DVA-C02 Mock Exam 88 — 25 Questions

Question 1

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The developer wants to update the stack to change the DB instance class. The update fails because CloudFormation cannot modify the DB instance class without replacement. The developer needs to complete the update with minimal downtime. What should the developer do?

Accepted Answer

Use a custom resource with an AWS Lambda function to perform the modification, ensuring data is backed up and downtime is minimized.. Option B is correct because a custom resource backed by an AWS Lambda function allows you to perform the RDS DB instance class modification outside of CloudFormation's direct lifecycle, enabling you to use the 'ApplyImmediately' parameter to minimize downtime. CloudFormation's native update for RDS DB instance class requires replacement (i.e., a new physical resource), which causes downtime; a custom resource can orchestrate a 'modify-db-instance' API call with '--apply-immediately' to change the class in-place with only a brief reboot.

Answer

Delete the stack and create a new stack with the new DB instance class.

Answer

Update the stack and disable rollback on failure.

Answer

Update the stack using a change set, then execute it.

Question 2

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'ScriptMissing' during the BeforeInstall lifecycle event. What is the most likely cause?

Accepted Answer

The script file specified in the appspec.yml for the BeforeInstall hook is not present on the instance. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment failed because a script file referenced in the appspec.yml for a lifecycle event (in this case, BeforeInstall) could not be found on the EC2 instance. CodeDeploy expects the script to be present at the specified path after the archive is extracted; if the file is missing or the path is incorrect, the agent reports this error. Option B correctly identifies that the script file is not present on the instance.

Answer

The BeforeInstall lifecycle event is not defined in the appspec.yml

Answer

The CodeDeploy agent on the instance is not running

Answer

The instance does not have the necessary permissions to execute the script

Question 3

A company uses AWS CloudFormation to deploy infrastructure. The development team wants to update a stack that includes an Amazon RDS database. The update requires changing the DB instance class, which will cause a brief downtime. The team wants to minimize downtime by creating a new database instance before deleting the old one. Which CloudFormation stack update policy should be used?

Accepted Answer

Use an 'UpdatePolicy' attribute with 'AutoScalingReplacingUpdate' set to true.. Option D is correct because the 'AutoScalingReplacingUpdate' update policy directs CloudFormation to create a new resource (in this case, an RDS DB instance) before deleting the old one, enabling a rolling replacement that minimizes downtime. This policy is specifically designed for resources that support replacement updates, allowing the new instance to be provisioned and traffic shifted before the old instance is terminated.

Answer

Use a 'DeletionPolicy' attribute set to 'Delete' for the RDS instance.

Answer

Use a 'DeletionPolicy' attribute set to 'Snapshot' for the RDS instance.

Answer

Use an 'UpdatePolicy' attribute with 'UseOnlineResharding' set to true.

Question 4

A company is deploying a critical application using AWS Elastic Beanstalk. The application experiences occasional spikes in traffic. The company wants to ensure that the environment scales automatically and that deployments are rolled back if health checks fail. Which TWO configurations should be used together to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Auto Scaling group to scale based on the average request count per instance.. Option B is correct because configuring the Auto Scaling group to scale based on the average request count per instance allows the environment to automatically add or remove instances in response to traffic spikes, ensuring dynamic scaling. Option D is correct because rolling updates with a batch size of 50% update instances in batches and automatically roll back the deployment if health checks fail, meeting the rollback requirement. Together, these configurations provide both automatic scaling and safe, self-healing deployments.

Answer

Use a blue/green deployment policy.

Answer

Set the environment's capacity to a fixed number of instances.

Answer

Enable immutable updates for the environment.

Question 5

A developer is troubleshooting a CloudFormation stack that fails to create. The stack includes an Auto Scaling group with a launch template. The error message says 'Value (null) for parameter groupId is invalid.' What is the MOST likely cause?

Accepted Answer

The launch template references a SecurityGroupId parameter that is not provided or is misspelled.. The error 'Value (null) for parameter groupId is invalid' indicates that a SecurityGroupId parameter referenced in the launch template is either not provided or misspelled. CloudFormation resolves parameters at stack creation; if the parameter is missing or has a typo, it evaluates to null, causing the launch template to fail validation because a security group ID is required for the network interface.

Answer

The Auto Scaling group does not specify a VPC subnet.

Answer

The Auto Scaling group's user data script contains a syntax error.

Answer

The launch template specifies an invalid key pair name.

Question 6

A company uses AWS CloudFormation to manage infrastructure. The development team wants to implement a CI/CD pipeline that automatically updates a CloudFormation stack when code is pushed to a CodeCommit repository. The pipeline should also run tests before deploying. Which THREE services should be used together to achieve this? (Choose THREE.)

Accepted Answer

AWS CodeBuild. AWS CodeBuild is correct because it can compile source code, run tests, and produce artifacts that are ready for deployment. In this CI/CD pipeline, CodeBuild executes the test suite after code is pushed to CodeCommit, ensuring that only validated code proceeds to update the CloudFormation stack.

Answer

Amazon CloudWatch Events

Answer

AWS CodeDeploy

Question 7

Refer to the exhibit. A CloudFormation template creates an S3 bucket with a 'Retain' deletion policy and an EC2 instance. If the stack is deleted, what happens to the S3 bucket?

Accepted Answer

The S3 bucket is retained and must be deleted manually.. Option D is correct because the 'Retain' deletion policy on the S3 bucket overrides the default stack deletion behavior. When a CloudFormation stack is deleted, any resource with a 'DeletionPolicy' set to 'Retain' is preserved in the AWS account, even though the resource is removed from the stack's template. The bucket continues to exist independently and must be manually deleted by the user via the AWS Management Console, CLI, or SDK.

Answer

The S3 bucket is deleted along with the stack.

Answer

The S3 bucket is moved to a different account.

Answer

A snapshot of the S3 bucket is taken before deletion.

Question 8

A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application uses environment variables for database credentials. What is the BEST way to securely provide these credentials to the application?

Accepted Answer

Set environment properties in the Elastic Beanstalk environment configuration.. Option D is correct because Elastic Beanstalk allows you to set environment properties in the environment configuration, which are injected as environment variables into the application's runtime. This approach keeps sensitive credentials out of the source code and deployment artifacts, adhering to the principle of least privilege and secure credential management. For a Node.js application, these environment variables can be accessed via `process.env`, providing a secure and flexible way to manage database credentials without hardcoding or storing them in files.

Answer

Store the credentials in a file in the source code repository.

Answer

Store the credentials in the application's configuration file within the deployment package.

Answer

Hardcode the credentials in the application code.

Question 9

A development team uses AWS CodePipeline to automate deployments. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy. After a recent change, the deploy stage fails intermittently with a timeout error. The CodeBuild stage succeeds. What should the team do to troubleshoot the issue?

Accepted Answer

Increase the timeout value in the CodeDeploy deployment configuration.. Option D is correct because the intermittent timeout error in the deploy stage, despite a successful build, indicates that the CodeDeploy agent is taking longer than the configured timeout to complete the deployment lifecycle events (e.g., BeforeInstall, AfterInstall, ApplicationStart). Increasing the timeout value in the CodeDeploy deployment configuration gives the agent more time to finish these operations, which directly addresses the timeout failure without altering the build or permissions.

Answer

Ensure the deployment group is configured to use the correct Auto Scaling group.

Answer

Verify that the CodeDeploy service role has sufficient permissions.

Answer

Check the buildspec.yml file for syntax errors.

Question 10

A developer is using AWS CodeDeploy to deploy an application to EC2 instances. The developer wants to ensure that the deployment stops if any instance fails to install the application. Which TWO CodeDeploy settings should be configured to achieve this? (Choose TWO.)

Accepted Answer

Set the 'IgnoreApplicationStopFailures' option to false in the deployment configuration.. Option B is correct because setting 'IgnoreApplicationStopFailures' to false ensures that if the application stop hook fails on any instance, the deployment stops immediately rather than continuing. This prevents the deployment from proceeding when an instance cannot properly stop the existing application, which could lead to conflicts or corrupted states.

Answer

Set the 'DeploymentStyle' to 'BLUE_GREEN'.

Answer

Configure the 'LoadBalancerInfo' to include the target group.

Answer

Configure the 'RevisionLocation' to point to an S3 bucket.

Question 11

A company uses AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Accepted Answer

The new application version fails the configured health checks on the instances.. The error message indicates that instances failed deployment, which is most commonly caused by the new application version failing the health checks configured in the deployment group. CodeDeploy uses these health checks (e.g., ELB health checks or custom scripts) to determine if an instance is healthy after deployment; if the application crashes or returns non-200 status codes, CodeDeploy marks the instance as failed and aborts the deployment.

Answer

The deployment group does not exist.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Answer

The CodeDeploy agent is not installed on the instances.

Question 12

A large enterprise is deploying a critical application across multiple AWS regions using AWS CodePipeline and AWS CodeDeploy. The application runs on EC2 instances in an Auto Scaling group. The deployment uses a blue/green strategy. During a cross-region deployment, the pipeline fails in the secondary region with the error 'The deployment group does not exist.' The developer confirms that the deployment group exists in the primary region and has been replicated via AWS CloudFormation StackSets. The developer also checks that the StackSet is successfully deployed in the secondary region. What is the most likely cause?

Accepted Answer

The CodePipeline in the secondary region references the deployment group ARN from the primary region instead of the secondary region.. Option D is correct because CodePipeline is region-specific and the pipeline in the secondary region must be configured to use the deployment group in that same region. The StackSet may have created the resources, but the pipeline definition still points to the primary region. Option A is wrong because the deployment group does exist. Option B is wrong because the pipeline exists. Option C is wrong because permissions are global.

Answer

The deployment group name is case-sensitive and differs between regions.

Answer

The CodePipeline in the secondary region is not configured with the correct source stage.

Answer

The IAM role for CodeDeploy in the secondary region does not have cross-region permissions.

Question 13

A company is using AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The application is deployed to an Auto Scaling group of EC2 instances. Recently, a deployment failed because the CodeDeploy agent on one of the instances was not running. The developer wants to ensure that the CodeDeploy agent is always running on all instances. What is the MOST efficient solution?

Accepted Answer

Modify the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent.. Option B is correct because using an EC2 user data script to install and start the CodeDeploy agent ensures it runs on instance launch. Option A is wrong because manual restart is not efficient. Option C is wrong because CloudWatch does not restart agents; it can only monitor. Option D is wrong because Systems Manager Run Command can fix the issue after detection, but user data is proactive.

Answer

Use AWS CloudTrail to monitor the CodeDeploy agent status and trigger an AWS Lambda function to restart it.

Answer

Configure a CloudWatch alarm to detect when the CodeDeploy agent is not running and restart it automatically.

Answer

Use AWS Systems Manager Run Command to run a script that checks and restarts the CodeDeploy agent on a schedule.

Question 14

A developer is building a mobile backend using Amazon API Gateway and AWS Lambda. The API has a single endpoint that accepts POST requests with a JSON payload and stores the data in an Amazon DynamoDB table. The developer wants to implement caching to reduce latency and costs. The data is user-specific and should not be shared between users. The developer configures API Gateway caching with a TTL of 300 seconds. After testing, the developer notices that users are seeing other users' data. What should the developer do to fix this issue?

Accepted Answer

Enable cache key parameters in API Gateway, such as the Authorization header.. Option C is correct because enabling cache keys for headers like Authorization ensures cached responses are per-user. Option A is wrong because disabling caching removes benefits. Option B is wrong because DynamoDB is for storage, not caching. Option D is wrong because Lambda@Edge is for CloudFront, not API Gateway caching.

Answer

Store cached responses in DynamoDB and retrieve them based on user ID.

Answer

Use Lambda@Edge to cache responses at the CloudFront level.

Answer

Disable API Gateway caching and use DynamoDB Accelerator (DAX) instead.

Question 15

A company is using Amazon DynamoDB as the database for a web application. The application reads and writes items based on a primary key. The traffic pattern shows that reads are 10 times more frequent than writes. The development team wants to reduce read latency and costs. They are considering adding a cache layer. The data is not sensitive, but stale data is acceptable for up to 5 minutes. The application runs on EC2 instances. What should the team do to implement caching?

Accepted Answer

Set up an Amazon ElastiCache Memcached cluster and update the application to check the cache before reading from DynamoDB.. Option D is correct because Amazon ElastiCache with Memcached provides a distributed cache that is suitable for read-heavy workloads and handles frequent reads. Option A is incorrect because DAX is a DynamoDB accelerator that is tightly coupled with DynamoDB and may be overkill. Option B is incorrect because CloudFront is for content delivery, not for caching database queries. Option C is incorrect because S3 is not suitable for low-latency caching of database items.

Answer

Use Amazon DynamoDB Accelerator (DAX) as a caching layer.

Answer

Store frequently accessed items in an S3 bucket and read from S3.

Answer

Use Amazon CloudFront to cache responses from the application.

Question 16

A developer wants to deploy a static website to AWS. The website content is stored in an S3 bucket. Which combination of actions is required to host the website? (Choose TWO.)

Accepted Answer

Enable static website hosting on the S3 bucket.. Option A and D are correct because enabling static website hosting and making objects publicly readable are required. Option B is wrong because CloudFront is optional. Option C is wrong because bucket policy is not required if ACLs are used. Option E is wrong because logging is optional.

Answer

Enable server access logging.

Answer

Set a bucket policy that restricts access to a specific IP.

Answer

Configure Amazon CloudFront as a CDN.

Question 17

A company runs a containerized application on Amazon ECS using Fargate. The application needs to access an S3 bucket to read configuration files and a DynamoDB table to store session state. The ECS task role is configured with the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "dynamodb:PutItem",
        "dynamodb:GetItem"
      ],
      "Resource": "*"
    }
  ]
}

The application fails to read from the S3 bucket and write to DynamoDB. The error messages indicate AccessDenied. The S3 bucket has a bucket policy that denies all access unless the request includes a specific aws:SourceIp condition. The DynamoDB table has a resource-based policy that allows access only from the VPC endpoint. The ECS tasks are running in a private subnet with a VPC endpoint for DynamoDB but no VPC endpoint for S3. Which action should be taken to resolve the errors?

Accepted Answer

Create a VPC endpoint for S3 and modify the S3 bucket policy to allow access from the VPC endpoint. The application fails because the S3 bucket policy denies access unless the request includes a specific `aws:SourceIp` condition, but the ECS tasks in a private subnet have no public IP and no VPC endpoint for S3. Without a VPC endpoint, traffic to S3 traverses the internet via a NAT gateway, but the bucket policy explicitly requires a specific source IP, which the NAT gateway's public IP does not match (or is not allowed). Option D resolves this by creating a VPC endpoint for S3 and modifying the bucket policy to allow access from the VPC endpoint, bypassing the IP condition and enabling private connectivity.

Answer

Add s3:ListBucket to the task role policy and ensure the S3 bucket policy allows the task role ARN

Answer

Attach a NAT gateway to the private subnet and update the S3 bucket policy to allow the NAT gateway's public IP

Answer

Modify the task role policy to restrict resource ARNs to the specific S3 bucket and DynamoDB table

Question 18

A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.. Option B is correct because AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.

Answer

Encrypt the configuration file using AWS KMS and store the encrypted file on S3.

Answer

Store the credentials in environment variables on the EC2 instance.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.

Question 19

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. Option B is correct because AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 20

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

Accepted Answer

Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.. Option C is correct because a bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Answer

Use SSE-KMS encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Move the sensitive data to a different S3 bucket and update the application.