AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 751–825

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store can store credentials but does not natively support automatic rotation; rotation would require custom automation with Lambda or other services, making it less suitable for this requirement. Option C is wrong because AWS Key Management Service (KMS) is a key management service for encryption keys, not for storing or rotating database credentials; it can encrypt secrets but does not manage rotation of the credentials themselves. Option D is wrong because IAM Roles for EC2 provide temporary credentials for AWS API access, not for storing or rotating database credentials; they cannot be used to store or rotate application-level database passwords.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because if the BeforeInstall lifecycle event is not defined in the appspec.yml, CodeDeploy would simply skip that event and not produce a 'ScriptMissing' error — the error specifically occurs when a hook is defined but its script is absent. Option C is wrong because if the CodeDeploy agent were not running, the deployment would fail with an 'AgentNotRunning' or 'InstanceUnreachable' error, not a 'ScriptMissing' error. Option D is wrong because insufficient permissions to execute the script would result in a 'ScriptFailed' error (e.g., exit code 126 or 127), not a 'ScriptMissing' error — the agent first checks for the file's existence before attempting execution.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because increasing batch size to 100 would cause each invocation to process more messages, but with only 5 concurrent executions, the function would still be limited to 5 invocations at a time, and the 1-second execution time per message would scale linearly, likely causing timeouts or increased latency without addressing the root cause of throttling. Option C is wrong because decreasing reserved concurrency to 2 would reduce throughput to 20 messages per second, worsening throttling and backlog. Option D is wrong because increasing DynamoDB write capacity addresses potential write throttling from DynamoDB, but the CloudWatch metrics show Lambda throttling, not DynamoDB throttling; the bottleneck is Lambda concurrency, not the database.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because enabling cluster mode and distributing data across multiple shards does not increase the total memory per node; it only partitions data, and if the total memory across shards is insufficient, evictions will still occur. Option C is wrong because changing the eviction policy to 'allkeys-lfu' only changes which keys are evicted (least frequently used) but does not address the root cause of insufficient memory; evictions will continue at the same rate. Option D is wrong because adding a read replica offloads read traffic but does not increase the primary node's memory, so evictions and low cache hit rate will persist on the primary node.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS KMS is used for encryption key management, not for granting permissions; it does not provide IAM-level access control for writing logs. Option C is wrong because resource-based policies on a Lambda function control who can invoke the function, not what the function itself can do (like writing to CloudWatch Logs); permissions for the function's actions are defined in its execution role. Option D is wrong because storing AWS access keys in environment variables is a security anti-pattern; Lambda should never use long-term credentials, and instead relies on the IAM execution role to provide temporary, automatically rotated credentials.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because storing AWS credentials in a file on the instance is a security risk and violates the principle of least privilege; it also requires managing long-term keys, which can be rotated or compromised. Option B is wrong because security groups control network traffic at the instance level, but DynamoDB is a managed service outside the VPC; without a VPC endpoint or internet access, security group rules alone cannot route traffic to DynamoDB. Option C is wrong because a NAT gateway would provide internet access, but it introduces additional cost and complexity, and using IAM user credentials on the instance still requires managing long-term keys; the recommended approach is to use an IAM role with a VPC endpoint.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a Lambda Authorizer (formerly Custom Authorizer) is used when you need custom validation logic beyond simple JWT verification, such as calling an external identity provider or performing complex claims mapping; it introduces unnecessary latency and cost for straightforward JWT validation. Option B is wrong because IAM Authorizer uses AWS Signature Version 4 (SigV4) for request signing and is intended for AWS service-to-service or IAM user authentication, not for validating externally-issued JWTs. Option D is wrong because Amazon Cognito User Pools is a full identity provider that issues JWTs, but it is not an API Gateway authorizer feature; you would still need to use a JWT Authorizer or Lambda Authorizer to validate those tokens in API Gateway.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing memory to 10 GB only allocates more CPU and memory to the function, but does not address the root cause of a single bad record blocking the shard; it does not provide any mechanism to isolate or skip failed records. Option B is wrong because disabling batch processing (setting batch size to 1) would still cause the same blocking behavior—each record would be processed individually, but a persistent bad record would still be retried indefinitely, blocking the shard. Option D is wrong because converting the stream to an S3 bucket is not a direct replacement for Kinesis event processing; S3 does not support the same record-level retry and failure handling semantics, and this would require a complete architectural change, not a simple configuration fix.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS IAM is for managing AWS service access and permissions for users and roles, not for external user authentication with social login providers; it lacks built-in support for social identity federation. Option C is wrong because AWS Directory Service provides managed Microsoft Active Directory or LDAP-based directories for enterprise identity, which does not natively support social login providers like Google or Facebook. Option D is wrong because AWS Single Sign-On (now AWS IAM Identity Center) is designed for workforce identity and SSO across AWS accounts and business applications, not for customer-facing web app authentication with social logins.

Why this answer

Why this answer

How to eliminate wrong answers

Option A (AllAtOnce) is wrong because it deploys to all instances simultaneously, taking the entire fleet out of service at once, which maximizes disruption. Option C (HalfAtATime) is wrong because it is not a predefined deployment configuration in AWS CodeDeploy; the correct predefined option for deploying to half the instances is 'HalfAtATime' but it would take 50% of instances out of service at a time, which is more than the single instance the developer wants. Option D (Custom with 50% at a time) is wrong because while custom configurations are possible, the developer specifically asked for a predefined configuration, and using a custom one would not be the simplest or most direct solution; moreover, deploying 50% at a time would still take more instances out of service than the desired minimum.

Why this answer

How to eliminate wrong answers

Option A is wrong because setting 'Reroute traffic to replacement instances' to 'Immediately' would route traffic to new instances as soon as they are registered, without waiting for health checks, risking traffic being sent to unhealthy instances. Option B is wrong because 'Wait for time' only introduces a fixed delay, not a health check verification, so traffic could be routed before instances are healthy if the wait time is too short. Option D is wrong because terminating original instances before rerouting traffic would cause downtime, as there would be no healthy instances to serve traffic during the transition.

Why this answer

How to eliminate wrong answers

Option B is wrong because `aws:ResourceTag` evaluates the tags already attached to an existing resource, not the tags in the creation request, so it cannot enforce tagging at bucket creation. Option C is wrong because `s3:ExistingObjectTag` is used to conditionally allow actions based on tags on existing objects within a bucket, not on the bucket creation request itself. Option D is wrong because `aws:TagKeys` is used to restrict which tag keys can be used in a request, but it does not require that a specific tag key be present; it only controls the allowed set of keys.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an IAM authorizer uses AWS Signature Version 4 for signing requests with IAM credentials, not OIDC tokens, and is designed for AWS-authenticated principals, not external identity providers. Option B is wrong because an API key authorizer only validates a static key passed in the header, which provides no authentication of the user's identity and cannot verify OIDC tokens. Option D is wrong because an S3 bucket policy controls access to S3 resources, not API Gateway endpoints, and has no mechanism to validate OIDC tokens.

Why this answer

How to eliminate wrong answers

Option B is wrong because an IAM authorizer uses AWS Signature Version 4 to sign requests with IAM credentials, not a custom JWT; it cannot inspect or validate JWT claims like user roles. Option C is wrong because Amazon Cognito user pools authorizer only works with JWTs issued by a Cognito user pool, not with a custom JWT from an external identity provider or self-issued token. Option D is wrong because an API Gateway resource policy controls access at the account or VPC level based on source IP, VPC endpoint, or AWS account, not on individual request-level JWT claims or user roles.

Why this answer

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) is used in AWS Organizations to set permission boundaries for all accounts in an organization, not to grant permissions to individual IAM users. Option B is wrong because a bucket policy is a resource-based policy attached directly to an S3 bucket, not to an IAM user; while it can grant cross-account access, it does not control permissions for a specific IAM user within the same account. Option C is wrong because a trust policy is attached to an IAM role to define which principals (e.g., users, services) can assume that role, not to grant direct permissions for S3 actions to an IAM user.

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because key rotation is performed via the `RotateKey` API or automatic rotation settings, not `CreateKey`. Option B is wrong because database encryption keys are typically managed by the database service (e.g., RDS, DynamoDB) using KMS grants or direct CMK usage, not a standalone `CreateKey` event. Option D is wrong because service-linked keys are created by AWS services on your behalf using a different API call (e.g., `CreateKey` with a service principal), but the event name is still `CreateKey`; however, the question's context implies a standard CMK creation, and service-linked keys are a specific subset that would be logged with a different `requestParameters` (e.g., `KeyUsage` and `Origin`).

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because implementing a local cache inside a Lambda function is ephemeral and not shared across concurrent invocations, so it cannot reduce backend load for repeated requests from different clients. Option C is wrong because while ElastiCache Redis can cache data, it requires additional code in the Lambda function to check the cache first, adding complexity and latency compared to API Gateway's built-in caching. Option D is wrong because CloudFront caches content at the edge, but it does not reduce backend load for API Gateway itself unless combined with API Gateway caching; CloudFront alone still forwards cache misses to API Gateway, which then invokes the backend.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because hardcoding the bucket name in the Lambda function code violates the separation of configuration from code, making the function environment-specific and requiring code changes to point to a different bucket. Option C is wrong because reading the bucket name from a text file stored in the same bucket creates a circular dependency: the function needs the bucket name to access the bucket, but it must first read the file from the bucket to get the name, which is impossible without prior knowledge of the bucket. Option D is wrong because using a KMS key to encrypt the bucket name and decrypt it in the function adds unnecessary complexity and overhead; environment variables are already encrypted at rest by default, and the bucket name is not sensitive data that requires custom encryption—this approach does not solve the configuration problem.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because reserved concurrency controls the maximum number of concurrent executions for a function, not storage capacity. Option C is wrong because the function URL auth type (e.g., AWS_IAM or NONE) determines authentication for HTTP invocations, not storage. Option D is wrong because a dead-letter queue target (e.g., SQS or SNS) is used for capturing failed asynchronous invocations, not for providing scratch space.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because an IAM group is a collection of IAM users and cannot be directly attached to an EC2 instance; groups are used to manage permissions for users, not for AWS resources. Option C is wrong because an IAM user has long-term credentials (access key ID and secret access key) that would need to be stored on the EC2 instance, which is a security risk and not a best practice for granting permissions to an AWS service. Option D is wrong because a resource-based policy on the DynamoDB table can grant access to principals (like IAM roles or users) but cannot be attached to an EC2 instance; the EC2 instance itself must have an identity (role) to authenticate against the policy.

Why this answer

How to eliminate wrong answers

Option A is wrong because while CloudTrail logs root account events, SNS notifications cannot be directly configured on CloudTrail; you need a CloudWatch Events rule to filter and route the events to an SNS topic. Option C is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) at layer 3/4, not API call details; they cannot log or monitor AWS API calls. Option D is wrong because AWS Config rules evaluate resource configuration compliance (e.g., whether an S3 bucket is public), not user activity or API call patterns; they cannot detect root account usage.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because HTTPS health checks require the target to support HTTPS; if the instances only support HTTP, the health check would fail and the instances would be marked unhealthy, leading to 503 errors (not 504). Option B is wrong because disabling cross-zone load balancing affects traffic distribution across Availability Zones, not the timeout behavior that causes 504 errors. Option D is wrong because a missing inbound security group rule for the load balancer would prevent the load balancer from establishing connections to the instances, resulting in 502 errors or health check failures, not intermittent 504 timeouts.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a syntax error in the Lambda function code would not prevent the resource from being created; CloudFormation would still create the function, but invocation would fail, and logs would appear (if permissions allow). Option B is wrong because the error message states the resource failed to create, meaning the function was never successfully created, so it cannot be invoked; the absence of logs is not due to lack of invocation but due to creation failure. Option D is wrong because a CloudFormation template syntax error would cause a different error (e.g., 'Template validation error') and would prevent the entire stack from being parsed, not just a single resource creation failure.

Why this answer

How to eliminate wrong answers

Option A is wrong because SSE-KMS uses AWS KMS keys, which are managed by the customer (customer-managed keys) by default and require manual rotation or configuration for automatic rotation, and incur additional costs. Option C is wrong because SSE-C requires the customer to provide and manage their own encryption keys, and AWS does not rotate them. Option D is wrong because client-side encryption is performed by the client application before data is sent to S3, and the keys are managed by the client, not by AWS.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Organizations SCPs cannot inspect the content of individual Git commits or enforce signing; they operate at the account or organizational level and cannot evaluate commit-level metadata. Option B is wrong because CodeCommit does not have a built-in 'Require signed commits' setting in its repository configuration; this feature exists in other Git hosting services like GitHub or GitLab but not in CodeCommit. Option D is wrong because CodeCommit does not support pre-commit hooks; hooks are a client-side Git feature and cannot be enforced server-side via AWS Lambda.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS::ApiGateway::DomainName only defines the custom domain name and its TLS certificate; it does not automatically create the base path mapping or integrate with the API stage, so additional resources and manual wiring are needed. Option C is wrong because AWS::ApiGateway::BasePathMapping maps a base path to an API stage but does not create the custom domain name itself; it must be used in conjunction with a DomainName resource, increasing complexity. Option D is wrong because AWS::Route53::RecordSet creates a DNS record (e.g., CNAME or A alias) to point a custom domain to the API Gateway endpoint, but it does not configure the API Gateway custom domain name or TLS termination; it is a DNS-only resource and cannot replace the DomainName configuration.

Why this answer

How to eliminate wrong answers

Option B is wrong because the bucket policy condition checking aws:SourceVpce is necessary to restrict access to the VPC endpoint, but the question states the policy already allows access only from a specific VPC endpoint; the issue is that requests are denied, so the condition is likely present but the endpoint policy is blocking. Option C is wrong because the route table does not need a route to the S3 endpoint; VPC endpoints use prefix lists and route tables direct traffic to the endpoint via a gateway or interface endpoint, but missing routes would cause a timeout or connection failure, not an IAM denial. Option D is wrong because security groups do not apply to VPC endpoint traffic; S3 uses a gateway endpoint which is not associated with security groups, and outbound HTTPS traffic from the EC2 instance is allowed by default in the VPC.