DVA-C02 Mock Exam 71 — 25 Questions

Question 1

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. Option A is correct because CodeDeploy requires an IAM service role (the CodeDeploy service role) that grants it permissions to perform actions on the developer's behalf, such as reading tags, accessing S3 revision bundles, and calling EC2 Auto Scaling APIs to manage instances during deployment. Option E is correct because the CodeDeploy agent must be installed and running on each EC2 instance in the Auto Scaling group so the instance can poll CodeDeploy, receive the revision, and execute the deployment lifecycle event hooks (ApplicationStop, BeforeInstall, AfterInstall, ApplicationStart, ValidateService). Option B is not required because an Application Load Balancer is only needed for load-balanced or blue/green scenarios, not for a basic in-place deployment to an Auto Scaling group. Option C is incorrect because Application Discovery Service is used for migration planning and discovery, not for CodeDeploy deployments. Option D is not required because CodeDeploy supports in-place deployments to Auto Scaling groups, so blue/green is optional rather than mandatory.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 2

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option A is correct because AWS Secrets Manager is purpose-built for storing and rotating secrets such as RDS database credentials, and the application can retrieve them at runtime via the AWS SDK using IAM permissions, so the credentials never appear in code or environment variables. Option D is correct because AWS Systems Manager Parameter Store supports the SecureString parameter type, which encrypts values with AWS KMS and allows retrieval at runtime through IAM-controlled API calls, keeping credentials out of the application code and environment variables. Option B is not appropriate because an S3 object, even with server-side encryption, is not a dedicated secrets-management service and would still require custom retrieval logic and careful access controls to avoid exposure. Option C is wrong because hardcoding credentials in a configuration file directly exposes them in source control and deployment artifacts. Option E is wrong because Elastic Beanstalk environment variables are visible in the console and configuration and are explicitly what the scenario wants to avoid.

Answer

Store credentials in an Amazon S3 bucket with server-side encryption.

Answer

Hardcode credentials in the application configuration file.

Answer

Store credentials as environment variables in the Elastic Beanstalk environment.

Question 3

A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?

Accepted Answer

SSE-C. SSE-C (option A) is a valid server-side encryption option where the customer supplies their own encryption keys to S3, and S3 performs the encryption/decryption on the server side while the customer retains the keys. SSE-KMS (option C) is correct because S3 uses AWS KMS customer master keys (CMKs) to generate and manage the data keys used for server-side encryption, giving audit and control benefits. SSE-S3 (option D) is also correct because S3 fully manages the encryption keys with AES-256, providing server-side encryption without any key management effort from the customer. Option B (client-side encryption) is not a server-side option since the data is encrypted before it reaches S3, and option E (AWS CloudHSM) is a hardware security module service, not an S3 server-side encryption mode, although it can be used indirectly with SSE-C or custom key management.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 4

A developer is tasked with securing a legacy application that stores secrets in environment variables. Which THREE AWS services can be used to improve the security posture?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) (A) is correct because it provides managed encryption keys that can be used to encrypt secrets at rest, and it integrates with services like Secrets Manager and Parameter Store to protect the underlying data with customer master keys (CMKs). AWS Systems Manager Parameter Store (D) is correct because it offers a centralized, secure store for configuration data and secrets, supports SecureString parameters encrypted via KMS, and can be referenced by applications instead of hardcoding values in environment variables. AWS Secrets Manager (E) is correct because it is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys, with native KMS encryption and fine-grained IAM access control. AWS Certificate Manager (B) is not correct because it manages and provisions TLS/SSL certificates for services like ELB and CloudFront, not application secrets. AWS CloudHSM (C) is not correct because it provides dedicated hardware security modules for cryptographic operations and key storage, but it is not a secrets management service for replacing environment-variable-stored secrets.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 5

A developer wants to securely store database credentials used by a Lambda function. The credentials should be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It supports native rotation with built-in integration for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB) and Amazon DocumentDB, allowing you to configure automatic rotation every 90 days without custom code. The service encrypts secrets at rest using AWS KMS and enforces fine-grained access control via IAM policies.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 6

Given the IAM policy above, what is the effective permission for an IAM user?

Accepted Answer

Read-only access to the bucket.. The IAM policy grants only s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, and explicitly denies s3:DeleteObject. Since no write permissions (e.g., s3:PutObject) are granted, the effective permission is read-only access (list and get) with delete explicitly denied. Therefore, the user has read-only access to the bucket, not full access.

Answer

No access to the bucket.

Answer

Full access to the bucket including delete.

Answer

Full access to the bucket except delete.

Question 7

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Accepted Answer

An SCP at the organization level denies s3:GetObject.. Option A is correct because AWS Organizations service control policies (SCPs) act as permissions guardrails that limit the maximum permissions for accounts in the organization; an SCP that denies s3:GetObject overrides the account-level IAM allow, producing Access Denied. Option C is correct because an explicit Deny in any attached IAM policy (identity-based) always wins over an Allow in the same or another policy, so a deny statement for s3:GetObject on the user's role blocks the action. Option E is correct because S3 bucket policies are resource-based policies evaluated alongside IAM policies, and an explicit Deny in the bucket policy for that user (or principal) overrides the account's Allow, resulting in Access Denied. Option B is not correct because using an incorrect regional endpoint typically causes connection or redirect errors (e.g., 301/PermanentRedirect), not an authorization Access Denied for a valid request. Option D is not correct because cross-account access is possible when the bucket policy grants permission to the external principal; being in a different account alone does not cause Access Denied.

Answer

The user is using an incorrect region endpoint.

Answer

The S3 bucket is in a different AWS account.

Question 8

Which TWO actions can help reduce latency for a web application hosted on EC2 instances behind an Application Load Balancer? (Select TWO.)

Accepted Answer

Use Amazon CloudFront as a content delivery network.. Option B is correct because Amazon CloudFront caches content at edge locations closer to end users, reducing round-trip time and offloading requests from the ALB and EC2 origin, which directly lowers latency for the web application. Option E is correct because ALBs natively support HTTP/2, and enabling it allows multiplexed streams over a single TCP connection, reducing connection overhead and improving page load latency for clients. Option A is not necessarily correct because a larger instance type increases compute capacity but does not inherently reduce network latency. Option C is incorrect because disabling keep-alive forces new TCP/TLS handshakes per request, increasing latency. Option D is incorrect because using multiple Availability Zones improves availability and fault tolerance, not latency.

Answer

Increase the EC2 instance size to a larger type.

Answer

Disable keep-alive connections on the ALB.

Answer

Use multiple Availability Zones for the ALB.

Question 9

A developer is troubleshooting an EC2 instance that is unreachable via SSH. The instance is in a public subnet with a security group that allows inbound SSH from 0.0.0.0/0. Which THREE are possible causes? (Choose 3.)

Accepted Answer

The network ACL associated with the subnet is blocking inbound SSH.. Option A is correct because a network ACL is a stateless subnet-level firewall, so even if the security group allows inbound TCP port 22 from 0.0.0.0/0, an NACL rule denying inbound SSH (and the corresponding outbound ephemeral ports) will block the connection. Option C is correct because an EC2 instance in the 'stopped' state has no running OS or network stack, so SSH cannot be served regardless of subnet, security group, or IP configuration. Option E is correct because an instance in a public subnet is only reachable from the internet if it has a public IPv4 address (or an Elastic IP); without one, external SSH clients have no routable destination. Option B is not a valid cause here because an incorrect SSH key pair would cause authentication failure after the TCP connection is established, not make the instance unreachable. Option D is not a valid cause because IAM roles govern AWS API permissions, not inbound SSH access to the instance's operating system.

Answer

The SSH key pair used to launch the instance is incorrect.

Answer

The instance does not have an IAM role with the necessary permissions.

Question 10

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)

Accepted Answer

Encryption at rest can be enabled when you create the DB instance.. Option B is correct because RDS encryption at rest is configured at creation time: when you launch the DB instance you select an AWS KMS customer master key (CMK), and RDS uses it to encrypt the underlying storage, logs, and snapshots. Option C is correct because any DB snapshot taken from an encrypted instance is automatically encrypted with the same KMS key, so copies and restores of that snapshot remain encrypted. Option D is correct because automated backups of an encrypted DB instance are encrypted with the same KMS key as the instance, as are manual snapshots and read replicas. Option A is not correct because you cannot enable encryption on an existing unencrypted instance in place; you must create an encrypted snapshot copy or restore into a new encrypted instance. Option E is not correct because a read replica of an encrypted instance must also be encrypted with the same KMS key; you cannot create an unencrypted read replica from an encrypted source.

Answer

Encryption at rest can be enabled on an existing unencrypted DB instance.

Answer

Read replicas of an encrypted instance can be unencrypted.

Question 11

A developer is using AWS X-Ray to trace requests through a microservices application. The developer notices that some traces are incomplete. Which TWO actions can help ensure complete traces?

Accepted Answer

Use the X-Ray SDK to instrument the application code.. Option A is correct because the X-Ray SDK must be used to instrument the application code so that it emits segment data and propagates trace headers across service calls; without instrumentation, downstream services cannot contribute subsegments and traces remain incomplete. Option E is correct because the X-Ray daemon must be running on every EC2 instance (or equivalent compute) to receive UDP segment data from the SDK on port 2000 and forward it to the X-Ray API; a missing daemon on any instance means those segments are dropped, producing incomplete traces. Option B is not correct because opening port 2000 in a security group is not required for the daemon to receive local UDP traffic from the SDK on the same host, and it does not by itself fix incomplete traces. Option C is not correct because the X-Ray daemon is designed to run locally on each instance (or as a sidecar/daemon set), not as a single centralized service, so centralizing it would not ensure all instances' segments are captured. Option D is not correct because the CloudWatch agent collects metrics and logs, not X-Ray trace segments, so it does not contribute to complete X-Ray traces.

Answer

Open port 2000 on the security groups for TCP traffic.

Answer

Deploy the X-Ray daemon as a centralized service in a separate instance.

Answer

Install the CloudWatch agent on all instances.

Question 12

Which THREE steps should a developer include in a CI/CD pipeline to deploy a serverless application using AWS SAM? (Choose three.)

Accepted Answer

Run 'sam build' to prepare the application. Option A is correct because 'sam build' compiles dependencies and prepares the application artifacts in the .aws-sam/build directory, which is the required first step before packaging or deploying a SAM application. Option C is correct because 'sam deploy' creates or updates the CloudFormation stack that provisions the serverless resources (Lambda functions, API Gateway, IAM roles, etc.) defined in the SAM template. Option E is correct because 'sam package' uploads the built artifacts to an S3 bucket and rewrites the template with the S3 locations, which is necessary for CloudFormation to access the code during deployment (in newer SAM CLI versions this is handled automatically by 'sam deploy --guided', but 'sam package' remains the explicit packaging step). Option B is incorrect because API Gateway stages are defined declaratively in the SAM template and created automatically by CloudFormation during deployment, not configured manually. Option D is incorrect because traffic shifting via Lambda aliases is an optional deployment preference configured in the SAM template (e.g., DeploymentPreference with Canary/Linear), not a manual 'aws lambda update-alias' command in the pipeline.

Answer

Manually configure API Gateway stages

Answer

Run 'aws lambda update-alias' to shift traffic

Question 13

Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)

Accepted Answer

Define fine-grained permissions with policies. Option C is correct because IAM's core purpose is to define fine-grained permissions using JSON policy documents that specify which principals can perform which actions on which resources under which conditions. Option E is correct because IAM natively provides identity management, allowing you to create and manage IAM users, groups, and roles, and attach policies to them for access control. Option A is incorrect because automatic S3 object encryption is a feature of Amazon S3 (e.g., SSE-S3, SSE-KMS, or default bucket encryption), not IAM. Option B is incorrect because network traffic monitoring is handled by services such as VPC Flow Logs, CloudWatch, or GuardDuty, not IAM. Option D is incorrect because EC2 instance lifecycle management is performed through EC2, Auto Scaling, or EC2 Instance Lifecycle policies, not IAM.

Answer

Encrypt S3 objects automatically

Answer

Monitor network traffic

Answer

Manage EC2 instance lifecycle

Question 14

A company uses AWS CodeBuild to compile and test a Java application. The build process takes a long time because dependencies are downloaded every time. Which TWO actions can reduce build time? (Choose TWO.)

Accepted Answer

Enable local caching in the CodeBuild project to reuse dependency files between builds.. Option D is correct because enabling local caching in the CodeBuild project (e.g., LOCAL_SOURCE_CACHE, LOCAL_DOCKER_LAYER_CACHE, or a local cache for dependency directories) lets CodeBuild retain downloaded dependencies on the build host between builds, so Maven/Gradle artifacts are not re-downloaded each time, directly cutting build duration. Option E is correct because CodeBuild supports S3 caching, where dependency files (such as the Maven ~/.m2 or Gradle ~/.gradle directories) are uploaded to an S3 bucket after a build and restored at the start of subsequent builds, eliminating repeated downloads even across fresh hosts. Option A is not correct because increasing compute type only adds CPU/memory and does not address the network-bound dependency download bottleneck, so it does not reliably reduce the time spent fetching dependencies. Option B is not correct because changing the build runtime to a 'faster-compiling language' is not applicable—the application is Java and the runtime must support Java compilation. Option C is not correct because running builds in parallel increases throughput of multiple builds but does not shorten the duration of an individual build's dependency download phase.

Answer

Increase the compute type of the build environment to have more CPU and memory.

Answer

Change the build runtime to a language that compiles faster.

Answer

Configure the build project to run builds in parallel.

Question 15

A company is deploying a critical application using AWS CodeDeploy. To minimize downtime, they want to perform a blue/green deployment. Which TWO strategies should they implement?

Accepted Answer

Create an Elastic Load Balancer to route traffic between the blue and green environments.. Option A is correct because AWS CodeDeploy blue/green deployments for EC2/on-premises rely on an Elastic Load Balancer (ALB or CLB) to route production traffic to either the blue (original) or green (replacement) environment, enabling an instant cutover with minimal downtime. Option E is correct because the replacement instances must be registered with the load balancer's target group and pass health checks before CodeDeploy shifts traffic, ensuring the green environment is healthy and avoiding failed requests during the switch. Option B is not appropriate because CodeDeploy blue/green traffic shifting is handled by the load balancer's listener/target groups, not by a Route 53 weighted routing policy, which is used for DNS-level traffic distribution. Option C is incorrect because A/B testing is a separate deployment configuration concept and a Lambda function is not required to perform the blue/green cutover. Option D is incorrect because CloudFront with multiple origins is a content-delivery/caching pattern, not the mechanism CodeDeploy uses to shift traffic between blue and green environments.

Answer

Use an Amazon Route 53 weighted routing policy to gradually shift traffic.

Answer

Configure an AWS Lambda function to perform A/B testing during deployment.

Answer

Use an Amazon CloudFront distribution with multiple origins.

Question 16

A development team uses AWS Elastic Beanstalk to deploy a web application. They want to perform a blue/green deployment to minimize downtime. What should they do to implement this?

Accepted Answer

Create a new environment, deploy the new version, and then swap the environment URLs.. Blue/green deployment in Elastic Beanstalk is achieved by creating a separate environment (the green environment) with the new application version, then swapping the CNAME records (URLs) of the two environments. This instantly routes traffic from the old (blue) environment to the new (green) environment with zero downtime, and allows quick rollback by swapping back.

Answer

Create an Auto Scaling group and manually replace instances.

Answer

Update the existing environment with the new version and set the deployment policy to 'Rolling'.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the EC2 instances.

Question 17

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application uses environment variables for database credentials. What is the BEST way to securely provide these credentials to the application?

Accepted Answer

Set environment properties in the Elastic Beanstalk environment configuration.. Elastic Beanstalk allows you to set environment properties in the environment configuration, which are injected as environment variables into the application's runtime. This approach keeps sensitive credentials out of the source code and deployment artifacts, adhering to the principle of least privilege and secure credential management. For a Node.js application, these environment variables can be accessed via `process.env`, providing a secure and flexible way to manage database credentials without hardcoding or storing them in files.

Answer

Store the credentials in a file in the source code repository.

Answer

Store the credentials in the application's configuration file within the deployment package.

Answer

Hardcode the credentials in the application code.

Question 18

A developer manages a web application deployed on an AWS Elastic Beanstalk environment with multiple Amazon EC2 instances. The developer needs to deploy a new version of the application with zero downtime. The new version requires a different instance type and additional software packages. Which deployment strategy should the developer use?

Accepted Answer

Immutable. Immutable deployment is the only strategy that supports changing instance types and other configuration settings while maintaining zero downtime. It creates a full new set of instances with the new configuration, then swaps them in. Other strategies either cause downtime or cannot alter the environment's instance type.

Answer

Rolling

Answer

All at once

Answer

Rolling with additional batch

Question 19

A developer is building a serverless application that uses Amazon Cognito user pools for authentication and an Amazon API Gateway REST API with a Lambda authorizer. The developer needs to ensure that the Lambda authorizer can validate tokens and return an IAM policy that allows access to specific API methods. The developer also wants to cache the authorizer result to reduce latency and cost. Which TWO actions must the developer take to meet these requirements? (Choose two.)

Accepted Answer

Configure the Lambda authorizer with a token source header, such as Authorization, and set the authorizer type to TOKEN.. To use a Lambda authorizer with a token source, the authorizer must be configured with the correct token source header and type TOKEN. Enabling authorization caching with a TTL reduces repeated Lambda invocations and latency. These two configurations together satisfy the validation and caching requirements. The authorizer must return a valid IAM policy, not a boolean, and does not require apigateway:Invoke permissions.

Answer

Use an AWS Lambda function that returns a boolean value indicating whether the token is valid.

Answer

Configure the API Gateway method to use AWS_IAM authorization instead of the Lambda authorizer.

Answer

Attach an IAM execution role to the Lambda authorizer that grants apigateway:Invoke permissions.

Question 20

A developer is writing a Lambda function that processes messages from an Amazon SQS queue. The function must ensure that if a message fails to process, it is retried later without blocking other messages. The queue is a standard queue. Which configuration should the developer use?

Accepted Answer

Use a Lambda event source mapping with a batch size greater than 1 and enable partial batch responses by returning batchItemFailures.. For standard queues, Lambda event source mappings support partial batch responses. When the function returns a batchItemFailures list, Lambda marks only those messages as failed, deletes the rest, and allows the failed messages to be retried according to the queue's visibility timeout and redrive policy.

Answer

Configure a dead-letter queue on the SQS queue and set maxReceiveCount to 1.

Answer

Set the SQS queue's visibility timeout to 0 seconds so failed messages become immediately visible again.

Answer

Configure the Lambda event source mapping with a batch size of 1 and set the maximumBatchingWindowInSeconds to 0.