DVA-C02 Development with AWS Services Practice Test 10 — 15 Questions

Question 1

A developer is deploying an application using AWS Elastic Beanstalk. The application reads and writes data to an Amazon RDS database. The developer wants to ensure that database credentials are not stored in the application code or configuration files. What should the developer do?

Accepted Answer

Store the credentials as environment properties in the Elastic Beanstalk environment configuration.. Option D is correct because Elastic Beanstalk can pass environment properties securely by storing them in the EB environment configuration, and they can be retrieved at runtime. Option A is wrong because hardcoding in environment variables in the EB console is not secure; they can be seen in the console. Option B is wrong because storing credentials in S3 and downloading them adds complexity and potential exposure. Option C is wrong because Secrets Manager is a good practice, but Elastic Beanstalk can inject secrets as environment properties without custom code.

Answer

Encrypt the credentials and store them in an Amazon S3 bucket. Have the application download them at startup.

Answer

Use AWS Secrets Manager to store the credentials and retrieve them in the application code.

Answer

Store the credentials in a separate configuration file and include it in the application source bundle.

Question 2

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to connected clients. The developer notices that the 'connectionId' changes every time a client reconnects. How should the developer store the mapping between user identity and connectionId?

Accepted Answer

Use Amazon DynamoDB to store the mapping, with user identity as the partition key and connectionId as an attribute.. Option A is correct because DynamoDB provides fast, scalable storage for the connectionId mapping. Option B is wrong because ElastiCache is ephemeral and not ideal for persistence. Option C is wrong because S3 is not designed for low-latency lookups. Option D is wrong because RDS adds overhead and cost for this simple use case.

Answer

Use Amazon ElastiCache to store the mapping in memory.

Answer

Use Amazon RDS to store the mapping in a relational database.

Answer

Use Amazon S3 to store the mapping as a JSON file.

Question 3

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. Option C is correct because setting the DeletionPolicy attribute to Delete ensures the bucket is deleted when the stack is deleted. Option A is wrong because the default is to retain the bucket. Option B is wrong because DependsOn does not affect deletion. Option D is wrong because the bucket name is not related to deletion behavior.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 4

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. Option B is correct because API Gateway can validate requests using a model schema, reducing Lambda invocations. Option A is wrong because validation in Lambda still incurs cost and latency. Option C is wrong because request parameters alone don't validate payload. Option D is wrong because CloudFront is a CDN, not for API validation.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.

Question 5

A developer is building a data processing pipeline that uses Amazon Kinesis Data Streams. The developer wants to ensure that records are processed in order within each shard. The consumer application runs on Amazon EC2 instances in an Auto Scaling group. What should the developer do to maintain ordering?

Accepted Answer

Ensure that one consumer processes each shard exclusively.. Option D is correct because each shard's records have a sequence number, and a single consumer can process them in order. Option A is wrong because multiple consumers in a group can process different shards but ordering within a shard is maintained only if one consumer handles that shard. Option B is wrong because DynamoDB streams are for DynamoDB tables, not Kinesis. Option C is wrong because Lambda consumes records in batches, but ordering is preserved within a shard as long as there's only one concurrent invocation per shard. However, the best practice is to have one consumer per shard.

Answer

Use Amazon DynamoDB Streams to capture the order.

Answer

Use AWS Lambda as the consumer and set the batch size to 1.

Answer

Use the Kinesis Client Library (KCL) with multiple workers in the same consumer group.

Question 6

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

Accepted Answer

Use the multipart upload API.. Option C is correct because the multipart upload API is designed for objects over 100 MB. Option A is wrong because PutObject is for objects up to 5 GB, but recommended for smaller objects. Option B is wrong because pre-signed URLs are for granting temporary access, not uploading large objects efficiently. Option D is wrong because S3 Transfer Acceleration speeds up uploads over long distances but does not change the API method needed.

Answer

Enable S3 Transfer Acceleration and use the PutObject API.

Answer

Use the PutObject API operation.

Answer

Use a pre-signed URL and upload using HTTP PUT.

Question 7

A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store encrypted credentials.. Options B and D are correct because they involve secure storage and rotation of credentials. Option A is wrong because storing credentials in Lambda environment variables is not secure if the variables are visible in the console. Option C is wrong because hardcoding is never a best practice. Option E is wrong because storing in source code is insecure.

Answer

Store the credentials as Lambda environment variables.

Answer

Hardcode the credentials in the Lambda function code.

Answer

Store the credentials in a file in the Lambda deployment package.

Question 8

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. Options A, C, and D are correct. Option A is correct because an approval action is added to the pipeline. Option B is wrong because CodeBuild is for build, not deployment. Option C is correct because approval requires an SNS topic to send notifications. Option D is correct because an IAM role is needed for the approval action to publish to SNS. Option E is wrong because the approval action is added to the pipeline, not a separate stage.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.

Question 9

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function's reserved concurrency is set to 0.. Options A, B, and E are correct. Option A is correct because cold starts add latency. Option B is correct because a VPC with no NAT gateway can cause network timeouts. Option C is wrong because a larger function size does not cause timeouts directly. Option D is wrong because DLQ is for async invocation failures, not timeouts. Option E is correct because hitting Lambda concurrency limits causes throttling, which can lead to timeout errors if the function waits.

Answer

The function has a dead-letter queue configured.

Answer

The function's deployment package is larger than 50 MB.

Question 10

A developer is building a serverless application using AWS Lambda. The function needs to access a DynamoDB table and write logs to Amazon CloudWatch. What is the minimum set of IAM permissions the Lambda execution role must have?

Accepted Answer

dynamodb:PutItem, logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents. Option C is correct because the Lambda execution role must allow logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents for CloudWatch, and dynamodb:PutItem for DynamoDB. Option A is wrong because it includes unnecessary DynamoDB read permissions. Option B is wrong because it includes dynamodb:* which is too broad. Option D is wrong because it lacks DynamoDB write permission.

Answer

logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents

Answer

dynamodb:*, logs:PutLogEvents

Answer

dynamodb:GetItem, dynamodb:PutItem, logs:PutLogEvents

Question 11

A company runs a microservices architecture on Amazon ECS with Fargate. The application experiences intermittent high latency. The operations team wants to trace requests across services and identify bottlenecks. Which AWS service should be used?

Accepted Answer

AWS X-Ray. Option B is correct because AWS X-Ray provides end-to-end tracing for distributed applications. Option A is wrong because CloudWatch Logs only collects logs, not traces. Option C is wrong because CloudWatch Metrics provides aggregated metrics but not request-level traces. Option D is wrong because VPC Flow Logs capture network metadata but not application-level tracing.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Metrics

Question 12

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. Option A is correct because Lambda's default timeout is 3 seconds; increasing it allows the function to wait for the API response. Option B is wrong because it affects concurrency, not timeout. Option C is wrong because Lambda always runs in a VPC if configured; not using a VPC does not fix timeout. Option D is wrong because increasing memory does not affect timeout.

Answer

Increase the Lambda function reserved concurrency.

Answer

Remove the Lambda function from the VPC.

Answer

Increase the Lambda function memory to 1024 MB.

Question 13

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. Option B is correct because AWS Systems Manager Parameter Store with SecureString provides encrypted storage for secrets. Option A is wrong because S3 is not designed for secret management. Option C is wrong because EC2 user data is not encrypted. Option D is wrong because CloudFormation is for infrastructure, not runtime secret retrieval.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 14

A company uses Amazon API Gateway with a Lambda authorizer to secure its APIs. The authorizer must verify a JWT token from a third-party identity provider. The team notices that the authorizer is called on every API request, causing additional latency. How can the team reduce the number of authorizer invocations?

Accepted Answer

Configure the Lambda authorizer to return a cached policy using the 'methodArn' and 'principalId' combination.. Option C is correct because enabling token caching in the Lambda authorizer reduces invocations. Option A is wrong because the TTL in API Gateway caching is for response caching, not authorizer caching. Option B is wrong because caching in CloudFront is for content, not authorization. Option D is wrong because the Lambda authorizer is the intended mechanism; removing it would bypass security.

Answer

Use Amazon CloudFront to cache the API responses.

Answer

Enable API Gateway caching and set a TTL of 300 seconds.

Answer

Remove the Lambda authorizer and use IAM roles for authorization.

Question 15

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

Accepted Answer

The Error document field in the static website hosting configuration is not set to error.html.. Option D is correct because S3 static website hosting uses the Index document and Error document settings; if the error document is not configured correctly, S3 returns a generic 403. Option A is wrong because error page is not tied to object permissions. Option B is wrong because error page is different from index. Option C is wrong because bucket policy does not affect error page routing.

Answer

The bucket policy denies access to the error.html object.

Answer

The index.html is missing from the bucket.

Answer

The error.html object has incorrect permissions.