DVA-C02 Development with AWS Services Practice Test 5 — 15 Questions

Question 1

A company has a microservices architecture running on Amazon ECS with Fargate. Each service exposes an API through an Application Load Balancer (ALB). The development team needs to implement canary deployments for one of the services. What is the MOST efficient way to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CodeDeploy with an ECS blue/green deployment configuration that supports canary traffic shifting.. AWS CodeDeploy natively supports blue/green and canary deployments (e.g., ECSCanary10Percent5Minutes) for Amazon ECS. While ALB weighted target groups and ECS Task Sets are the underlying mechanisms used during these deployments, managing them manually (Option C) requires using the EXTERNAL deployment controller and writing custom orchestration code, which is highly inefficient. CodeDeploy automates this entire process seamlessly.

Answer

Create two ECS services behind the same ALB, each with a different task definition, and use sticky sessions.

Answer

Use Amazon Route 53 weighted routing policies to distribute traffic between two ALBs.

Answer

Configure the ALB to use weighted target groups, each pointing to a different task set of the same ECS service.

Question 2

A company is using AWS CloudFormation to deploy a web application. The template creates an Auto Scaling group, an Application Load Balancer, and a security group. The developer wants to ensure that the stack update fails if the new Auto Scaling group instances fail health checks. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Configure the Auto Scaling group to send a signal to CloudFormation using cfn-signal.. To ensure that a stack update fails if new Auto Scaling group (ASG) instances fail health checks, you must: 
1. Associate the ASG with an Application Load Balancer (ALB) target group so that the load balancer can perform health checks on the instances.
2. Add an UpdatePolicy to the ASG (specifically with AutoScalingRollingUpdate and WaitOnResourceSignals set to true) so that CloudFormation pauses the update and waits for signals from the new instances.
3. Configure the instances (via UserData) to send a success signal to CloudFormation using the cfn-signal helper script once they pass local health/startup checks.

Answer

Add a CreationPolicy to the Auto Scaling group.

Answer

Use the AWS::CloudFormation::Init metadata to run a health check script.

Question 3

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The API should only be accessible from a specific VPC. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for API Gateway.. Creating a VPC endpoint for API Gateway (of type `execute-api`) allows API Gateway to be accessed privately from within a specific VPC without traversing the public internet. This endpoint uses AWS PrivateLink to provide a private IP address within the VPC, ensuring traffic stays within the AWS network.

Answer

Use an API key that is only known within the VPC.

Answer

Configure the Lambda function to be VPC-enabled.

Answer

Create a VPC endpoint for Lambda.

Question 4

The IAM policy above is attached to a user. The user tries to decrypt a KMS key with encryption context {"department": "finance"}. What will happen?

Accepted Answer

The action is allowed because the Allow statement matches the encryption context.. The question stem references an IAM policy ('The IAM policy above is attached to a user...'), but no policy is provided in the prompt. Without the policy, it is impossible to evaluate the correctness of the options or the explanation.

Answer

The action is denied because the Deny statement applies to all resources.

Answer

The action is denied because there is an explicit Deny that overrides any Allow.

Answer

The action is denied because the Allow statement does not explicitly allow.

Question 5

A developer is using Amazon DynamoDB as a data store for a serverless application. The application requires strongly consistent reads and must be able to recover from failures. Which THREE measures should the developer implement? (Choose THREE.)

Accepted Answer

Use the ConsistentRead parameter set to true in GetItem and Query operations.. To meet the requirements of strongly consistent reads and recovery from failures, the developer should implement the following measures: 
- **A**: Using the `ConsistentRead` parameter set to `true` in `GetItem` and `Query` operations ensures strongly consistent reads, guaranteeing the most up-to-date data after a write.
- **C**: Configuring DynamoDB global tables provides multi-region replication, enabling disaster recovery by replicating data across AWS regions.
- **D**: Enabling DynamoDB Streams captures item-level changes, which can be used to replicate data to other tables or regions for recovery purposes.

Option B is incorrect because DynamoDB does not support read replicas like traditional databases. Option E (DAX) is a caching layer that improves read performance but does not provide failure recovery or strong consistency; it serves eventually consistent data by default.

Answer

Use DynamoDB read replicas to offload read traffic.

Answer

Implement DAX (DynamoDB Accelerator) for caching.

Question 6

A company is using Amazon S3 to store sensitive documents. They must encrypt all objects at rest. Which TWO methods can be used to enforce server-side encryption? (Choose TWO.)

Accepted Answer

Set a bucket policy that denies PutObject if x-amz-server-side-encryption header is not present.. Option A is correct because an S3 bucket policy can be configured to deny `s3:PutObject` requests if they do not include the `s3:x-amz-server-side-encryption` header, thereby forcing clients to explicitly request server-side encryption. Option B is correct because enabling default encryption on the S3 bucket automatically encrypts all new objects at rest using SSE-S3 (or SSE-KMS if configured), even if the incoming `PutObject` request does not specify any encryption headers.

Answer

Attach an IAM policy that denies all S3 actions unless encryption is specified.

Answer

Configure an SQS queue policy to require encryption.

Answer

Use client-side encryption before uploading objects.

Question 7

A company is using AWS Step Functions to orchestrate a workflow that processes orders. The workflow includes a task that calls a Lambda function to validate the order. If the validation fails, the workflow should wait for manual approval before proceeding. What is the MOST efficient way to implement this manual approval step?

Accepted Answer

Use a Step Functions activity task that sends a message to an Amazon SQS queue. The approval process polls the queue and sends a task success response with the .taskToken.. The callback pattern (.waitForTaskToken) allows Step Functions to pause a workflow execution until it receives a task token back. By configuring a Task state to send a message to an Amazon SQS queue (or SNS topic) with the task token, the workflow pauses. An external approval system (such as a web app or Lambda function triggered by an approval action) can then call SendTaskSuccess or SendTaskFailure with the token to resume the workflow. This is the most efficient and native way to implement manual approvals.

Answer

Publish a message to an Amazon SNS topic that triggers an email to the approver. The workflow continues after a fixed timeout.

Answer

Schedule a CloudWatch Events rule to trigger a Lambda function that checks for approval status in a DynamoDB table.

Answer

Use Amazon Cognito to manage user identities and require the approver to authenticate via a web portal.

Question 8

A company has a production AWS Lambda function that processes critical financial transactions. The function's code is stored in an S3 bucket. A developer accidentally deletes the S3 bucket, causing the function to fail. The developer wants to prevent this in the future by ensuring that the Lambda function can always be updated and deployed even if the original S3 bucket is deleted. What should the developer do?

Accepted Answer

Update the Lambda function code directly using the AWS CLI or SDK, and remove the dependency on S3 for future updates.. Updating the Lambda function code directly via the AWS CLI or SDK (e.g., using `update-function-code` with the `--zip-file` parameter) eliminates the dependency on an external S3 bucket for deployment. By uploading the code directly, the function remains deployable even if the original S3 bucket is deleted. This approach ensures the deployment artifact is stored within the Lambda service itself, decoupling it from S3 bucket availability.

Answer

Enable AWS CloudTrail to monitor bucket deletions.

Answer

Set up cross-region replication to another S3 bucket.

Answer

Enable versioning on the S3 bucket.

Question 9

A developer is designing a microservices architecture using Amazon ECS with Fargate. The application needs to store and retrieve user session data. Which TWO AWS services can be used to store session state?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for storing session state. It supports Time to Live (TTL) to automatically expire old sessions. Amazon ElastiCache for Redis is an in-memory key-value store that provides sub-millisecond latency, making it another excellent choice for fast, low-latency session state management in stateless microservices architectures.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Question 10

A developer is building an API using Amazon API Gateway and AWS Lambda. The API must authenticate users using a third-party OAuth 2.0 provider. Which TWO components are required to implement this authentication?

Accepted Answer

The OAuth 2.0 access token in the Authorization header. The OAuth 2.0 access token must be sent in the Authorization header for the Lambda authorizer to validate. Option D is correct because the Lambda authorizer function is responsible for decoding and verifying the token against the third-party OAuth provider. Option C is incorrect because a resource policy controls access to the API but does not invoke the authorizer; the authorizer is configured via API Gateway authorizer settings, not a resource policy. Therefore, only options A and D are the required components.

Answer

Amazon CloudFront distribution for API caching

Answer

An API Gateway resource policy that invokes the Lambda authorizer

Answer

An Amazon Cognito user pool as the OAuth provider

Question 11

A developer is using AWS CodePipeline to automate the deployment of a web application. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which TWO actions can the developer take to automatically trigger the pipeline when new code is uploaded to the S3 bucket?

Accepted Answer

Configure an S3 event notification that sends to an Amazon SNS topic, which triggers an AWS Lambda function that starts the pipeline.. Option C is correct because AWS CodePipeline natively integrates with Amazon EventBridge (formerly CloudWatch Events) to automatically detect changes in an S3 source bucket (using AWS CloudTrail data events or S3 EventBridge notifications) and trigger the pipeline execution directly. This is the AWS-recommended approach.

Option B is also correct because you can set up an Amazon S3 event notification to publish to an Amazon SNS topic when a new object is created. This SNS topic can trigger an AWS Lambda function, which programmatically starts the pipeline using the `StartPipelineExecution` API call.

Answer

Configure an Amazon SQS queue to poll the S3 bucket for new objects and invoke the pipeline.

Answer

Use an AWS Lambda function that periodically checks the S3 bucket for new objects.

Answer

Use AWS CodeStar to automatically detect changes in the S3 bucket.

Question 12

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to the S3 bucket 'example-bucket' from an IP address 198.51.100.5. What will happen?

Accepted Answer

The request is allowed because the action s3:PutObject is allowed.. The IAM policy grants permission for the `s3:PutObject` action on `arn:aws:s3:::example-bucket/*` under the condition that the request originates from the IP range `198.51.100.0/24`. Since the user's IP address (198.51.100.5) falls within this CIDR block, the condition is satisfied, and the request is allowed. A bucket policy is not required if the IAM policy already grants the necessary permissions.

Answer

The request is allowed because the user is an IAM user.

Answer

The request is denied because the source IP does not match the condition.

Answer

The request is denied because the bucket policy is missing.

Question 13

Refer to the exhibit. An IAM policy statement is attached to an AWS Lambda function's execution role. The function needs to invoke another Lambda function named 'my-function'. However, the invocation fails with an access denied error. What is the most likely cause?

Accepted Answer

The action should be 'lambda:*' to allow all Lambda actions.. In AWS IAM, the permission required to invoke a Lambda function is `lambda:InvokeFunction`. Although the API action is called `Invoke`, the corresponding IAM action is `lambda:InvokeFunction`. Using `lambda:Invoke` is invalid and will result in an AccessDeniedException.

Answer

The Lambda function has a timeout set too low.

Answer

The resource ARN is missing the function name.

Answer

The policy is attached to the wrong IAM role.

Question 14

A company runs a critical application on AWS Lambda that processes real-time data from Kinesis Data Streams. The function is idempotent, but occasionally duplicate records are processed due to retries. The company wants to ensure exactly-once processing. Which approach should the developer implement?

Accepted Answer

Use a DynamoDB table to store processed record IDs and perform deduplication in the Lambda function.. DynamoDB provides a scalable, low-latency store for tracking processed record IDs, enabling the Lambda function to check for duplicates before processing. Since the function is idempotent but retries cause duplicates, a DynamoDB-based deduplication layer ensures exactly-once semantics without altering the event source or introducing ordering constraints.

Answer

Use an SQS FIFO queue between Kinesis and Lambda.

Answer

Enable Lambda reserved concurrency to limit retries.

Answer

Reduce the batch size in the event source mapping.

Question 15

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The application experiences occasional throttling on DynamoDB writes. The developer wants to implement a retry mechanism with exponential backoff. Which THREE steps should the developer take?

Accepted Answer

Configure a dead-letter queue (DLQ) for the Lambda function to capture failed events.. Configuring a dead-letter queue (DLQ) for the Lambda function allows failed events (e.g., DynamoDB write throttling after retries) to be captured for later analysis or reprocessing. This ensures that events that exhaust the retry budget are not lost and can be investigated or replayed, which is a standard pattern for handling transient failures in serverless architectures.

Answer

Use Amazon SQS to buffer write requests to DynamoDB.

Answer

Increase the DynamoDB table's provisioned write capacity.