DVA-C02 Development with AWS Services Practice Test 12 — 15 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. Option C is correct because 'aws cloudformation change-set create' creates a change set that previews changes. Option A is wrong because 'update-stack' directly updates without preview. Option B is wrong because 'deploy' is for CodeDeploy. Option D is wrong because 'validate-template' only checks syntax.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 2

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. Option B is correct because private subnets need a VPC endpoint (or NAT gateway) to access DynamoDB. Option A is wrong because security groups control traffic at instance level, but the issue is routing. Option C is wrong because IAM roles are for permissions, not network connectivity. Option D is wrong because task definitions don't have network settings for VPC endpoints.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 3

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

Accepted Answer

aws deploy get-deployment-instance. Option D is correct because 'aws deploy get-deployment-instance' provides detailed information about a specific instance deployment. Option A is wrong because 'list-deployment-instances' only lists IDs. Option B is wrong because 'get-deployment' gives overall deployment info. Option C is wrong because 'list-deployments' lists deployments.

Answer

aws deploy get-deployment

Answer

aws deploy list-deployments

Answer

aws deploy list-deployment-instances

Question 4

A developer is designing a serverless application using AWS Lambda. The function needs to process messages from an Amazon SQS queue. The developer wants to configure the Lambda function to be triggered by the SQS queue. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Attach an IAM execution role to Lambda with permission to receive messages from SQS.. B and D are correct. The Lambda function needs an event source mapping (B) and the execution role needs permissions to poll the queue (D). Option A is wrong because SQS does not need a resource-based policy for the same account. Option C is wrong because DLQ is optional. Option E is wrong because VPC is not required.

Answer

Configure a resource-based policy on the SQS queue to allow Lambda invocation.

Answer

Set up a dead-letter queue for failed messages.

Answer

Place the Lambda function in a VPC to access the SQS queue.

Question 5

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. The developer wants to implement caching to improve performance. Which THREE steps are necessary to enable caching for a specific stage? (Choose THREE.)

Accepted Answer

Enable API caching in the stage settings.. A, B, and D are correct. You must enable caching in API Gateway (A), specify a cache size (B), and set a TTL (D). Option C is wrong because the Lambda function does not need changes. Option E is wrong because IAM permissions are not directly required for caching.

Answer

Attach an IAM policy to the API Gateway role for cache access.

Answer

Modify the Lambda function to store responses in ElastiCache.

Question 6

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. B, C, and D are correct. You need an approval action (B), SNS notification for approvers (C), and an IAM policy for approvers to allow approval (D). Option A is wrong because CloudWatch Events is not required for approval. Option E is wrong because Lambda is not required; approval action is built-in.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 7

The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?

Accepted Answer

Use the aws s3api put-bucket-versioning command with the --mfa parameter.. Option A is correct because the 'aws s3api put-bucket-versioning' command with MFA is required to enable MFA Delete. Option B is wrong because 's3api put-bucket-versioning' is the correct command. Option C is wrong because 's3api put-bucket-versioning' can enable MFA Delete without locking. Option D is wrong because 's3api put-bucket-versioning' is the right command.

Answer

Use the aws s3api put-bucket-acl command with MFA token.

Answer

Enable Object Lock on the bucket, which automatically enables MFA Delete.

Answer

Use the aws s3api put-bucket-policy command to require MFA.

Question 8

The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The policy does not include the 'dynamodb:Scan' action.. Option B is correct because the policy does not include 'dynamodb:Scan' action. Option A is wrong because the resource ARN is correct. Option C is wrong because table exists. Option D is wrong because the role is attached.

Answer

The DynamoDB table does not exist.

Answer

The IAM role is not attached to the Lambda function.

Answer

The resource ARN is incorrect.

Question 9

The above command invokes a Lambda function. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught and returned as an error.. Option C is correct because 'Handled' means the function threw an exception that was caught by the code (e.g., in a try-catch block) and returned an error response. Option A is wrong because 'Handled' does not mean the function succeeded. Option B is wrong because a timeout would be 'Unhandled'. Option D is wrong because permission errors would result in 403.

Answer

The function had a permission error.

Answer

The function executed successfully.

Answer

The function timed out.

Question 10

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. Option C is correct because assigning an IAM role to the Lambda function with a policy that allows DynamoDB actions follows the principle of least privilege and is the recommended approach. Option A is wrong because embedding access keys in environment variables is insecure. Option B is wrong because IAM users are for human users, not services. Option D is wrong because granting full admin access violates least privilege.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 11

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. Option B is correct because the artifacts section in buildspec.yml uses the 'files' key (not 'file') to specify which files are build artifacts. Option A is wrong because 'file' is not a valid key. Option C is wrong because 'path' is not a key in the artifacts section; it's a property of the 'files' list. Option D is wrong because 'base-directory' is misspelled and the structure is incorrect.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 12

A company has a microservices architecture running on Amazon ECS with Fargate. Each service exposes an API through an Application Load Balancer (ALB). The development team needs to implement canary deployments for one of the services. What is the MOST efficient way to achieve this?

Accepted Answer

Configure the ALB to use weighted target groups, each pointing to a different task set of the same ECS service.. Option D is correct because using the ALB weighted target groups feature allows directing a percentage of traffic to a new task set, enabling canary deployments without additional infrastructure. Option A is wrong because CodeDeploy can perform canary deployments with ECS, but it requires additional setup and is not as direct as ALB weighted target groups. Option B is wrong because multiple ECS services would require a separate ALB or complex routing. Option C is wrong because Route 53 cannot route based on percentage for canary deployments without complex health checks and DNS propagation delays.

Answer

Create two ECS services behind the same ALB, each with a different task definition, and use sticky sessions.

Answer

Use Amazon Route 53 weighted routing policies to distribute traffic between two ALBs.

Answer

Use AWS CodeDeploy with an ECS blue/green deployment configuration that supports canary traffic shifting.

Question 13

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Accepted Answer

Use S3 multipart upload for large files to improve throughput.. Option B is correct because increasing Lambda memory often increases CPU and network throughput, reducing processing time. Option D is correct because using S3 multipart upload for large files can reduce the time to download/upload. Option A is wrong because updating the function code may not help if the issue is resource constraints. Option C is wrong because changing the trigger to SQS adds complexity and does not directly address the timeout. Option E is wrong because increasing timeout without addressing performance may just delay the failure.

Answer

Change the S3 event notification to send messages to an Amazon SQS queue instead.

Answer

Update the Lambda function code to use a more efficient algorithm.

Answer

Increase the Lambda function timeout to 15 minutes.

Question 14

A company is using AWS CloudFormation to deploy a web application. The template creates an Auto Scaling group, an Application Load Balancer, and a security group. The developer wants to ensure that the stack update fails if the new Auto Scaling group instances fail health checks. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to send a signal to CloudFormation using cfn-signal.. Option A is correct because the Auto Scaling group must associate with the ALB target group for health checks. Option B is correct because creation policies allow CloudFormation to wait for a signal of success. Option D is correct because a CloudFormation signal (cfn-signal) is used to report success/failure. Option C is wrong because UpdatePolicy is used for rolling updates, not for signaling health checks. Option E is wrong because AWS::CloudFormation::Init is for software configuration, not health check signaling.

Answer

Add an UpdatePolicy to the Auto Scaling group with a rolling update configuration.

Answer

Use the AWS::CloudFormation::Init metadata to run a health check script.

Question 15

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The API should only be accessible from a specific VPC. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for API Gateway.. Option B is correct because a resource policy on API Gateway can restrict access to a VPC. Option E is correct because a VPC endpoint for API Gateway allows API Gateway to receive traffic from the VPC privately. Option A is wrong because Lambda VPC configuration is for the function's access to VPC resources, not for API Gateway. Option C is wrong because a VPC endpoint for Lambda is not needed for API Gateway access. Option D is wrong because an API key is for authentication, not network restriction.

Answer

Use an API key that is only known within the VPC.

Answer

Configure the Lambda function to be VPC-enabled.

Answer

Create a VPC endpoint for Lambda.