeds because the Allow statement matches the request.

Answer

The download succeeds because the Deny statement does not apply to GetObject.

Question 18

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. When a Lambda function is attached to a VPC, it loses the default internet access it normally has and can only reach resources within that VPC's subnets. To reach S3, the function must either route through a NAT gateway/instance to the public internet or use an S3 Gateway VPC Endpoint, which provides private connectivity without traversing the internet.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 19

A developer is using AWS SAM to deploy a serverless application. The developer wants to enable canary deployments for the Lambda function. Which TWO resources must be configured in the SAM template? (Choose TWO.)

Accepted Answer

DeploymentPreference property on the AWS::Serverless::Function resource.. Option A is correct because the DeploymentPreference property on the AWS::Serverless::Function resource is what tells SAM to perform a canary (or linear/all-at-once) deployment, specifying the deployment type, the alias, and the CloudWatch alarms that trigger rollback. Option B is correct because AutoPublishAlias is required for SAM to create and publish a Lambda alias (e.g., 'live') that the canary deployment shifts traffic to; without a published alias, DeploymentPreference cannot route weighted traffic between versions. Option C is not required for canary deployments since CodeUri simply specifies the function's code location and is unrelated to traffic shifting. Option D is not required because an event source mapping only connects the function to a stream/queue and has nothing to do with canary traffic routing. Option E is not required because SAM automatically creates the alias and its routing configuration when AutoPublishAlias and DeploymentPreference are set, so the developer does not need to define an alias resource manually.

Answer

The function's CodeUri property pointing to the deployment package.

Answer

An event source mapping for the function.

Answer

The function's alias resource with a routing configuration.

Question 20

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. Which THREE services can be used for session state storage? (Choose THREE.)

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis (A) is correct because it is an in-memory data store that supports fast key-value session data with sub-millisecond latency and optional persistence, making it a standard choice for shared session state in Elastic Beanstalk applications. Amazon DynamoDB (B) is correct because it is a fully managed, highly available key-value NoSQL database that can store session tokens and attributes with consistent low-latency reads/writes at scale. Amazon RDS (E) is correct because a relational database such as MySQL, PostgreSQL, or SQL Server can persist session state in a table, and Elastic Beanstalk applications commonly use RDS for shared session storage. Amazon S3 (C) is not appropriate because it is object storage with eventual consistency characteristics and higher latency, not designed for frequent small session reads/writes. Amazon CloudFront (D) is a content delivery network that caches HTTP content at edge locations and does not provide writable session state storage.

Answer

Amazon S3

Answer

Amazon CloudFront