DVA-C02 Multiple Select — 20 Questions

Question 1

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Options A and D are correct. Cognito User Pools can integrate with third-party IdPs. API Gateway can use Lambda authorizers to validate tokens. Option B is wrong because IAM is for AWS users, not external IdPs directly. Option C is wrong because Secrets Manager is for secrets. Option E is wrong because STS is for temporary credentials, not authentication.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 2

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. Option A is correct because an IAM role must be created with the necessary permissions. Option C is correct because the role must be attached to the EC2 instance. Option B is wrong because S3 bucket policy is optional if using an IAM role; it's needed for cross-account. Option D is wrong because KMS is not required. Option E is wrong because instance profile is not the same as role attachment.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 3

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Option A is correct because Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 4

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer notices that the deploy stage fails intermittently due to EC2 instances not being available. Which TWO actions should the developer take to improve the reliability of the deployment? (Choose two.)

Accepted Answer

Configure the CodeDeploy deployment group to have a minimum healthy hosts threshold.. Option B is correct because configuring a minimum healthy hosts threshold in the CodeDeploy deployment group ensures that a certain percentage or number of EC2 instances remain healthy during the deployment. This prevents the deployment from proceeding if too many instances are unavailable, reducing the risk of failure due to insufficient capacity. Option E is correct because adding a manual approval step before the deploy stage allows the developer to verify instance health (e.g., via AWS Systems Manager or custom scripts) before triggering the deployment, catching availability issues early.

Answer

Increase the number of EC2 instances in the Auto Scaling group to ensure availability.

Answer

Reduce the deployment timeout to fail faster.

Answer

Use a different deployment type, such as blue/green, instead of in-place.

Question 5

A developer is troubleshooting a slow web application. The application uses an Application Load Balancer, EC2 instances, and an RDS database. The developer suspects the database is the bottleneck. Which TWO CloudWatch metrics should the developer examine to confirm this? (Select TWO.)

Accepted Answer

DatabaseConnections. Options B and D are correct. DatabaseConnections shows current connections; ReadIOPS and WriteIOPS show disk I/O, which can cause slowness. Option A (CPUUtilization) is a general metric, but for database bottleneck, I/O and connections are more indicative. Option C (NetworkIn) is more about network load. Option E (RequestCount) is for the ALB, not the database.

Answer

RequestCount

Answer

NetworkIn

Answer

CPUUtilization

Question 6

A developer is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. The pipeline must automatically build and deploy the application when changes are pushed to a CodeCommit repository. The application uses AWS CloudFormation for infrastructure provisioning. Which TWO actions should the developer include in the pipeline?

Accepted Answer

Use AWS CodeBuild to run unit tests and package the application.. Options A and C are correct because CodeBuild can run unit tests, and CloudFormation can deploy and update stacks. Option B is wrong because CodeDeploy is not used for CloudFormation deployments. Option D is wrong because Lambda can be invoked but is not the primary deployment mechanism. Option E is wrong because CodeCommit is the source, not an action in the pipeline.

Answer

Use AWS CodeDeploy to deploy the application to EC2 instances.

Answer

Use AWS CodeCommit as a deployment action.

Answer

Use AWS Lambda to run integration tests.

Question 7

A developer is deploying a new version of an AWS Lambda function. The function is behind an API Gateway endpoint. The developer wants to use canary deployments to gradually shift traffic to the new version. Which TWO steps should the developer perform?

Accepted Answer

Create a Lambda alias that points to the current version and configure routing to shift a percentage of traffic to the new version.. Options B and D are correct because creating a Lambda alias with routing configuration and updating the API Gateway to point to the alias enables canary deployments. Option A is wrong because updating the function code does not shift traffic. Option C is wrong because creating a new API Gateway stage is unnecessary. Option E is wrong because CloudFront is not needed.

Answer

Configure Amazon CloudFront to distribute traffic between two API Gateway endpoints.

Answer

Update the Lambda function code and publish a new version.

Answer

Create a new API Gateway stage for the new version and update DNS.

Question 8

A company is using AWS CloudFormation to deploy and manage infrastructure. The developer wants to implement a CI/CD pipeline that automatically deploys CloudFormation stacks. The pipeline should be able to create, update, and delete stacks. Which THREE AWS services should the developer use together?

Accepted Answer

AWS CodeBuild. Options A, B, and E are correct because CodePipeline orchestrates the pipeline, CodeBuild can run scripts or validate templates, and CloudFormation performs the stack operations. Option C is wrong because CodeDeploy is for application deployment, not CloudFormation. Option D is wrong because Lambda can be used but is not required.

Answer

AWS CodeDeploy

Answer

AWS Lambda

Question 9

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. Options A and C are correct. The '--rollback-configuration' parameter can specify CloudWatch alarm thresholds that trigger rollback. Option C: Setting '--disable-rollback' to false (i.e., not disabling rollback) means rollback is enabled. Option B is wrong because '--on-failure' is only for stack creation, not update. Option D is wrong because a stack policy does not control rollback behavior. Option E is wrong because change sets do not enable automatic rollback.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 10

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. Options A, B, and D are correct. CodeDeploy requires a CodeDeploy application and deployment group. An ECS service with a load balancer is also required. Option C is wrong because an ECS cluster is required, but the question asks for components, and the cluster is implicit; however, the deployment group references the ECS service, so the cluster is needed. But among options, A, B, D are explicitly required. Option E is wrong because a target tracking scaling policy is not required for blue/green deployment.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 11

Which TWO strategies can be used to reduce the risk of a failed deployment when using AWS CodeDeploy? (Select TWO.)

Accepted Answer

Configure automatic rollback based on CloudWatch alarms.. Options B and D are correct. Gradual traffic shifting (canary or linear) and automatic rollback based on CloudWatch alarms reduce risk. Option A is wrong because deploying to all instances at once increases risk. Option C is wrong because skipping health checks increases risk. Option E is wrong because manual approval gate introduces delay but does not reduce risk of failure; it can help catch issues but not specifically reduce deployment failure risk.

Answer

Disable health checks to prevent false positives.

Answer

Require a manual approval step before deployment.

Answer

Deploy to all instances at once to ensure consistency.

Question 12

A company uses AWS CodePipeline to deploy a web application. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The developer wants to add a manual approval step before the Deploy stage. Which TWO configurations are required?

Accepted Answer

An IAM role that allows CodePipeline to publish to the SNS topic.. Options B and D are correct because a manual approval action requires an SNS topic for notification and an IAM role for the pipeline to publish to SNS. Option A is wrong because Lambda is not required. Option C is wrong because CloudWatch is not needed. Option E is wrong because SES is not used.

Answer

An Amazon SES identity to send emails.

Answer

An AWS Lambda function to send approval emails.

Answer

An Amazon CloudWatch alarm to trigger the approval.

Question 13

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Accepted Answer

Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.. Options A, C, and D are correct. Option B is wrong because hardcoding credentials is insecure. Option E is wrong because environment variables in the task definition are visible in plain text.

Answer

Hardcode the credentials in the container image.

Answer

Define environment variables in the task definition with the credentials.

Question 14

A company uses AWS CloudFormation to manage infrastructure. They need to update a stack that includes an Amazon RDS DB instance. To minimize downtime, they want to perform a rolling update. Which THREE properties must be set in the CloudFormation template?

Accepted Answer

CreationPolicy attribute with ResourceSignal. Option A (UpdatePolicy with AutoScalingReplacingUpdate) is correct for rolling updates on Auto Scaling groups. Option B (CreationPolicy with ResourceSignal) is correct to wait for signals. Option D (DeletionPolicy) is incorrect because it controls deletion behavior. Option C (UpdatePolicy with AutoScalingRollingUpdate) is correct for rolling update configuration. Option E (UpdatePolicy with UseOnlineResizing) is not a valid property. So correct are A, B, C.

Answer

DeletionPolicy attribute set to Snapshot

Answer

UpdatePolicy attribute with UseOnlineResizing

Question 15

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Accepted Answer

Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.. Option B (Ensure the S3 bucket is in the same region) is correct because cross-region access requires explicit configuration. Option D (Check that the source artifact is a zip file) is correct because Elastic Beanstalk expects a zip. Option A is wrong because the bucket name is not an issue. Option C is wrong because it's a separate service. Option E is wrong because the S3 key is typically correct.

Answer

Make sure the source artifact is a valid zip file containing the application code and environment configuration.

Answer

Confirm that the S3 object key does not contain special characters.

Answer

Verify that the S3 bucket name is exactly as specified in the pipeline.

Question 16

A developer is deploying an application using AWS CloudFormation. The stack includes an Amazon RDS DB instance. To ensure secure credential management, which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter for the password.. Options B and D are correct. Using AWS Secrets Manager or Systems Manager Parameter Store to store database credentials securely is a best practice. Option A is incorrect because hardcoding credentials in the template is insecure. Option C is incorrect because the default password is not automatically randomized; it must be explicitly set. Option E is incorrect because IAM database authentication is separate from credential storage.

Answer

Hardcode the master password in the CloudFormation template.

Answer

Use IAM database authentication to manage credentials.

Answer

Leave the master password empty so that CloudFormation generates a random password.

Question 17

A developer is using AWS SAM to deploy a serverless application. The developer wants to enable canary deployments for the Lambda function. Which TWO resources must be configured in the SAM template? (Choose TWO.)

Accepted Answer

DeploymentPreference property on the AWS::Serverless::Function resource.. Options A and B are correct. The AutoPublishAlias property enables canary deployments by creating a new version and updating the alias. The DeploymentPreference property specifies the canary configuration. Option C is incorrect because the alias can be used for canary, but the deployment preference is required. Option D is incorrect because the function's code URI is always needed but not specific to canary. Option E is incorrect because the event source mapping is not related to canary deployment.

Answer

The function's CodeUri property pointing to the deployment package.

Answer

An event source mapping for the function.

Answer

The function's alias resource with a routing configuration.

Question 18

Which TWO actions should a developer take to minimize downtime when deploying a new version of a production application running on Amazon ECS with Fargate?

Accepted Answer

Configure the ECS service to use a blue/green deployment with CodeDeploy. Using a blue/green deployment (A) and updating the ECS service with a new task definition while setting the minimum healthy percent to 100% and maximum percent to 200% (B) both reduce downtime. Option C (delete and recreate) causes downtime. Option D (update target group) is part of blue/green but not a complete action. Option E (stop all tasks) causes downtime.

Answer

Delete the existing service and recreate it with the new task definition

Answer

Update the target group health check settings to a more lenient threshold

Answer

Stop all running tasks and then start new tasks with the updated image

Question 19

Which THREE factors should a developer consider when choosing between a blue/green deployment and a rolling deployment for an Amazon ECS service?

Accepted Answer

Rolling deployments update a subset of tasks at a time, which may cause slower rollback. Blue/green deployments require additional resources (A), support quick rollback (B), and have higher cost (C). Option D (cost) is relevant. Option E (database schema changes) is not directly related; both can handle it with proper migration.

Answer

Rolling deployments require manual intervention to rollback

Answer

Blue/green deployments are always cheaper than rolling deployments

Question 20

Which TWO approaches can a developer use to automate the deployment of a microservices application to Amazon ECS with Fargate, ensuring that each microservice is independently deployable and can scale based on demand?

Accepted Answer

Define each microservice as a separate ECS service with its own task definition. Using separate ECS services (A) and a CI/CD pipeline per microservice (B) ensures independent deployment and scaling. Option C (monolithic pipeline) defeats independence. Option D (single task definition) couples services. Option E (single service) does not allow independent scaling.

Answer

Define all microservices in a single task definition and run them as one service

Answer

Use a single ECS service with multiple containers per task definition

Answer

Use a single CodePipeline that builds all microservices together