DVA-C02 Multiple Select — 60 Questions

Question 1

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 2

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Options A and D are correct. A: Viewing stack events (Events tab) shows error messages for each resource, which can indicate which resource failed and why. D: Reviewing the stack template for logical errors can help identify issues like missing dependencies or incorrect parameter values. Option B is wrong because stack outputs are only available after successful creation; during a failure, outputs are not generated. Option C is wrong because deleting and recreating the stack with the same parameters will likely result in the same failure and also removes the stack's logs and events, losing troubleshooting information. Option E is wrong because CloudTrail logs API calls made to AWS, but CloudFormation-specific errors during resource creation are not detailed in CloudTrail; stack events provide more relevant information.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.

Question 3

A company is deploying a new web application on Amazon EC2 instances behind an Application Load Balancer. The application must be deployed with no downtime. The deployment uses AWS CodeDeploy with a Blue/Green deployment configuration. Which TWO actions should be taken to achieve zero-downtime deployment? (Choose TWO.)

Accepted Answer

Create a new Auto Scaling group with the new application version and register it with the ALB.. In a Blue/Green deployment, you create a new Auto Scaling group with the new application version and register it with the existing ALB. Option E is correct because after the new environment is ready, you gradually shift traffic from the old environment to the new environment using the ALB to ensure zero downtime. Option A is incorrect because you should reuse the existing ALB to avoid re-creating DNS and other configurations. Option C is incorrect because updating the existing Auto Scaling group in-place would cause downtime (rolling update) rather than a true Blue/Green deployment. Option D is incorrect because terminating old instances immediately could cause downtime if the new environment fails; you should allow rollback by keeping old instances until traffic is fully shifted.

Answer

Create a new load balancer for the new environment.

Answer

Update the existing Auto Scaling group with the new application version.

Answer

Terminate the old EC2 instances immediately after deploying the new ones.

Question 4

A developer is troubleshooting a slow RDS MySQL instance. Which TWO metrics in Amazon CloudWatch should the developer examine first?

Accepted Answer

CPUUtilization. The correct metrics to examine first for a slow RDS MySQL instance are CPUUtilization and ReadLatency. High CPUUtilization indicates that the instance is under heavy load, possibly from inefficient queries or inadequate compute capacity. High ReadLatency suggests slow I/O, which could be due to disk contention or suboptimal queries. NetworkReceiveThroughput (A) is related to network traffic, not database performance. SwapUsage (B) is not typically a primary metric for RDS performance. FreeStorageSpace (D) indicates storage capacity but does not directly measure performance. Therefore, options C and E are the correct choices.

Answer

NetworkReceiveThroughput

Answer

SwapUsage

Answer

FreeStorageSpace

Question 5

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 6

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Accepted Answer

Enable default encryption.. Options B and D are correct. Enabling default encryption (B) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data from unauthorized access if the bucket is misconfigured or accessed improperly. Blocking public access at the bucket level (D) prevents accidental public exposure of data. Option A (versioning) helps recover from accidental deletions or overwrites but does not prevent data leaks. Option C (MFA Delete) adds an extra authentication step for deleting objects or changing versioning, which protects against unauthorized deletions, not leaks. Option E (cross-region replication) provides data redundancy and disaster recovery, but does not prevent data leaks.

Answer

Enable versioning.

Answer

Enable MFA Delete.

Answer

Configure cross-region replication.

Question 7

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 8

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 9

Which TWO actions can be taken to enable automatic rollback for an AWS CloudFormation stack update that fails? (Select TWO.)

Accepted Answer

Specify a CloudWatch alarm in the '--rollback-configuration' parameter during stack update.. The `--rollback-configuration` parameter allows you to specify a CloudWatch alarm that, when triggered during a stack update, automatically initiates a rollback. This is the intended mechanism for monitoring-based automatic rollback, as CloudFormation will monitor the alarm state and revert the update if the alarm enters the ALARM state. Option E is correct because setting `--disable-rollback` to `false` explicitly enables automatic rollback on any stack update failure, which is the default behavior but can be explicitly configured for clarity.

Answer

Set the '--on-failure' parameter to 'ROLLBACK' during stack update.

Answer

Use a change set to review the changes before updating.

Answer

Apply a stack policy that denies updates to critical resources.

Question 10

A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store encrypted credentials.. AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.

Answer

Store the credentials as Lambda environment variables.

Answer

Hardcode the credentials in the Lambda function code.

Answer

Store the credentials in a file in the Lambda deployment package.

Question 11

A company is running a serverless application using AWS Lambda and Amazon API Gateway. The application experiences increased latency during peak hours. CloudWatch metrics show that Lambda function duration remains stable, but API Gateway latency spikes. Which THREE actions should the developer take to reduce API Gateway latency?

Accepted Answer

Enable compression for API responses.. Options B, D, and E are correct. Enabling compression reduces payload size, decreasing response time. API Gateway caching reduces backend calls by serving cached responses, lowering latency. Switching to Regional endpoint reduces network latency by eliminating the global edge network hop. Option A is wrong because increasing Lambda timeout does not reduce API Gateway latency; it only allows functions to run longer. Option C is wrong because throttling limits cap request rates but do not reduce latency for individual requests.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 12

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 13

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Accepted Answer

An SCP at the organization level denies s3:GetObject.. The correct answers are A, C, and E. An organization-level SCP can deny s3:GetObject, overriding IAM allows. An explicit deny in the user's role policy also overrides any allow. A bucket policy with an explicit Deny statement will cause access denied even if IAM allows. Option B is incorrect because using a wrong region endpoint results in a different error (e.g., NoSuchBucket or redirect), not an access denied. Option D is incorrect because cross-account access is possible with proper permissions; the bucket being in another account does not inherently deny access.

Answer

The user is using an incorrect region endpoint.

Answer

The S3 bucket is in a different AWS account.

Question 14

A developer needs to securely expose an API running on an EC2 instance behind an Application Load Balancer. The API should only be accessible to authenticated users via a custom authorization header. Which steps should be taken? (Choose TWO.)

Accepted Answer

Create a Lambda authorizer that validates the custom header. It creates a Lambda authorizer that can validate a custom authorization header. Option D is correct because API Gateway natively supports Lambda authorizers, allowing the custom header validation to secure the API. Options B and C are incorrect because AWS WAF cannot perform custom authorization logic, and Cognito User Pools require OIDC flows, not custom headers. Option E is incorrect because ALB does not natively support Lambda authorizers as a feature.

Answer

Enable AWS WAF on the ALB to inspect the header

Answer

Use Amazon Cognito User Pools to validate the header

Answer

Configure the ALB to use the Lambda authorizer

Question 15

Which TWO are best practices for securing an AWS account? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users. The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture. Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Answer

Disable AWS CloudTrail to reduce costs

Answer

Disable password rotation to avoid user inconvenience

Answer

Use the root user for daily administrative tasks

Question 16

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic. Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 17

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?

Accepted Answer

Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }. The `Null` condition operator checks whether the `aws:MultiFactorAuthPresent` key is absent or explicitly set to `false`. When set to `false`, it denies API calls that were made without MFA, effectively enforcing MFA for all API operations. Option E is correct because the `Bool` condition operator with `true` requires that MFA was used, but it must be combined with a `Deny` effect to block unauthenticated requests; used alone in an `Allow` statement, it only permits MFA-authenticated calls without blocking non-MFA ones.

Answer

Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }

Answer

Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }

Answer

Condition: { "StringEquals": { "iam:ResourcePath": "/" } }

Question 18

A developer is using AWS CodePipeline to automate deployments. The pipeline has a Source stage using Amazon S3 and a Deploy stage using AWS Elastic Beanstalk. The developer notices that the pipeline fails at the Deploy stage with the error 'The deployment failed because the version of the application to be deployed could not be found.' Which TWO actions should the developer take to resolve this issue?

Accepted Answer

Ensure that the S3 bucket and the Elastic Beanstalk environment are in the same AWS region.. CodePipeline and Elastic Beanstalk must be in the same AWS region for the pipeline to locate the application version. When the Source stage stores the artifact in an S3 bucket in a different region, the Deploy stage cannot find the version in Elastic Beanstalk, which expects the artifact to be in the same region. This cross-region mismatch causes the 'version of the application to be deployed could not be found' error. Option E is also correct because the IAM role for CodePipeline must have permissions to read from the S3 bucket and to deploy to Elastic Beanstalk. Without these permissions, the pipeline cannot access the artifact or perform the deployment, leading to the 'could not be found' error.

Answer

Make sure the source artifact is a valid zip file containing the application code and environment configuration.

Answer

Confirm that the S3 object key does not contain special characters.

Answer

Verify that the S3 bucket name is exactly as specified in the pipeline.

Question 19

Which THREE components are required to perform a blue/green deployment of an application running on Amazon ECS using AWS CodeDeploy? (Select THREE.)

Accepted Answer

An Application Load Balancer. An Application Load Balancer (ALB) is required for blue/green deployments on Amazon ECS with AWS CodeDeploy because it routes traffic between the 'blue' (current) and 'green' (new) task sets. CodeDeploy uses the ALB's target groups to shift traffic incrementally during the deployment, enabling zero-downtime updates. Without an ALB, there is no mechanism to direct production traffic to the new task set while keeping the old one available for rollback.

Answer

An Amazon ECS cluster

Answer

A target tracking scaling policy

Question 20

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a relational database. Which THREE components are created by Elastic Beanstalk when you add a database to your environment?

Accepted Answer

A DB subnet group. When you add a database to an Elastic Beanstalk environment, Elastic Beanstalk automatically creates a DB subnet group, an Amazon RDS DB instance, and a security group for the database. The CloudFormation stack is already created as part of the environment's infrastructure, not specifically when adding the database. DynamoDB is not used for relational databases.

Answer

An AWS CloudFormation stack

Answer

An Amazon DynamoDB table