DVA-C02 Development with AWS Services Practice Test 25 — 15 Questions

Question 1

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Option A is correct because Amazon SNS can send email notifications when integrated with CloudWatch Events (now Amazon EventBridge) for CodePipeline state changes. Option B is wrong because SES is for sending transactional emails, but not directly integrated with CodePipeline. Option C is wrong because CloudWatch Logs is for log storage. Option D is wrong because Lambda can be used but is not the simplest service for just sending email notifications.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 2

A developer is designing a microservice that processes orders. The service must ensure that each order is processed exactly once. The developer uses an SQS queue to decouple the order submission from processing. Which SQS feature should be used to prevent duplicate processing?

Accepted Answer

FIFO queue with content-based deduplication. Option B is correct because SQS FIFO queues support exactly-once processing through deduplication based on message deduplication ID. Option A is wrong because standard queues guarantee at-least-once delivery. Option C is wrong because visibility timeout prevents other consumers from processing the same message, but does not prevent duplicates if the message is delivered again. Option D is wrong because dead-letter queues store messages that could not be processed, they do not prevent duplicates.

Answer

Standard queue with visibility timeout

Answer

FIFO queue with a dead-letter queue

Answer

Standard queue with message retention period

Question 3

A developer needs to store a large number of binary files (e.g., images) that are accessed infrequently but must be retrievable within minutes. The storage solution should be cost-effective. Which Amazon S3 storage class is MOST suitable?

Accepted Answer

S3 Glacier Instant Retrieval. Option C is correct because S3 Glacier Instant Retrieval is for long-lived, rarely accessed data that requires millisecond retrieval, but with a retrieval cost. Option A is wrong because S3 Standard is for frequently accessed data. Option B is wrong because S3 Intelligent-Tiering is for unknown or changing access patterns. Option D is wrong because S3 One Zone-IA is for infrequent access but less durable.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Question 4

Which TWO actions can improve the performance of an Amazon DynamoDB table that experiences frequent throttling due to hot partitions? (Choose TWO.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching. Options B and D are correct. Adding a random prefix to the partition key distributes writes across partitions. Using DynamoDB Accelerator (DAX) reduces read load. Option A is wrong because increasing read capacity does not solve hot partition issue. Option C is wrong because global secondary indexes do not reduce throttling on the base table. Option E is wrong because disabling auto scaling may worsen throttling.

Answer

Disable auto scaling to provision fixed capacity

Answer

Increase the read capacity units (RCUs) of the table

Answer

Use a global secondary index (GSI) with a different partition key

Question 5

Which THREE steps are required to set up cross-account access for an Amazon S3 bucket? (Choose THREE.)

Accepted Answer

Create an IAM role in the source account that the other account can assume. Options A, B, and D are correct. The bucket policy must grant access to the other account's user or role. The user in the other account must have permissions via IAM. The IAM role in the source account can be used for cross-account access. Option C is wrong because ACLs are legacy and not recommended. Option E is wrong because VPC endpoint is for network connectivity, not cross-account access.

Answer

Configure the bucket ACL to allow the other account

Answer

Set up a VPC endpoint for S3

Question 6

Which TWO AWS services can be used to decouple microservices in a distributed application? (Choose TWO.)

Accepted Answer

Amazon Simple Notification Service (SNS). Options B and C are correct. Amazon SQS provides message queuing for decoupling. Amazon SNS enables pub/sub messaging. Option A is wrong because ELB is for load balancing traffic to a single service. Option D is wrong because CloudWatch is for monitoring. Option E is wrong because Route 53 is DNS.

Answer

Amazon CloudWatch

Answer

Elastic Load Balancer (ELB)

Answer

Amazon Route 53

Question 7

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

Accepted Answer

Amazon S3 Event Notifications. Correct: C. S3 can be configured to send events to Lambda, SQS, or SNS when objects are created. Option A is wrong because SQS is a queue service, not a direct trigger source for S3 events. Option B is wrong because SNS is a notification service, but S3 can directly invoke Lambda without SNS. Option D is wrong because CloudWatch Events is used for scheduled or pattern-based events, not S3 object creation.

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Answer

Amazon SNS

Question 8

A developer is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for database credentials. The developer wants to ensure that the credentials are encrypted at rest and rotated automatically. Which solution meets these requirements with minimal effort?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the application code. Configure automatic rotation.. Correct: B. AWS Secrets Manager provides automatic rotation of secrets and encryption at rest. Option A is wrong because SSM Parameter Store with SecureString provides encryption but does not automatically rotate. Option C is wrong because hardcoding credentials is insecure. Option D is wrong because environment variables in Elastic Beanstalk are not encrypted by default and do not rotate.

Answer

Hardcode the credentials in the application code and use environment variables for different environments.

Answer

Store the credentials in AWS Systems Manager Parameter Store as SecureString parameters and reference them in the application code.

Answer

Use Elastic Beanstalk environment properties to set the credentials as plaintext environment variables.

Question 9

A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?

Accepted Answer

Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.. Correct: D. AWS PrivateLink with a Network Load Balancer allows you to expose services privately within your VPC without internet access. Option A is wrong because ALB in public subnets exposes services to the internet. Option B is wrong because Internet Gateway is for public access. Option C is wrong because NAT Gateway is for outbound traffic, not inbound.

Answer

Place an Application Load Balancer in public subnets and point to the services' target groups.

Answer

Use a NAT Gateway to allow inbound traffic from the VPN to the services.

Answer

Use an Internet Gateway and route traffic from the VPN to the services.

Question 10

Which TWO of the following are benefits of using Amazon API Gateway to manage APIs? (Choose two.)

Accepted Answer

Throttling and rate limiting of API requests. Correct: A and D. API Gateway provides throttling to protect backend services and can generate SDKs for multiple languages. Option B is wrong because API Gateway does not provide a built-in caching layer for RDS; it can cache responses but not RDS queries directly. Option C is wrong because API Gateway does not manage database connections. Option E is wrong because API Gateway does not handle file storage.

Answer

Built-in caching of database queries to Amazon RDS

Answer

Direct integration with Amazon S3 for file storage

Answer

Automatic connection pooling for backend databases

Question 11

Which THREE of the following are valid use cases for AWS Lambda? (Choose three.)

Accepted Answer

Processing records from a DynamoDB Stream in real time. Correct: A, C, and E. Lambda can process S3 events, run scheduled tasks via CloudWatch Events, and process DynamoDB Streams. Option B is wrong because Lambda is not suitable for long-running applications; maximum execution time is 15 minutes. Option D is wrong because Lambda cannot be used as a web server like EC2; it is event-driven and stateless.

Answer

Serving as a web server for a static website

Answer

Hosting a long-running web application with WebSockets

Question 12

Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)

Accepted Answer

Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers. Correct: A and D. To enable CORS, you must enable CORS on the API Gateway resource (which adds the required headers) and configure the OPTIONS method to respond to preflight requests. Option B is wrong because Lambda functions do not need to return CORS headers if API Gateway handles it. Option C is wrong because CloudFront does not enable CORS for API Gateway. Option E is wrong because S3 CORS configuration is for S3, not API Gateway.

Answer

Modify the Lambda function to return CORS headers in the response

Answer

Configure Amazon CloudFront to add CORS headers

Answer

Configure an S3 bucket CORS policy

Question 13

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user tries to upload an object to s3://example-bucket/secret/file.txt?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the secret/ prefix.. Correct: D. The Deny statement explicitly denies all s3 actions on the secret/ prefix. Even though the Allow statement allows PutObject on the bucket, the explicit Deny overrides it. Option A is wrong because Deny takes precedence. Option B is wrong because it's denied. Option C is wrong because the Deny is not conditional.

Answer

The upload fails only if the user is not the bucket owner.

Answer

The upload succeeds because the Deny statement does not match the specific action.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Question 14

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function asynchronously. What does the response indicate?

Accepted Answer

The function invocation was accepted but the function failed to execute successfully.. Correct: D. The StatusCode 202 indicates the invocation was accepted. However, the FunctionError set to 'Unhandled' means the function invocation failed and the error was not handled by the function's error handling (e.g., a caught exception or DLQ). Option A is wrong because 202 does not mean success. Option B is wrong because 202 means accepted, not denied. Option C is wrong because the invocation type is Event (async), not synchronous.

Answer

The function executed successfully and returned output.

Answer

The invocation was denied due to insufficient permissions.

Answer

The function was invoked synchronously and returned an error.

Question 15

Refer to the exhibit. A developer deploys this CloudFormation stack. The Lambda function is triggered by SQS messages. However, the function fails to process messages. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have permissions to poll from SQS.. Correct: A. The Lambda execution role only has the AWSLambdaBasicExecutionRole policy, which grants permissions to write logs to CloudWatch. However, the Lambda function needs permission to poll and delete messages from SQS. The missing policy is AWSLambdaSQSQueueExecutionRole or a custom policy with sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes. Option B is wrong because the SQS event source mapping is correctly defined. Option C is wrong because the function code is valid. Option D is wrong because the batch size of 10 is valid.

Answer

The SQS queue event source mapping is not configured correctly.

Answer

The batch size of 10 exceeds the maximum allowed batch size.

Answer

The Lambda function code has a syntax error.