DVA-C02 Hard Questions — 25 Difficult Questions

Question 1

A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?

Accepted Answer

The bucket policy in Account A grants s3:GetObject to the role, the KMS key policy grants kms:Decrypt to the role, and the role in Account B has an IAM policy allowing s3:GetObject and kms:Decrypt. Option A is correct because cross-account access to an SSE-KMS encrypted S3 bucket requires three layers of permissions: the bucket policy in Account A must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to the same role, and the role's IAM policy in Account B must allow both s3:GetObject and kms:Decrypt. Without any one of these, the request will fail due to either an S3 authorization error or a KMS decryption failure.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the role in Account B has an IAM policy allowing s3:GetObject. No KMS permissions are needed because SSE-KMS uses AWS managed keys by default.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the KMS key policy grants kms:Decrypt to the role. The role in Account B does not need additional IAM policies because the bucket and key policies provide sufficient permissions.

Answer

Only the bucket policy in Account A needs to grant s3:GetObject to the role. KMS is not involved because the bucket is encrypted with SSE-KMS but the role can decrypt using the default KMS key.

Question 2

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. Option C is correct because an HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 3

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Options A and D are correct. Cognito User Pools can integrate with third-party IdPs. API Gateway can use Lambda authorizers to validate tokens. Option B is wrong because IAM is for AWS users, not external IdPs directly. Option C is wrong because Secrets Manager is for secrets. Option E is wrong because STS is for temporary credentials, not authentication.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 4

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The CloudTrail log entry shows that the `sts:AssumeRole` API call was made without the `aws:MultiFactorAuthPresent` key set to `true`. This indicates that the role was assumed without MFA, which violates the security best practice of requiring MFA for privileged role assumptions. The absence of MFA increases the risk of unauthorized access if the user's credentials are compromised.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.

Question 5

A company has an IAM policy that allows access to an S3 bucket only if the request comes from a specific VPC endpoint. The developer notices that requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The VPC endpoint policy does not allow the required S3 action for the principal. The correct answer is A because the VPC endpoint policy is an additional layer of access control that can explicitly deny actions even if the bucket policy allows them. If the endpoint policy does not grant the required S3 action (e.g., s3:GetObject) for the IAM principal (the EC2 instance's role), requests will be denied regardless of the bucket policy. This is a common misconfiguration where developers focus only on the bucket policy and overlook the endpoint policy.

Answer

The bucket policy does not have a condition checking aws:SourceVpce

Answer

The route table does not have a route to the S3 endpoint

Answer

The security group does not allow outbound HTTPS traffic

Question 6

A developer applied the above bucket policy to an S3 bucket. What is the outcome?

Accepted Answer

All requests to the bucket must use HTTPS; otherwise, they are denied.. Option A is correct because the policy denies all S3 actions when the request is not using HTTPS (SecureTransport is false). All other requests are allowed by default. Option B is wrong because it denies all actions, not just write. Option C is wrong because it only denies when not HTTPS. Option D is wrong because it does not allow anonymous access.

Answer

Anonymous users are allowed to read objects.

Answer

Only write requests are denied if not using HTTPS.

Answer

The policy has no effect because it uses Deny.

Question 7

A developer is deploying an application on EC2 instances behind an Application Load Balancer. The application must support mutual TLS (mTLS) authentication between clients and the load balancer. Which configuration is required?

Accepted Answer

Create a trust store in AWS Certificate Manager Private CA and associate it with the ALB.. Option C is correct because mutual TLS (mTLS) on an Application Load Balancer requires a trust store that contains the trusted Certificate Authority (CA) certificates used to validate client certificates. This trust store must be created in AWS Certificate Manager Private CA and then associated with the ALB's listener rules. The ALB then performs client certificate verification during the TLS handshake, ensuring both the server and client present valid certificates.

Answer

Use a Network Load Balancer (NLB) with TLS listeners.

Answer

Configure listener rules on the ALB to require client certificates.

Answer

Use Amazon CloudFront with a custom origin and require client certificates.

Question 8

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. Option C is correct because the bucket policy explicitly allows only the role with the exact ARN 'arn:aws:iam::123456789012:role/AppRole'. If the instance's role ARN is different, the request is denied. Option A is wrong because S3 does not require SSE for GetObject. Option B is wrong because MFA is not specified in the error. Option D is wrong because IAM role policies and bucket policies are evaluated separately; an allow in the bucket policy must match the principal.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 9

A developer is troubleshooting an AWS Lambda function that processes large CSV files (up to 1 GB) uploaded to an Amazon S3 bucket. The function uses Python and the pandas library to perform data transformations. Recently, the function started timing out on large files. CloudWatch Logs show that the function's execution time is close to the 15-minute Lambda timeout, and memory utilization peaks at around 80% of the configured 3,008 MB. The function has not been modified in months. Which action will most likely resolve the timeout issue without requiring code changes?

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files

Question 10

A developer optimized an Amazon S3 bucket for high request rates. The bucket receives over 5,000 PUT requests per second. Recently, some requests are failing with a 503 Slow Down error. What is the most likely cause and how should the developer fix it?

Accepted Answer

Add a random prefix to the object keys to distribute across partitions.. Option D is correct because S3 returns 503 when request rates exceed partition limits. Prefix randomization spreads requests across partitions. Option A is wrong because 503 is not due to permissions. Option B is wrong because 503 is not a quota limit exceeded error (that would be 400). Option C is wrong because multipart upload is for large objects, not rate limits.

Answer

Use multipart upload for all objects to improve throughput.

Answer

The request rate exceeds the account-level PUT quota; request a quota increase.

Answer

The bucket policy is too permissive; restrict access to prevent abuse.

Question 11

A company uses AWS CodePipeline with CodeBuild to deploy a Node.js application. The build fails intermittently with 'npm ERR! network' errors. What is the most likely cause and solution?

Accepted Answer

The build environment lacks outbound internet access; configure a NAT gateway or use a VPC endpoint for npm.. Option A is correct because CodeBuild may have limited outbound internet access; using a NAT gateway or VPC endpoint for npm registry resolves this. Option B is incorrect because failing test does not cause network errors. Option C is incorrect because CodeBuild does not have npm cache. Option D is incorrect because npm token expiry returns 401, not network errors.

Answer

A unit test is failing; fix the test code.

Answer

The npm cache is corrupted; clear the cache in CodeBuild.

Answer

The npm token has expired; regenerate the token.

Question 12

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS. Option D is correct because ECS service discovery with AWS Cloud Map provides DNS-based service discovery, and mTLS via App Mesh or service mesh provides encryption. Option A is incorrect because ELB is for external traffic. Option B is incorrect because API Gateway is for APIs. Option C is incorrect because Route 53 is not suitable for service discovery in ECS.

Answer

Use Amazon API Gateway and AWS Lambda

Answer

Use Amazon Route 53 private hosted zones and enable DNSSEC

Answer

Use an Application Load Balancer for each service and enable TLS termination

Question 13

A developer is deploying an AWS Lambda function that processes data from an Amazon Kinesis stream. The function must be idempotent and handle duplicate records. The developer notices that the same record is being processed multiple times. What is the most likely cause of this issue?

Accepted Answer

The Kinesis stream's iterator age is too low, causing the function to reprocess records after a failure.. Option D is correct because a low iterator age can cause the Lambda function to reprocess records if the function fails or times out, leading to duplicates. Option A is wrong because the batch size affects how many records are sent per invocation, not duplicates. Option B is wrong because the concurrency limit throttles invocations but does not cause duplicates. Option C is wrong because the retention period determines how long records are available, not duplicates.

Answer

The Kinesis data stream's retention period is too long, causing old records to be reprocessed.

Answer

The function's reserved concurrency is set too low, causing invocations to be throttled and retried.

Answer

The batch size is set too high, causing the function to process records in multiple batches.

Question 14

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error message 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The developer checks the deployment logs and finds that the ApplicationStop hook failed on some instances. What is the most likely cause of this failure?

Accepted Answer

The ApplicationStop script is not compatible with the instance operating system or is missing.. Option A is correct because the ApplicationStop hook fails if the script attempts to stop a process that is not running or the script has a bug. Option B is wrong because the BeforeInstall hook runs after ApplicationStop. Option C is wrong because the ValidateService hook runs after deployment. Option D is wrong because insufficient capacity would cause a different error.

Answer

The ValidateService hook script is failing.

Answer

The BeforeInstall hook script is incorrectly configured.

Answer

The Auto Scaling group does not have enough capacity to perform the deployment.

Question 15

A company is deploying a containerized application on Amazon EKS. The developer wants to automate the deployment process using a CI/CD pipeline that builds a Docker image, pushes it to Amazon ECR, and updates the Kubernetes deployment. Which tool should the developer use to update the Kubernetes deployment?

Accepted Answer

kubectl set image command. Option B is correct because `kubectl set image` can update the image of a deployment. Option A is wrong because AWS CodeBuild can build and push the image but not update the deployment directly. Option C is wrong because AWS CloudFormation is for infrastructure provisioning. Option D is wrong because AWS Systems Manager is for management, not Kubernetes updates.

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation with a custom resource

Answer

AWS CodeBuild with a buildspec that runs kubectl commands

Question 16

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Accepted Answer

Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.. Options B and D are correct because creating a Lambda alias with routing configuration and updating the API Gateway to point to the alias enables canary deployments. Option A is wrong because updating the function code does not shift traffic. Option C is wrong because creating a new API Gateway stage is unnecessary. Option E is wrong because CloudFront is not needed.

Answer

Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.

Answer

Update the Lambda function code and publish a new version.

Answer

Create a new API Gateway stage for the new version and update DNS.

Question 17

Refer to the exhibit. A developer is troubleshooting a failed CodeDeploy deployment to an EC2 Auto Scaling group. The instance logs show that the 'BeforeInstall' script failed with exit code 1. What should the developer do to resolve the issue?

Accepted Answer

Review the BeforeInstall script for errors and fix them.. Option C is correct because the BeforeInstall hook script failed, and the developer should review the script's logic and fix any errors. Option A is wrong because the scripts location is correct if the error is exit code 1. Option B is wrong because the IAM role likely has sufficient permissions if the script runs. Option D is wrong because the CodeDeploy agent is running if it executes scripts.

Answer

Ensure the CodeDeploy agent is installed and running on the instance.

Answer

Verify that the scripts location in the AppSpec file is correct.

Answer

Check that the instance's IAM role has permissions to download the revision.

Question 18

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. Options A, B, and D are correct. CodeDeploy requires a CodeDeploy application and deployment group. An ECS service with a load balancer is also required. Option C is wrong because an ECS cluster is required, but the question asks for components, and the cluster is implicit; however, the deployment group references the ECS service, so the cluster is needed. But among options, A, B, D are explicitly required. Option E is wrong because a target tracking scaling policy is not required for blue/green deployment.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 19

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 20

A developer is deploying a microservices application on Amazon ECS using Fargate. The developer wants to implement a blue/green deployment strategy using AWS CodeDeploy. The current production environment uses an Application Load Balancer (ALB). What is the minimum configuration required to enable blue/green deployments?

Accepted Answer

An ALB with two target groups, one for blue and one for green.. Option A is correct because CodeDeploy blue/green requires an ALB and a target group for each environment. Option B is wrong because NLB also works but requires additional configuration. Option C is wrong because CloudFront is not required. Option D is wrong because ECS service discovery is not necessary.

Answer

An ALB with a single target group and an Amazon CloudFront distribution.

Answer

An ECS service discovery namespace.

Answer

A Network Load Balancer (NLB) with a single target group.