DVA-C02 Development with AWS Services Practice Test 29 — 15 Questions

Question 1

Which TWO of the following are benefits of using Amazon API Gateway to manage APIs? (Choose two.)

Accepted Answer

Throttling and rate limiting of API requests. Option C is correct because API Gateway provides built-in throttling and rate limiting through usage plans and API keys, allowing you to control request rates per client and protect backend services from being overwhelmed. Option D is correct because API Gateway can automatically generate client SDKs for multiple programming languages (such as Java, JavaScript, Python, and iOS/Android) from an API's definition, simplifying client integration. Option A is not a feature of API Gateway, which does not cache database queries to Amazon RDS; it can cache API responses at the stage level, but not RDS queries. Option B is inaccurate as a benefit of API Gateway itself, since API Gateway can proxy to S3 but does not provide direct S3 file storage management as a core API management benefit. Option E is incorrect because automatic connection pooling for backend databases is handled by services like Amazon RDS Proxy, not API Gateway.

Answer

Built-in caching of database queries to Amazon RDS

Answer

Direct integration with Amazon S3 for file storage

Answer

Automatic connection pooling for backend databases

Question 2

Which THREE of the following are valid use cases for AWS Lambda? (Choose three.)

Accepted Answer

Processing records from a DynamoDB Stream in real time. Option A is correct because DynamoDB Streams can be configured as an event source for Lambda, which then invokes the function in real time with batches of stream records for processing. Option B is correct because Amazon EventBridge (CloudWatch Events) scheduled rules can invoke a Lambda function on a cron or rate expression, such as hourly, making it suitable for periodic cleanup tasks. Option C is incorrect because static websites are served by services like Amazon S3 static website hosting or CloudFront, not by Lambda, which is an event-driven compute service rather than a persistent web server. Option D is incorrect because long-running applications with persistent WebSocket connections require continuously running compute such as EC2, ECS, or API Gateway WebSocket APIs backed by appropriate compute, whereas Lambda has a maximum execution timeout of 15 minutes and is not designed for persistent connections. Option E is correct because S3 can be configured to send event notifications (e.g., s3:ObjectCreated:*) that invoke a Lambda function to process uploaded objects.

Answer

Serving as a web server for a static website

Answer

Hosting a long-running web application with WebSockets

Question 3

Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)

Accepted Answer

Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers. CORS requires a preflight OPTIONS request to determine if the actual request is safe to send. By adding an OPTIONS method to the API Gateway resource and configuring it to return the required CORS headers (such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers), the API can respond to the browser's preflight request and enable cross-origin requests.

Answer

Modify the Lambda function to return CORS headers in the response

Answer

Configure Amazon CloudFront to add CORS headers

Answer

Configure an S3 bucket CORS policy

Question 4

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user tries to upload an object to s3://example-bucket/secret/file.txt?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the secret/ prefix.. The Deny statement in the IAM policy explicitly denies the s3:PutObject action for any object with the prefix secret/ in the example-bucket. Since the user is trying to upload to s3://example-bucket/secret/file.txt, which matches the Deny condition, the request is denied regardless of any Allow statements. AWS IAM policy evaluation is explicit deny by default, meaning a Deny always overrides an Allow.

Answer

The upload fails only if the user is not the bucket owner.

Answer

The upload succeeds because the Deny statement does not match the specific action.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Question 5

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For read-heavy workloads like session data, DAX offloads read traffic from the DynamoDB table, reducing latency and providing a seamless caching layer without application code changes.

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Answer

DynamoDB Time to Live (TTL)

Question 6

A company has a REST API running on Amazon EC2 instances behind an Application Load Balancer. The API is accessed by mobile clients. The company wants to add authentication and authorization without modifying the backend code. Which AWS service should be used?

Accepted Answer

Amazon Cognito user pools integrated with the Application Load Balancer. Amazon Cognito user pools can be integrated directly with an Application Load Balancer (ALB) to handle authentication and authorization without modifying backend code. The ALB uses an OIDC-compatible identity provider (Cognito) to authenticate users before forwarding requests to the EC2 instances, allowing the backend to remain unchanged.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon API Gateway with a Lambda authorizer

Answer

Amazon CloudFront with Lambda@Edge

Question 7

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The developer wants to automatically roll back the deployment if the CloudFormation stack update fails. Which configuration should be used?

Accepted Answer

Configure the CloudFormation stack to roll back on failure using the RollbackConfiguration.. CloudFormation natively supports automatic rollback on stack update failure through the `RollbackConfiguration` property. When a stack update fails, CloudFormation can automatically revert to the last known good state, which is exactly what the developer needs for a serverless deployment pipeline. This configuration can be set in the CloudFormation template or passed as a parameter during the deploy action in CodePipeline.

Answer

Add a stack policy to the CloudFormation stack to prevent updates.

Answer

Set the deployment to use AWS CodeDeploy and enable rollback.

Answer

Configure a manual approval action in the pipeline to trigger a rollback.

Question 8

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3 with S3 Server Access Logs

Question 9

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

Accepted Answer

Amazon API Gateway WebSocket API. Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Answer

Amazon SQS with long polling

Answer

Application Load Balancer with WebSocket support

Answer

Amazon CloudFront with WebSocket support

Question 10

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

Accepted Answer

Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.. A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.

Answer

Use a VPC Link to connect to a private server for validation.

Answer

Validate the token inside the Lambda function integrated with the API.

Answer

Use API Gateway request validation to check the header format.

Question 11

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 12

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

Accepted Answer

Enable Auto Scaling and configure scaling triggers based on CPU utilization.. Enabling Auto Scaling with CPU utilization triggers dynamically adds EC2 instances during peak hours, distributing the load and reducing latency without over-provisioning during off-peak times. This matches the symptom of under-provisioned instances and minimizes cost by scaling only when needed, unlike static solutions that waste resources.

Answer

Place the environment behind an Application Load Balancer.

Answer

Change the instance type to a larger size in the environment configuration.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 13

A developer is writing a Lambda function that needs to access an Amazon RDS MySQL database. The function will be invoked frequently. What is the BEST practice for managing the database connection?

Accepted Answer

Use Amazon RDS Proxy to manage the connection pool.. For Lambda functions accessing relational databases like Amazon RDS, the best practice is to use Amazon RDS Proxy. Because Lambda functions can scale rapidly to hundreds or thousands of concurrent executions, they can quickly exhaust the database's connection pool. RDS Proxy pools and shares these connections, improving scalability and application resilience. While opening connections outside the handler (Option C) is a good general practice, it does not solve the connection exhaustion problem under high concurrency and frequent invocations.

Answer

Close the database connection at the end of each invocation.

Answer

Open a new database connection inside the handler for each invocation.

Answer

Open the database connection outside the handler function and reuse it.

Question 14

A company uses Amazon CloudFront to distribute content from an S3 bucket. The content is static and rarely changes. The developer wants to reduce the load on the origin and improve performance for users. Which configuration change would achieve this?

Accepted Answer

Increase the TTL (Time to Live) for the cache behavior.. Increasing the TTL for the cache behavior tells CloudFront edge locations to retain cached copies of the static content for a longer period before re-validating with the origin S3 bucket. This reduces the number of requests that reach the origin, lowering load on the S3 bucket, and improves user performance by serving content directly from the edge cache more frequently.

Answer

Disable caching for the distribution.

Answer

Enable Lambda@Edge to process requests at edge locations.

Answer

Decrease the TTL (Time to Live) for the cache behavior.

Question 15

A developer is deploying a microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other using service discovery. The developer wants to use AWS Cloud Map for service discovery. Which configuration is required for the services to register and discover each other?

Accepted Answer

Create a Cloud Map namespace and service; then configure ECS tasks to register with the service.. AWS Cloud Map requires a namespace (either HTTP or DNS) and a service resource. ECS tasks configured with service discovery can register themselves with the Cloud Map service, and other tasks can discover them via DNS queries or the Cloud Map API. Option A is incorrect because an Application Load Balancer is used for load balancing traffic, not for service discovery. Option B is incorrect because VPC endpoints provide private connectivity to AWS services, not service registration and discovery. Option C is incorrect because Security Groups control network traffic but do not facilitate service discovery.

Answer

Create an Application Load Balancer and register each service as a target group.

Answer

Create a VPC endpoint for each service.

Answer

Configure Security Groups to allow traffic between services.