🔍

DVA-C02 — questions

Page 18 of 28 · 557 total questions.

DVA-C02 Question 341

Single page →
Topic 1 · Question 341

A developer is deploying an application in the AWS Cloud by using AWS CloudFormation. The application will connect to an existing Amazon RDS database. The hostname of the RDS database is stored in AWS Systems Manager Parameter Store as a plaintext value. The developer needs to incorporate the database hostname into the CloudFormation template to initialize the application when the stack is created. How should the developer reference the parameter that contains the database hostname?

  • AUse the ssm dynamic reference. (correct answer)
  • BUse the Ref intrinsic function.
  • CUse the Fn::ImportValue intrinsic function.
  • DUse the ssm-secure dynamic reference.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use the ssm dynamic reference.

DVA-C02 Question 342

Single page →
Topic 1 · Question 342

A company uses an AWS Lambda function to call a third-party service. The third-party service has a limit of requests each minute. If the number of requests exceeds the limit, the third-party service returns rate-limiting errors. A developer needs to configure the Lambda function to avoid receiving rate limiting errors from the third-party service. Which solution will meet these requirements?

  • ASet the reserved concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows. (correct answer)
  • BDecrease the memory that is allocated to the Lambda function.
  • CSet the provisioned concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.
  • DIncrease the timeout value that is specified on the Lambda function.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Set the reserved concurrency on the Lambda function to match the number of concurrent requests that the third-party service allows.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

DVA-C02 Question 343

Single page →
Topic 1 · Question 343

A developer is building a new containerized application by using AWS Copilot. The developer uses the AWS Copilot command line interface (CLI) to deploy the application during development. The developer committed the application code to a new AWS CodeCommit repository. The developer must create an automated deployment process before releasing the new application to production. What should the developer do to meet these requirements in the MOST operationally efficient way?

  • ACreate a buildspec file that invokes the AWS Copilot CLI commands to build and deploy the application. Use the AWS Copilot CLI to create an AWS CodePipeline that uses the CodeCommit repository in the source stage and AWS CodeBuild in the build stage.
  • BUse the AWS Serverless Application Model (AWS SAM) CLI to bootstrap and initialize an AWS CodePipeline configuration. Use the CodeCommit repository as the source. Invoke the AWS Copilot CLI to build and deploy the application.
  • CUse the AWS Copilot CLI to define the AWS Copilot pipeline and to deploy the AWS CodePipeline. Select CodeCommit as the source for the AWS CodePipeline. (correct answer)
  • DDefine an AWS CloudFormation template for an AWS CodePipeline with CodeCommit as the source. Configure the template as an AWS Copilot CLI add-on. Use the AWS Copilot CLI to deploy the application.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the AWS Copilot CLI to define the AWS Copilot pipeline and to deploy the AWS CodePipeline. Select CodeCommit as the source for the AWS CodePipeline.

Explanation

AWS CodePipeline automates continuous delivery pipelines. AWS CodeCommit hosts private Git repositories.

DVA-C02 Question 344

Single page →
Topic 1 · Question 344

A developer is creating a new application for a pet store. The application will manage customer rewards points. The developer will use Amazon DynamoDB to store the data for the application. The developer needs to optimize query performance and limit partition overload before actual performance analysis. Which option should the developer use for a partition key to meet these requirements?

  • AA randomly generated universally unique identifier (UUID) (correct answer)
  • BThe customer's full name
  • CThe date when the customer signed up for the rewards program
  • DThe name of the customer's pet
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: A randomly generated universally unique identifier (UUID).

DVA-C02 Question 345

Single page →
Topic 1 · Question 345

A developer uses AWS IAM Identity Center (AWS Single Sign-On) to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation. What is the MOST likely cause of the developer's access issue?

  • AThe access permissions to the developer's AWS CLI binary file have changed.
  • BThe permission set that is assumed by IAM Identity Center does not have the necessary permissions to complete the API call.
  • CThe credentials from the IAM Identity Center federated role have expired. (correct answer)
  • DThe developer is attempting to make API calls to the incorrect AWS account.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: The credentials from the IAM Identity Center federated role have expired.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

DVA-C02 Question 346

Single page →
Topic 1 · Question 346

A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities. Which solution will meet these requirements?

  • AStore the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
  • BStore the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key. (correct answer)
  • CStore the API key in the code repository. Use an AWS managed key to encrypt the code repository.
  • DStore the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the API key.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DVA-C02 Question 347

Single page →
Topic 1 · Question 347

A developer is writing an application to analyze the traffic to a fleet of Amazon EC2 instances. The EC2 instances run behind a public Application Load Balancer (ALB). An HTTP server runs on each of the EC2 instances, logging all requests to a log file. The developer wants to capture the client public IP addresses. The developer analyzes the log files and notices only the IP address of the ALB. What must the developer do to capture the client public IP addresses in the log file?

  • AAdd a Host header to the HTTP server log configuration file.
  • BInstall the Amazon CloudWatch Logs agent on each EC2 instance. Configure the agent to write to the log file.
  • CInstall the AWS X-Ray daemon on each EC2 instance. Configure the daemon to write to the log file.
  • DAdd an X-Forwarded-For header to the HTTP server log configuration file. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Add an X-Forwarded-For header to the HTTP server log configuration file.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 348

Single page →
Topic 1 · Question 348

A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a VPC. The company creates a role that includes the necessary permissions to access the DB instance. The company then assigns the role to the Lambda function. A developer must take additional action to give the Lambda function access to the DB instance. What should the developer do to meet these requirements?

  • AAssign a public IP address to the DB instance. Modify the security group of the DB instance to allow inbound traffic from the IP address of the Lambda function.
  • BSet up an AWS Direct Connect connection between the Lambda function and the DB instance.
  • CConfigure an Amazon CloudFront distribution to create a secure connection between the Lambda function and the DB instance.
  • DConfigure the Lambda function to connect to the private subnets in the VPC. Add security group rules to allow traffic to the DB instance from the Lambda function. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure the Lambda function to connect to the private subnets in the VPC. Add security group rules to allow traffic to the DB instance from the Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 349

Single page →
Topic 1 · Question 349

A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?

  • AUse the Amazon Cognito user pools to get short-lived credentials for the second account.
  • BCreate a dedicated IAM access key for the second account, and send it by mail.
  • CCreate a cross-account access role, and use sts:AssumeRole API to get short-lived credentials. (correct answer)
  • DEstablish trust, and add an SSH key for the second account to the IAM user.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.

DVA-C02 Question 350

Single page →
Topic 1 · Question 350

A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS. Which approach should the company take to allow the application to interact with Amazon S3?

  • ACreate an IAM role that has administrative access to AWS. Attach the role to the EC2 instance.
  • BCreate an IAM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
  • CCreate an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance. (correct answer)
  • DCreate an IAM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

DVA-C02 Question 351

Single page →
Topic 1 · Question 351 · Select all that apply

A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website. Which combination of steps will meet these requirements? (Choose two.)

  • ACreate a public Network Load Balancer.
  • BCreate a public Application Load Balancer. (correct answer)
  • CConfigure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration. (correct answer)
  • DConfigure a listener for the load balancer that listens on HTTP port 80. Add a default authenticate action providing the OIDC IdP configuration.
  • EConfigure a listener for the load balancer that listens on HTTPS port 443. Add a default AWS Lambda action providing an Amazon Resource Name (ARN) to a Lambda authentication function.
Reveal answer & explanation
Correct answer: B, C

The correct answer is B, C. Option B: Create a public Application Load Balancer. Option C: Configure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration.

Explanation

An Application Load Balancer distributes HTTP/HTTPS traffic and supports path/host routing. A load balancer distributes traffic across targets in multiple AZs for availability and scale. AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 352

Single page →
Topic 1 · Question 352

A developer is working on a web application that requires selective activation of specific features. The developer wants to keep the features hidden from end users until the features are ready for public access. Which solution will meet these requirements?

  • ACreate a feature flag configuration profile in AWS AppSync. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.
  • BStore prerelease data in an Amazon DynamoDB table. Enable Amazon DynamoDB Streams in the table. Toggle between hidden and visible states by using DynamoDB Streams.
  • CCreate a feature flag configuration profile in AWS AppConfig. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed. (correct answer)
  • DStore prerelease data in AWS Amplify DataStore. Toggle between hidden and visible states by using Amplify DataStore cloud synchronization.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a feature flag configuration profile in AWS AppConfig. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

DVA-C02 Question 353

Single page →
Topic 1 · Question 353 · Select all that apply

A developer at a company writes an AWS CloudFormation template. The template refers to subnets that were created by a separate AWS CloudFormation template that the company's network team wrote. When the developer attempts to launch the stack for the first time, the launch fails. Which template coding mistakes could have caused this failure? (Choose two.)

  • AThe developer's template does not use the Ref intrinsic function to refer to the subnets.
  • BThe developer's template does not use the ImportValue intrinsic function to refer to the subnets. (correct answer)
  • CThe Mappings section of the developer's template does not refer to the subnets.
  • DThe network team's template does not export the subnets in the Outputs section. (correct answer)
  • EThe network team's template does not export the subnets in the Mappings section.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: The developer's template does not use the ImportValue intrinsic function to refer to the subnets. Option D: The network team's template does not export the subnets in the Outputs section.

DVA-C02 Question 354

Single page →
Topic 1 · Question 354

A developer is running an application on an Amazon EC2 instance. When the application tries to read an Amazon S3 bucket, the application fails. The developer notices that the associated IAM role is missing the S3 read permission. The developer needs to give the application the ability to read the S3 bucket. Which solution will meet this requirement with the LEAST application disruption?

  • AAdd the permission to the role. Terminate the existing EC2 instance. Launch a new EC2 instance.
  • BAdd the permission to the role so that the change will take effect automatically. (correct answer)
  • CAdd the permission to the role. Hibernate and restart the existing EC2 instance.
  • DAdd the permission to the S3 bucket. Restart the EC2 instance.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Add the permission to the role so that the change will take effect automatically.

DVA-C02 Question 355

Single page →
Topic 1 · Question 355 · Select all that apply

A developer is writing a web application that is deployed on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The developer must add an Amazon CloudFront distribution in front of the ALB. The developer also must ensure that customer data from outside the VPC is encrypted in transit. Which combination of CloudFront configuration settings should the developer use to meet these requirements? (Choose two.)

  • ARestrict viewer access by using signed URLs.
  • BSet the Origin Protocol Policy setting to Match Viewer. (correct answer)
  • CEnable field-level encryption.
  • DEnable automatic object compression.
  • ESet the Viewer Protocol Policy setting to Redirect HTTP to HTTPS. (correct answer)
Reveal answer & explanation
Correct answer: B, E

The correct answer is B, E. Option B: Set the Origin Protocol Policy setting to Match Viewer. Option E: Set the Viewer Protocol Policy setting to Redirect HTTP to HTTPS.

DVA-C02 Question 356

Single page →
Topic 1 · Question 356

A developer is implementing an AWS Lambda function that will be invoked when an object is uploaded to Amazon S3. The developer wants to test the Lambda function in a local development machine before publishing the function to a production AWS account. Which solution will meet these requirements with the LEAST operational overhead?

  • AUpload an object to Amazon S3 by using the aws s3api put-object CLI command. Wait for the local Lambda invocation from the S3 event.
  • BCreate a sample JSON text file for a put object S3 event. Invoke the Lambda function locally. Use the aws lambda invoke CLI command with the JSON file and Lambda function name as arguments.
  • CUse the sam local start-lambda CLI command to start Lambda. Use the sam local generate-event s3 put CLI command to create the Lambda test JSON file. Use the sam local invoke CLI command with the JSON file as the argument to invoke the Lambda function. (correct answer)
  • DCreate a JSON string for the put object S3 event. In the AWS Management Console, use the JSON string to create a test event for the local Lambda function. Perform the test.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use the sam local start-lambda CLI command to start Lambda. Use the sam local generate-event s3 put CLI command to create the Lambda test JSON file. Use the sam local invoke CLI command with the JSON file as the argum...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

DVA-C02 Question 357

Single page →
Topic 1 · Question 357

A developer is publishing critical log data to a log group in Amazon CloudWatch Logs. The log group was created 2 months ago. The developer must encrypt the log data by using an AWS Key Management Service (AWS KMS) key so that future data can be encrypted to comply with the company's security policy. Which solution will meet this requirement with the LEAST effort?

  • AUse the AWS Encryption SDK for encryption and decryption of the data before writing to the log group.
  • BUse the AWS KMS console to associate the KMS key with the log group.
  • CUse the AWS CLI aws logs create-log-group command, and specify the key Amazon Resource Name (ARN).
  • DUse the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN). (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN).

Explanation

AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DVA-C02 Question 358

Single page →
Topic 1 · Question 358

A developer is working on an app for a company that uses an Amazon DynamoDB table named Orders to store customer orders. The table uses OrderID as the partition key and there is no sort key. The table contains more than 100,000 records. The developer needs to add a functionality that will retrieve all Orders records that contain an OrderSource attribute with the MobileApp value. Which solution will improve the user experience in the MOST efficient way?

  • APerform a Scan operation on the Orders table. Provide a QueryFilter condition to filter to only the items where the OrderSource attribute is equal to the MobileApp value.
  • BCreate a local secondary index (LSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.
  • CCreate a global secondary index (GSI) with OrderSource as the sort key. Perform a Query operation by using MobileApp as the key.
  • DCreate a global secondary index (GSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a global secondary index (GSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.

DVA-C02 Question 359

Single page →
Topic 1 · Question 359

A company has an application that uses an AWS Lambda function to process data. A developer must implement encryption in transit for all sensitive configuration data, such as API keys, that is stored in the application. The developer creates an AWS Key Management Service (AWS KMS) customer managed key. What should the developer do next to meet the encryption requirement?

  • ACreate parameters of the String type in AWS Systems Manager Parameter Store. For each parameter, specify the KMS key ID to encrypt the parameter in transit. Reference the GetParameter API call in the Lambda environment variables.
  • BCreate secrets in AWS Secrets Manager by using the customer managed KMS key. Create a new Lambda function and set up a Lambda layer. Configure the Lambda layer to retrieve the values from Secrets Manager.
  • CCreate objects in Amazon S3 for each sensitive data field. Specify the customer managed KMS key to encrypt the object. Configure the Lambda function to retrieve the objects from Amazon S3 during data processing.
  • DCreate encrypted Lambda environment variables. Specify the customer managed KMS key to encrypt the variables. Enable encryption helpers for encryption in transit. Grant permission to the Lambda function's execution role to access the KMS key. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create encrypted Lambda environment variables. Specify the customer managed KMS key to encrypt the variables. Enable encryption helpers for encryption in transit. Grant permission to the Lambda function's execution ro...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS KMS manages encryption keys and integrates with most AWS services for encryption at rest.

DVA-C02 Question 360

Single page →
Topic 1 · Question 360

A developer is building an ecommerce application. When there is a sale event, the application needs to concurrently call three third-party systems to record the sale. The developer wrote three AWS Lambda functions. There is one Lambda function for each third-party system, which contains complex integration logic. These Lambda functions are all independent. The developer needs to design the application so each Lambda function will run regardless of others' success or failure. Which solution will meet these requirements?

  • APublish the sale event from the application to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the three Lambda functions to poll the queue.
  • BPublish the sale event from the application to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the three Lambda functions to be triggered by the SNS topic. (correct answer)
  • CPublish the sale event from the application to an Application Load Balancer (ALB). Add the three Lambda functions as ALB targets.
  • DPublish the sale event from the application to an AWS Step Functions state machine. Move the logic from the three Lambda functions into the Step Functions state machine.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Publish the sale event from the application to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the three Lambda functions to be triggered by the SNS topic.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

Showing questions 341–360 of 557 · Page 18 of 28