DVA-C02 Development with AWS Services Practice Test 33 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.. Option A is correct because using AWS Secrets Manager allows automatic rotation and secure retrieval of secrets without hardcoding. Option B is wrong because environment variables are visible in the Lambda console. Option C is wrong because storing in S3 is less secure and requires additional permissions. Option D is wrong because IAM roles are for AWS services, not database credentials.

Answer

Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.

Answer

Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.

Answer

Hardcode the credentials as environment variables in the Lambda function configuration.

Question 2

A company runs a containerized application on Amazon ECS Fargate. The application writes logs to stdout. The operations team wants to centralize log monitoring and set up alarms for error patterns. What should a developer do to meet these requirements with minimal operational overhead?

Accepted Answer

Configure the ECS task definition to use the awslogs log driver and set the log group.. Option B is correct because the awslogs driver automatically sends stdout logs to CloudWatch Logs, enabling alarms and central monitoring. Option A is wrong because CloudWatch agent is for EC2. Option C is wrong because Kinesis adds complexity. Option D is wrong because CloudWatch Logs for ECS requires no extra SDK.

Answer

Use Amazon Kinesis Data Firehose to stream logs to Amazon S3 and then to CloudWatch Logs.

Answer

Modify the application code to use the AWS SDK for CloudWatch Logs to put log events.

Answer

Install the CloudWatch agent in the container and configure it to send logs.

Question 3

A developer is implementing a REST API using Amazon API Gateway and AWS Lambda. The API should return a static response from an Amazon S3 bucket for a specific GET endpoint without invoking a Lambda function. Which API Gateway integration type should be used?

Accepted Answer

HTTP_PROXY. Option C is correct because the HTTP proxy integration forwards requests directly to an HTTP endpoint, such as an S3 static website. Option A is wrong because MOCK returns a static response but does not integrate with S3. Option B is wrong because AWS proxy integrates with Lambda. Option D is wrong because it's for private integrations.

Answer

MOCK

Answer

AWS_PROXY

Answer

AWS

Question 4

A developer is designing a workflow using AWS Step Functions that includes a task to invoke an AWS Lambda function. The Lambda function sometimes times out due to long-running operations. The developer needs the workflow to wait for the Lambda function to complete asynchronously and retry on failure. Which Step Functions pattern should the developer use?

Accepted Answer

Use a Task state with .waitForTaskToken and have the Lambda function return the token upon completion.. Option A is correct because the Task token (.waitForTaskToken) allows the Lambda function to run asynchronously and call back with the token upon completion, enabling long-running operations. Option B is wrong because it's synchronous and tied to Lambda's timeout. Option C is wrong because it's for parallel execution. Option D is wrong because it doesn't involve Lambda.

Answer

Use a Task state that directly invokes the Lambda function synchronously.

Answer

Use a Parallel state to run multiple Lambda functions concurrently.

Answer

Use a Choice state to branch based on the Lambda function's output.

Question 5

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?

Accepted Answer

Create a custom buildspec.yml file in the source code that installs the dependencies in the install phase.. Option C is correct because a custom buildspec.yml can install dependencies in the install phase. Option A is wrong because CodePipeline does not manage environment variables for CodeBuild. Option B is wrong because it's not efficient to install manually. Option D is wrong because CodeCommit is a different source.

Answer

Configure environment variables in CodePipeline to set dependency paths.

Answer

Manually install dependencies on the CodeBuild build server each time.

Answer

Use AWS CodeCommit as the source repository instead of S3.

Question 6

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses a MySQL database. During deployment, the developer needs to apply database schema migrations. Which approach should the developer use to run database migrations as part of the Elastic Beanstalk deployment?

Accepted Answer

Use an .ebextensions configuration file to run a migration script during deployment.. Option A is correct because .ebextensions config files can run custom commands during deployment, such as a migration script. Option B is wrong because deployment hooks are for scripts, not RDS events. Option C is wrong because CodeDeploy is a separate service. Option D is wrong because Lambda is not triggered automatically during Beanstalk deployment.

Answer

Configure an RDS event subscription to trigger a Lambda function that runs migrations.

Answer

Run the migration script as a scheduled task using CloudWatch Events.

Answer

Use AWS CodeDeploy's AppSpec file to run the migration script.

Question 7

A developer is using Amazon DynamoDB to store session data for a web application. The application reads and writes a single item per user session. The traffic pattern shows occasional spikes. The developer wants to minimize read and write costs. Which DynamoDB capacity mode should the developer choose?

Accepted Answer

On-demand capacity. Option D is correct because on-demand capacity handles spikes automatically and is cost-effective for unpredictable traffic. Option A is wrong because provisioned capacity requires manual scaling and may throttle during spikes. Option B is wrong because reserved capacity is for predictable workloads. Option C is wrong because auto scaling adds latency and cost during scaling.

Answer

Reserved capacity

Answer

Provisioned capacity with manual scaling

Answer

Provisioned capacity with auto scaling

Question 8

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

Accepted Answer

Use Fn::ImportValue to import the exported outputs from the other stack.. Option C is correct because Fn::ImportValue imports exported outputs from another stack. Option A is wrong because Fn::GetAtt only works within the same stack. Option B is wrong because Fn::Ref returns a single value. Option D is wrong because nested stacks are more complex.

Answer

Use Fn::GetAtt to retrieve the IDs from the other stack's resources.

Answer

Use a nested stack to include the security group resources in the same template.

Answer

Use Fn::Ref to reference the security group IDs directly.

Question 9

A developer is creating an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message only once. Which SQS queue type should the developer use?

Accepted Answer

FIFO queue. Option A is correct because standard queues provide at-least-once delivery, not exactly-once. Option B is correct because FIFO queues guarantee exactly-once processing. Option C is wrong because DLQs are for failed messages. Option D is wrong because dead-letter queue is a feature, not a type.

Answer

Amazon SQS does not support exactly-once processing.

Answer

Dead-letter queue

Answer

Standard queue

Question 10

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO options can the developer use for service discovery?

Accepted Answer

AWS Cloud Map. Option A is correct because Cloud Map provides DNS-based service discovery. Option D is correct because Service Connect is a native ECS feature for service discovery. Option B is wrong because R53 private hosted zones are for custom domain names, not dynamic service discovery. Option C is wrong because ALB is for load balancing, not service discovery. Option E is wrong because Global Accelerator is for global traffic.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 private hosted zones

Answer

Application Load Balancer internal

Question 11

A developer is using AWS CodeBuild to run unit tests as part of a CI/CD pipeline. The developer wants to store the test results for later analysis. Which TWO AWS services can the developer use to store and view the test reports?

Accepted Answer

AWS CodeBuild test reports. Option B is correct because CodeBuild can publish test reports to the CodeBuild console. Option E is correct because CodeBuild can also upload raw test results to S3. Option A is wrong because X-Ray is for tracing. Option C is wrong because CloudWatch Logs is for logs, not structured reports. Option D is wrong because Athena is for querying data in S3, not storing reports.

Answer

AWS X-Ray

Answer

Amazon Athena

Answer

Amazon CloudWatch Logs

Question 12

A developer is using AWS Lambda with an Amazon DynamoDB trigger. The Lambda function processes items from a DynamoDB Stream. The developer needs to ensure that the function processes each change exactly once and in order. Which TWO configurations should the developer use?

Accepted Answer

Set a reserved concurrency for the Lambda function to limit concurrent executions.. Option A is correct because a Lambda reservation ensures concurrency for the function. Option C is correct because specifying a batch size of 1 processes each record individually, ensuring order. Option B is wrong because DynamoDB Streams is already ordered by default; no need for FIFO. Option D is wrong because increasing concurrency is unnecessary. Option E is wrong because batch window is not needed.

Answer

Use a FIFO queue as an event source instead of DynamoDB Streams.

Answer

Increase the Lambda function's concurrency limit.

Answer

Enable the batch window in the event source mapping.

Question 13

Refer to the exhibit. An IAM policy is attached to a Lambda function's execution role. The Lambda function is triggered by an S3 event and needs to invoke another Lambda function and decrypt an S3 object encrypted with a customer-managed KMS key. However, the invocation fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The policy is missing kms:GenerateDataKey and kms:Decrypt might not be sufficient for all decryption scenarios.. Option C is correct because the policy allows kms:Decrypt but not kms:DescribeKey or other necessary actions for decryption; also, the function might need kms:Decrypt on the key. Option A is wrong because kms:Decrypt is allowed. Option B is wrong because the resource is specific. Option D is wrong because the policy does not cover S3 actions, but the error is about invocation.

Answer

The policy does not allow s3:GetObject on the S3 bucket.

Answer

The policy resource for Lambda is incorrect.

Answer

The policy does not allow kms:Decrypt for the key.

Question 14

Refer to the exhibit. A developer creates a CloudFormation stack with this template. The developer wants to ensure that all objects uploaded to the bucket are encrypted at rest using SSE-KMS. However, the current policy allows anyone to put objects without encryption. What additional change is needed to enforce SSE-KMS?

Accepted Answer

Set the bucket's default encryption configuration to SSE-KMS.. Option B is correct because the policy condition only checks for the header, but if the user does not specify it, the request is denied. However, the bucket policy should also deny PutObject if the header is not present, which is already done via the condition. But the issue is that the bucket does not have a default encryption setting. Option A is wrong because the condition already requires the header. Option C is wrong because the condition is already correct. Option D is wrong because bucket policy already exists.

Answer

Add a bucket policy that denies PutObject if encryption is not set.

Answer

Modify the condition to use s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

Remove the condition to allow all PutObject requests.

Question 15

A company runs a production web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic across multiple EC2 instances in an Auto Scaling group. The application uses an Amazon Aurora MySQL database. The operations team reports that the application is experiencing intermittent latency spikes, especially during peak hours. Investigation reveals that the database CPU utilization is consistently above 80% and there are many slow queries. The developer is asked to improve database performance without changing the application code. Which solution should the developer implement?

Accepted Answer

Implement an Amazon RDS Proxy in front of the Aurora cluster to manage database connections efficiently.. Option A is correct because adding an RDS Proxy reduces connection management overhead and can improve latency. Option B is wrong because scaling EC2 instances does not help database performance. Option C is wrong because ElastiCache requires application changes. Option D is wrong because increasing instance size helps but may be costly and not address connection pooling.

Answer

Use Amazon ElastiCache to cache frequently accessed data.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances.

Answer

Upgrade the Aurora instance to a larger instance type.