DVA-C02 Development with AWS Services Practice Test 13 — 15 Questions

Question 1

The IAM policy above is attached to a user. The user tries to decrypt a KMS key with encryption context {"department": "finance"}. What will happen?

Accepted Answer

The action is allowed because the Allow statement matches the encryption context.. Option C is correct because the first statement allows decryption when the encryption context equals "finance", and the second statement denies if it does not equal "finance". For the context {"department": "finance"}, it matches both: the Allow applies, and the Deny does not because the condition is not met (it equals, not not-equals). Since an explicit Allow overrides an explicit Deny? Actually, Deny always overrides Allow. But here the Deny condition is not satisfied, so only the Allow applies. So the action is allowed. Option A is wrong because the Deny condition does not match. Option B is wrong because the Allow condition matches. Option D is wrong because the Deny does not apply.

Answer

The action is denied because the Deny statement applies to all resources.

Answer

The action is denied because there is an explicit Deny that overrides any Allow.

Answer

The action is denied because the Allow statement does not explicitly allow.

Question 2

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. Option B is correct because when MFA Delete is enabled, permanent deletion of object versions requires MFA authentication. Without MFA, the request fails. Option A is wrong because the delete marker is not created; the request is denied. Option C is wrong because the request does not succeed. Option D is wrong because a delete marker is not created when trying to delete a specific version.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 3

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

Accepted Answer

Use Fn::GetAtt with "Arn" attribute on the DLQ resource.. Option D is correct because using Fn::GetAtt to retrieve the ARN of the DLQ resource within the same template avoids hardcoding. Option A is wrong because Fn::ImportValue is for cross-stack references, not needed here. Option B is wrong because Ref returns the queue URL, not the ARN. Option C is wrong because Fn::Sub is a string substitution function, but you still need to reference the resource attribute correctly.

Answer

Use Ref to reference the DLQ's QueueName and construct the ARN.

Answer

Use Fn::Sub to substitute the queue name into a hardcoded ARN template.

Answer

Use Fn::ImportValue to import the DLQ ARN from another stack.

Question 4

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Option A is correct because Elastic Beanstalk can be configured to rotate and retain logs by setting the appropriate option settings in the environment configuration. Option B is wrong because CloudWatch Logs agent without rotation configuration may not handle log rotation properly. Option C is wrong because a cron job is a manual approach and not integrated with Elastic Beanstalk. Option D is wrong because storing logs in S3 via a script is not automatic rotation.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 5

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?

Accepted Answer

Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.. Option B is correct because by setting the CodeBuild project to use a custom VPC, it can be configured with a subnet and security group that allow access to the private database. Option A is wrong because a NAT gateway would require the CodeBuild project to be in a public subnet, not private. Option C is wrong because VPC peering is unnecessary; CodeBuild can be launched directly in the VPC. Option D is wrong because a VPC endpoint is for accessing AWS services privately, not for general network access.

Answer

Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.

Answer

Set up a VPC peering connection between the CodeBuild VPC and the database VPC.

Answer

Create a VPC endpoint for the database service and attach it to the CodeBuild project.

Question 6

A developer is using Amazon DynamoDB as a data store for a serverless application. The application requires strongly consistent reads and must be able to recover from failures. Which THREE measures should the developer implement? (Choose THREE.)

Accepted Answer

Use the ConsistentRead parameter set to true in GetItem and Query operations.. Option B is correct because strongly consistent reads can be requested per operation. Option C is correct because DynamoDB global tables provide multi-region replication for disaster recovery. Option D is correct because DynamoDB Accelerator (DAX) can improve read performance, though not directly for recovery. Option A is wrong because DynamoDB Streams is for changes, not recovery. Option E is wrong because read replicas are a feature of RDS, not DynamoDB.

Answer

Use DynamoDB read replicas to offload read traffic.

Answer

Enable DynamoDB Streams to capture changes.

Question 7

A company is using Amazon S3 to store sensitive documents. They must encrypt all objects at rest. Which TWO methods can be used to enforce server-side encryption? (Choose TWO.)

Accepted Answer

Set a bucket policy that denies PutObject if x-amz-server-side-encryption header is not present.. Option C is correct because S3 Bucket Policies can deny uploads without encryption headers. Option D is correct because S3 default encryption can be configured to automatically encrypt objects. Option A is wrong because client-side encryption is different from server-side. Option B is wrong because S3 does not support SQS policies for encryption. Option E is wrong because IAM policies can control permissions but not enforce encryption on uploads.

Answer

Attach an IAM policy that denies all S3 actions unless encryption is specified.

Answer

Configure an SQS queue policy to require encryption.

Answer

Use client-side encryption before uploading objects.

Question 8

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

Accepted Answer

Implement retry logic with exponential backoff in the Lambda function.. Option C is correct because implementing a retry mechanism with exponential backoff is the recommended approach to handle throttling errors from DynamoDB. Option A is wrong because increasing Lambda memory does not affect DynamoDB throughput. Option B is wrong because decreasing batch size may reduce the number of writes per invocation, but does not handle throttling directly; exponential backoff is more effective. Option D is wrong because changing the Kinesis stream's shard count does not affect DynamoDB throughput.

Answer

Decrease the batch size of the Kinesis event source mapping.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the memory allocated to the Lambda function.

Question 9

A company is using AWS Step Functions to orchestrate a workflow that processes orders. The workflow includes a task that calls a Lambda function to validate the order. If the validation fails, the workflow should wait for manual approval before proceeding. What is the MOST efficient way to implement this manual approval step?

Accepted Answer

Use a Step Functions activity task that sends a message to an Amazon SQS queue. The approval process polls the queue and sends a task success response with the .taskToken.. Option A is correct because Step Functions has a built-in 'Wait for Callback' pattern with .taskToken and activity tasks that can integrate with SQS to wait for manual approval. Option B is wrong because an SNS topic does not provide a callback mechanism. Option C is wrong because CloudWatch Events is for scheduling and events, not for manual approval workflows. Option D is wrong because Cognito is for user authentication, not workflow approval.

Answer

Publish a message to an Amazon SNS topic that triggers an email to the approver. The workflow continues after a fixed timeout.

Answer

Schedule a CloudWatch Events rule to trigger a Lambda function that checks for approval status in a DynamoDB table.

Answer

Use Amazon Cognito to manage user identities and require the approver to authenticate via a web portal.

Question 10

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

Accepted Answer

Configure an SQS event source mapping on the Lambda function.. Amazon SQS can directly invoke AWS Lambda via event source mappings. Option A is correct because Lambda can poll SQS and process messages. Option B is incorrect because SNS is a pub/sub service, not for SQS. Option C is incorrect because EventBridge is for event buses, not direct SQS triggers. Option D is incorrect because Step Functions orchestrate workflows, not direct triggers.

Answer

Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

Answer

Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

Answer

Use AWS Step Functions to poll the SQS queue and invoke Lambda.

Question 11

A developer is deploying a new version of an AWS Lambda function. The function uses an environment variable for a database password. The developer wants to securely store the password and automatically rotate it. Which combination of AWS services should the developer use?

Accepted Answer

Store the password in AWS Secrets Manager and retrieve it in the Lambda function using the AWS SDK.. AWS Secrets Manager securely stores secrets and supports automatic rotation. Lambda can retrieve the secret at runtime. Option B is correct. Option A is incorrect because Parameter Store does not natively support rotation. Option C is incorrect because DynamoDB is not a secure secret store. Option D is incorrect because KMS encrypts data but does not store or rotate secrets.

Answer

Use AWS KMS to generate a data key and store it in the Lambda environment variable.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it in the Lambda function.

Answer

Encrypt the password using AWS KMS and store it in Amazon DynamoDB.

Question 12

A company has a production AWS Lambda function that processes critical financial transactions. The function's code is stored in an S3 bucket. A developer accidentally deletes the S3 bucket, causing the function to fail. The developer wants to prevent this in the future by ensuring that the Lambda function can always be updated and deployed even if the original S3 bucket is deleted. What should the developer do?

Accepted Answer

Update the Lambda function code directly using the AWS CLI or SDK, and remove the dependency on S3 for future updates.. Option C is correct because Lambda functions can be updated directly with new code, making them independent of the original S3 bucket. Option A is incorrect because versioning prevents accidental deletion of objects, not the bucket itself. Option B is incorrect because replicating to another account still has the same dependency. Option D is incorrect because CloudTrail logs actions but does not prevent failures.

Answer

Enable AWS CloudTrail to monitor bucket deletions.

Answer

Set up cross-region replication to another S3 bucket.

Answer

Enable versioning on the S3 bucket.

Question 13

A developer is designing a microservices architecture using Amazon ECS with Fargate. The application needs to store and retrieve user session data. Which TWO AWS services can be used to store session state?

Accepted Answer

Amazon DynamoDB. Option A (ElastiCache Redis) and Option C (DynamoDB) are both suitable for storing session state. Option B (S3) is object storage, not optimal for low-latency session state. Option D (RDS MySQL) is relational and can work but is not a typical choice for session state due to overhead. Option E (EFS) is file storage, not suitable for session data.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Question 14

A developer is building an API using Amazon API Gateway and AWS Lambda. The API must authenticate users using a third-party OAuth 2.0 provider. Which THREE components are required to implement this authentication?

Accepted Answer

The OAuth 2.0 access token in the Authorization header. Option A, B, and D are required. A Lambda authorizer can validate tokens from a third-party OAuth provider. The token must be included in the request header. API Gateway invokes the Lambda authorizer. Option C (Cognito user pool) is not required if using a third-party provider. Option E (CloudFront) is not needed for authentication.

Answer

Amazon CloudFront distribution for API caching

Answer

An Amazon Cognito user pool as the OAuth provider

Question 15

A developer is using AWS CodePipeline to automate the deployment of a web application. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which TWO actions can the developer take to automatically trigger the pipeline when new code is uploaded to the S3 bucket?

Accepted Answer

Configure an S3 event notification that sends to an Amazon SNS topic, which triggers an AWS Lambda function that starts the pipeline.. Option A (S3 event notification to SNS, which triggers Lambda to start the pipeline) and Option B (CloudWatch Events rule for S3 PUT operations) are both valid. Option C (SQS polling) is not automatic. Option D (CodeStar) is not a trigger. Option E (manual) is not automatic.

Answer

Configure an Amazon SQS queue to poll the S3 bucket for new objects and invoke the pipeline.

Answer

Use an AWS Lambda function that periodically checks the S3 bucket for new objects.

Answer

Use AWS CodeStar to automatically detect changes in the S3 bucket.

DVA-C02 Development with AWS Services Practice Test 13 — 15 Questions

Exhibit

DVA-C02 Development with AWS Services Practice Test 13 — 15 Questions

Exhibit