DVA-C02 Development with AWS Services Practice Test 24 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

Accepted Answer

Use the ephemeral storage provided by Fargate.. Amazon EFS is a shared file system and persists beyond task lifecycle; not suitable for temporary data. Fargate ephemeral storage is temporary and deleted when the task stops, but it is not persistent across restarts. EBS volumes are not supported with Fargate. A Docker volume using the 'tmpfs' driver is memory-backed and not persistent.

Answer

Attach an Amazon EBS volume to the task.

Answer

Mount an Amazon EFS file system to the container.

Answer

Create a Docker volume using the 'tmpfs' driver.

Question 2

A developer is writing a Lambda function that processes records from a Kinesis stream. The function must handle duplicate records and ensure exactly-once processing. Which approach should the developer use?

Accepted Answer

Use a unique identifier for each record and store processed IDs in a DynamoDB table to skip duplicates.. Kinesis does not guarantee exactly-once delivery; the application must handle duplicates. Using a unique identifier to deduplicate in a DynamoDB table ensures idempotency. Enabling record ordering does not prevent duplicates. Using a FIFO queue is not applicable for Kinesis. Disabling retries would lose data.

Answer

Disable retries in the Lambda function to avoid processing duplicates.

Answer

Enable record ordering in the Kinesis stream.

Answer

Send the records to an SQS FIFO queue for deduplication.

Question 3

A company has a DynamoDB table that stores order data. The table has a partition key of OrderID and a sort key of OrderDate. The company frequently queries orders by CustomerID, which is not a key attribute. The queries are slow and consume a lot of read capacity. Which design change would MOST improve query performance?

Accepted Answer

Create a Global Secondary Index (GSI) with CustomerID as the partition key.. Queries by non-key attributes require a Scan, which is inefficient. Creating a Global Secondary Index with CustomerID as the partition key allows efficient querying. Changing the table's key would break existing applications. Using FilterExpression still scans the table. Increasing read capacity only addresses throttling, not performance of scans.

Answer

Increase the provisioned read capacity for the table.

Answer

Change the table's primary key to use CustomerID as the partition key.

Answer

Use a FilterExpression on the CustomerID attribute in a Scan operation.

Question 4

A developer is deploying an application using AWS CloudFormation. The template includes an AWS::Lambda::Function resource. The developer wants to ensure that the Lambda function's code is automatically updated when the source code in S3 changes. Which approach should the developer use?

Accepted Answer

Specify the S3 object version in the template and update the version number in the template when code changes.. CloudFormation does not automatically detect changes in S3. Using the same S3 key with a version ID ensures that CloudFormation sees a change and updates the function. Using a parameter for the bucket does not trigger updates. Custom Resource or CodePipeline is overkill for simple updates.

Answer

Use the AWS::Lambda::Version resource to create a new version.

Answer

Include the S3 bucket and key as template parameters and update the stack with a new key when code changes.

Answer

Use a custom resource backed by a Lambda function that polls S3 for changes.

Question 5

A developer needs to store application logs in a highly available and durable storage service. The logs must be retained for 7 years for compliance purposes. The logs are accessed infrequently after the first 30 days. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. S3 Glacier Deep Archive is the lowest cost for long-term archival with retrieval times of 12 hours. S3 Standard is expensive for long retention. S3 Intelligent-Tiering automatically moves to lower cost tiers, but still incurs monitoring fees. S3 One Zone-Infrequent Access is not highly available across AZs.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 One Zone-Infrequent Access

Answer

Amazon S3 Standard

Question 6

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from an S3 bucket, a build stage using CodeBuild, and a deploy stage using CodeDeploy. The build stage sometimes fails due to intermittent network issues. Which TWO actions would make the pipeline more resilient to such failures?

Accepted Answer

Enable retry on the build stage to automatically attempt the build again on failure.. Enabling retry on the build stage allows the pipeline to automatically retry on failure. Configuring a manual approval stage does not help with automated retries. Using a different source does not address build failures. Splitting into multiple actions adds complexity, not resilience. Storing artifacts in different bucket is not relevant.

Answer

Store build artifacts in a different S3 bucket.

Answer

Add a manual approval stage before the build stage.

Answer

Configure the build stage to run multiple build actions in parallel.

Answer

Use a different source repository, such as CodeCommit.

Question 7

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The application must authenticate users using a third-party OAuth 2.0 provider. Which THREE options can the developer use to integrate with the OAuth provider?

Accepted Answer

Use a Lambda authorizer in API Gateway to validate the OAuth token.. API Gateway Lambda authorizer can call the OAuth provider to validate tokens. Cognito User Pools can be configured as an OAuth 2.0 provider and integrated with API Gateway. Custom Lambda function can validate tokens directly. API Gateway resource policy is for IP whitelisting, not authentication. IAM authorization is for AWS credentials.

Answer

Use an API Gateway resource policy to allow only authenticated users.

Answer

Use IAM authorization with a custom token service.

Question 8

A company is using AWS Elastic Beanstalk to deploy a web application. The environment is running behind a load balancer. The developer needs to ensure that the application logs are centralized and retained for analysis. Which TWO services can be used to collect and store logs from the EC2 instances?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs agent sends logs to CloudWatch Logs for centralized storage. S3 can be used as a destination for log exports. X-Ray is for tracing, not log collection. Kinesis Data Firehose can stream logs to destinations but is not directly installed on instances. CloudTrail records API calls, not application logs.

Answer

AWS X-Ray

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Question 9

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other securely. Which THREE methods can be used to enable service-to-service authentication?

Accepted Answer

Use AWS App Mesh with mutual TLS (mTLS) authentication.. IAM roles for tasks can be used to authenticate to other AWS services via SDK. Service Connect can handle service discovery and encryption. App Mesh provides mTLS for authentication between services. Security groups control network access, not authentication. API Gateway is for external APIs.

Answer

Use Amazon API Gateway as a proxy for inter-service communication.

Answer

Use security group rules to allow traffic only between services.

Question 10

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

Accepted Answer

Increase the Lambda function's memory allocation. Option C is correct because increasing the Lambda memory allocation also increases allocated CPU, which directly helps CPU-bound functions. Option A is wrong because increasing batch size does not help CPU-bound tasks. Option B is wrong because Provisioned Concurrency does not reduce execution time. Option D is wrong because changing to a different runtime may not address the CPU limitation.

Answer

Increase the SQS batch window size

Answer

Switch the Lambda runtime from Python to Node.js

Answer

Enable Provisioned Concurrency for the function

Question 11

A company uses Amazon DynamoDB as a session store for a web application. The application recently experienced a spike in traffic, causing increased read latency. The DynamoDB table has a read capacity of 5000 RCUs and uses eventual consistent reads. The application performs many GetItem calls. What should a developer do to improve read performance with minimal cost?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table. Option B is correct because DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Option A is wrong because increasing RCUs increases cost and does not use caching. Option C is wrong because DynamoDB Streams are for change data capture, not caching. Option D is wrong because Global Tables are for multi-region replication, not read performance.

Answer

Increase the read capacity to 10000 RCUs

Answer

Configure DynamoDB global tables for the application

Answer

Enable DynamoDB Streams and process updates asynchronously

Question 12

A developer needs to store application configuration settings that may change at runtime and wants to avoid redeploying the application. Which AWS service should be used?

Accepted Answer

AWS AppConfig. Option A is correct because AWS AppConfig is designed to manage application configuration and allow dynamic updates without redeployment. Option B is wrong because Secrets Manager is for secrets, not general config. Option C is wrong because SSM Parameter Store can store config but lacks advanced features like validation and staged rollouts. Option D is wrong because DynamoDB is a database, not purpose-built for config management.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Secrets Manager

Answer

Amazon DynamoDB

Question 13

A developer is deploying a new version of an AWS Lambda function. The deployment failed because the new function code references a layer that is not available. Which AWS CLI command can be used to list all layers associated with the function?

Accepted Answer

aws lambda get-function-configuration --function-name my-function. Option C is correct because `aws lambda get-function-configuration` returns the function's configuration, including Layers. Option A is wrong because `list-layers` lists all layers in the account, not those attached to a specific function. Option B is wrong because `list-layer-versions` lists versions of a specific layer. Option D is wrong because `get-function` returns the function code but does not include layers by default.

Answer

aws lambda list-layer-versions --layer-name my-layer

Answer

aws lambda get-function --function-name my-function

Answer

aws lambda list-layers --function-name my-function

Question 14

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

Accepted Answer

Use the FireLens log driver to route logs to Fluent Bit and then to the tool. Option D is correct because the FireLens integration allows you to use a log router (e.g., Fluent Bit) in the task definition to transform logs to JSON and forward them to any destination. Option A is wrong because CloudWatch Logs agent is for EC2, not Fargate. Option B is wrong because you cannot modify the `awslogs` driver to output JSON; it sends to CloudWatch Logs. Option C is wrong because modifying the application requires code change.

Answer

Use the awslogs log driver and configure a JSON output format

Answer

Install the CloudWatch Logs agent on the container

Answer

Modify the application to output logs in JSON format

Question 15

A developer is creating an Amazon S3 bucket to store sensitive documents. The bucket must encrypt objects at rest using an AWS Key Management Service (KMS) key. Which S3 bucket property should be configured?

Accepted Answer

Default encryption. Option B is correct because S3 default encryption can be set to use SSE-KMS. Option A is wrong because bucket policies control access, not encryption. Option C is wrong because lifecycle policies manage object lifecycle. Option D is wrong because versioning is for object versions, not encryption.

Answer

Bucket policy

Answer

Versioning

Answer

Lifecycle configuration