DVA-C02 Practice Exam 70 — 20 Questions

Question 1

A company is using Amazon S3 to store sensitive documents. They must encrypt all objects at rest. Which TWO methods can be used to enforce server-side encryption? (Choose TWO.)

Accepted Answer

Set a bucket policy that denies PutObject if x-amz-server-side-encryption header is not present.. Option A is correct because a bucket policy can include a Deny statement on s3:PutObject with a condition such as StringNotEquals on s3:x-amz-server-side-encryption (or its absence via Null), which blocks any upload that does not request server-side encryption with the required algorithm (for example, AES256 or aws:kms). Option B is correct because enabling default bucket encryption (SSE-S3, SSE-KMS, or DSSE-KMS) causes Amazon S3 to automatically encrypt every object at rest on upload, even when the request does not include the x-amz-server-side-encryption header, thereby enforcing encryption at rest. Option C is not appropriate because an IAM policy denying all S3 actions unless encryption is specified is overly broad and does not itself enforce encryption on PutObject in the precise, header-based way a bucket policy condition does. Option D is wrong because an SQS queue policy governs access to an SQS queue, not to S3 objects, and has no effect on S3 server-side encryption. Option E is wrong because client-side encryption encrypts data before it reaches S3 and is not a server-side encryption enforcement method.

Answer

Attach an IAM policy that denies all S3 actions unless encryption is specified.

Answer

Configure an SQS queue policy to require encryption.

Answer

Use client-side encryption before uploading objects.

Question 2

A developer is designing a microservices architecture using Amazon ECS with Fargate. The application needs to store and retrieve user session data. Which TWO AWS services can be used to store session state?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB (A) is correct because it is a fully managed, low-latency key-value NoSQL database that is commonly used to store session state for microservices, allowing fast reads/writes keyed by session ID with automatic scaling and TTL-based expiration. Amazon ElastiCache for Redis (B) is also correct because Redis is an in-memory data store with sub-millisecond latency and native support for data structures and key expiration, making it a standard choice for session caching and storage in containerized ECS/Fargate architectures. Amazon S3 (C) is not suitable because it is object storage with higher latency and eventual consistency characteristics, not designed for frequent small session reads/writes. Amazon EFS (D) is a shared file system for POSIX workloads and is not intended as a low-latency session state store. Amazon RDS for MySQL (E) is a relational database that can technically store sessions, but it is not the typical high-throughput, low-latency session store for microservices and is not marked correct here.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Question 3

A developer is designing a serverless application that uses AWS Lambda and Amazon DynamoDB. The application needs to handle high traffic spikes without data loss. Which TWO actions should the developer take?

Accepted Answer

Enable DynamoDB Auto Scaling. Option A (Enable DynamoDB Auto Scaling) is correct because DynamoDB Auto Scaling automatically adjusts provisioned read/write capacity in response to traffic spikes, ensuring the table can absorb sudden load without throttling or data loss. Option D (Use Amazon SQS to buffer requests to Lambda) is correct because placing an SQS queue between the request source and Lambda decouples the components, buffers bursts of traffic, and provides durable at-least-once delivery so requests are not lost if Lambda throttles or fails. Option B is incorrect because Provisioned IOPS is an EBS storage feature, not a DynamoDB capacity mode, and does not address DynamoDB throughput scaling. Option C is incorrect because DynamoDB Streams captures item-level changes for change data capture and triggers, but it does not itself handle traffic spikes or prevent data loss under load. Option E is incorrect because simply raising the Lambda concurrency limit to the maximum does not buffer requests or guarantee delivery; without a queue, excess invocations can still be throttled and dropped.

Answer

Use Provisioned IOPS for DynamoDB

Answer

Enable DynamoDB Streams

Answer

Increase the Lambda concurrency limit to the maximum

Question 4

A company has a REST API deployed on Amazon API Gateway with a Lambda integration. The API is experiencing high latency. Which TWO actions would help diagnose the issue?

Accepted Answer

Use AWS X-Ray to trace requests.. Option A is correct because AWS X-Ray traces the full request path through API Gateway, the Lambda integration, and downstream calls, exposing where latency is introduced (e.g., Lambda cold starts, slow downstream calls) via trace segments and subsegments. Option B is correct because enabling detailed CloudWatch Logs (execution logging and access logging) for the API Gateway stage captures per-request latency metrics such as integrationLatency and responseLatency, helping pinpoint whether the delay is in API Gateway or the Lambda backend. Option C is not a diagnostic action; increasing Lambda memory changes CPU allocation and could improve performance but does not help identify the root cause of latency. Option D is not a diagnostic step and changing the integration type alters architecture rather than measuring where latency occurs. Option E is also a remediation/architecture change (caching and edge termination) rather than a way to diagnose the source of the high latency.

Answer

Increase the Lambda function memory.

Answer

Change the API integration type from Lambda to HTTP.

Answer

Add Amazon CloudFront in front of API Gateway.

Question 5

Which THREE of the following are valid use cases for AWS Lambda? (Choose three.)

Accepted Answer

Processing records from a DynamoDB Stream in real time. Option A is correct because DynamoDB Streams can be configured as an event source for Lambda, which then invokes the function in real time with batches of stream records for processing. Option B is correct because Amazon EventBridge (CloudWatch Events) scheduled rules can invoke a Lambda function on a cron or rate expression, such as hourly, making it suitable for periodic cleanup tasks. Option C is incorrect because static websites are served by services like Amazon S3 static website hosting or CloudFront, not by Lambda, which is an event-driven compute service rather than a persistent web server. Option D is incorrect because long-running applications with persistent WebSocket connections require continuously running compute such as EC2, ECS, or API Gateway WebSocket APIs backed by appropriate compute, whereas Lambda has a maximum execution timeout of 15 minutes and is not designed for persistent connections. Option E is correct because S3 can be configured to send event notifications (e.g., s3:ObjectCreated:*) that invoke a Lambda function to process uploaded objects.

Answer

Serving as a web server for a static website

Answer

Hosting a long-running web application with WebSockets

Question 6

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. A developer needs to improve performance. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure Auto Scaling to add more instances during peak hours.. Option A is correct because configuring Auto Scaling to add more instances during peak hours horizontally scales the compute capacity behind the Application Load Balancer, distributing the increased request load across more targets and directly reducing the per-instance latency caused by peak traffic. Option C is correct because implementing Amazon ElastiCache (Redis or Memcached) offloads repeated reads of frequently accessed data from the backend instances and any database, cutting response times and reducing the load that contributes to high latency during peaks. Option B is not appropriate because increasing the ALB idle timeout only affects how long idle connections are kept open and does not improve application response latency. Option D is not the best fit because vertically scaling with larger instance types is a single-instance change that does not address load distribution and is less elastic than Auto Scaling. Option E is incorrect because EBS optimization improves storage throughput/IOPS consistency for EBS-backed volumes, not the application's peak-hour latency driven by request load.

Answer

Increase the ALB idle timeout.

Answer

Use larger EC2 instance types.

Answer

Enable EBS optimization on the instances.

Question 7

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The application must be highly available across multiple Availability Zones. The developer needs to configure the ECS service. Which THREE configuration options are required? (Choose THREE.)

Accepted Answer

Set the desired number of tasks to at least 2.. Option B is correct because setting the desired task count to at least 2 ensures that more than one task replica runs, which is necessary for high availability so that the service survives the failure of a single task. Option C is correct because associating an Application Load Balancer with the ECS service distributes incoming traffic across the running tasks and performs health checks, enabling traffic to be routed only to healthy tasks in multiple AZs. Option D is correct because configuring the service to place tasks in at least two subnets in different Availability Zones spreads the tasks across distinct AZs, which is the fundamental requirement for multi-AZ high availability in ECS. Option A is not required because AWS Fargate is a serverless launch type that does not use EC2 Auto Scaling groups; scaling is handled through ECS Service Auto Scaling instead. Option E is not required because ECS manages task state internally, and DynamoDB is not part of the ECS service configuration for high availability.

Answer

Create an Auto Scaling group for the Fargate tasks.

Answer

Use a DynamoDB table to store task state.

Question 8

Which TWO of the following are benefits of using Amazon API Gateway to manage APIs? (Choose two.)

Accepted Answer

Throttling and rate limiting of API requests. Option C is correct because API Gateway provides built-in throttling and rate limiting through usage plans and API keys, allowing you to control request rates per client and protect backend services from being overwhelmed. Option D is correct because API Gateway can automatically generate client SDKs for multiple programming languages (such as Java, JavaScript, Python, and iOS/Android) from an API's definition, simplifying client integration. Option A is not a feature of API Gateway, which does not cache database queries to Amazon RDS; it can cache API responses at the stage level, but not RDS queries. Option B is inaccurate as a benefit of API Gateway itself, since API Gateway can proxy to S3 but does not provide direct S3 file storage management as a core API management benefit. Option E is incorrect because automatic connection pooling for backend databases is handled by services like Amazon RDS Proxy, not API Gateway.

Answer

Built-in caching of database queries to Amazon RDS

Answer

Direct integration with Amazon S3 for file storage

Answer

Automatic connection pooling for backend databases

Question 9

A developer is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API receives a high volume of requests, and the developer needs to cache responses to reduce latency and cost. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Use Amazon CloudFront in front of API Gateway to cache responses.. Option C is correct because Amazon CloudFront can be deployed in front of API Gateway as a CDN, caching responses at edge locations to reduce latency and offload requests from the API, which lowers Lambda invocations and cost. Option D is correct because API Gateway has a built-in caching feature that can be enabled per stage or method, and setting a TTL controls how long responses are cached, directly reducing backend calls and latency. Option A is incorrect because DAX is a caching layer for DynamoDB, not for API Gateway or Lambda responses. Option B is incorrect because ElastiCache for Redis would require custom application logic to read/write the cache and is not a native API Gateway caching mechanism. Option E is incorrect because returning cache-control headers from Lambda does not by itself enable caching in API Gateway; caching must be explicitly configured on the API Gateway stage or method.

Answer

Use DynamoDB Accelerator (DAX) to cache Lambda responses.

Answer

Use ElastiCache for Redis to store frequently accessed responses.

Answer

Configure the Lambda function to return cache-control headers in the response.

Question 10

An application running on EC2 instances behind an Application Load Balancer (ALB) occasionally returns HTTP 503 errors. The instances are in an Auto Scaling group. Which action should be taken to resolve this issue?

Accepted Answer

Review the ALB access logs to identify the target response codes.. HTTP 503 errors from an ALB indicate that the targets (EC2 instances) are not responding successfully. Reviewing ALB access logs reveals the specific target response codes (e.g., 503 from the target itself or connection timeouts), which helps pinpoint whether the issue is due to overloaded instances, application errors, or health check failures. This diagnostic step is essential before making any configuration changes.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the ALB idle timeout setting.

Answer

Increase the size of the EC2 instances.

Question 11

A developer notices that an EC2 instance running a web application is unreachable via its public IP. The instance passes status checks but security group rules appear correct. What should the developer check NEXT?

Accepted Answer

Check the network ACL associated with the subnet for rules that may block traffic.. The instance passes status checks, the route table is confirmed to have a route to an internet gateway, and security group rules appear correct. Since the instance is still unreachable via its public IP, the next logical step is to check the network ACL (NACL) associated with the subnet. NACLs are stateless and can block inbound or outbound traffic even if security groups allow it. NACLs evaluate rules in order by rule number, and a deny rule (or missing allow rule) for the required ephemeral ports (e.g., 1024-65535 for return traffic) could silently drop packets.

Answer

Verify that the instance has an Elastic IP associated.

Answer

Review the route table for a route to an internet gateway.

Answer

Inspect the IAM role attached to the instance for network permissions.

Question 12

A developer deploys a new version of an AWS Lambda function using the AWS CLI. After the deployment, the function starts returning errors. The developer needs to quickly revert to the previous version without redeploying. What should the developer do?

Accepted Answer

Update the alias to point to the previous version.. AWS Lambda versions are immutable, while aliases are mutable pointers to specific function versions. By updating the alias to point to the previous version, the developer can instantly revert traffic to the stable code without any redeployment, as the alias is used as the invocation target (e.g., via the function's ARN with the alias name). This approach leverages Lambda's built-in versioning and alias routing, which is the fastest and safest rollback mechanism.

Answer

Use AWS CodeDeploy to automatically roll back the deployment.

Answer

Use the AWS CLI to update the function code with the previous code.

Answer

Delete the current function and recreate it using the previous deployment package.

Question 13

A company uses AWS CodePipeline to automate deployments. The pipeline has a source stage that pulls from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CloudFormation. The deploy stage often fails because CloudFormation change sets are not being created. What is the most likely cause?

Accepted Answer

The CodeBuild project is not producing the expected output artifacts.. For AWS CloudFormation to create a change set in a CodePipeline deploy stage, it requires an input artifact containing the CloudFormation template file. If the preceding CodeBuild stage is not configured to produce the expected output artifact (or if the template file is omitted from the buildspec's artifacts section), the CloudFormation action will fail because it cannot locate the template to generate the change set.

Answer

The CloudFormation deploy action is configured to use the 'CREATE_AND_EXECUTE' change set mode, but the stack does not exist yet.

Answer

The CloudFormation service role is missing.

Answer

The source stage is not configured to detect changes in the S3 bucket.

Question 14

An organization uses AWS Lambda functions behind an Amazon API Gateway REST API. They want to deploy a new version of the Lambda function using canary deployments. What is the recommended approach?

Accepted Answer

Deploy the new Lambda version using AWS SAM with AutoPublishAlias and DeploymentPreference.. AWS SAM (Serverless Application Model) provides built-in support for safe Lambda deployments. By defining the `AutoPublishAlias` and `DeploymentPreference` (such as `Canary10Percent10Minutes`) in the SAM template, AWS SAM automatically configures AWS CodeDeploy to gradually shift traffic to the new Lambda version. It also monitors CloudWatch alarms and automatically rolls back if any errors are detected, making it the recommended and most robust approach.

Answer

Use AWS CodeDeploy to create a canary deployment for the Lambda function.

Answer

Use API Gateway canary release deployment to shift traffic to the new Lambda version.

Answer

Configure the Lambda function alias with traffic shifting using weights.

Question 15

A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store (SecureString) [CORRECT] is right because it stores sensitive values like database credentials as encrypted parameters using KMS, and a Lambda function can retrieve them programmatically via the GetParameter API with the WithDecryption flag set to true. AWS Secrets Manager [CORRECT] is also right because it is purpose-built for storing and rotating secrets such as database credentials, and Lambda can retrieve them programmatically using the GetSecretValue API. AWS CloudFormation does not belong because it is an infrastructure-as-code service for provisioning resources, not a secrets store for runtime retrieval. AWS Identity and Access Management (IAM) does not belong because it manages permissions and identities, not the storage of credential values themselves. Amazon S3 does not belong because it is object storage and, while it can hold files, it is not designed as a secure credential store with native secret-retrieval APIs for this use case.

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 16

A developer wants to ensure that an S3 bucket is not publicly accessible. Which TWO measures should the developer implement?

Accepted Answer

Review the bucket policy to ensure it does not allow public access.. Option D is correct because the bucket policy is the resource-based policy that can explicitly grant public access (for example, a Principal of "*" with s3:GetObject), so reviewing it to confirm it does not allow public access is a direct way to prevent the bucket from being publicly accessible. Option E is correct because S3 Block Public Access settings, when enabled on the bucket, override any bucket policy or ACL that would otherwise make objects public, providing a strong account- or bucket-level safeguard against public exposure. Option A is incorrect because S3 server access logging only records requests made to the bucket for auditing purposes; it does not restrict or prevent public access. Option B is incorrect because versioning preserves multiple versions of objects for recovery and rollback, but it has no effect on whether the bucket or its objects are publicly accessible. Option C is incorrect because default encryption protects data at rest but does not control who can access the objects, so it does not prevent public accessibility.

Answer

Enable S3 server access logging.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 17

A development team is using AWS Elastic Beanstalk to deploy a web application. The team wants to perform a blue/green deployment. Which THREE steps are required to complete the blue/green deployment?

Accepted Answer

Swap the CNAMEs of the two environments.. Elastic Beanstalk blue/green deployment requires creating a completely new environment rather than updating the existing one, so option E (deploy the new application version to a separate Elastic Beanstalk environment) is correct because the new version must run in its own environment alongside the original. Option B (swap the CNAMEs of the two environments) is correct because Elastic Beanstalk's Swap Environment URLs feature exchanges the CNAMEs so that the environment URL users already use now resolves to the new environment, redirecting traffic without DNS changes. Option C (terminate the old environment after verifying the new environment) is correct because once the swap is validated and the new environment is healthy, the original environment is no longer needed and should be terminated to avoid unnecessary resource charges. Option A is incorrect because updating the existing environment in place is a rolling/all-at-once deployment, not blue/green, and would not provide an instant rollback path. Option D is incorrect because Elastic Beanstalk blue/green uses the built-in CNAME swap rather than manually editing a Route 53 DNS record.

Answer

Update the existing environment with the new version.

Answer

Update the Route 53 DNS record to point to the new environment.

Question 18

Which THREE are valid methods to authenticate to AWS APIs? (Choose 3)

Accepted Answer

Temporary security credentials from AWS STS. Option A is correct because AWS STS issues temporary security credentials (access key ID, secret access key, and session token) via APIs like AssumeRole, GetSessionToken, or GetFederationToken, and these credentials are accepted by AWS APIs for signing requests with SigV4. Option C is correct because an EC2 instance profile delivers temporary IAM role credentials to the instance through the Instance Metadata Service (IMDS), which the AWS SDK and CLI automatically use to sign API calls. Option E is correct because a long-term IAM user access key ID and secret access key are the classic SigV4 signing credentials used to authenticate programmatic requests to AWS APIs. Option B is not a valid AWS API authentication method because a database password in Secrets Manager is a secret for connecting to a database, not an AWS credential, even though Secrets Manager itself is accessed using AWS credentials. Option D is not valid because a CloudFront key pair is used to create signed URLs or signed cookies for private content distribution, not to authenticate requests to AWS service APIs.

Answer

Database password stored in Secrets Manager

Answer

CloudFront key pair

Question 19

Which THREE are best practices for managing IAM users and roles? (Choose three.)

Accepted Answer

Rotate IAM user access keys periodically.. Option A is correct because periodically rotating IAM user access keys limits the window of exposure if a key is compromised, and AWS best practices recommend key rotation (for example, via the IAM console or aws iam create-access-key/update-access-key/delete-access-key). Option B is correct because granting least privilege means attaching only the minimal IAM policies and permissions required for a principal's task, reducing the blast radius of accidental or malicious actions. Option C is correct because EC2 instances should assume an IAM role through instance profiles and the Instance Metadata Service (IMDS) to obtain temporary credentials via AWS STS, eliminating long-lived access keys stored on the instance. Option D is not correct because the root account should be used only for a few account-level tasks, protected with MFA, and never for daily administration. Option E is not correct because assigning full administrator access to all users violates least privilege and dramatically increases security risk.

Answer

Use the root account for daily administrative tasks.

Answer

Assign full administrator access to all users.

Question 20

Which TWO actions are recommended to secure an S3 bucket? (Choose 2)

Accepted Answer

Block public access at the bucket level. Option A is correct because enabling S3 Block Public Access at the bucket level overrides any bucket policy or ACL that would otherwise grant public access, preventing accidental exposure of objects. Option D is correct because enabling default encryption (SSE-S3, SSE-KMS, or SSE-C) ensures all objects are encrypted at rest automatically, protecting data even if storage media is compromised. Option B is wrong because disabling versioning reduces recoverability from accidental deletes or overwrites and is not a security best practice. Option C is wrong because HTTP transmits data in plaintext; HTTPS (TLS) should always be used to protect data in transit. Option E is wrong because granting public read access via ACLs exposes objects to anyone on the internet, directly undermining bucket security.

Answer

Disable versioning to reduce complexity

Answer

Use HTTP instead of HTTPS for faster access

Answer

Grant public read access via ACLs