🔍

DVA-C02 — questions

Page 13 of 28 · 557 total questions.

DVA-C02 Question 241

Single page →
Topic 1 · Question 241

A company is creating a REST service using an Amazon API Gateway with AWS Lambda integration. The service must run different versions for testing purposes. What would be the BEST way to accomplish this?

  • AUse an X-Version header to denote which version is being called and pass that header to the Lambda function(s).
  • BCreate an API Gateway Lambda authorizer to route API clients to the correct API version.
  • CCreate an API Gateway resource policy to isolate versions and provide context to the Lambda function(s).
  • DDeploy the API versions as unique stages with unique endpoints and use stage variables to provide further context. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Deploy the API versions as unique stages with unique endpoints and use stage variables to provide further context.

DVA-C02 Question 242

Single page →
Topic 1 · Question 242 · Select all that apply

A company is using AWS CodePipeline to deliver one of its applications. The delivery pipeline is triggered by changes to the main branch of an AWS CodeCommit repository and uses AWS CodeBuild to implement the test and build stages of the process and AWS CodeDeploy to deploy the application. The pipeline has been operating successfully for several months and there have been no modifications. Following a recent change to the application’s source code, AWS CodeDeploy has not deployed the updated application as expected. What are the possible causes? (Choose two.)

  • AThe change was not made in the main branch of the AWS CodeCommit repository. (correct answer)
  • BOne of the earlier stages in the pipeline failed and the pipeline has terminated. (correct answer)
  • COne of the Amazon EC2 instances in the company’s AWS CodePipeline cluster is inactive.
  • DThe AWS CodePipeline is incorrectly configured and is not invoking AWS CodeDeploy.
  • EAWS CodePipeline does not have permissions to access AWS CodeCommit.
Reveal answer & explanation
Correct answer: A, B

The correct answer is A, B. Option A: The change was not made in the main branch of the AWS CodeCommit repository. Option B: One of the earlier stages in the pipeline failed and the pipeline has terminated.

Explanation

AWS CodeCommit hosts private Git repositories.

DVA-C02 Question 243

Single page →
Topic 1 · Question 243

A developer is building a serverless application by using AWS Serverless Application Model (AWS SAM) on multiple AWS Lambda functions. When the application is deployed, the developer wants to shift 10% of the traffic to the new deployment of the application for the first 10 minutes after deployment. If there are no issues, all traffic must switch over to the new version. Which change to the AWS SAM template will meet these requirements?

  • ASet the Deployment Preference Type to Canary10Percent10Minutes. Set the AutoPublishAlias property to the Lambda alias. (correct answer)
  • BSet the Deployment Preference Type to Linear10PercentEvery10Minutes. Set AutoPublishAlias property to the Lambda alias.
  • CSet the Deployment Preference Type to Canary10Percent10Minutes. Set the PreTraffic and PostTraffic properties to the Lambda alias.
  • DSet the Deployment Preference Type to Linear10PercentEvery10Minutes. Set PreTraffic and PostTraffic properties to the Lambda alias.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set the Deployment Preference Type to Canary10Percent10Minutes. Set the AutoPublishAlias property to the Lambda alias.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

DVA-C02 Question 244

Single page →
Topic 1 · Question 244

An AWS Lambda function is running in a company’s shared AWS account. The function needs to perform an additional ec2:DescribeInstances action that is directed at the company’s development accounts. A developer must configure the required permissions across the accounts. How should the developer configure the permissions to adhere to the principle of least privilege?

  • ACreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship between the development accounts for this role. Update the Lambda function IAM role in the shared account by adding the ec2:DescribeInstances permission to the role.
  • BCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions. (correct answer)
  • CCreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship between the development accounts for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions.
  • DCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the ec2:DescribeInstances permission to the role.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the sh...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

DVA-C02 Question 245

Single page →
Topic 1 · Question 245 · Select all that apply

A developer is building a new application that will be deployed on AWS. The developer has created an AWS CodeCommit repository for the application. The developer has initialized a new project for the application by invoking the AWS Cloud Development Kit (AWS CDK) cdk init command. The developer must write unit tests for the infrastructure as code (IaC) templates that the AWS CDK generates. The developer also must run a validation tool across all constructs in the CDK application to ensure that critical security configurations are activated. Which combination of actions will meet these requirements with the LEAST development overhead? (Choose two.)

  • AUse a unit testing framework to write custom unit tests against the cdk.out file that the AWS CDK generates. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository.
  • BUse the CDK assertions module to integrate unit tests with the application. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository. (correct answer)
  • CUse the CDK runtime context to set key-value pairs that must be present in the cdk.out file that the AWS CDK generates. Fail the stack synthesis if any violations are present.
  • DWrite a script that searches the application for specific key configuration strings. Configure the script to produce a report of any security violations.
  • EUse the CDK Aspects class to create custom rules to apply to the CDK application. Fall the stack synthesis if any violations are present. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Use the CDK assertions module to integrate unit tests with the application. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository. Option E: Use the CDK Aspects class to create custom rules to apply to the CDK application. Fall the stack synthesis if any violations are present.

Explanation

The AWS CDK defines cloud infrastructure as code using familiar programming languages.

DVA-C02 Question 246

Single page →
Topic 1 · Question 246

An online sales company is developing a serverless application that runs on AWS. The application uses an AWS Lambda function that calculates order success rates and stores the data in an Amazon DynamoDB table. A developer wants an efficient way to invoke the Lambda function every 15 minutes. Which solution will meet this requirement with the LEAST development effort?

  • ACreate an Amazon EventBridge rule that has a rate expression that will run the rule every 15 minutes. Add the Lambda function as the target of the EventBridge rule. (correct answer)
  • BCreate an AWS Systems Manager document that has a script that will invoke the Lambda function on Amazon EC2. Use a Systems Manager Run Command task to run the shell script every 15 minutes.
  • CCreate an AWS Step Functions state machine. Configure the state machine to invoke the Lambda function execution role at a specified interval by using a Wait state. Set the interval to 15 minutes.
  • DProvision a small Amazon EC2 instance. Set up a cron job that invokes the Lambda function every 15 minutes.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Amazon EventBridge rule that has a rate expression that will run the rule every 15 minutes. Add the Lambda function as the target of the EventBridge rule.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. This option needs the least custom development effort.

DVA-C02 Question 247

Single page →
Topic 1 · Question 247

A company deploys a photo-processing application to an Amazon EC2 instance. The application needs to process each photo in less than 5 seconds. If processing takes longer than 5 seconds, the company’s development team must receive a notification. How can a developer implement the required time measurement and notification with the LEAST operational overhead?

  • ACreate an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that is based on a static threshold of 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic. (correct answer)
  • BCreate an Amazon Simple Queue Service (Amazon SQS) queue. Each time a photo is processed, publish the processing time to the queue. Create an application to consume from the queue and to determine whether any values are more than 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.
  • CCreate an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that enters ALARM state if the average of values is greater than 5 seconds. Notify the development team by sending an Amazon Simple Email Service (Amazon SES) message.
  • DCreate an Amazon Kinesis data stream. Each time a photo is processed, publish the processing time to the data stream. Create an Amazon CloudWatch alarm that enters ALARM state if any values are more than 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Create an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that is based on a static threshold of 5 seconds. Notify the developm...

Explanation

Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

DVA-C02 Question 248

Single page →
Topic 1 · Question 248 · Select all that apply

A company is using AWS Elastic Beanstalk to manage web applications that are running on Amazon EC2 instances. A developer needs to make configuration changes. The developer must deploy the changes to new instances only. Which types of deployment can the developer use to meet this requirement? (Choose two.)

  • AAll at once
  • BImmutable (correct answer)
  • CRolling
  • DBlue/green (correct answer)
  • ERolling with additional batch
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Immutable Option D: Blue/green.

DVA-C02 Question 249

Single page →
Topic 1 · Question 249

A developer needs to use Amazon DynamoDB to store customer orders. The developer’s company requires all customer data to be encrypted at rest with a key that the company generates. What should the developer do to meet these requirements?

  • ACreate the DynamoDB table with encryption set to None. Code the application to use the key to decrypt the data when the application reads from the table. Code the application to use the key to encrypt the data when the application writes to the table.
  • BStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS customer managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key. (correct answer)
  • CStore the key by using AWS Key Management Service (AWS KMS). Create the DynamoDB table with default encryption. Include the kms:Encrypt parameter with the Amazon Resource Name (ARN) of the AWS KMS key when using the DynamoDB software development kit (SDK).
  • DStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS AWS managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS customer managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DVA-C02 Question 250

Single page →
Topic 1 · Question 250

A company uses AWS CloudFormation to deploy an application that uses an Amazon API Gateway REST API with AWS Lambda function integration. The application uses Amazon DynamoDB for data persistence. The application has three stages: development, testing, and production. Each stage uses its own DynamoDB table. The company has encountered unexpected issues when promoting changes to the production stage. The changes were successful in the development and testing stages. A developer needs to route 20% of the traffic to the new production stage API with the next production release. The developer needs to route the remaining 80% of the traffic to the existing production stage. The solution must minimize the number of errors that any single customer experiences. Which approach should the developer take to meet these requirements?

  • AUpdate 20% of the planned changes to the production stage. Deploy the new production stage. Monitor the results. Repeat this process five times to test all planned changes.
  • BUpdate the Amazon Route 53 DNS record entry for the production stage API to use a weighted routing policy. Set the weight to a value of 80. Add a second record for the production domain name. Change the second routing policy to a weighted routing policy. Set the weight of the second policy to a value of 20. Change the alias of the second policy to use the testing stage API.
  • CDeploy an Application Load Balancer (ALB) in front of the REST API. Change the production API Amazon Route 53 record to point traffic to the ALB. Register the production and testing stages as targets of the ALB with weights of 80% and 20%, respectively.
  • DConfigure canary settings for the production stage API. Change the percentage of traffic directed to canary deployment to 20%. Make the planned updates to the production stage. Deploy the changes (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure canary settings for the production stage API. Change the percentage of traffic directed to canary deployment to 20%. Make the planned updates to the production stage. Deploy the changes

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 251

Single page →
Topic 1 · Question 251

A developer has created a data collection application that uses Amazon API Gateway, AWS Lambda, and Amazon S3. The application’s users periodically upload data files and wait for the validation status to be reflected on a processing dashboard. The validation process is complex and time-consuming for large files. Some users are uploading dozens of large files and have to wait and refresh the processing dashboard to see if the files have been validated. The developer must refactor the application to immediately update the validation result on the user’s dashboard without reloading the full dashboard. What is the MOST operationally efficient solution that meets these requirements?

  • AIntegrate the client with an API Gateway WebSocket API. Save the user-uploaded files with the WebSocket connection ID. Push the validation status to the connection ID when the processing is complete to initiate an update of the user interface. (correct answer)
  • BLaunch an Amazon EC2 micro instance, and set up a WebSocket server. Send the user-uploaded file and user detail to the EC2 instance after the user uploads the file. Use the WebSocket server to send updates to the user interface when the uploaded file is processed.
  • CSave the user’s email address along with the user-uploaded file. When the validation process is complete, send an email notification through Amazon Simple Notification Service (Amazon SNS) to the user who uploaded the file.
  • DSave the user-uploaded file and user detail to Amazon DynamoDB. Use Amazon DynamoDB Streams with Amazon Simple Notification Service (Amazon SNS) push notifications to send updates to the browser to update the user interface.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Integrate the client with an API Gateway WebSocket API. Save the user-uploaded files with the WebSocket connection ID. Push the validation status to the connection ID when the processing is complete to initiate an upd...

Explanation

Amazon EBS provides block storage attached to a single EC2 instance. Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

DVA-C02 Question 252

Single page →
Topic 1 · Question 252

A company’s developer is creating an application that uses Amazon API Gateway. The company wants to ensure that only users in the Sales department can use the application. The users authenticate to the application by using federated credentials from a third-party identity provider (IdP) through Amazon Cognito. The developer has set up an attribute mapping to map an attribute that is named Department and to pass the attribute to a custom AWS Lambda authorizer. To test the access limitation, the developer sets their department to Engineering in the IdP and attempts to log in to the application. The developer is denied access. The developer then updates their department to Sales in the IdP and attempts to log in. Again, the developer is denied access. The developer checks the logs and discovers that access is being denied because the developer’s access token has a department value of Engineering. Which of the following is a possible reason that the developer’s department is still being reported as Engineering instead of Sales?

  • AAuthorization caching is enabled in the custom Lambda authorizer. (correct answer)
  • BAuthorization caching is enabled on the Amazon Cognito user pool.
  • CThe IAM role for the custom Lambda authorizer does not have a Department tag.
  • DThe IAM role for the Amazon Cognito user pool does not have a Department tag.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Authorization caching is enabled in the custom Lambda authorizer.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

DVA-C02 Question 253

Single page →
Topic 1 · Question 253

A company has migrated an application to Amazon EC2 instances. Automatic scaling is working well for the application user interface. However, the process to deliver shipping requests to the company’s warehouse staff is encountering issues. Duplicate shipping requests are arriving, and some requests are lost or arrive out of order. The company must avoid duplicate shipping requests and must process the requests in the order that the requests arrive. Requests are never more than 250 KB in size and take 5-10 minutes to process. A developer needs to rearchitect the application to improve the reliability of the delivery and processing of the requests. What should the developer do to meet these requirements?

  • ACreate an Amazon Kinesis Data Firehose delivery stream to process the requests. Create an Amazon Kinesis data stream. Modify the application to write the requests to the Kinesis data stream.
  • BCreate an AWS Lambda function to process the requests. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda function to the SNS topic. Modify the application to write the requests to the SNS topic.
  • CCreate an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) standard queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the requests to the SQS queue.
  • DCreate an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the requests to the SQS queue. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the r...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes.

DVA-C02 Question 254

Single page →
Topic 1 · Question 254

A developer is creating a machine learning (ML) pipeline in AWS Step Functions that contains AWS Lambda functions. The developer has configured an Amazon Simple Queue Service (Amazon SQS) queue to deliver ML model parameters to the ML pipeline to train ML models. The developer uploads the trained models are uploaded to an Amazon S3 bucket. The developer needs a solution that can locally test the ML pipeline without making service integration calls to Amazon SQS and Amazon S3. Which solution will meet these requirements?

  • AUse the Amazon CodeGuru Profiler to analyze the Lambda functions used in the AWS Step Functions pipeline.
  • BUse the AWS Step Functions Local Docker Image to run and locally test the Lambda functions.
  • CUse the AWS Serverless Application Model (AWS SAM) CLI to run and locally test the Lambda functions.
  • DUse AWS Step Functions Local with mocked service integrations. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use AWS Step Functions Local with mocked service integrations.

Explanation

AWS Step Functions coordinates multi-step workflows as a managed state machine.

DVA-C02 Question 255

Single page →
Topic 1 · Question 255

A company runs a batch processing application by using AWS Lambda functions and Amazon API Gateway APIs with deployment stages for development, user acceptance testing, and production. A development team needs to configure the APIs in the deployment stages to connect to third-party service endpoints. Which solution will meet this requirement?

  • AStore the third-party service endpoints in Lambda layers that correspond to the stage.
  • BStore the third-party service endpoints in API Gateway stage variables that correspond to the stage. (correct answer)
  • CEncode the third-party service endpoints as query parameters in the API Gateway request URL.
  • DStore the third-party service endpoint for each environment in AWS AppConfig.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the third-party service endpoints in API Gateway stage variables that correspond to the stage.

Explanation

Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

DVA-C02 Question 256

Single page →
Topic 1 · Question 256

A developer is building a serverless application that runs on AWS. The developer wants to create an accelerated development workflow that deploys incremental changes to AWS for testing. The developer wants to deploy the incremental changes but does not want to fully deploy the entire application to AWS for every code commit. What should the developer do to meet these requirements?

  • AUse the AWS Serverless Application Model (AWS SAM) to build the application. Use the sam sync command to deploy the incremental changes. (correct answer)
  • BUse the AWS Serverless Application Model (AWS SAM) to build the application. Use the sam init command to deploy the incremental changes.
  • CUse the AWS Cloud Development Kit (AWS CDK) to build the application. Use the cdk synth command to deploy the incremental changes.
  • DUse the AWS Cloud Development Kit (AWS CDK) to build the application. Use the cdk bootstrap command to deploy the incremental changes.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the AWS Serverless Application Model (AWS SAM) to build the application. Use the sam sync command to deploy the incremental changes.

DVA-C02 Question 257

Single page →
Topic 1 · Question 257

A developer is building an application that will use an Amazon API Gateway API with an AWS Lambda backend. The team that will develop the frontend requires immediate access to the API endpoints to build the UI. To prepare the backend application for integration, the developer needs to set up endpoints. The endpoints need to return predefined HTTP status codes and JSON responses for the frontend team. The developer creates a method for an API resource. Which solution will meet these requirements?

  • ASet the integration type to AWS_PROXY. Provision Lambda functions to return hardcoded JSON data.
  • BSet the integration type to MOCK. Configure the method's integration request and integration response to associate a JSON responses with specific HTTP status codes. (correct answer)
  • CSet the integration type to HTTP_PROXY. Configure API Gateway to pass all requests to an external placeholder API. which the team will build.
  • DSet the integration type to MOCK. Use a method request to define HTTP status codes. Use an integration request to define JSON responses.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Set the integration type to MOCK. Configure the method's integration request and integration response to associate a JSON responses with specific HTTP status codes.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 258

Single page →
Topic 1 · Question 258

A developer is migrating an application to Amazon Elastic Kubernetes Service (Amazon EKS). The developer migrates the application to Amazon Elastic Container Registry (Amazon ECR) with an EKS cluster. As part of the application migration to a new backend, the developer creates a new AWS account. The developer makes configuration changes to the application to point the application to the new AWS account and to use new backend resources. The developer successfully tests the changes within the application by deploying the pipeline. The Docker image build and the pipeline deployment are successful, but the application is still connecting to the old backend. The developer finds that the application's configuration is still referencing the original EKS cluster and not referencing the new backend resources. Which reason can explain why the application is not connecting to the new resources?

  • AThe developer did not successfully create the new AWS account.
  • BThe developer added a new tag to the Docker image.
  • CThe developer did not update the Docker image tag to a new version. (correct answer)
  • DThe developer pushed the changes to a new Docker image tag.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: The developer did not update the Docker image tag to a new version.

DVA-C02 Question 259

Single page →
Topic 1 · Question 259

A developer is creating an application that reads and writes to multiple Amazon S3 buckets. The application will be deployed to an Amazon EC2 instance. The developer wants to make secure API requests from the EC2 instances without the need to manage the security credentials for the application. The developer needs to apply the principle of least privilege. Which solution will meet these requirements?

  • ACreate an IAM user. Create access keys and secret keys for the user. Associate the user with an IAM policy that allows s3:* permissions.
  • BAssociate the EC2 instance with an IAM role that has an IAM policy that allows s3:ListBucket and s3:*Object permissions for specific S3 buckets. (correct answer)
  • CAssociate the EC2 instance with an IAM role that has an AmazonS3FullAccess AWS managed policy.
  • DCreate a bucket policy on the S3 bucket that allows s3:ListBucket and s3:*Object permissions to the EC2 instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Associate the EC2 instance with an IAM role that has an IAM policy that allows s3:ListBucket and s3:*Object permissions for specific S3 buckets.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

DVA-C02 Question 260

Single page →
Topic 1 · Question 260

A developer is writing an application that will retrieve sensitive data from a third-party system. The application will format the data into a PDF file. The PDF file could be more than 1 MB. The application will encrypt the data to disk by using AWS Key Management Service (AWS KMS). The application will decrypt the file when a user requests to download it. The retrieval and formatting portions of the application are complete. The developer needs to use the GenerateDataKey API to encrypt the PDF file so that the PDF file can be decrypted later. The developer needs to use an AWS KMS symmetric customer managed key for encryption. Which solutions will meet these requirements?

  • AWrite the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file. (correct answer)
  • BWrite the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.
  • CWrite the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API.
  • DWrite the plain text key from the GenerateDataKey API to disk for later use. Use the encrypted key from the GenerateDataKey API to encrypt the file by using the KMS Encrypt API.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Write the encrypted key from the GenerateDataKey API to disk for later use. Use the plaintext key from the GenerateDataKey API and a symmetric encryption algorithm to encrypt the file.

Showing questions 241–260 of 557 · Page 13 of 28