DVA-C02 Multiple Select — 30 Questions

Question 1

Which TWO AWS services can be used to automatically deploy code to Amazon EC2 instances? (Choose two.)

Accepted Answer

AWS Elastic Beanstalk. AWS Elastic Beanstalk is a PaaS service that automates the deployment of applications to EC2 instances by handling capacity provisioning, load balancing, and health monitoring. It automatically deploys code when you upload a new application version, making it a correct choice for automated deployment to EC2.

Answer

AWS CloudFormation

Answer

AWS OpsWorks

Answer

AWS CodeBuild

Question 2

A developer is deploying a web application using AWS Elastic Beanstalk. Which TWO configuration files can be used to customize the software that runs on the EC2 instances? (Select TWO.)

Accepted Answer

.platform/hooks/. The `.platform/hooks/` directory is a feature of Elastic Beanstalk's platform-specific configuration that allows you to run custom scripts at specific lifecycle events (e.g., prebuild, postdeploy) on the EC2 instances. This is the modern replacement for the older `.ebextensions` approach for running commands during deployment, and it directly customizes the software running on the instances.

Answer

Dockerfile

Answer

appspec.yml

Answer

buildspec.yml

Question 3

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 4

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Option A is correct because CloudFormation records every resource-level status transition (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) as a stack event, and the event for the failed resource includes the exact StatusReason returned by the underlying service, which is the fastest way to pinpoint the root cause. Option D is correct because a resource creation failure is frequently caused by an invalid template definition — for example a bad property value, an incorrect intrinsic function reference, or a missing required parameter — so reviewing the template for logical errors validates the resource configuration against the service's requirements. Option B is not appropriate because stack outputs are only populated after resources are successfully created and are not generated for a failed stack, so they contain no troubleshooting data. Option C is not appropriate because deleting and recreating with identical parameters reproduces the same failure without gathering any diagnostic information. Option E is not appropriate because CloudTrail logs API calls made to AWS services (such as CreateStack), not the internal per-resource failure reasons that CloudFormation surfaces in stack events.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 5

A developer is designing a system to store sensitive user data in Amazon S3. The data must be encrypted at rest and the encryption keys must be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 SSE-KMS. Option A (Amazon S3 SSE-KMS) is correct because server-side encryption with AWS KMS keys (SSE-KMS) encrypts objects at rest in S3 and supports automatic annual key rotation when the underlying KMS customer managed key has rotation enabled. Option D (AWS KMS) is correct because it is the service that creates and manages the customer managed keys used for encryption and provides built-in annual automatic key rotation (every 365 days) for symmetric KMS keys. Option B (AWS Secrets Manager) is not for encrypting S3 object data at rest; it stores and rotates secrets such as database credentials. Option C (AWS Certificate Manager) manages TLS/SSL certificates for encryption in transit, not S3 data-at-rest encryption keys. Option E (AWS CloudHSM) provides dedicated hardware security modules and does not by itself deliver S3 at-rest encryption with annual key rotation as required.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 6

A company is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer. The application must be deployed with no downtime. The deployment uses AWS CodeDeploy with a Blue/Green deployment configuration. Which TWO actions should be taken to achieve zero-downtime deployment? (Choose TWO.)

Accepted Answer

Create a new Auto Scaling group with the new application version and register it with the ALB.. Option B is correct because a CodeDeploy blue/green deployment for EC2 requires provisioning a replacement environment — a new Auto Scaling group running the new application revision — and registering it with the existing Application Load Balancer so it can serve traffic. Option E is correct because zero downtime is achieved by having the ALB gradually shift traffic from the original (blue) target group to the replacement (green) target group, using CodeDeploy's traffic-shifting controls (e.g., all-at-once, linear, or canary) before the old instances are terminated. Option A is wrong because creating a separate load balancer is unnecessary and would not provide the controlled traffic rerouting that CodeDeploy performs through the ALB's target groups. Option C is wrong because updating the existing Auto Scaling group in place is an in-place deployment, not blue/green, and would replace instances without the parallel green environment needed for zero downtime. Option D is wrong because terminating the old instances immediately removes the safety net and can cause dropped connections; the original environment must be kept until traffic has fully shifted and the deployment succeeds.

Answer

Create a new load balancer for the new environment.

Answer

Update the existing Auto Scaling group with the new application version.

Answer

Terminate the old EC2 instances immediately after deploying the new ones.

Question 7

Which TWO services can be used to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

SSE-KMS. Options A and E are correct. Option A: SSE-KMS uses AWS Key Management Service (KMS) for managing encryption keys, providing additional control and audit capabilities. Option E: SSE-S3 uses S3-managed keys for encryption at rest. Option B is incorrect because AWS IAM is an access management service, not an encryption service. Option C is incorrect because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not data encryption. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not directly integrated with S3 for encryption.

Answer

AWS IAM

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 8

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 9

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Accepted Answer

Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.. Options A, B, and C are correct because they all provide secure, native mechanisms for delivering RDS credentials to an ECS Fargate task. Option A is right because ECS task definitions support the secrets parameter with valueFrom pointing to a Systems Manager Parameter Store parameter (for example, arn:aws:ssm:region:account:parameter/name), and the value is injected at container start without being baked into the image. Option B is right because ECS also supports referencing AWS Secrets Manager secrets in the task definition's secrets block, allowing the credential to be fetched and injected securely at runtime. Option C is right because an IAM task role can grant the container permission to call secretsmanager:GetSecretValue (or ssm:GetParameter) at runtime, letting the application retrieve credentials dynamically without embedding them. Option D is wrong because hardcoding credentials in the container image exposes them to anyone who can pull or inspect the image and violates credential-rotation best practices. Option E is wrong because defining credentials as plaintext environment variables in the task definition stores them in the task definition itself, making them visible to anyone with ECS read access and not securely encrypted or rotated.

Answer

Hardcode the credentials in the container image.

Answer

Define environment variables in the task definition with the credentials.

Question 10

Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?

Accepted Answer

S3 bucket/object access policy or IAM policy. When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.

Answer

CloudFront cache policy

Answer

Route 53 resolver rule policy

Question 11

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 12

A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which THREE factors could cause this denial?

Accepted Answer

An explicit deny statement in the bucket policy.. Option B is correct because an explicit Deny in a bucket policy always overrides any Allow in an identity-based policy, so a Deny on s3:ListBucket would block the user regardless of other permissions. Option D is correct because a permissions boundary sets the maximum permissions an IAM user can have; if s3:ListBucket is not within the boundary, the effective permissions cannot include it even if an identity policy allows it. Option E is correct because s3:ListBucket must be explicitly granted in an identity-based policy (or another applicable policy) for the user to list the bucket, and its absence results in an implicit deny. Option A is not correct because S3 bucket access is not restricted by the user's default region; region only affects endpoint routing, not authorization. Option C is not correct because KMS encryption affects access to object data via kms:Decrypt, not the s3:ListBucket permission itself.

Answer

The bucket is in a different region than the user's default region.

Answer

The bucket is encrypted with AWS KMS.

Question 13

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 14

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 15

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 16

A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)

Accepted Answer

Remove the public access grant from the bucket ACL.. The bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.

Answer

Create an IAM user policy that denies s3:GetObject for anonymous users.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 17

A developer is troubleshooting a slow Amazon DynamoDB table. The table has a read capacity of 1000 RCU and a write capacity of 500 WCU. The application frequently reads the same item. Which TWO actions can improve read performance?

Accepted Answer

Implement DynamoDB Accelerator (DAX) for caching.. DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read latency for frequently accessed items from milliseconds to microseconds, offloading read traffic from the table and improving performance without requiring a capacity increase. Option E is correct because eventually consistent reads consume half the RCU of strongly consistent reads (0.5 RCU vs 1 RCU per 4 KB item) and return data faster, which is suitable when the application can tolerate slightly stale data for the same item.

Answer

Increase the read capacity units (RCU) to 2000.

Answer

Add a Global Secondary Index (GSI) on the frequently read attribute.

Answer

Decrease the write capacity units (WCU) to 250.

Question 18

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AES-256 (SSE-S3) and that no public access is allowed. Which TWO methods can be used to enforce these requirements across all accounts? (Choose TWO.)

Accepted Answer

Use AWS Config rules with automatic remediation to detect and fix non-compliant buckets.. AWS Config rules can evaluate S3 bucket configurations against desired settings (e.g., encryption enabled, public access blocked) and trigger automatic remediation via AWS Systems Manager Automation documents to fix non-compliant buckets. This provides continuous enforcement across all accounts in the organization without manual intervention.

Answer

Attach an IAM policy to all IAM users in each account that denies unencrypted operations.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets.

Question 19

A developer is using AWS CodeDeploy to deploy a revision to an Amazon EC2 instance. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which TWO actions should the developer take to troubleshoot the issue? (Choose TWO.)

Accepted Answer

Check the CodeDeploy agent logs on the EC2 instance for errors.. The CodeDeploy agent logs on the EC2 instance contain detailed error messages about why the deployment script failed, such as script exit codes, missing dependencies, or permission issues. Checking these logs is the first step in diagnosing individual instance failures, as the agent writes events to `/var/log/aws/codedeploy-agent/codedeploy-agent.log`.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Verify that the EC2 instance has an IAM role that allows CodeDeploy to access it.

Answer

Increase the health check grace period on the Auto Scaling group.

Question 20

A developer is designing a mobile application that needs to upload files to Amazon S3. The developer wants to use temporary credentials to avoid storing long-term AWS credentials on the device. Which TWO services should the developer use together?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is used to generate temporary, limited-privilege credentials for accessing AWS resources, such as S3 buckets. Amazon Cognito provides identity pools that can automatically obtain and refresh STS tokens for authenticated users, eliminating the need to store long-term AWS credentials on the mobile device. Together, they enable secure, temporary credential management for file uploads.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)