DVA-C02 Timed Practice Test 3 — 10 Questions

Question 1

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Option A is correct because Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 2

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. Option C is correct because API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.

Question 3

A developer needs to securely store database credentials used by an application running on EC2. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option A is correct because AWS Secrets Manager is designed to securely store and rotate secrets such as database credentials. Option B is wrong because AWS Certificate Manager is for SSL/TLS certificates. Option C is wrong because Systems Manager Parameter Store can store secrets, but Secrets Manager provides built-in rotation and is more suitable for database credentials. Option D is wrong because S3 is an object store, not designed for secret management.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Certificate Manager (ACM)

Question 4

A developer is designing a serverless application using API Gateway, Lambda, and DynamoDB. The API must authenticate users using a JWT token. Which API Gateway feature should the developer use to validate the JWT before invoking the Lambda function?

Accepted Answer

Use a Lambda authorizer (custom authorizer).. Option C is correct because a Lambda authorizer (custom authorizer) allows the developer to implement custom JWT validation logic, such as verifying the token's signature, expiry, and claims, before the request reaches the Lambda function. This is the most flexible approach when the JWT is issued by a third-party identity provider (IdP) that is not Amazon Cognito, as API Gateway's native JWT authorizer only supports JWTs from specific providers like Cognito or Auth0. The Lambda authorizer can return an IAM policy to allow or deny the request, enabling fine-grained access control based on the token's content.

Answer

Use an IAM authorizer with a resource policy.

Answer

Use an Amazon Cognito user pool authorizer.

Answer

Use an API Gateway resource policy to allow only authenticated IPs.

Question 5

A developer is designing a web application that will run on EC2 instances behind an Application Load Balancer. The application needs to authenticate users. Which service should the developer use to manage user identities and provide single sign-on?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications. It provides user sign-up, sign-in, and access control, and supports single sign-on (SSO) through federation with social identity providers (e.g., Google, Facebook) and enterprise identity providers via SAML 2.0 or OIDC. This makes it ideal for authenticating users in an application running behind an Application Load Balancer.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Security Token Service (STS)

Question 6

A developer is deploying an application on EC2 instances behind an Application Load Balancer. The application must support mutual TLS (mTLS) authentication between clients and the load balancer. Which configuration is required?

Accepted Answer

Create a trust store in AWS Certificate Manager Private CA and associate it with the ALB.. Option C is correct because mutual TLS (mTLS) on an Application Load Balancer requires a trust store that contains the trusted Certificate Authority (CA) certificates used to validate client certificates. This trust store must be created in AWS Certificate Manager Private CA and then associated with the ALB's listener rules. The ALB then performs client certificate verification during the TLS handshake, ensuring both the server and client present valid certificates.

Answer

Use a Network Load Balancer (NLB) with TLS listeners.

Answer

Configure listener rules on the ALB to require client certificates.

Answer

Use Amazon CloudFront with a custom origin and require client certificates.

Question 7

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. Option C is correct because the bucket policy explicitly allows only the role with the exact ARN 'arn:aws:iam::123456789012:role/AppRole'. If the instance's role ARN is different, the request is denied. Option A is wrong because S3 does not require SSE for GetObject. Option B is wrong because MFA is not specified in the error. Option D is wrong because IAM role policies and bucket policies are evaluated separately; an allow in the bucket policy must match the principal.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 8

A company has a centralized logging solution where all EC2 instances send logs to a CloudWatch Logs group in a central account. The EC2 instances are in a different account (App Account). The developer configures the CloudWatch agent on the instances with the necessary IAM role. However, logs are not appearing in the central account's log group. The IAM role in the App Account has permissions to put logs to the central account's log group. What is the most likely missing configuration?

Accepted Answer

The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.. Option A is correct because cross-account CloudWatch Logs requires a destination policy in the central account that allows the App Account to write logs. Option B is wrong because VPC endpoints are not required. Option C is wrong because the log group does not need to be in the same region, but cross-region might require additional configuration. Option D is wrong because KMS encryption is optional.

Answer

CloudWatch Logs must be encrypted with the same KMS key in both accounts.

Answer

The log group must be in the same region as the EC2 instances.

Answer

The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

Question 9

A developer is troubleshooting an AWS Lambda function that processes large CSV files (up to 1 GB) uploaded to an Amazon S3 bucket. The function uses Python and the pandas library to perform data transformations. Recently, the function started timing out on large files. CloudWatch Logs show that the function's execution time is close to the 15-minute Lambda timeout, and memory utilization peaks at around 80% of the configured 3,008 MB. The function has not been modified in months. Which action will most likely resolve the timeout issue without requiring code changes?

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files

Question 10

A developer optimized an Amazon S3 bucket for high request rates. The bucket receives over 5,000 PUT requests per second. Recently, some requests are failing with a 503 Slow Down error. What is the most likely cause and how should the developer fix it?

Accepted Answer

Add a random prefix to the object keys to distribute across partitions.. Option D is correct because S3 returns 503 when request rates exceed partition limits. Prefix randomization spreads requests across partitions. Option A is wrong because 503 is not due to permissions. Option B is wrong because 503 is not a quota limit exceeded error (that would be 400). Option C is wrong because multipart upload is for large objects, not rate limits.

Answer

Use multipart upload for all objects to improve throughput.

Answer

The request rate exceeds the account-level PUT quota; request a quota increase.

Answer

The bucket policy is too permissive; restrict access to prevent abuse.