DVA-C02 Development with AWS Services Practice Test 31 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the FireLens log driver to route logs to Fluent Bit and then to the tool. FireLens is an ECS log driver that integrates with Fluent Bit or Fluentd to route, filter, and transform container logs without modifying application code. By using FireLens with Fluent Bit, you can configure a JSON parser to convert stdout logs into JSON format before forwarding them to the centralized log management tool, meeting the requirement exactly.

Answer

Use the awslogs log driver and configure a JSON output format

Answer

Install the CloudWatch Logs agent on the container

Answer

Modify the application to output logs in JSON format

Question 2

A developer is using AWS CodePipeline to automate deployments. The pipeline has a manual approval action that requires a developer to approve before deploying to production. The developer wants to receive an email notification when an approval action is pending. Which AWS service should be used to send the notification?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon Simple Notification Service (SNS) is the correct choice because it is a pub/sub messaging service designed to send notifications to subscribers via email, SMS, or other protocols. CodePipeline can publish events to an SNS topic when an approval action is pending, and the developer can subscribe an email endpoint to that topic to receive the notification directly.

Answer

Amazon Simple Email Service (SES)

Answer

AWS Lambda

Answer

Amazon CloudWatch Logs

Question 3

A developer needs to store a large number of binary files (e.g., images) that are accessed infrequently but must be retrievable within minutes. The storage solution should be cost-effective. Which Amazon S3 storage class is MOST suitable?

Accepted Answer

S3 Glacier Instant Retrieval. S3 Glacier Instant Retrieval is the most suitable because it is designed for long-lived, infrequently accessed data that requires retrieval in milliseconds (within minutes), offering a lower storage cost than S3 Standard while still providing rapid access. The question specifies 'retrievable within minutes' and 'cost-effective,' which aligns with Glacier Instant Retrieval's sub-second retrieval times and lower storage price point compared to S3 Standard or Intelligent-Tiering for data accessed rarely.

Answer

S3 Intelligent-Tiering

Answer

S3 One Zone-Infrequent Access

Answer

S3 Standard

Question 4

A developer is building a serverless application using AWS Lambda that processes files uploaded to an S3 bucket. The function needs to read the file content and store metadata in DynamoDB. Which AWS service should be used to trigger the Lambda function when a new object is created in S3?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications (Option D) are the native mechanism for S3 to publish events (e.g., s3:ObjectCreated:*) directly to AWS Lambda, SQS, or SNS when an object is created. This is the simplest and most direct way to trigger a Lambda function for file processing without needing additional services.

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Answer

Amazon SNS

Question 5

A developer is deploying a Node.js application on AWS Elastic Beanstalk. The application uses environment variables for database credentials. The developer wants to ensure that the credentials are encrypted at rest and rotated automatically. Which solution meets these requirements with minimal effort?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the application code. Configure automatic rotation.. AWS Secrets Manager is the correct choice because it provides built-in automatic rotation of secrets (including database credentials) with minimal configuration, and it encrypts secrets at rest using AWS KMS. The developer can retrieve the credentials at runtime via the AWS SDK, avoiding hardcoding or plaintext exposure. Elastic Beanstalk environment properties do not offer encryption at rest or rotation, and while Parameter Store SecureString parameters encrypt at rest, they lack native automatic rotation without additional custom logic.

Answer

Hardcode the credentials in the application code and use environment variables for different environments.

Answer

Store the credentials in AWS Systems Manager Parameter Store as SecureString parameters and reference them in the application code.

Answer

Use Elastic Beanstalk environment properties to set the credentials as plaintext environment variables.

Question 6

A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?

Accepted Answer

Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.. AWS PrivateLink with a VPC Endpoint service and a Network Load Balancer (NLB) allows you to expose services running in private subnets to other VPCs or on-premises networks via VPN without traversing the public internet. The NLB handles TCP traffic at Layer 4, and the VPC Endpoint service provides secure, scalable connectivity by creating elastic network interfaces in the consumer VPC, ensuring traffic stays within the AWS network. This approach is both secure (no public exposure) and scalable (NLB handles high throughput and availability).

Answer

Place an Application Load Balancer in public subnets and point to the services' target groups.

Answer

Use a NAT Gateway to allow inbound traffic from the VPN to the services.

Answer

Use an Internet Gateway and route traffic from the VPN to the services.

Question 7

Which TWO of the following are required to enable cross-origin resource sharing (CORS) for an API hosted on Amazon API Gateway? (Choose two.)

Accepted Answer

Add an OPTIONS method to the API Gateway resource and configure it to return the required CORS headers. CORS requires a preflight OPTIONS request to determine if the actual request is safe to send. By adding an OPTIONS method to the API Gateway resource and configuring it to return the required CORS headers (such as Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers), the API can respond to the browser's preflight request and enable cross-origin requests.

Answer

Modify the Lambda function to return CORS headers in the response

Answer

Configure Amazon CloudFront to add CORS headers

Answer

Configure an S3 bucket CORS policy

Question 8

A developer is using Amazon DynamoDB to store session data for a web application. The application experiences read-heavy traffic and the developer wants to reduce latency. Which feature should be used to improve read performance?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, in-memory cache that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For read-heavy workloads like session data, DAX offloads read traffic from the DynamoDB table, reducing latency and providing a seamless caching layer without application code changes.

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Answer

DynamoDB Time to Live (TTL)

Question 9

A company has a REST API running on Amazon EC2 instances behind an Application Load Balancer. The API is accessed by mobile clients. The company wants to add authentication and authorization without modifying the backend code. Which AWS service should be used?

Accepted Answer

Amazon Cognito user pools integrated with the Application Load Balancer. Amazon Cognito user pools can be integrated directly with an Application Load Balancer (ALB) to handle authentication and authorization without modifying backend code. The ALB uses an OIDC-compatible identity provider (Cognito) to authenticate users before forwarding requests to the EC2 instances, allowing the backend to remain unchanged.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon API Gateway with a Lambda authorizer

Answer

Amazon CloudFront with Lambda@Edge

Question 10

A developer is using AWS CodePipeline to deploy a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The developer wants to automatically roll back the deployment if the CloudFormation stack update fails. Which configuration should be used?

Accepted Answer

Configure the CloudFormation stack to roll back on failure using the RollbackConfiguration.. CloudFormation natively supports automatic rollback on stack update failure through the `RollbackConfiguration` property. When a stack update fails, CloudFormation can automatically revert to the last known good state, which is exactly what the developer needs for a serverless deployment pipeline. This configuration can be set in the CloudFormation template or passed as a parameter during the deploy action in CodePipeline.

Answer

Add a stack policy to the CloudFormation stack to prevent updates.

Answer

Set the deployment to use AWS CodeDeploy and enable rollback.

Answer

Configure a manual approval action in the pipeline to trigger a rollback.

Question 11

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3 with S3 Server Access Logs

Question 12

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

Accepted Answer

Amazon API Gateway WebSocket API. Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Answer

Amazon SQS with long polling

Answer

Application Load Balancer with WebSocket support

Answer

Amazon CloudFront with WebSocket support

Question 13

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

Accepted Answer

Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.. A Lambda authorizer (formerly custom authorizer) runs before the backend Lambda invocation, caching the JWT validation result for a configurable TTL (default 300 seconds). This avoids re-validating the token on every request, providing the lowest latency for token validation compared to validating inside the backend Lambda.

Answer

Use a VPC Link to connect to a private server for validation.

Answer

Validate the token inside the Lambda function integrated with the API.

Answer

Use API Gateway request validation to check the header format.

Question 14

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 15

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

Accepted Answer

Enable Auto Scaling and configure scaling triggers based on CPU utilization.. Enabling Auto Scaling with CPU utilization triggers dynamically adds EC2 instances during peak hours, distributing the load and reducing latency without over-provisioning during off-peak times. This matches the symptom of under-provisioned instances and minimizes cost by scaling only when needed, unlike static solutions that waste resources.

Answer

Place the environment behind an Application Load Balancer.

Answer

Change the instance type to a larger size in the environment configuration.

Answer

Decrease the minimum number of instances in the Auto Scaling group.