DVA-C02 Mock Exam 89 — 25 Questions

Question 1

A developer is using the AWS CLI to deploy a new version of a Lambda function. The developer runs the following command:

aws lambda update-function-code --function-name my-function --zip-file fileb://my-code.zip

After the command completes, the developer checks the function and sees that the code has been updated but the version number is still $LATEST. The developer wants to create a new version so that the previous version is preserved. What should the developer do next?

Accepted Answer

Run the publish-version command to create a new version from the updated $LATEST.. Option C is correct because the `update-function-code` command without the `--publish` flag only updates the `$LATEST` version of the Lambda function. To create an immutable, numbered version that preserves the previous code, the developer must explicitly run the `publish-version` command, which takes the current `$LATEST` code and publishes it as a new version (e.g., version 2). This ensures the previous version (version 1) remains unchanged and can be referenced via its version ARN.

Answer

Run the update-function-code command again with the --publish flag.

Answer

Run the delete-function command and then create-function with the updated code.

Answer

Run the update-function-configuration command to set the version number.

Question 2

A developer is using AWS CodeBuild to build a Java application. The build succeeds locally but fails in CodeBuild with the error 'BUILD FAILED: Unable to find a Java installation.' The buildspec.yml file includes a 'runtime-versions' section specifying Java 11. The CodeBuild project uses the 'aws/codebuild/amazonlinux2-x86_64-standard:4.0' image. What is the MOST likely cause of the failure?

Accepted Answer

The runtime-versions section in buildspec.yml is not correctly formatted.. The error 'Unable to find a Java installation' indicates that the CodeBuild environment does not have Java available at runtime. When using a standard managed image like 'aws/codebuild/amazonlinux2-x86_64-standard:4.0', Java must be explicitly declared in the 'runtime-versions' section of buildspec.yml. The most likely cause is that the 'runtime-versions' section is incorrectly formatted (e.g., using 'java: 11' instead of the correct 'java: corretto11'), causing CodeBuild to skip installing Java.

Answer

The CodeBuild project does not have sufficient permissions to download Java.

Answer

The buildspec.yml file is not in the root of the source directory.

Answer

The build commands reference a non-existent Maven dependency.

Question 3

A developer needs to share an S3 bucket with a third-party AWS account. The third-party will upload files to the bucket using their own IAM users. The developer creates a bucket policy that grants s3:PutObject to the third-party account's root user. However, the third-party reports that their IAM users cannot upload files. What is the MOST likely reason?

Accepted Answer

The third-party's IAM users do not have an IAM policy allowing s3:PutObject.. Option A is correct because the bucket policy grants access to the root user, but the IAM users also need explicit permissions from their own account via an IAM policy. Option B is wrong because the bucket policy is not missing a condition; it's a permissions issue. Option C is wrong because the bucket policy grants PutObject to the root, but not to the users. Option D is wrong because S3 does not require user creation in the owning account for cross-account access.

Answer

The bucket policy must include a condition requiring encryption.

Answer

The bucket policy should grant access to the IAM user ARN instead of the root user.

Answer

The developer must create IAM users in their own account for the third-party.

Question 4

A company has an S3 bucket that stores log files. The bucket policy grants the AWSServiceRoleForSSO service role write access. However, the logs are not being written. What is the MOST likely reason?

Accepted Answer

The bucket policy uses a service role ARN that is not a valid principal for S3 bucket policies.. Option A is correct because S3 bucket policies must grant access to the principal, and the service role is not a valid principal for S3 bucket policies. Option B is wrong because SSE-S3 does not block writes. Option C is wrong because Block Public Access does not affect service roles. Option D is wrong because ACLs are disabled by default but service roles use bucket policies.

Answer

The bucket has S3 Block Public Access enabled, which blocks all service role access.

Answer

The bucket ACL is set to private, which prevents service role writes.

Answer

The bucket has default encryption enabled using SSE-S3, which prevents writes from service roles.

Question 5

A developer needs to allow a user to deploy AWS CloudFormation stacks but restrict the user from creating or modifying IAM resources. Which IAM policy should the developer attach to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"},{"Effect":"Deny","Action":"iam:*","Resource":"*"}]}. Option D is correct because it allows CloudFormation actions but denies IAM actions. Option A is wrong because it allows all CloudFormation actions including IAM. Option B is wrong because it denies all CloudFormation actions. Option C is wrong because it allows IAM actions.

Answer

{"Effect":"Allow","Action":"iam:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"}

Answer

{"Effect":"Deny","Action":"cloudformation:*","Resource":"*"}

Question 6

A developer is creating a new IAM policy to allow users to list objects in a specific S3 bucket. The policy must follow the principle of least privilege. Which policy statement should the developer use?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}. Option B is correct because it grants s3:ListBucket on the specific bucket. Option A is wrong because it grants s3:ListAllMyBuckets which lists all buckets, not just the specific one. Option C is wrong because s3:GetObject is for reading objects, not listing. Option D is wrong because s3:PutObject is for writing.

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}

Question 7

A developer is deploying a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party OIDC provider. The developer wants to minimize latency and avoid managing sessions. What is the BEST approach to achieve this?

Accepted Answer

Use Amazon Cognito User Pools with the OIDC identity provider and integrate with API Gateway.. Option C is correct because Cognito User Pools with an OIDC identity provider can handle token-based authentication and integrate with API Gateway. Option A is wrong because Lambda@Edge is for CloudFront. Option B is wrong because Cognito Identity Pools are for AWS credentials, not OIDC auth. Option D is wrong because custom authorizer adds latency and management overhead.

Answer

Use Lambda@Edge to validate tokens at CloudFront edge locations.

Answer

Use Amazon Cognito Identity Pools with the OIDC provider.

Answer

Implement a custom Lambda authorizer in API Gateway to validate tokens.

Question 8

A developer is building a web application that stores user session data in an ElastiCache Redis cluster. The cluster is in a VPC and is not publicly accessible. The developer needs to ensure that data in transit is encrypted. What should the developer do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster.. Option D is correct because enabling encryption in transit on the ElastiCache Redis cluster encrypts data between clients and the cluster. Option A is wrong because ElastiCache does not support TLS termination at the ALB. Option B is wrong because security groups do not encrypt traffic. Option C is wrong because VPC peering does not encrypt traffic by default.

Answer

Place an Application Load Balancer in front of the Redis cluster and enable TLS termination.

Answer

Configure the security group to only allow traffic from the application servers.

Answer

Use VPC peering to connect the application VPC to the ElastiCache VPC.

Question 9

A developer is deploying a static website to Amazon S3. The website uses client-side JavaScript to make API calls to an AWS Lambda function via Amazon API Gateway. The developer wants to enable cross-origin resource sharing (CORS) on the API Gateway to allow the S3 website to make requests. After enabling CORS on the API Gateway and redeploying the API, the browser still reports CORS errors. The developer checks the API Gateway configuration and sees that the OPTIONS method is not defined. The developer has already enabled CORS via the API Gateway console, which should have created the OPTIONS method. However, it did not appear. What should the developer do to resolve the issue?

Accepted Answer

Manually add an OPTIONS method to the API Gateway resource and configure the CORS headers in the integration response.. Option B is correct because enabling CORS via the console should automatically create an OPTIONS method; if it didn't, manually adding it is the next step. Option A is wrong because the S3 bucket policy is not the cause of CORS errors. Option C is wrong because the Lambda function does not handle OPTIONS requests; API Gateway does. Option D is wrong because the browser's CORS check is based on the server response, not the client code.

Answer

Update the JavaScript in the website to use a different HTTP method.

Answer

Update the S3 bucket policy to allow cross-origin requests from any origin.

Answer

Modify the Lambda function to return CORS headers in its response.

Question 10

A developer is deploying a web application on AWS Elastic Beanstalk. The application uses a relational database and requires a custom environment variable for the database connection string. The developer has created an Elastic Beanstalk environment and wants to set the environment variable securely without exposing it in the source code or configuration files. The developer also wants to ensure that the environment variable is available to the application instances at deployment time. What is the BEST way to achieve this?

Accepted Answer

Set the environment variable using the Elastic Beanstalk console or CLI by configuring environment properties.. Option B is correct because Elastic Beanstalk allows setting environment properties in the environment configuration, which are securely passed to the instances. Option A is incorrect because storing the connection string in a plain text file is insecure. Option C is incorrect because hardcoding the value in the application code is not secure and not a best practice. Option D is incorrect because although AWS Systems Manager Parameter Store can store the value, the application would need to retrieve it at runtime, adding complexity; Elastic Beanstalk environment properties are simpler and automatically injected.

Answer

Store the connection string in AWS Systems Manager Parameter Store and retrieve it from the application code at runtime.

Answer

Hardcode the connection string in the application code and commit it to the source repository.

Answer

Store the connection string in a file named 'env.txt' in the application source bundle and read it at application startup.

Question 11

A company is using AWS CloudFormation to deploy a stack that includes an Amazon EC2 instance with an attached Amazon EBS volume. The developer wants to ensure that the EBS volume is deleted when the EC2 instance is terminated. The developer has set the DeletionPolicy attribute on the EBS volume resource to Delete. However, after terminating the EC2 instance through the console, the EBS volume is still present. The stack still exists. What is the most likely reason the volume was not deleted?

Accepted Answer

The DeletionPolicy attribute only takes effect when the CloudFormation stack is deleted, not when an individual resource is terminated.. Option A is correct because DeletionPolicy only applies when the stack is deleted, not when an individual resource is terminated. Option B is wrong because the EC2 instance termination does not trigger stack update. Option C is wrong because the EBS volume is not a root device; root device is an instance store or EBS volume. Option D is wrong because the DeleteOnTermination attribute on the EC2 instance's BlockDeviceMapping controls whether the volume is deleted when the instance is terminated, not the DeletionPolicy on the volume resource.

Answer

The EBS volume has a DeleteOnTermination attribute set to false.

Answer

The EBS volume is the root device of the EC2 instance.

Answer

The EC2 instance was terminated manually, not through a stack update.

Question 12

A developer is using AWS CodeBuild to build and test a Java application. The buildspec.yaml file includes phases for install, pre_build, build, and post_build. The developer notices that the build fails intermittently due to network timeouts when downloading dependencies from an external repository. The developer wants to improve the reliability of the build by caching the dependencies. The build environment is Linux and the dependencies are stored in the /root/.m2 directory (Maven cache). The developer has an S3 bucket for caching. What should the developer add to the buildspec.yaml to enable caching?

Accepted Answer

Add a 'cache' section with 'paths' including '/root/.m2' and 'location' set to the S3 bucket ARN.. Option A is correct because adding a 'cache' section with 'paths' pointing to /root/.m2 and 'location' pointing to the S3 bucket will cache the Maven dependencies. Option B is incorrect because the 'artifacts' section is for output artifacts, not caching. Option C is incorrect because the 'env' section is for environment variables. Option D is incorrect because the 'phases' section defines build commands, not caching.

Answer

Add a 'phases' section with install commands to manually copy dependencies to S3.

Answer

Add an 'artifacts' section with 'files' including '/root/.m2/**/*' and 'location' set to the S3 bucket.

Answer

Add an 'env' section with 'parameter-store' variables to store the dependency paths.

Question 13

A developer notices that an S3 bucket's 'PutObject' API calls are failing intermittently for a specific application. The application uses the AWS SDK for Java to upload files. The error message is 'RequestTimeout: Your socket connection to the server was not read from or written to within the timeout period.' The bucket is in the same region as the application. The developer checks the S3 metrics and sees no throttling errors. The application runs on EC2 instances behind an ALB. The developer suspects a network issue. What should the developer do to resolve the issue?

Accepted Answer

Increase the socket timeout in the AWS SDK configuration and ensure the network path (ALB) has a higher idle timeout.. The 'RequestTimeout' error indicates that the connection is idle for too long. This often happens when using a proxy or load balancer that has a shorter idle timeout than the S3 SDK's timeout. Option A is correct: increasing the S3 client's timeout settings or using HTTP keep-alive. Option B is wrong because the bucket policy is not related to timeouts. Option C is wrong because S3 Transfer Acceleration is for large files over long distances, not for timeouts. Option D is wrong because the issue is not about permissions.

Answer

Add a bucket policy that grants s3:PutObject to the application's IAM role.

Answer

Use an S3 VPC endpoint to improve network reliability.

Answer

Enable S3 Transfer Acceleration on the bucket and update the application to use the accelerated endpoint.

Question 14

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an AWS Lambda function and an Amazon API Gateway REST API. The developer runs 'sam deploy' but the deployment fails with the error: 'Error: Security Constraints Not Satisfied'. The developer checks the IAM policies and confirms that the Lambda function has the necessary permissions. What is the most likely cause?

Accepted Answer

The API Gateway endpoint is configured with 'OPEN' access without any authorization.. Option A is correct because SAM enforces security constraints, and if the API is configured with open access (e.g., no authorization), SAM deployment will fail. Option B is wrong because SAM does not require a VPC. Option C is wrong because SAM manages S3 buckets. Option D is wrong because the error is about security constraints.

Answer

The Lambda function is not configured to run inside a VPC.

Answer

The SAM template does not specify an S3 bucket for the deployment artifacts.

Answer

The Lambda function's memory size is set too high.

Question 15

A company uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. They have a CodePipeline that deploys the built artifacts to an Auto Scaling group using CodeDeploy. Recently, the build stage started failing with the error: 'BUILD FAILED: Could not resolve dependencies for project'. The developer checks the buildspec.yml and sees that it uses Maven to download dependencies from a private repository. The developer also notices that the build environment is a managed Docker image. What is the most likely cause?

Accepted Answer

The build environment does not have network access to the private Maven repository because it is not configured with a VPC.. Option B is correct because a managed Docker image may not have network access to a private repository if it's not configured with a VPC or NAT gateway. Option A is wrong because CodeBuild supports private repositories with proper network configuration. Option C is wrong because the buildspec is correct. Option D is wrong because the error is about dependency resolution, not compilation.

Answer

The CodeBuild project does not have the necessary IAM permissions to access the private Maven repository.

Answer

The buildspec.yml has a syntax error in the 'phases' section.

Answer

The Java compiler version is incompatible with the project.

Question 16

A company is using AWS CodePipeline to automate the deployment of a microservices application to Amazon ECS. The pipeline has the following stages: Source (GitHub), Build (CodeBuild), Deploy (ECS). The Deploy stage uses an ECS task definition and updates the service. Recently, the pipeline failed at the Deploy stage with the error: 'The task definition family is inactive.' The developer checks the ECS console and sees that the task definition family exists but is inactive. The developer also notices that the pipeline uses a parameter 'TASK_DEFINITION_FAMILY' with the value 'my-app'. What is the most likely cause?

Accepted Answer

The pipeline is referencing the task definition family name without a specific revision number, and the latest revision is inactive.. Option B is correct because CodePipeline expects a specific revision number, not just the family. When the family is inactive, it may be because the latest revision is inactive. The pipeline should reference the active revision. Option A is wrong because the family exists. Option C is wrong because the task role is not related. Option D is wrong because the environment variables are likely correct.

Answer

The task definition family 'my-app' does not exist in the ECS cluster.

Answer

The environment variables in the task definition are not correctly set.

Answer

The IAM role for ECS does not have permission to register new task definitions.

Question 17

A company runs a data processing pipeline using AWS Step Functions. The pipeline starts with a task that reads a CSV file from Amazon S3 and then fans out to multiple parallel Lambda functions for data transformation. The final step aggregates the results and writes to an Amazon DynamoDB table. Recently, the pipeline has been failing intermittently with 'StateMachineExecutionLimitExceeded' errors. The development team has already increased the execution history limit to the maximum. The pipeline runs about 500 executions per day. Meanwhile, the operations team reports that some executions are timing out after 5 minutes, even though each Lambda function completes within 30 seconds. The Step Function definition uses a Map state with a max concurrency of 20. The developer needs to fix both issues. Which combination of actions should the developer take? (Choose the BEST option.)

Accepted Answer

Reduce the max concurrency of the Map state and increase the task execution timeout in the Step Function definition.. Option A is correct because reducing max concurrency and increasing task timeout addresses both state machine execution limits and timeouts. Option B is wrong because increasing map concurrency would worsen throttling. Option C is wrong because splitting into multiple state machines does not address task timeouts. Option D is wrong because Lambda reserved concurrency does not prevent state machine throttling.

Answer

Split the pipeline into multiple smaller Step Functions and chain them together.

Answer

Increase the max concurrency of the Map state and add a retry policy.

Answer

Set a Lambda reserved concurrency for the transformation functions to 100.

Question 18

A company has a production application running on AWS Lambda that processes real-time streaming data from Amazon Kinesis Data Streams. The Lambda function is configured with a batch size of 100 and a maximum concurrency of 5. Recently, the application has been experiencing failures with a high number of invocation errors. The errors indicate that the function is timing out. The developer checks the CloudWatch metrics and notices that the IteratorAge metric for the Kinesis stream is increasing rapidly, and there are many Throttles events for the Lambda function. The average execution duration of the function is 30 seconds, and the function timeout is set to 1 minute. The Kinesis stream has 10 shards. The company expects the data volume to double in the next month. Which combination of actions should the developer take to resolve the issue and prepare for future growth?

Accepted Answer

Increase Lambda concurrency to at least 20 and reduce the batch size to 10.. Option C is correct. Increasing Lambda concurrency to at least 20 (2 per shard) will reduce throttling. Reducing batch size to 10 will lower processing time per batch, preventing timeouts. Option A is wrong because increasing timeout to 5 minutes doesn't address throttling. Option B is wrong because increasing shards to 20 without increasing concurrency will not help. Option D is wrong because disabling concurrency limit could cause uncontrolled scaling.

Answer

Increase the number of shards in the Kinesis stream to 20 and increase Lambda concurrency to 10.

Answer

Disable the reserved concurrency limit on the Lambda function and decrease the batch size to 5.

Answer

Increase the Lambda function timeout to 5 minutes and increase the batch size to 500.

Question 19

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

Accepted Answer

The application code is not retrieving the secret from Secrets Manager at startup.. Option D is correct. The application likely needs to retrieve the secret at runtime, but the code may be incorrect. However, the 'Host not found' error suggests the database hostname is not being resolved. Option A is wrong because the instance profile has permission. Option B is wrong because Secrets Manager does not automatically inject into environment; the app must fetch it. Option C is wrong because the secret can be stored as plaintext or JSON; format is not the issue.

Answer

The secret is not correctly referenced in the Elastic Beanstalk environment properties.

Answer

The IAM instance profile does not have the necessary permissions to access the secret.

Answer

The secret is stored in a different region than the Elastic Beanstalk environment.

Question 20

A developer is building an application that processes user-uploaded images. The application uses Amazon S3 to store the images and AWS Lambda to generate thumbnails. When a user uploads an image to an S3 bucket, an S3 event notification triggers a Lambda function. The Lambda function processes the image and saves the thumbnail to another S3 bucket. The developer notices that sometimes the Lambda function is not triggered after an upload. The developer checks the Lambda function's CloudWatch logs and sees no invocation records for those uploads. The S3 bucket event notification configuration appears correct. What is the most likely cause of this issue?

Accepted Answer

The S3 bucket and the Lambda function are in different AWS regions.. Option A is correct because S3 event notifications might not be delivered if the bucket is in a different region than the Lambda function; the Lambda function must be in the same region as the S3 bucket for S3 event notifications. Option B is wrong because the Lambda function's IAM role does not affect invocation; it affects execution. Option C is wrong because S3 event notifications are not asynchronous; they are delivered synchronously. Option D is wrong because the destination bucket's permissions are not relevant to the invocation trigger.

Answer

The destination S3 bucket does not have the correct bucket policy to allow the Lambda function to write thumbnails.

Answer

The S3 event notification is configured as an asynchronous invocation, and the event is lost.

Answer

The Lambda function's execution role does not have permission to read from the S3 bucket.