DVA-C02 Development with AWS Services Practice Test 11 — 15 Questions

Question 1

A developer is deploying an application using AWS CloudFormation. The template includes an AWS::Lambda::Function resource. The developer wants to ensure that the Lambda function's code is automatically updated when the source code in S3 changes. Which approach should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Specify the S3 object version in the template and update the version number in the template when code changes.. AWS CloudFormation detects changes to the `AWS::Lambda::Function` resource's `Code` property only when the properties defined in the template (such as `S3Key` or `S3ObjectVersion`) change. If you upload a new deployment package to S3 using the same bucket and key, CloudFormation will not detect any change and will not update the Lambda function. To resolve this, you should enable S3 Versioning on the bucket, specify the `S3ObjectVersion` in the CloudFormation template, and update this version parameter in the template whenever the code is updated.

Answer

Use the AWS::Lambda::Version resource to create a new version.

Answer

Include the S3 bucket and key as template parameters and update the stack with a new key when code changes.

Answer

Use a custom resource backed by a Lambda function that polls S3 for changes.

Question 2

A developer needs to store application logs in a highly available and durable storage service. The logs must be retained for 7 years for compliance purposes. The logs are accessed infrequently after the first 30 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Intelligent-Tiering. The most cost-effective, highly available, and durable solution is to store the logs in Amazon S3 Standard for the first 30 days when they are accessed frequently, and then use an S3 Lifecycle policy to transition them to Amazon S3 Glacier Deep Archive for the remaining 7 years. Glacier Deep Archive offers the lowest storage cost in AWS ($0.00099 per GB/month) and is designed for long-term retention of infrequently accessed data. Storing them directly in Glacier Deep Archive (Option B) is incorrect because it would prevent immediate access during the first 30 days. One Zone-IA (Option C) is not highly available as it stores data in a single Availability Zone. S3 Intelligent-Tiering (Option D) is less cost-effective due to monitoring fees and higher storage costs compared to Glacier Deep Archive over a 7-year period.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Standard

Question 3

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from an S3 bucket, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage sometimes fails due to intermittent network issues. Which TWO actions would make the pipeline more resilient to such failures?

Accepted Answer

Enable retry on the build stage to automatically attempt the build again on failure.. CodePipeline supports automatic retry on failed actions, including build stages. By enabling retry on the build stage, the pipeline will automatically re-run the build action if it fails due to transient issues like intermittent network errors, without requiring manual intervention. This directly improves resilience against such failures. Option D is also correct because running multiple build actions in parallel allows the pipeline to have multiple build environments executing simultaneously. If one build fails due to a network issue, the other parallel build can still complete successfully, provided that the stage is configured to succeed if any of the parallel actions succeed. This reduces the impact of intermittent network failures on the overall pipeline.

Answer

Store build artifacts in a different S3 bucket.

Answer

Add a manual approval stage before the build stage.

Answer

Use a different source repository, such as CodeCommit.

Question 4

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application must authenticate users using a third-party OAuth 2.0 provider. Which THREE options can the developer use to integrate with the OAuth provider?

Accepted Answer

Use a Lambda authorizer in API Gateway to validate the OAuth token.. To authenticate users using a third-party OAuth 2.0 provider with API Gateway, you have two primary native options:

1. **Lambda Authorizer (Custom Authorizer):** You can create a Lambda function that receives the OAuth token (bearer token), validates its signature/expiration against the third-party provider's JWKS (JSON Web Key Set), and returns an IAM policy allowing or denying the request.
2. **Amazon Cognito User Pools:** You can configure Cognito User Pools to federate with the third-party OAuth 2.0 / OIDC provider. Once configured, you can use a native Cognito User Pools Authorizer in API Gateway to validate the tokens issued by Cognito.

Other options are incorrect:
- Resource policies (Option A) control which AWS accounts, VPCs, or IP addresses can access the API, but cannot parse or validate OAuth tokens.
- IAM authorization (Option D) requires requests to be signed using AWS Signature Version 4 (SigV4) credentials, not raw OAuth bearer tokens.
- Client certificates (Option E) are used for API Gateway to authenticate itself to backend services, not for authenticating end-users via OAuth.

Answer

Use an API Gateway resource policy to allow only authenticated users.

Answer

Use IAM authorization with a custom token service.

Answer

Implement token validation in a custom Lambda function that is invoked before processing the request.

Question 5

A company is using AWS Elastic Beanstalk to deploy a web application. The environment is running behind a load balancer. The developer needs to ensure that the application logs are centralized and retained for analysis. Which TWO services can be used to collect and store logs from the EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can be installed as an agent on EC2 instances to collect application logs and stream them to a centralized log group for storage, retention, and analysis. Amazon S3 is also correct because logs can be written directly to S3 from EC2 instances using the AWS SDK, CLI, or a custom script, providing durable, cost-effective storage for analysis. Both services meet the requirement for centralized log collection and storage from EC2 instances.

Answer

AWS X-Ray

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Question 6

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other securely. Which THREE methods can be used to enable service-to-service authentication?

Accepted Answer

Use AWS App Mesh with mutual TLS (mTLS) authentication.. AWS App Mesh with mutual TLS (mTLS) provides service-to-service authentication by requiring each side of a connection to present and validate X.509 certificates. This ensures both the caller and the receiver are authenticated, preventing unauthorized services from communicating within the mesh.

Answer

Use Amazon API Gateway as a proxy for inter-service communication.

Answer

Use security group rules to allow traffic only between services.

Question 7

A developer needs to store application configuration settings that may change at runtime and wants to avoid redeploying the application. Which AWS service should be used?

Accepted Answer

AWS AppConfig. AWS AppConfig. AWS AppConfig is purpose-built for managing application configuration and enabling dynamic updates without requiring redeployment. It provides features like configuration validation, staged rollouts, and automatic rollback, making it ideal for runtime configuration changes. Option A (AWS Systems Manager Parameter Store) can store configuration parameters but lacks advanced features such as validation and deployment strategies. Option B (AWS Secrets Manager) is designed for managing secrets, not general configuration. Option C (Amazon DynamoDB) is a NoSQL database and not a configuration management service.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Secrets Manager

Answer

Amazon DynamoDB

Question 8

A developer is deploying a new version of an AWS Lambda function. The deployment failed because the new function code references a layer that is not available. Which AWS CLI command can be used to list all layers associated with the function?

Accepted Answer

aws lambda get-function-configuration --function-name my-function. The `aws lambda get-function-configuration` command returns the configuration details of a Lambda function, including a list of layer ARNs (Amazon Resource Names) associated with the function. This allows the developer to verify which layers are attached and identify any missing or incorrect layer references that caused the deployment failure. Option B has been updated to a plausible but non-existent command to ensure there is only one correct answer.

Answer

aws lambda list-layer-versions --layer-name my-layer

Answer

aws lambda get-function-layers --function-name my-function

Answer

aws lambda list-layers --function-name my-function

Question 9

A developer is creating an Amazon S3 bucket to store sensitive documents. The bucket must encrypt objects at rest using an AWS Key Management Service (KMS) key. Which S3 bucket property should be configured?

Accepted Answer

Default encryption. S3 default encryption can be set to use SSE-KMS. Option A is wrong because bucket policies control access, not encryption. Option C is wrong because versioning is for object versions, not encryption. Option D is wrong because lifecycle configuration manages object lifecycle, not encryption.

Answer

Bucket policy

Answer

Versioning

Answer

Lifecycle configuration

Question 10

A developer is designing a microservice that processes orders. The service must ensure that each order is processed exactly once. The developer uses an SQS queue to decouple the order submission from processing. Which SQS feature should be used to prevent duplicate processing?

Accepted Answer

FIFO queue with content-based deduplication. A FIFO queue with content-based deduplication ensures that each unique order is processed exactly once. FIFO queues guarantee first-in-first-out delivery and exactly-once processing, while content-based deduplication uses the message body to generate a deduplication ID, preventing duplicate messages from being added to the queue within a 5-minute deduplication interval.

Answer

Standard queue with visibility timeout

Answer

FIFO queue with a dead-letter queue

Answer

Standard queue with message retention period

Question 11

Which TWO actions can improve the performance of an Amazon DynamoDB table that experiences frequent throttling due to hot partitions? (Choose TWO.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching. DynamoDB Accelerator (DAX) is an in-memory cache that reduces the number of read requests hitting the underlying table, thereby alleviating pressure on hot partitions. By serving frequently accessed items from DAX, the table experiences fewer throttled read requests, improving overall performance without changing the data model.

Answer

Disable auto scaling to provision fixed capacity

Answer

Increase the read capacity units (RCUs) of the table

Answer

Use a global secondary index (GSI) with a different partition key

Question 12

Which THREE steps are required to set up cross-account access to an Amazon S3 bucket using an IAM role in the bucket owner's account? (Choose THREE.)

Accepted Answer

Create an IAM role in the bucket owner's account with a trust policy that allows the other account to assume it.. To set up cross-account access using an IAM role, create the IAM role in the bucket owner's account (the trusting account) with a trust policy that allows the other account to assume it. Attach an IAM policy to the role granting the required S3 permissions. Then grant the IAM user in the other account permission to assume the role (sts:AssumeRole). A bucket policy is an alternative resource-based method, not required when using a role in the bucket owner's account.

Answer

Set up a VPC endpoint for Amazon S3.

Answer

Add an S3 bucket policy that grants the other account access to the bucket.

Question 13

Which TWO AWS services can be used to decouple microservices in a distributed application? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables microservices to communicate asynchronously by broadcasting messages to multiple subscribers (e.g., SQS queues, Lambda functions, HTTP endpoints). This decouples the producer from the consumers, allowing each microservice to scale and fail independently without blocking the sender.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancer (ELB)

Answer

Amazon Route 53

Question 14

Which TWO of the following are benefits of using Amazon API Gateway to manage APIs? (Choose two.)

Accepted Answer

Throttling and rate limiting of API requests. Amazon API Gateway provides built-in throttling and rate limiting of API requests (Option C) to protect backend services from being overwhelmed by traffic spikes. It also allows you to generate client SDKs for multiple programming languages (Option D), such as JavaScript, iOS, Android, and more, making it easier for developers to consume your APIs.

Option A is incorrect because API Gateway does not cache database queries to Amazon RDS; it can cache API responses, but not direct database queries.
Option B is incorrect because while API Gateway can integrate with S3, it is an integration capability rather than a core API management benefit.
Option E is incorrect because API Gateway does not provide automatic connection pooling for backend databases; this is typically handled by services like Amazon RDS Proxy.

Answer

Built-in caching of database queries to Amazon RDS

Answer

Direct integration with Amazon S3 for file storage

Answer

Automatic connection pooling for backend databases

Question 15

Which THREE of the following are valid use cases for AWS Lambda? (Choose three.)

Accepted Answer

Processing records from a DynamoDB Stream in real time. AWS Lambda can be configured as an event source mapping for DynamoDB Streams, enabling real-time processing of record changes. When items in a DynamoDB table are created, updated, or deleted, the stream captures the change and Lambda is invoked synchronously with a batch of records, allowing immediate reaction to data modifications.

Answer

Serving as a web server for a static website

Answer

Hosting a long-running web application with WebSockets