DVA-C02 Hard Questions — 25 Difficult Questions

Question 1

A company wants to grant a third-party vendor access to an Amazon S3 bucket in the company's AWS account. The vendor has their own AWS account. The company requires the vendor to include a unique identifier in each request to verify their identity before granting access. Which policy element should the company include in the S3 bucket policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Condition with sts:ExternalId. The `sts:ExternalId` condition key is specifically designed for scenarios where a third party (the vendor) needs to access AWS resources in your account, and you want to ensure that the vendor includes a unique identifier in each request. This prevents the confused deputy problem by requiring the vendor to pass the external ID in the `AssumeRole` call. By including this condition in the IAM role's trust policy, the company can verify that the request originates from the intended vendor and not from another entity trying to misuse the permissions.

Answer

Condition with aws:SourceArn

Answer

Condition with aws:SourceAccount

Answer

Principal element with the vendor's AWS account ID

Question 2

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation. AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.

Answer

Manually rotate the KMS key every year

Answer

Create a new KMS key and update all applications to use it

Answer

Use AWS CloudWatch Events to trigger a Lambda function that rotates the key

Question 3

A developer is building a serverless application using AWS Lambda and API Gateway. The API should be accessible only from a specific VPC. What is the MOST secure way to achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. The most secure way to restrict API Gateway access to a specific VPC is to create a VPC endpoint for API Gateway (using AWS PrivateLink) and attach a resource policy to the API that allows access only from that VPC endpoint using the aws:SourceVpce condition. Option A is incorrect because security groups cannot be attached to API Gateway; they are used for EC2 instances or other VPC resources. Option B is incorrect because a private API Gateway endpoint does allow access from within the VPC, but without a resource policy, the API could still be accessible from other sources if the endpoint is shared or if the API is not properly restricted. Option C is incorrect because VPC peering is used to connect VPCs; API Gateway is not in a VPC, so peering does not apply.

Answer

Attach a security group to the API Gateway that only allows traffic from the VPC.

Answer

Create a private API Gateway endpoint and associate it with the VPC.

Answer

Set up VPC Peering between the VPC and the API Gateway's VPC.

Question 4

A developer is trying to update a CloudFormation stack that includes a Lambda function. The stack rolls back with the error shown. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have a trust policy that allows Lambda to assume it.. The error message indicates that the IAM role cannot be assumed by Lambda. This typically means the trust policy of the execution role does not include 'lambda.amazonaws.com' as a trusted entity. Option A is incorrect because the error is about assuming the role, not about writing logs. Option B is incorrect because the error is not about the deployment package location. Option C is incorrect because the error is not about code size.

Answer

The Lambda function's execution role lacks permissions to write logs to CloudWatch.

Answer

The Lambda function's deployment package is not stored in Amazon S3.

Answer

The Lambda function's code is too large for the deployment.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to enable caching for API responses to reduce latency and cost. Which step is REQUIRED to enable caching?

Accepted Answer

Create a cache cluster in API Gateway for the stage. API Gateway caching requires a dedicated cache cluster to be enabled and configured at the stage level. This cluster stores API responses and serves them directly from the cache for identical requests, reducing the number of calls to the backend Lambda function and lowering latency. Without creating and enabling this cache cluster in the API Gateway stage settings, caching cannot function.

Answer

Enable caching in the Lambda function code

Answer

Set the TTL in the API Gateway method request integration

Answer

Use Amazon ElastiCache and modify the Lambda function to check cache

Question 6

Refer to the exhibit. A developer deploys this CloudFormation template. After deployment, the S3 bucket is created but the developer notices that the lifecycle rule does not appear in the bucket's management console. What is the most likely cause?

Accepted Answer

The VersioningConfiguration is incorrectly specified.. The VersioningConfiguration might be incorrectly specified, such as setting it to 'Suspended' while the lifecycle rule requires versioning to be enabled for actions like 'NoncurrentVersionExpiration'. If versioning is not enabled, the lifecycle rule may not be applied or may not appear in the management console. Option A is incorrect because the 'Prefix' property is optional; an omitted prefix means the rule applies to all objects and is still valid. Option B is incorrect because lifecycle rules are not required to have a 'Transitions' property; they can have other actions like 'Expiration'. Option D is incorrect because bucket names can contain account IDs as long as they are globally unique.

Answer

The lifecycle rule is missing the 'Prefix' property, causing it to be invalid.

Answer

The lifecycle rule must have a 'Transitions' property.

Answer

The bucket name contains an account ID, which is not allowed.

Question 7

A company runs a containerized web application on Amazon ECS with Fargate launch type. The application experiences intermittent HTTP 503 errors. The ECS service auto-scales based on CPU, but the errors persist. What is the most likely cause and solution?

Accepted Answer

The ALB health check interval is too short; increase the health check interval.. HTTP 503 errors from an ALB typically indicate that the targets are failing health checks. In an ECS Fargate service with auto-scaling, new tasks may require time to initialize and pass health checks. If the health check interval is too short, tasks may be considered unhealthy before they are ready, leading to 503 errors. Increasing the health check interval gives tasks more time to become healthy. Option B is incorrect because increasing the CPU threshold would reduce the frequency of scaling, potentially worsening the errors. Option C is incorrect because the idle timeout relates to 504 (gateway timeout) errors, not 503. Option D is incorrect because Fargate does not use EC2 instances; it runs tasks without managing underlying infrastructure.

Answer

The CPU threshold is too low; increase the target value to 80%.

Answer

The ALB idle timeout is too low; increase it to 300 seconds.

Answer

The cluster does not have enough EC2 instances; add more instances.

Question 8

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

Accepted Answer

The Error document field in the static website hosting configuration is not set to error.html.. When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Answer

The bucket policy denies access to the error.html object.

Answer

The index.html is missing from the bucket.

Answer

The error.html object has incorrect permissions.

Question 9

An application uses a custom KMS key to encrypt data. The application runs on an EC2 instance. To decrypt data, the application must call KMS. What is the BEST practice to securely provide the KMS key ID to the application?

Accepted Answer

Use an environment variable to pass the key ID to the application. The best practice is to use an environment variable to pass the KMS key ID to the application. This avoids hardcoding or storing the key ID in a file, which can be exposed. Option D is correct because environment variables are flexible and secure when managed properly. Option A is wrong because hardcoding the key ID in code is insecure and not maintainable. Option B is wrong because storing the key ID in a configuration file on the instance is less secure and can be accessed if the instance is compromised. Option C is wrong because an IAM role provides permissions but does not directly supply the key ID; the application would still need to retrieve it from somewhere else, such as an environment variable or parameter store.

Answer

Hardcode the key ID in the application code

Answer

Store the key ID in a configuration file on the instance

Answer

Retrieve the key ID using the instance's IAM role

Question 10

A developer performed a CodeDeploy deployment to an Auto Scaling group. The deployment status is Failed with code HEALTH_CONSTRAINTS. Based on the exhibit, what is the most likely cause?

Accepted Answer

The minimum number of healthy instances required for the deployment was not met. The error 'HEALTH_CONSTRAINTS' means that too many instances failed health checks. The deployment overview shows 2 failed instances and 3 succeeded. The minimum healthy instances setting likely required more than 3 healthy instances. Option B is correct. Option A (incorrect application revision) would cause a different error. Option C (CodeDeploy agent) would show agent issues. Option D (permissions) would cause access denied errors.

Answer

The CodeDeploy agent on the instances is not running

Answer

The application revision contains invalid scripts

Answer

The IAM role for CodeDeploy does not have sufficient permissions

Question 11

A company is using AWS CloudFormation to deploy infrastructure. The developer needs to update a stack but wants to avoid downtime for a critical database. Which THREE strategies should the developer consider?

Accepted Answer

Use the UpdateReplace policy to create a new resource before deleting the old one.. The `UpdateReplace` policy (specifically using a `CreationPolicy` and `UpdatePolicy` with `AutoScalingReplacingUpdate`) instructs CloudFormation to create a replacement resource before deleting the original, ensuring zero downtime during a stack update that requires resource replacement. This is critical for a database where continuous availability is required.

Answer

Set the DeletionPolicy attribute to Retain on the database resource.

Answer

Use the Parameters section to set a conditional update flag.

Question 12

A developer is using IAM roles for Amazon EC2 to grant permissions to an application. The application makes API calls to DynamoDB and S3. After deploying, the application fails to access DynamoDB. The developer verifies the IAM role has the correct DynamoDB permissions. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance profile.. For an EC2 instance to use an IAM role, the role must be attached to an EC2 instance profile, which is the container that passes the role's credentials to the instance via the instance metadata service. Even if the IAM role has the correct DynamoDB permissions, if it is not associated with the instance profile, the application will not receive temporary credentials and will fail to access DynamoDB.

Answer

The IAM role does not have a trust policy for EC2.

Answer

The DynamoDB table is in a different region than the EC2 instance.

Answer

The application is using the wrong AWS SDK.

Question 13

A company runs a monolithic application on EC2 Behind an Application Load Balancer. They want to migrate to a microservices architecture using ECS Fargate. What is the most important optimization to ensure minimal downtime during the migration?

Accepted Answer

Use a blue/green deployment strategy with weighted target groups.. A blue/green deployment strategy with weighted target groups allows you to gradually shift traffic from the existing monolithic EC2 application (blue) to the new microservices on ECS Fargate (green) while monitoring for errors. This minimizes downtime by enabling instant rollback if issues arise, and it leverages Application Load Balancer (ALB) features like stickiness and health checks to ensure a seamless transition without disrupting active connections.

Answer

Increase the EC2 instance size to handle the microservices load.

Answer

Deploy all microservices in a single ECS service for simplicity.

Answer

Scale horizontally by adding more EC2 instances.

Question 14

A developer is troubleshooting an AWS Lambda function that is invoked from an Amazon S3 bucket via event notifications. The function processes images and stores metadata in Amazon DynamoDB. The developer notices that some images are being processed multiple times, resulting in duplicate entries in DynamoDB. The S3 event notification is configured to send events to the Lambda function with the 's3:ObjectCreated:*' event type. The function uses the 'uuid' library to generate a unique ID for each image upon processing. What is the most likely cause of the duplicate processing?

Accepted Answer

S3 event notifications are delivered at least once, and the Lambda function is not idempotent.. Amazon S3 event notifications are delivered on an 'at least once' basis, meaning the same event can be sent to Lambda multiple times. If the Lambda function is not idempotent—i.e., processing the same event multiple times produces duplicate side effects—then duplicate DynamoDB entries will occur. The use of a 'uuid' library inside the function does not help because a new UUID is generated on each invocation, so the same image gets different IDs and is stored as a separate item each time.

Answer

The Lambda function's concurrency is set too high, causing race conditions.

Answer

The DynamoDB table does not have a primary key that prevents duplicates.

Answer

The S3 bucket is configured with versioning, causing multiple object creation events.

Question 15

A company has multiple AWS accounts managed under AWS Organizations. The security team requires that all Amazon S3 buckets with bucket names containing 'logs' must be encrypted with a specific KMS key (key ID: alias/logs-key) at rest. A developer must enforce this using an SCP (Service Control Policy). Which SCP effect and condition key should be used to deny any PutObject request that does not use the required KMS key?

Accepted Answer

Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id. SCPs use a Deny effect to block non-compliant requests. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` ensures that any PutObject request that does not specify the exact KMS key alias/logs-key is denied. This enforces encryption with the required key for all S3 buckets containing 'logs' in their name.

Answer

Deny effect with a Condition: StringEquals on s3:x-amz-server-side-encryption

Answer

Allow effect with a Condition: StringEquals on kms:RequestTag/key-id

Answer

Deny effect with a Condition: IpAddress on aws:SourceIp

Question 16

A developer deployed an AWS Lambda function that is invoked by an Amazon SQS queue. The function is configured with a batch size of 10 and a timeout of 30 seconds. CloudWatch metrics show that the function's Duration is consistently around 28 seconds, but occasionally spikes to 35 seconds causing timeouts. The function makes a synchronous HTTP call to an external API. Which approach will MOST effectively prevent timeouts while maximizing throughput?

Accepted Answer

Reduce the batch size to 5. Reducing the batch size to 5 is the most effective and simplest solution. Since the function currently takes ~28 seconds to process 10 messages (about 2.8 seconds per message), reducing the batch size to 5 will lower the average execution time to approximately 14 seconds. This is well below the 30-second Lambda timeout, preventing timeouts without requiring any code changes.

Increasing the Lambda timeout to 60 seconds (Option B) or SQS visibility timeout to 60 seconds (Option D) in isolation is incorrect because AWS recommends setting the SQS visibility timeout to at least 6 times the Lambda function timeout to prevent duplicate processing. Option A is incorrect because making asynchronous calls with callbacks in Lambda can lead to the function exiting before the callbacks complete, or requires complex concurrency management and code refactoring.

Answer

Use async HTTP calls with a callback

Answer

Increase the function's timeout to 60 seconds

Answer

Increase the SQS visibility timeout to 60 seconds

Question 17

A developer is using AWS CodePipeline with a two-stage pipeline: Source (CodeCommit) and Deploy (Elastic Beanstalk). The developer wants to add a test stage that runs unit tests using AWS CodeBuild. The test stage should run only when a specific branch (development) is pushed. Which approach should the developer use?

Accepted Answer

Create a separate pipeline for the development branch and configure it with the test stage.. AWS CodePipeline is designed such that a pipeline structure is static and runs end-to-end for the configured source. It does not natively support conditionally skipping or executing specific stages (like a Test stage) based on the branch name within a single pipeline. To run unit tests on a 'development' branch while maintaining a separate deployment workflow for another branch (like 'main'), the correct AWS best practice is to create a separate pipeline for the development branch and configure it with the Test stage.

Answer

Add a test stage in the pipeline and configure a 'branch' filter on the source action to only trigger for the development branch.

Answer

Add a test stage in the pipeline and configure a 'branch' condition on the test action using a Lambda function.

Answer

Add a test stage in the pipeline and use a 'Manual approval' action that requires a human to verify the branch.

Question 18

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key (e.g., aws/s3).. AWS managed keys (e.g., aws/s3) automatically rotate every year (365 days) without any configuration or administrative action required, making them the solution with the least operational effort. While customer managed keys also support automatic rotation every 365 days, they require manual configuration to enable this feature.

Answer

Use a custom key store with automatic rotation enabled.

Answer

Use a key with imported key material and set a rotation period of 365 days.

Answer

Use a customer managed key with automatic rotation enabled.

Question 19

A company uses AWS CodeDeploy to deploy an application to EC2 instances. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The deployment group consists of 4 EC2 instances. The deployment configuration is 'CodeDeployDefault.OneAtATime'. The CodeDeploy agent logs on the failed instance show: 'Error: Script at specified location: scripts/install_dependencies.sh failed with exit code 1.' What should the developer do to resolve this issue?

Accepted Answer

Review the install_dependencies.sh script for errors and correct them.. The error message from CodeDeploy indicates that the deployment failed because too many instances failed due to a script error. The CodeDeploy agent logs on the failed instance show that the script 'scripts/install_dependencies.sh' failed with exit code 1. This indicates a bug in the script. The correct action is to review and fix the script. Option A is incorrect because changing the deployment configuration to 'CodeDeployDefault.AllAtOnce' would not fix the script error and could cause all instances to fail simultaneously. Option C is incorrect because reinstalling the CodeDeploy agent does not fix a script error. Option D is incorrect because increasing the number of EC2 instances does not resolve the script issue.

Answer

Change the deployment configuration to 'CodeDeployDefault.AllAtOnce'.

Answer

Reinstall the CodeDeploy agent on the failed instance.

Answer

Increase the number of EC2 instances in the deployment group.

Question 20

A company is deploying a microservices-based application on Amazon ECS using Fargate. The application consists of three services: frontend, backend, and database. The database service uses Amazon Aurora Serverless. The frontend and backend services are deployed as separate ECS services. The company uses AWS CodePipeline for CI/CD. Each service has its own CodePipeline pipeline that builds a Docker image and pushes it to Amazon ECR, then updates the ECS service with the new image. Recently, the backend service deployment started causing intermittent errors. After investigation, the developer found that the backend service is being updated while the frontend service is still pointing to the old backend version, causing API incompatibility. The developer needs to ensure that the backend service is updated before the frontend service, and that both are updated atomically. The developer also wants to automate the update process using CodePipeline. What should the developer do?

Accepted Answer

Create a single pipeline with separate stages: first deploy backend, then after successful deployment, deploy frontend.. A single pipeline with sequential stages ensures the backend is deployed first, and the frontend deploys only after the backend is stable. Option A is wrong because triggers don't control order. Option B is wrong because manual approval is not atomic and can be error-prone. Option C is wrong because updating services is not atomic; they should be in one pipeline.

Answer

Add a manual approval step between the backend and frontend pipelines.

Answer

Create a single pipeline that deploys both services simultaneously by updating both ECS services in a single CodeDeploy deployment.

Answer

Configure the frontend pipeline to trigger after the backend pipeline completes using Amazon CloudWatch Events.