DVA-C02 Deployment Practice Test 25 — 15 Questions

Question 1

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The native library is compiled for a different operating system than Lambda (Amazon Linux).. AWS Lambda runs on Amazon Linux, which uses a different kernel and C runtime than typical local development environments (e.g., macOS or Windows). Native libraries compiled for a local OS will not be compatible with Lambda's execution environment, causing the 'Unable to import module' error. The developer must compile the native library on Amazon Linux or use a Lambda-compatible container to ensure binary compatibility.

Answer

The Lambda function's IAM role does not have permission to access the library.

Answer

The Lambda function's handler configuration is incorrect.

Answer

The Lambda function's timeout is too short.

Question 2

A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Options A and D are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store (with SecureString parameter type) are secure services for storing and retrieving database credentials at runtime. Option B is incorrect because storing credentials in an S3 bucket is not a secure practice for secrets management, even with server-side encryption, as access policies may inadvertently expose the bucket and it is not designed for secret rotation or fine-grained access control. Option C is incorrect because hardcoding credentials in the application code exposes them in version control and to anyone with access to the code. Option E is incorrect because environment variables in Elastic Beanstalk can be viewed in the environment configuration and may be exposed in logs or through other AWS services if not carefully managed.

Answer

Store credentials in an Amazon S3 bucket with server-side encryption.

Answer

Hardcode credentials in the application configuration file.

Answer

Store credentials as environment variables in the Elastic Beanstalk environment.

Question 3

A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)

Accepted Answer

Add a manual approval step before the deploy stage.. To ensure only approved changes are deployed to production, the developer should implement a manual approval step (option C) to gate deployments, use separate pipelines for different environments (option D) to isolate changes, and include integration tests in the build stage (option E) to catch errors early. Automatic deployment to production (option A) bypasses approval, and deploying all feature branches directly (option B) introduces unverified code, making both risky.

Answer

Configure the pipeline to automatically deploy every commit to production.

Answer

Deploy all feature branches directly to production.

Question 4

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Accepted Answer

Enable termination protection on the CloudFormation stack.. The correct strategies to protect a resource from accidental deletion during stack updates or deletions are: Enable termination protection on the CloudFormation stack (Option B) prevents the entire stack from being deleted, thus protecting all resources. Use a stack policy to deny delete actions on the resource (Option D) can explicitly deny updates or deletions to specific resources. Set the DeletionPolicy attribute to 'Retain' on the resource (Option E) ensures the resource is retained even if the stack is deleted. Option A is incorrect because wrapping a resource in a nested stack does not inherently protect it from deletion; the nested stack itself could be deleted. Option C is incorrect because UpdateReplacePolicy only affects behavior during stack updates that replace the resource, not during deletions; it is used to retain the old resource when a replacement occurs, but does not prevent deletion during stack deletion.

Answer

Wrap the resource in a nested stack.

Answer

Set the UpdateReplacePolicy attribute to 'Retain' on the resource.

Question 5

An organization wants to deploy a microservices architecture using AWS Lambda functions. They need to manage environment variables for each function across different stages (dev, test, prod). Which approach is the MOST secure and maintainable?

Accepted Answer

Use AWS Systems Manager Parameter Store with separate paths for each stage.. AWS Systems Manager Parameter Store (Option A) is the most secure and maintainable approach for managing environment variables across stages. It provides hierarchical storage (e.g., /dev/myapp/var, /prod/myapp/var), supports encryption with AWS KMS, and can be referenced by Lambda functions using the AWS SDK. Option B (CloudFormation parameters) ties configuration to deployment templates and does not provide a secure, runtime-configurable store. Option C (hardcoding) is insecure and not maintainable. Option D (storing in Lambda configuration) lacks the stage-specific hierarchy and encryption features of Parameter Store.

Answer

Use AWS CloudFormation parameters to pass values at deployment.

Answer

Hardcode the environment variables in each Lambda function code.

Answer

Store environment variables in the Lambda function configuration.

Question 6

A developer wants to deploy a static website to AWS. The website content is stored in an S3 bucket. Which combination of actions is required to host the website? (Choose TWO.)

Accepted Answer

Enable static website hosting on the S3 bucket.. To host a static website on S3, you must enable static website hosting on the bucket (option B) and make the objects publicly readable (option E). Option A (server access logging) is optional for tracking requests, not required. Option C (restricting access to a specific IP) would prevent public access, which is needed for a public website. Option D (CloudFront) is an optional CDN service, not a requirement for S3 static website hosting.

Answer

Enable server access logging.

Answer

Set a bucket policy that restricts access to a specific IP.

Answer

Configure Amazon CloudFront as a CDN.

Question 7

Which TWO actions should a developer take to ensure that an AWS CodeDeploy deployment is successful when deploying to an Auto Scaling group? (Choose TWO.)

Accepted Answer

Create an IAM service role that allows CodeDeploy to access the instances.. The correct actions are to create an IAM service role that allows CodeDeploy to access the instances (Option A) and install the CodeDeploy agent on each EC2 instance in the Auto Scaling group (Option E). The service role grants CodeDeploy the necessary permissions to deploy to the instances, and the agent must be running on each instance to receive and execute deployment commands. Option B is not required; a load balancer is optional and not necessary for successful deployments. Option C is irrelevant; the Application Discovery Service is used for discovery and migration planning, not for CodeDeploy. Option D is not required; CodeDeploy supports both in-place and blue/green deployments, but the question does not specify which type, and a blue/green deployment is not mandatory for success.

Answer

Attach an Application Load Balancer to the Auto Scaling group.

Answer

Enable the Application Discovery Service for the instances.

Answer

Configure the deployment to use a blue/green deployment type.

Question 8

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Answer

AWS CodeBuild

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 9

Refer to the exhibit. A developer is trying to deploy an EC2 instance using AWS CloudFormation. The stack creation fails with an 'AccessDenied' error when CloudFormation tries to create the EC2 instance. The developer has the IAM policy above. What is the MOST likely reason for the failure?

Accepted Answer

The IAM role specified in the CloudFormation template is not the same as the one in the PassRole resource.. CloudFormation needs permission to pass the IAM role specified in the template. The policy allows PassRole only for a specific role ARN. If the template specifies a different role, CloudFormation cannot pass it, resulting in an AccessDenied error. Option A is incorrect because ec2:DescribeImages is allowed in the policy. Option C is incorrect because ec2:RunInstances is allowed. Option D is incorrect because ec2:TerminateInstances is not called during stack creation, and the policy allows it anyway.

Answer

The policy does not allow ec2:DescribeImages.

Answer

The policy does not allow ec2:RunInstances.

Answer

The policy does not allow ec2:TerminateInstances.

Question 10

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

Accepted Answer

Create an Amazon RDS database instance separately and configure the application to connect to it.. The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Answer

Use the Elastic Beanstalk console to add an RDS database to the environment.

Answer

Use an S3 bucket to store data.

Answer

Use Amazon DynamoDB as the database.

Question 11

A developer is deploying a Lambda function that processes images uploaded to an S3 bucket. The function is triggered by S3 events. After deployment, the function does not execute when new images are uploaded. What is the MOST likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured for the Lambda function.. The most likely cause is that the S3 bucket does not have an event notification configured to invoke the Lambda function. S3 event notifications must be explicitly set on the bucket to trigger a Lambda function when objects are created; without this configuration, S3 will not send any invocation request to Lambda, regardless of the function's permissions or settings.

Answer

The Lambda function memory is set too low.

Answer

The Lambda function does not have permission to read from the S3 bucket.

Answer

The Lambda function is not in the same region as the S3 bucket.

Question 12

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Globals. The `Globals` section in an AWS SAM template allows you to define shared configuration settings that apply to all resources in the template. For API Gateway, you can set properties like `StageName` under `Globals.Api`, which will be inherited by all API Gateway resources defined in the template, ensuring consistent stage naming without repeating the configuration.

Answer

Conditions

Answer

Outputs

Answer

Parameters

Question 13

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Options A and D are correct. A: Viewing stack events (Events tab) shows error messages for each resource, which can indicate which resource failed and why. D: Reviewing the stack template for logical errors can help identify issues like missing dependencies or incorrect parameter values. Option B is wrong because stack outputs are only available after successful creation; during a failure, outputs are not generated. Option C is wrong because deleting and recreating the stack with the same parameters will likely result in the same failure and also removes the stack's logs and events, losing troubleshooting information. Option E is wrong because CloudTrail logs API calls made to AWS, but CloudFormation-specific errors during resource creation are not detailed in CloudTrail; stack events provide more relevant information.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 14

A developer is using AWS CodeDeploy to deploy an application to an Amazon EC2 Auto Scaling group. The deployment fails because the CodeDeploy agent on the instances is not running. Which TWO steps should the developer take to resolve this issue? (Choose TWO.)

Accepted Answer

Install the CodeDeploy agent on the instances.. The issue is that the CodeDeploy agent is not running on the instances. To resolve this, the developer should first ensure the agent is installed (Option B) and then start the agent service (Option C). Option A is incorrect because attaching an IAM role allows permissions but does not install or start the agent. Option D is incorrect because rebooting does not fix missing or stopped agents. Option E is incorrect because user data runs only at launch, not on existing instances; it is a preventive measure, not a fix for already-running instances.

Answer

Attach an IAM role to the instances that allows CodeDeploy actions.

Answer

Reboot the instances.

Answer

Add a script in the Auto Scaling group's launch configuration user data to install the agent.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The application uses an Amazon RDS database. The developer wants to ensure that the database connection string is not hard-coded in the application code. Which THREE methods can the developer use to pass the connection string securely? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager.. To pass the database connection string securely without hard-coding it, developers can use AWS Secrets Manager (B) to store and retrieve secrets programmatically, Elastic Beanstalk environment properties (C) to inject configuration into the application environment, and AWS Systems Manager Parameter Store (E) to securely store strings and secrets. Option A is incorrect because RDS tags are not designed for sensitive data like connection strings. Option D is incorrect because storing the connection string in a configuration file within the application bundle would expose it in the source code and deployment package.

Answer

Read the connection string from Amazon RDS tags.

Answer

Store the connection string in a configuration file in the application bundle.