DVA-C02 Multiple Select — 10 Questions

Question 1

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Options A and D are correct. Cognito User Pools can integrate with third-party IdPs. API Gateway can use Lambda authorizers to validate tokens. Option B is wrong because IAM is for AWS users, not external IdPs directly. Option C is wrong because Secrets Manager is for secrets. Option E is wrong because STS is for temporary credentials, not authentication.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 2

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. Option A is correct because an IAM role must be created with the necessary permissions. Option C is correct because the role must be attached to the EC2 instance. Option B is wrong because S3 bucket policy is optional if using an IAM role; it's needed for cross-account. Option D is wrong because KMS is not required. Option E is wrong because instance profile is not the same as role attachment.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 3

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Option A is correct because Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 4

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer notices that the deploy stage fails intermittently due to EC2 instances not being available. Which TWO actions should the developer take to improve the reliability of the deployment? (Choose two.)

Accepted Answer

Configure the CodeDeploy deployment group to have a minimum healthy hosts threshold.. Option B is correct because configuring a minimum healthy hosts threshold in the CodeDeploy deployment group ensures that a certain percentage or number of EC2 instances remain healthy during the deployment. This prevents the deployment from proceeding if too many instances are unavailable, reducing the risk of failure due to insufficient capacity. Option E is correct because adding a manual approval step before the deploy stage allows the developer to verify instance health (e.g., via AWS Systems Manager or custom scripts) before triggering the deployment, catching availability issues early.

Answer

Increase the number of EC2 instances in the Auto Scaling group to ensure availability.

Answer

Reduce the deployment timeout to fail faster.

Answer

Use a different deployment type, such as blue/green, instead of in-place.

Question 5

A developer is troubleshooting a slow web application. The application uses an Application Load Balancer, EC2 instances, and an RDS database. The developer suspects the database is the bottleneck. Which TWO CloudWatch metrics should the developer examine to confirm this? (Select TWO.)

Accepted Answer

DatabaseConnections. Options B and D are correct. DatabaseConnections shows current connections; ReadIOPS and WriteIOPS show disk I/O, which can cause slowness. Option A (CPUUtilization) is a general metric, but for database bottleneck, I/O and connections are more indicative. Option C (NetworkIn) is more about network load. Option E (RequestCount) is for the ALB, not the database.

Answer

RequestCount

Answer

NetworkIn

Answer

CPUUtilization

Question 6

A developer is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. The pipeline must automatically build and deploy the application when changes are pushed to a CodeCommit repository. The application uses AWS CloudFormation for infrastructure provisioning. Which TWO actions should the developer include in the pipeline?

Accepted Answer

Use AWS CodeBuild to run unit tests and package the application.. Options A and C are correct because CodeBuild can run unit tests, and CloudFormation can deploy and update stacks. Option B is wrong because CodeDeploy is not used for CloudFormation deployments. Option D is wrong because Lambda can be invoked but is not the primary deployment mechanism. Option E is wrong because CodeCommit is the source, not an action in the pipeline.

Answer

Use AWS CodeDeploy to deploy the application to EC2 instances.

Answer

Use AWS CodeCommit as a deployment action.

Answer

Use AWS Lambda to run integration tests.

Question 7

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Accepted Answer

Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.. Options B and D are correct because creating a Lambda alias with routing configuration and updating the API Gateway to point to the alias enables canary deployments. Option A is wrong because updating the function code does not shift traffic. Option C is wrong because creating a new API Gateway stage is unnecessary. Option E is wrong because CloudFront is not needed.

Answer

Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.

Answer

Update the Lambda function code and publish a new version.

Answer

Create a new API Gateway stage for the new version and update DNS.

Question 8

A company is using AWS CloudFormation to deploy and manage infrastructure. The developer wants to implement a CI/CD pipeline that automatically deploys CloudFormation stacks. The pipeline should be able to create, update, and delete stacks. Which THREE AWS services should the developer use together?

Accepted Answer

AWS CodeBuild. Options A, B, and E are correct because CodePipeline orchestrates the pipeline, CodeBuild can run scripts or validate templates, and CloudFormation performs the stack operations. Option C is wrong because CodeDeploy is for application deployment, not CloudFormation. Option D is wrong because Lambda can be used but is not required.

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 9

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. Options A and C are correct. The '--rollback-configuration' parameter can specify CloudWatch alarm thresholds that trigger rollback. Option C: Setting '--disable-rollback' to false (i.e., not disabling rollback) means rollback is enabled. Option B is wrong because '--on-failure' is only for stack creation, not update. Option D is wrong because a stack policy does not control rollback behavior. Option E is wrong because change sets do not enable automatic rollback.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 10

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. Options A, B, and D are correct. CodeDeploy requires a CodeDeploy application and deployment group. An ECS service with a load balancer is also required. Option C is wrong because an ECS cluster is required, but the question asks for components, and the cluster is implicit; however, the deployment group references the ECS service, so the cluster is needed. But among options, A, B, D are explicitly required. Option E is wrong because a target tracking scaling policy is not required for blue/green deployment.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy