DVA-C02 Quick Quiz — 10 Questions

Question 1

A developer is creating an API with Amazon API Gateway that needs to accept binary data (e.g., images) and store them directly in an S3 bucket. The developer wants to minimize backend complexity. Which integration type should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS service integration with S3. AWS service integration with S3 allows API Gateway to directly proxy binary data (e.g., images) to an S3 bucket without invoking a Lambda function or other backend. This minimizes backend complexity because the API Gateway handles the request transformation and passes the payload directly to S3 via the PutObject API action, eliminating the need for custom code.

Answer

Lambda proxy integration

Answer

HTTP integration

Answer

Mock integration

Question 2

A developer is using AWS CodePipeline to deploy a web application. The pipeline has stages: Source, Build, Staging Deploy, Staging Test, and Prod Deploy. The developer wants to ensure that if the Staging Test stage fails, the pipeline automatically stops and does not proceed to Prod Deploy. Which action should the developer take?

Accepted Answer

No action is needed; CodePipeline automatically stops on stage failure. AWS CodePipeline's default behavior is to stop execution when a stage fails, preventing the pipeline from proceeding to subsequent stages. When the Staging Test stage fails, the pipeline transitions to a 'Failed' status and does not automatically continue to Prod Deploy. No additional configuration is required for this behavior.

Answer

Add a manual approval step before Prod Deploy

Answer

Disable the transition from Staging Test to Prod Deploy

Answer

Configure the pipeline execution mode to 'Superseded'

Question 3

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

Accepted Answer

Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement. The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Answer

Attach an IAM policy to the role that allows s3:GetObject on the bucket

Answer

Use an S3 access point instead of the bucket directly

Answer

Make the bucket public to allow all access

Question 4

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Answer

AWS CodeBuild

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 5

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 6

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation. AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.

Answer

Manually rotate the KMS key every year

Answer

Create a new KMS key and update all applications to use it

Answer

Use AWS CloudWatch Events to trigger a Lambda function that rotates the key

Question 7

A developer uses AWS CodeCommit to store source code. The developer wants to automatically trigger a build in AWS CodeBuild every time a new commit is pushed to the master branch. Which AWS service should the developer use to configure this integration?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it provides a fully managed continuous delivery service that can be configured to automatically start a pipeline execution whenever a new commit is pushed to a specific branch in AWS CodeCommit. By setting up a CodeCommit source action in a pipeline, CodePipeline uses webhooks or polling to detect changes and then triggers the build project in AWS CodeBuild as the next stage. This creates a seamless CI/CD workflow without requiring custom event rules or additional services.

Answer

Amazon CloudWatch Events (or EventBridge)

Answer

Amazon S3 events

Answer

AWS CodeDeploy

Question 8

A developer is building a serverless application using AWS Step Functions. The workflow must execute hundreds of thousands of short-lived tasks per day, each taking less than 30 seconds. The tasks need to run in parallel, and a small number of duplicate executions are acceptable. Which type of Step Functions workflow should the developer choose?

Accepted Answer

Express Workflow. Express Workflows are designed for high-volume, short-duration (under 5 minutes) event-processing workloads, executing hundreds of thousands of state transitions per second with at-least-once semantics. Since the tasks are short-lived (under 30 seconds), run in parallel, and tolerate a small number of duplicate executions, Express Workflow is the correct choice because it offers lower cost and higher throughput than Standard Workflow, which guarantees exactly-once execution and is better suited for long-running, auditable workflows.

Answer

Standard Workflow

Answer

AWS Lambda function with synchronous invocation

Answer

Amazon Simple Workflow Service (SWF)

Question 9

A developer is writing a Lambda function that processes images uploaded to an S3 bucket. The function needs to extract metadata from the image. Which S3 feature can be used to automatically trigger the Lambda function?

Accepted Answer

S3 Events. Amazon S3 Events can be configured to send a notification when an object is created (e.g., via PutObject) in an S3 bucket. This event can directly invoke an AWS Lambda function, making it the correct service to automatically trigger the function upon image upload. The developer simply needs to set up an S3 event notification with the Lambda function as the destination.

Answer

S3 Inventory

Answer

S3 Transfer Acceleration

Answer

S3 Batch Operations

Question 10

A company is deploying a critical application using AWS CloudFormation. The stack creation fails due to a resource creation failure. The developer needs to troubleshoot the issue. Which TWO actions should the developer take to identify the root cause? (Choose TWO.)

Accepted Answer

View the stack events in the CloudFormation console.. Options A and D are correct. A: Viewing stack events (Events tab) shows error messages for each resource, which can indicate which resource failed and why. D: Reviewing the stack template for logical errors can help identify issues like missing dependencies or incorrect parameter values. Option B is wrong because stack outputs are only available after successful creation; during a failure, outputs are not generated. Option C is wrong because deleting and recreating the stack with the same parameters will likely result in the same failure and also removes the stack's logs and events, losing troubleshooting information. Option E is wrong because CloudTrail logs API calls made to AWS, but CloudFormation-specific errors during resource creation are not detailed in CloudTrail; stack events provide more relevant information.

Answer

Check the stack outputs.

Answer

Delete the stack and recreate it with the same parameters.

Answer

Check AWS CloudTrail logs for the stack creation attempt.