AWS Certified Developer – Associate practice questions

1. Question 1 of 25

   A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions. When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API. A developer needs to implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts. Which solution will meet these requirements with the LEAST management overhead?

   • AUse an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with the decrypt flag enabled. Use the decrypted access token to send the message to the chat.
   • BEncrypt the access token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS. Retrieve the token from DynamoDDecrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
   • CUse AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
   • DEncrypt the access token by using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to the S3 bucket to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the massage to the chat.

   Show answer

   Correct answer: C

   How others answered

   • C86%

   Explanation

   The correct answer is C. https://aws.amazon.com/premiumsupport/knowledge-center/secrets-manager-share-between-accounts/ https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples_cross.html Option A is wrong. It seems to be a good solution. However, AWS managed keys cannot be used for cross account accessing.

   Adapted from community discussion by Untamables · 2023-03-20 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. U

      Untamables

      2023-03-20

      Selected C30 upvotes

      The correct answer is C. https://aws.amazon.com/premiumsupport/knowledge-center/secrets-manager-share-between-accounts/ https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_examples_cross.html Option A is wrong. It seems to be a good solution. However, AWS managed keys cannot be used for cross account accessing.

   2. C

      clarksu

      2023-03-18

      Selected C3 upvotes

      Should be C. Option A is a valid solution that meets the requirements of encrypting the access token at rest and in transit, as well as allowing access from other AWS accounts. However, it requires an additional step of retrieving the token with the decrypt flag enabled, which adds some management overhead when compared to other options. Option C uses AWS Secrets Manager, which eliminates the need for explicitly enabling the decryption flag. It also has more granular permissions for accessing the secrets, making it slightly more secure. DynamoDB in Option B and S3 in Option D are also options for storing the access token, but they require additional steps for encryption and decryption, adding more management overhead. Overall, Option A is a valid solution, but the other options have less management overhead while still meeting the requirements.

   3. I

      ihebchorfi

      2023-04-28

      Selected C4 upvotes

      A is wrong, you can't share a parameter-store secureString to an external AWS Account. This is only possible with Secrets Manager : https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-modifying-external-accounts.html

   4. T

      trieudo

      2024-12-11

      Selected C1 upvote

      keywords: LEAST management overhead ==> Discard B, D: you must do many steps to config with Storage, DB with KMS, IAM Role ==> Discard A: Pretty correct, but in use, you may write some script. It can work but requires additional configuration and doesn't offer some of the benefits tailored for secrets management like automatic rotation. D: The solution with AWS Secrets Manager (option C) provides the least management overhead because: Secrets Manager is specifically designed for storing and managing sensitive information like access tokens. It natively integrates with AWS KMS for encryption and decryption. It simplifies access control and auditing. By adding a resource-based policy, cross-account access is easily managed without the need for additional configurations like DynamoDB tables or S3 bucket policies.

2. Question 2 of 25

   A company uses AWS Lambda functions and an Amazon S3 trigger to process images into an S3 bucket. A development team set up multiple environments in a single AWS account. After a recent production deployment, the development team observed that the development S3 buckets invoked the production environment Lambda functions. These invocations caused unwanted execution of development S3 files by using production Lambda functions. The development team must prevent these invocations. The team must follow security best practices. Which solution will meet these requirements?

   • AUpdate the Lambda execution role for the production Lambda function to add a policy that allows the execution role to read from only the production environment S3 bucket.
   • BMove the development and production environments into separate AWS accounts. Add a resource policy to each Lambda function to allow only S3 buckets that are within the same account to invoke the function.
   • CAdd a resource policy to the production Lambda function to allow only the production environment S3 bucket to invoke the function.
   • DMove the development and production environments into separate AWS accounts. Update the Lambda execution role for each function to add a policy that allows the execution role to read from the S3 bucket that is within the same account.

   Show answer

   Correct answer: B

   How others answered

   • B52%
   • C45%

   Only 52% agreed on this answer — treat it as contested rather than settled.

   Explanation

   I choose B because it says that the team should follow the best security practices. AWS well-architected framework suggests separation. For reference see the link below: https://wa.aws.amazon.com/wat.question.SEC_1.en.html

   Adapted from community discussion by csG13 · 2023-06-06 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • aws.amazon.com documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. C

      csG13

      2023-06-06

      Selected B23 upvotes

      I choose B because it says that the team should follow the best security practices. AWS well-architected framework suggests separation. For reference see the link below: https://wa.aws.amazon.com/wat.question.SEC_1.en.html

   2. M

      MrPie

      2023-07-06

      15 upvotes

      It's a best practice: Best Practices: Separate workloads using accounts: Establish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account strategy. Account-level separation is strongly recommended, as it provides a strong isolation boundary for security, billing, and access. https://wa.aws.amazon.com/wat.question.SEC_1.en.html

   3. S

      SD_CS

      2024-02-15

      Selected B4 upvotes

      I initially thought C, but after going through the below, I dont think there is any scope for doubt. stablish common guardrails and isolation between environments (such as production, development, and test) and workloads through a multi-account strategy. Account-level separation is strongly recommended, as it provides a strong isolation boundary for security, billing, and access https://docs.aws.amazon.com/en_us/wellarchitected/latest/framework/sec_securely_operate_multi_accounts.html

   4. R

      Rameez1

      2023-10-17

      Selected B4 upvotes

      Moving the Dev and Prod environments to separate Accounts will make them totally isolated with cross account Lambda invocations. Whereas in Option C though Prod Lambda won't trigger with Dev S3 bucket Event, Dev Lambda may still get mistakenly invoked by Prod S3 Bucket event and perform unwanted actions.

3. Question 3 of 25

   A social media application uses the AWS SDK for JavaScript on the frontend to get user credentials from AWS Security Token Service (AWS STS). The application stores its assets in an Amazon S3 bucket. The application serves its content by using an Amazon CloudFront distribution with the origin set to the S3 bucket. The credentials for the role that the application assumes to make the SDK calls are stored in plaintext in a JSON file within the application code. The developer needs to implement a solution that will allow the application to get user credentials without having any credentials hardcoded in the application code. Which solution will meet these requirements?

   • AAdd a Lambda@Edge function to the distribution. Invoke the function on viewer request. Add permissions to the function's execution role to allow the function to access AWS STS. Move all SDK calls from the frontend into the function.
   • BAdd a CloudFront function to the distribution. Invoke the function on viewer request. Add permissions to the function's execution role to allow the function to access AWS STS. Move all SDK calls from the frontend into the function.
   • CAdd a Lambda@Edge function to the distribution. Invoke the function on viewer request. Move the credentials from the JSON file into the function. Move all SDK calls from the frontend into the function.
   • DAdd a CloudFront function to the distribution. Invoke the function on viewer request. Move the credentials from the JSON file into the function. Move all SDK calls from the frontend into the function.

   Show answer

   Correct answer: A

   How others answered

   • A85%
   • B15%

   Explanation

   The answer is A. Here is a reference directly from AWS docs: "If you need some of the capabilities of Lambda@Edge that are not available with CloudFront Functions, such as network access or a longer execution time, you can still use Lambda@Edge before and after content is cached by CloudFront." Since the requirement is to access the STS service, network access is required. Therefore, it can't be Cloudfront functions. Also, as a side note it's worth to mention that Cloudfront functions can only execute for up to 1ms. Apparently this isn't enough to fetch user creds (tokens) from STS. The table in the following link summarises the differences between Cloudfront functions and Lambda@edge https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale/

   Adapted from community discussion by csG13 · 2023-12-08 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. C

      csG13

      2023-12-08

      Selected A14 upvotes

      The answer is A. Here is a reference directly from AWS docs: "If you need some of the capabilities of Lambda@Edge that are not available with CloudFront Functions, such as network access or a longer execution time, you can still use Lambda@Edge before and after content is cached by CloudFront." Since the requirement is to access the STS service, network access is required. Therefore, it can't be Cloudfront functions. Also, as a side note it's worth to mention that Cloudfront functions can only execute for up to 1ms. Apparently this isn't enough to fetch user creds (tokens) from STS. The table in the following link summarises the differences between Cloudfront functions and Lambda@edge https://aws.amazon.com/blogs/aws/introducing-cloudfront-functions-run-your-code-at-the-edge-with-low-latency-at-any-scale/

   2. R

      rrharris

      2024-08-19

      Selected A3 upvotes

      Why A is Correct: Lambda@Edge for Secure Credential Management: Lambda@Edge allows you to run Lambda functions in response to CloudFront events. By using Lambda@Edge, the developer can securely manage credentials by keeping them out of the client-side code. Invoking on Viewer Request: Invoking the Lambda@Edge function on viewer requests ensures that the credential generation happens in real-time, securely, and as needed, without exposing any sensitive information. Execution Role with STS Access: Assigning the Lambda function an execution role with permissions to access AWS STS (Security Token Service) enables the function to securely request temporary, limited-privilege credentials on behalf of the client. Moving SDK Calls to Lambda@Edge: Transferring all AWS SDK calls from the frontend to the Lambda@Edge function prevents exposing any credentials in the frontend code, enhancing security.

   3. S

      SerialiDr

      2024-07-15

      Selected A4 upvotes

      A. Lambda@Edge allows you to run Lambda functions in response to CloudFront events. By using a Lambda@Edge function, you can securely handle the process of obtaining credentials from AWS STS without exposing them in the client-side application code. The function's execution role can be granted the necessary permissions to interact with AWS STS, and SDK calls can be made from within this server-side environment. This approach centralizes credential management and AWS interactions in a more secure, server-side context.

   4. S

      sumanshu

      2024-12-27

      Selected A1 upvote

      B) Eliminated - CloudFront functions are lightweight JavaScript functions designed for simple HTTP request and response manipulations (e.g., header rewrites, URL rewrites). They cannot access AWS services like STS or assume roles C/D) Eliminated - Moving the credentials from the JSON file to the Lambda@Edge function does not eliminate the core issue of hardcoding credentials

4. Question 4 of 25

   A company has an image storage web application that runs on AWS. The company hosts the application on Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group acts as the target group for an Application Load Balancer (ALB) and uses an Amazon S3 bucket to store the images for sale. The company wants to develop a feature to test system requests. The feature will direct requests to a separate target group that hosts a new beta version of the application. Which solution will meet this requirement with the LEAST effort?

   • ACreate a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Update the test system code to use this cookie to test the beta version of the application.
   • BCreate a new ALB, Auto Scaling group, and target group for the beta version of the application. Configure an alternate Amazon Route 53 record for the new ALB endpoint. Use the alternate Route 53 endpoint in the test system requests to test the beta version of the application.
   • CCreate a new ALB, Auto Scaling group, and target group for the beta version of the application. Use Amazon CloudFront with Lambda@Edge to determine which specific request will go to the new ALB. Use the CloudFront endpoint to send the test system requests to test the beta version of the application.
   • DCreate a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Use Amazon CloudFront with Lambda@Edge to update the test system requests to add the required cookie when the requests go to the ALB.

   Show answer

   Correct answer: A

   How others answered

   • A53%
   • B36%

   Only 53% agreed on this answer — treat it as contested rather than settled.

   Explanation

   This solution will allow the company to direct requests to a separate target group that hosts the new beta version of the application without having to create a new ALB or use additional services such as Amazon Route 53 or Amazon CloudFront. Option D adds additional complexity and effort compared to option A, which simply involves updating the ALB routing rule with a condition that looks for a cookie named version that has a value of beta and updating the test system code to use this cookie to test the beta version of the application.

   Adapted from community discussion by MrTee · 2023-04-22 · 26 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. M

      MrTee

      2023-04-22

      Selected A26 upvotes

      This solution will allow the company to direct requests to a separate target group that hosts the new beta version of the application without having to create a new ALB or use additional services such as Amazon Route 53 or Amazon CloudFront. Option D adds additional complexity and effort compared to option A, which simply involves updating the ALB routing rule with a condition that looks for a cookie named version that has a value of beta and updating the test system code to use this cookie to test the beta version of the application.

   2. Y

      yeacuz

      2023-05-16

      Selected A3 upvotes

      Option A is the least effort. With option B, you have to additionally create a new ALB *and* also a new route 53 record. With option A, you can create a new listener based on HTTP header: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-update-rules.html and it will fulfill the requirements. You will also need a new auto scaling group and target group with option A - but you also need this with option B as well, so option A is the least effort.

   3. S

      SerialiDr

      2024-01-15

      Selected A1 upvote

      A. Create a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Update the test system code to use this cookie to test the beta version of the application: This is a straightforward and effective solution. By creating a new Auto Scaling group and target group for the beta version and updating the ALB to route based on a specific cookie, the company can easily direct test traffic to the beta version without needing additional infrastructure or complex configurations. The test system would simply include the specified cookie in its requests to access the beta version.

   4. L

      LR2023

      2023-12-04

      3 upvotes

      I am going with D..... https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-at-the-edge.html A Lambda function can inspect cookies and rewrite URLs so that users see different versions of a site for A/B testing. Option B & C requires to create new ALB - which is not least effort. And option A requires to update code.

5. Question 5 of 25

   A developer needs to build an AWS CloudFormation template that self-populates the AWS Region variable that deploys the CloudFormation template. What is the MOST operationally efficient way to determine the Region in which the template is being deployed?

   • AUse the AWS::Region pseudo parameter.
   • BRequire the Region as a CloudFormation parameter.
   • CFind the Region from the AWS::StackId pseudo parameter by using the Fn::Split intrinsic function.
   • DDynamically import the Region by referencing the relevant parameter in AWS Systems Manager Parameter Store.

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html AWS::Region is a pseudo parameter that automatically provides the Region where the stack is being deployed (e.g., us-east-1 if deploying in the US East Region). B) Eliminated - Adding a parameter for the Region means users would need to manually specify the Region every time they deploy the template C) Eliminated - While the stack ID contains the Region as part of its value (e.g., arn:aws:cloudformation:us-east-1:123456789012:stack/MyStack/...), extracting it with Fn::Split is a complicated workaround. D) Eliminated

   Adapted from community discussion by sumanshu · 2024-12-27 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. L

      loctong

      2023-05-17

      Selected A4 upvotes

      The AWS::Region pseudo parameter is a built-in CloudFormation parameter that automatically resolves to the AWS Region where the CloudFormation stack is being created. By using this pseudo parameter, you can dynamically access the current Region without requiring any additional configuration or input.

   2. S

      sumanshu

      2024-12-27

      Selected A2 upvotes

      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html AWS::Region is a pseudo parameter that automatically provides the Region where the stack is being deployed (e.g., us-east-1 if deploying in the US East Region). B) Eliminated - Adding a parameter for the Region means users would need to manually specify the Region every time they deploy the template C) Eliminated - While the stack ID contains the Region as part of its value (e.g., arn:aws:cloudformation:us-east-1:123456789012:stack/MyStack/...), extracting it with Fn::Split is a complicated workaround. D) Eliminated

   3. B

      Baba_Eni

      2023-06-16

      Selected A2 upvotes

      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html

   4. B

      Baba_Eni

      2023-06-16

      Selected A1 upvote

      https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.htmlhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html

6. Question 6 of 25

   A developer is writing an application for a company. The application will be deployed on Amazon EC2 and will use an Amazon RDS for Microsoft SQL Server database. The company's security team requires that database credentials are rotated at least weekly. How should the developer configure the database credentials for this application?

   • ACreate a database user. Store the user name and password in an AWS Systems Manager Parameter Store secure string parameter. Enable rotation of the AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter.
   • BEnable IAM authentication for the database. Create a database user for use with IAM authentication. Enable password rotation.
   • CCreate a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled.
   • DUse the EC2 user data to create a database user. Provide the user name and password in environment variables to the application.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   option C: Create a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled. This will allow the developer to securely store the database credentials and automatically rotate them at least weekly to meet the company’s security requirements.

   Adapted from community discussion by MrTee · 2023-04-22 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. M

      MrTee

      2023-04-22

      Selected C14 upvotes

      option C: Create a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled. This will allow the developer to securely store the database credentials and automatically rotate them at least weekly to meet the company’s security requirements.

   2. B

      Baba_Eni

      2023-06-16

      Selected C3 upvotes

      https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_turn-on-for-other.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_schedule.html

   3. S

      SerialiDr

      2024-01-16

      Selected C2 upvotes

      C. Create a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled: This is the correct solution. AWS Secrets Manager is specifically designed to handle secrets like database credentials, including their rotation. You can configure Secrets Manager to automatically rotate the credentials as frequently as needed (e.g., daily or weekly), which aligns with the security team's requirements.

   4. J

      jipark

      2023-08-03

      Selected C2 upvotes

      rotation key & cross account key is feature of Secret Manager https://tutorialsdojo.com/aws-secrets-manager-vs-systems-manager-parameter-store/

7. Question 7 of 25

   A company is developing a serverless application that consists of various AWS Lambda functions behind Amazon API Gateway APIs. A developer needs to automate the deployment of Lambda function code. The developer will deploy updated Lambda functions with AWS CodeDeploy. The deployment must minimize the exposure of potential errors to end users. When the application is in production, the application cannot experience downtime outside the specified maintenance window. Which deployment configuration will meet these requirements with the LEAST deployment time?

   • AUse the AWS CodeDeploy in-place deployment configuration for the Lambda functions. Shift all traffic immediately after deployment.
   • BUse the AWS CodeDeploy linear deployment configuration to shift 10% of the traffic every minute.
   • CUse the AWS CodeDeploy all-at-once deployment configuration to shift all traffic to the updated versions immediately.
   • DUse the AWS CodeDeploy predefined canary deployment configuration to shift 10% of the traffic immediately and shift the remaining traffic after 5 minutes.

   Show answer

   Correct answer: D

   How others answered

   • D90%

   Explanation

   D is correct. Keyword: -"must minimize the exposure of potential errors to end users", you just have to trade-off 10% of traffic - "cannot experience downtime ", eliminate C. - "LEAST deployment time", with B, You have to take 10 mins other than D just 5 min.

   Adapted from community discussion by Parsons · 2024-02-04 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. P

      Parsons

      2024-02-04

      Selected D4 upvotes

      D is correct. Keyword: -"must minimize the exposure of potential errors to end users", you just have to trade-off 10% of traffic - "cannot experience downtime ", eliminate C. - "LEAST deployment time", with B, You have to take 10 mins other than D just 5 min.

   2. S

      SerialiDr

      2024-07-17

      Selected D2 upvotes

      D. Use the AWS CodeDeploy predefined canary deployment configuration to shift 10% of the traffic immediately and shift the remaining traffic after 5 minutes: The canary deployment strategy first shifts a small percentage of traffic to the new version (e.g., 10%) and, after a specified period (e.g., 5 minutes), shifts the remaining traffic. This approach allows for initial validation of the new version with minimal user exposure before full rollout, balancing speed and risk mitigation.

   3. C

      cloudenthusiast

      2024-02-04

      Selected D2 upvotes

      the predefined canary deployment configuration, which shifts a small percentage of traffic to the updated versions immediately, and then shifts the remaining traffic after a specified period

   4. K

      KarBiswa

      2024-08-25

      Selected D2 upvotes

      https://docs.aws.amazon.com/whitepapers/latest/practicing-continuous-integration-continuous-delivery/deployment-methods.html#:~:text=A%20variation%20of,is%20gradually%20increased.

8. Question 8 of 25

   A financial company must store original customer records for 10 years for legal reasons. A complete record contains personally identifiable information (PII). According to local regulations, PII is available to only certain people in the company and must not be shared with third parties. The company needs to make the records available to third-party organizations for statistical analysis without sharing the PII. A developer wants to store the original immutable record in Amazon S3. Depending on who accesses the S3 document, the document should be returned as is or with all the PII removed. The developer has written an AWS Lambda function to remove the PII from the document. The function is named removePii. What should the developer do so that the company can meet the PII requirements while maintaining only one copy of the document?

   • ASet up an S3 event notification that invokes the removePii function when an S3 GET request is made. Call Amazon S3 by using a GET request to access the object without PII.
   • BSet up an S3 event notification that invokes the removePii function when an S3 PUT request is made. Call Amazon S3 by using a PUT request to access the object without PII.
   • CCreate an S3 Object Lambda access point from the S3 console. Select the removePii function. Use S3 Access Points to access the object without PII.
   • DCreate an S3 access point from the S3 console. Use the access point name to call the GetObjectLegalHold S3 API function. Pass in the removePii function name to access the object without PII.

   Show answer

   Correct answer: C

   How others answered

   • C100%

   Explanation

   An S3 Object Lambda access point is a new type of access point that you can create to invoke your own AWS Lambda function to modify the content of an S3 object. You can use S3 Object Lambda access points to transform data as it is being retrieved from an S3 bucket, without modifying the original data stored in the bucket

   Adapted from community discussion by gcmrjbr · 2023-11-15 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. G

      gcmrjbr

      2023-11-15

      19 upvotes

      An S3 Object Lambda access point is a new type of access point that you can create to invoke your own AWS Lambda function to modify the content of an S3 object. You can use S3 Object Lambda access points to transform data as it is being retrieved from an S3 bucket, without modifying the original data stored in the bucket

   2. A

      aragon_saa

      2023-03-15

      7 upvotes

      C https://www.examtopics.com/discussions/amazon/view/88229-exam-aws-certified-developer-associate-topic-1-question-174/

   3. A

      ahadh7621

      2024-07-16

      Selected C2 upvotes

      https://aws.amazon.com/s3/features/object-lambda/ With S3 Object Lambda, you can add your own code to S3 GET, HEAD, and LIST requests to modify and process data as it is returned to an application. You can use custom code to modify the data returned by S3 GET requests to filter rows, dynamically resize images, redact confidential data, and much more.

   4. S

      sumanshu

      2024-12-21

      Selected C2 upvotes

      A) Eliminated - function cannot be invoked when a GET request is made. B) Eliminated - It will either create two copies or overwrite existing copy D) Eliminated - GetObjectLegalHold this API is used to check if an object is under a legal hold. It has nothing to do with dynamically modifying or removing PII from documents.

9. Question 9 of 25

   A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amazon SQS) queue in the company's main AWS account for further processing. Which solution will meet these requirements?

   • AConfigure Amazon EC2 to deliver the EC2 instance lifecycle events from all accounts to the Amazon EventBridge event bus of the main account. Add an EventBridge rule to the event bus of the main account that matches all EC2 instance lifecycle events. Add the SQS queue as a target of the rule.
   • BUse the resource policies of the SQS queue in the main account to give each account permissions to write to that SQS queue. Add to the Amazon EventBridge event bus of each account an EventBridge rule that matches all EC2 instance lifecycle events. Add the SQS queue in the main account as a target of the rule.
   • CWrite an AWS Lambda function that scans through all EC2 instances in the company accounts to detect EC2 instance lifecycle changes. Configure the Lambda function to write a notification message to the SQS queue in the main account if the function detects an EC2 instance lifecycle change. Add an Amazon EventBridge scheduled rule that invokes the Lambda function every minute.
   • DConfigure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.

   Show answer

   Correct answer: D

   How others answered

   • D80%
   • B15%

   Explanation

   The correct answer is D. Amazon EC2 instances can send the state-change notification events to Amazon EventBridge. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-instance-state-changes.html Amazon EventBridge can send and receive events between event buses in AWS accounts. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html

   Adapted from community discussion by Untamables · 2023-03-21 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • AWS documentation
   • AWS documentation
   • AWS documentation

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

   1. U

      Untamables

      2023-03-21

      Selected D20 upvotes

      The correct answer is D. Amazon EC2 instances can send the state-change notification events to Amazon EventBridge. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-instance-state-changes.html Amazon EventBridge can send and receive events between event buses in AWS accounts. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html

   2. T

      trieudo

      2024-12-11

      Selected D2 upvotes

      ==> Discard C: lamdba scans ==> it will be delay by scan all data ==> Discard A: 'matches all EC2 instance' ==> hard to maintain, when updating many times can occurs ==> Discard B: it works, but it maybe have some security problem when pushing raw data (not clean) into SQS. It also doesn't take advantage of D: By configuring the main account's event bus to accept events from other accounts and adding rules in those accounts to forward lifecycle events, this solution achieves secure and efficient centralization. EventBridge then routes the events to an SQS queue in the main account for further processing.

   3. K

      KillThemWithKindness

      2023-07-14

      4 upvotes

      Sorry Im wrong, AWS allow to send and receive Amazon EventBridge events between AWS accounts. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html Both B and D works, but D is more centralized

   4. K

      KillThemWithKindness

      2023-07-14

      2 upvotes

      B Answer A is incorrect because Amazon EventBridge events can't be sent directly from one account's event bus to another. Answer C is incorrect because it's unnecessary and inefficient to use Lambda to periodically scan all EC2 instances for lifecycle changes. Amazon EventBridge can capture these events automatically as they occur. Answer D is incorrect because it is not possible to configure the main account event bus to receive events from all accounts directly, and Amazon EventBridge events can't be sent directly from one account's event bus to another. The EventBridge rules need to be set up in the accounts where the events are generated.

10. Question 10 of 25

    An IT department uses Amazon S3 to store sensitive images. After more than 1 year, the company moves the images into archival storage. The company rarely accesses the images, but the company wants a storage solution that maximizes resiliency. The IT department needs access to the images that have been moved to archival storage within 24 hours. Which solution will meet these requirements MOST cost-effectively?

    • AUse S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
    • BUse S3 Standard-Infrequent Access (S3 Standard-IA) to store the images. Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.
    • CUse S3 Intelligent-Tiering to store the images. Use S3 Glacier Deep Archive with standard retrieval to store and retrieve archived images.
    • DUse S3 One Zone-Infrequent Access (S3 One Zone-IA) to store the images. Use S3 Glacier Deep Archive with bulk retrieval to store and retrieve archived images.

    Show answer

    Correct answer: A

    How others answered

    • A50%
    • C25%
    • B25%

    Only 50% agreed on this answer — treat it as contested rather than settled.

    Explanation

    A is correct. The requirement of maximizing resiliency rules out One Zone. Standard recover is within 12 hours, which fits the requirement of within 24 hours. https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects-retrieval-options.html

    Adapted from community discussion by Learning4life · 2023-10-15 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. L

       Learning4life

       2023-10-15

       8 upvotes

       A is correct. The requirement of maximizing resiliency rules out One Zone. Standard recover is within 12 hours, which fits the requirement of within 24 hours. https://docs.aws.amazon.com/AmazonS3/latest/userguide/restoring-objects-retrieval-options.html

    2. S

       SerialiDr

       2024-01-22

       Selected A3 upvotes

       S3 Standard-IA is designed for data that is accessed less frequently but requires rapid access when needed. It offers a lower storage cost while still providing high durability, availability, and performance. S3 Glacier Deep Archive is the most cost-effective option for archival storage in AWS and is designed for data that is accessed very rarely. The standard retrieval option in Glacier Deep Archive typically returns data within 12 hours, meeting the requirement of access within 24 hours.

    3. D

       Digo30sp

       2023-10-06

       Selected A4 upvotes

       A) Correct A) because the standard recovery is carried out within 12 hours and the requirement says that it must be recovered within 24 hours. Bulk recovery takes up to 48 hours

    4. D

       DeaconStJohn

       2024-03-25

       2 upvotes

       As a society we need to learn to challenge AI models. https://aws.amazon.com/s3/faqs/#Amazon_S3_Glacier_Deep_Archive When restoring an archived object, you can specify one of the following options in the Tier element of the request body: Standard is the default tier and lets you access any of your archived objects within 12 hours, with retrievals typically starting within 9 hours when initiated using S3 Batch Operations. Bulk lets you retrieve large amounts of data, even petabytes of data, inexpensively and typically completes within 48 hours.

11. Question 11 of 25

    A developer is working on an AWS Lambda function that accesses Amazon DynamoDB. The Lambda function must retrieve an item and update some of its attributes, or create the item if it does not exist. The Lambda function has access to the primary key. Which IAM permissions should the developer request for the Lambda function to achieve this functionality?

    • Adynamodb:DeleleItem dynamodb:GetItem dynamodb:PutItem
    • Bdynamodb:UpdateItem dynamodb:GetItem dynamodb:DescribeTable
    • Cdynamodb:GetRecords dynamodb:PutItem dynamodb:UpdateTable
    • Ddynamodb:UpdateItem dynamodb:GetItem dynamodb:PutItem

    Show answer

    Correct answer: D

    How others answered

    • D91%

    Explanation

    UpdateItem: Edits an existing item's attributes https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html GetItem: retrieves attributes from the Thread table https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html#API_GetItem_Examples PutItem: Creates a new item, or replaces an old item with a new item. https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

    Adapted from community discussion by TanTran04 · 2024-06-15 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. C

       Claire_KMT

       2024-04-28

       8 upvotes

       D. dynamodb:UpdateItem, dynamodb:GetItem, and dynamodb:PutItem Here's why: dynamodb:GetItem: This permission allows the Lambda function to retrieve an item from DynamoDB. dynamodb:UpdateItem: This permission allows the Lambda function to update the attributes of an item in DynamoDB. dynamodb:PutItem: This permission allows the Lambda function to create a new item if it doesn't already exist in the DynamoDB table.

    2. D

       didorins

       2024-04-28

       Selected D4 upvotes

       PutItem is to CREATE new item or replace old item with new item GetItem is to retrieve an item UpdateItem so to update the attributes Hence answer D

    3. T

       TanTran04

       2024-06-15

       Selected D2 upvotes

       UpdateItem: Edits an existing item's attributes https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_UpdateItem.html GetItem: retrieves attributes from the Thread table https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_GetItem.html#API_GetItem_Examples PutItem: Creates a new item, or replaces an old item with a new item. https://docs.aws.amazon.com/amazondynamodb/latest/APIReference/API_PutItem.html

12. Question 12 of 25

    A company has a multi-node Windows legacy application that runs on premises. The application uses a network shared folder as a centralized configuration repository to store configuration files in .xml format. The company is migrating the application to Amazon EC2 instances. As part of the migration to AWS, a developer must identify a solution that provides high availability for the repository. Which solution will meet this requirement MOST cost-effectively?

    • AMount an Amazon Elastic Block Store (Amazon EBS) volume onto one of the EC2 instances. Deploy a file system on the EBS volume. Use the host operating system to share a folder. Update the application code to read and write configuration files from the shared folder.
    • BDeploy a micro EC2 instance with an instance store volume. Use the host operating system to share a folder. Update the application code to read and write configuration files from the shared folder.
    • CCreate an Amazon S3 bucket to host the repository. Migrate the existing .xml files to the S3 bucket. Update the application code to use the AWS SDK to read and write configuration files from Amazon S3.
    • DCreate an Amazon S3 bucket to host the repository. Migrate the existing .xml files to the S3 bucket. Mount the S3 bucket to the EC2 instances as a local volume. Update the application code to read and write configuration files from the disk.

    Show answer

    Correct answer: C

    How others answered

    • C77%
    • D23%

    Explanation

    c Option C is the most cost-effective solution to provide high availability for the centralized configuration repository. Amazon S3 provides a highly durable and available object storage service. S3 stores objects redundantly across multiple devices and multiple facilities within a region, making it highly available. The developer can migrate the existing .xml files to an S3 bucket and update the application code to use the AWS SDK to read and write configuration files from Amazon S3. Option A and B are not the best solutions as they require the developer to use the host operating system to share a folder, which can lead to a single point of failure. Option D is not a recommended solution as it is not a direct way of accessing an S3 bucket. While it is possible to use third-party tools to mount an S3 bucket as a local disk, it can lead to performance issues and additional complexity.

    Adapted from community discussion by Bibay · 2023-05-14 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. B

       Bibay

       2023-05-14

       11 upvotes

       c Option C is the most cost-effective solution to provide high availability for the centralized configuration repository. Amazon S3 provides a highly durable and available object storage service. S3 stores objects redundantly across multiple devices and multiple facilities within a region, making it highly available. The developer can migrate the existing .xml files to an S3 bucket and update the application code to use the AWS SDK to read and write configuration files from Amazon S3. Option A and B are not the best solutions as they require the developer to use the host operating system to share a folder, which can lead to a single point of failure. Option D is not a recommended solution as it is not a direct way of accessing an S3 bucket. While it is possible to use third-party tools to mount an S3 bucket as a local disk, it can lead to performance issues and additional complexity.

    2. U

       Untamables

       2023-03-23

       Selected C6 upvotes

       C https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/AmazonS3.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingAWSSDK.html

    3. T

       trieudo

       2024-12-14

       Selected C2 upvotes

       Keyword: multi-node, Windows legacy application, shared folder as a centralized configuration repository, high availability, MOST cost-effectively maybe many of you think EFS first when reach 'shared folder', but EFS is not work with 'Windows legacy application', it depnds on OS, MOST cost-effectively ==> discard B: when you reboot or turn off EC2, data in 'instance store volumn will be lost, violate 'high availability ' ==> discard A: EBS at time, can link only one EC2, violate 'shared folder' ==> discard D: complexity than option C, you must setup more, then maintain many things afterward, violate 'MOST cost-effectively' C is match with all requirement

    4. S

       someone234

       2024-02-10

       Selected C2 upvotes

       Option C is the most cost-effective solution to provide high availability for the centralized configuration repository. Amazon S3 provides a highly durable and available object storage service. S3 stores objects redundantly across multiple devices and multiple facilities within a region, making it highly available. The developer can migrate the existing .xml files to an S3 bucket and update the application code to use the AWS SDK to read and write configuration files from Amazon S3.

13. Question 13 of 25

    Select 2

    An application is processing clickstream data using Amazon Kinesis. The clickstream data feed into Kinesis experiences periodic spikes. The PutRecords API call occasionally fails and the logs show that the failed call returns the response shown below:

    

    Which techniques will help mitigate this exception? (Choose two.)

    • AImplement retries with exponential backoff.
    • BUse a PutRecord API instead of PutRecords.
    • CReduce the frequency and/or size of the requests.
    • DUse Amazon SNS instead of Kinesis.
    • EReduce the number of KCL consumers.

    Show answer

    Correct answer: A, C

    How others answered

    • AC85%
    • BC15%

    Explanation

    100% AC as per AWS : ProvisionedThroughputExceededException The request rate for the stream is too high, or the requested data is too large for the available throughput. Reduce the frequency or size of your requests. For more information, see Streams Limits in the Amazon Kinesis Data Streams Developer Guide, and Error Retries and Exponential Backoff in AWS in the AWS General Reference. https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecords.html

    Adapted from community discussion by eboehm2 · 2023-06-14 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. E

       eboehm2

       2023-06-14

       Selected A, C8 upvotes

       100% AC as per AWS : ProvisionedThroughputExceededException The request rate for the stream is too high, or the requested data is too large for the available throughput. Reduce the frequency or size of your requests. For more information, see Streams Limits in the Amazon Kinesis Data Streams Developer Guide, and Error Retries and Exponential Backoff in AWS in the AWS General Reference. https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecords.html

    2. E

       eboehm2

       2023-06-14

       4 upvotes

       I thought this at first too, but I was doing some additional reading and using the PutRecord API over PutRecords is wrong as it could actually make the problem worse as producers may make too many rapid requests to write to the stream https://repost.aws/knowledge-center/kinesis-data-stream-throttling

    3. U

       Untamables

       2023-03-23

       Selected A, C4 upvotes

       A and C https://aws.amazon.com/premiumsupport/knowledge-center/kinesis-data-stream-throttling-errors/

    4. S

       sumanshu

       2024-12-22

       Selected A, C2 upvotes

       A) Correct - Retries with exponential backoff help manage temporary spikes by delaying subsequent retry attempts progressively B) Eliminated - Switching to PutRecord would increase API calls, worsening the throughput issue C) Correct - Reducing request size or frequency directly addresses the throughput limits by spreading out the data more evenly. D) Eliminated - Amazon SNS is a messaging service, not designed for streaming data with high throughput like Kinesis.

14. Question 14 of 25

    A developer is creating an application that includes an Amazon API Gateway REST API in the us-east-2 Region. The developer wants to use Amazon CloudFront and a custom domain name for the API. The developer has acquired an SSL/TLS certificate for the domain from a third-party provider. How should the developer configure the custom domain for the application?

    • AImport the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API. Create a DNS A record for the custom domain.
    • BImport the SSL/TLS certificate into CloudFront. Create a DNS CNAME record for the custom domain.
    • CImport the SSL/TLS certificate into AWS Certificate Manager (ACM) in the same Region as the API. Create a DNS CNAME record for the custom domain.
    • DImport the SSL/TLS certificate into AWS Certificate Manager (ACM) in the us-east-1 Region. Create a DNS CNAME record for the custom domain.

    Show answer

    Correct answer: D

    How others answered

    • D87%

    Explanation

    To use a certificate in AWS Certificate Manager (ACM) to require HTTPS between viewers and CloudFront, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1). https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html

    Adapted from community discussion by brandon87 · 2023-10-03 · 31 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • repost.aws documentation

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. B

       brandon87

       2023-10-03

       Selected D31 upvotes

       To use a certificate in AWS Certificate Manager (ACM) to require HTTPS between viewers and CloudFront, make sure you request (or import) the certificate in the US East (N. Virginia) Region (us-east-1). https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html

    2. A

       ancomedian

       2024-01-18

       Selected D9 upvotes

       I have checked at various places Answer is D Reason: ACM just can only import certificate in us-east-1 and we need to associate the imported certificate with us-east-2 The caused confusion regarding it is because of import and associate Crux: we will import in us-east-1 but use in us-east-2

    3. U

       Untamables

       2023-09-23

       Selected D8 upvotes

       The correct answer is D. https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html https://docs.aws.amazon.com/acm/latest/userguide/import-certificate.html https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html

    4. P

       Pupina

       2024-01-05

       Selected D3 upvotes

       A is not right because for cloudfront you create a CNMA not a DNS A https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/CNAMEs.html C is not right because ACM cannot import certificates in us-east-2 https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/cnames-and-https-requirements.html B is not right. The certificate is for an external CA but can be uploaded to ACM or you must request a public certificate from AWS certificate Manager https://repost.aws/knowledge-center/install-ssl-cloudfront but you cannot import the certificate into CloudFront

15. Question 15 of 25

    Select 2

    A development team maintains a web application by using a single AWS CloudFormation template. The template defines web servers and an Amazon RDS database. The team uses the Cloud Formation template to deploy the Cloud Formation stack to different environments. During a recent application deployment, a developer caused the primary development database to be dropped and recreated. The result of this incident was a loss of data. The team needs to avoid accidental database deletion in the future. Which solutions will meet these requirements? (Choose two.)

    • AAdd a CloudFormation Deletion Policy attribute with the Retain value to the database resource.
    • BUpdate the CloudFormation stack policy to prevent updates to the database.
    • CModify the database to use a Multi-AZ deployment.
    • DCreate a CloudFormation stack set for the web application and database deployments.
    • EAdd a Cloud Formation DeletionPolicy attribute with the Retain value to the stack.

    Show answer

    Correct answer: A, B

    How others answered

    • AB100%

    Explanation

    A. Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource: By adding a DeletionPolicy attribute with the Retain value to the database resource in the CloudFormation template, the database will not be deleted even if the CloudFormation stack is deleted. This helps prevent accidental database loss during stack deletion. B. Update the CloudFormation stack policy to prevent updates to the database: By updating the CloudFormation stack policy, the development team can restrict updates to the database resource. This prevents accidental modifications or recreations of the database during stack updates. The stack policy can define specific actions that are allowed or denied, providing an additional layer of protection against unintentional database changes.

    Adapted from community discussion by Mtho96 · 2024-01-06 · 16 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. M

       Mtho96

       2024-01-06

       16 upvotes

       A. Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource: By adding a DeletionPolicy attribute with the Retain value to the database resource in the CloudFormation template, the database will not be deleted even if the CloudFormation stack is deleted. This helps prevent accidental database loss during stack deletion. B. Update the CloudFormation stack policy to prevent updates to the database: By updating the CloudFormation stack policy, the development team can restrict updates to the database resource. This prevents accidental modifications or recreations of the database during stack updates. The stack policy can define specific actions that are allowed or denied, providing an additional layer of protection against unintentional database changes.

    2. S

       svrnvtr

       2023-09-21

       Selected A, B7 upvotes

       AB https://aws.amazon.com/ru/premiumsupport/knowledge-center/cloudformation-accidental-updates/

    3. S

       sumanshu

       2024-12-22

       Selected A, B4 upvotes

       A) Correct - When a DeletionPolicy: Retain is applied to a resource, CloudFormation retains (does not delete) the resource even if the stack is deleted or updated. B) Correct - Preventing updates ensures that no actions (such as deletion or replacement) can accidentally impact the database. This is an effective safeguard to avoid both deletion and unintended modifications. C) Eliminated - Multi-AZ deployment is for ensuring database availability and durability, not to prevent accidental deletion. Even with Multi-AZ, the database can still be deleted. D) Eliminated - Stack sets are for multi-account/multi-region deployments and do not inherently prevent resource deletion. E) Eliminated - The DeletionPolicy attribute applies only to individual resources, not the entire stack.

    4. U

       Untamables

       2023-09-25

       Selected A, B5 upvotes

       A and B https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

16. Question 16 of 25

    An application that is hosted on an Amazon EC2 instance needs access to files that are stored in an Amazon S3 bucket. The application lists the objects that are stored in the S3 bucket and displays a table to the user. During testing, a developer discovers that the application does not show any objects in the list. What is the MOST secure way to resolve this issue?

    • AUpdate the IAM instance profile that is attached to the EC2 instance to include the S3:* permission for the S3 bucket.
    • BUpdate the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket.
    • CUpdate the developer's user permissions to include the S3:ListBucket permission for the S3 bucket.
    • DUpdate the S3 bucket policy by including the S3:ListBucket permission and by setting the Principal element to specify the account number of the EC2 instance.

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • A17%

    Explanation

    The correct answer is B. https://repost.aws/knowledge-center/ec2-instance-access-s3-bucket Option A also works, but it is not compliant to the AWS security practice of the least privilege permissions.

    Adapted from community discussion by Untamables · 2023-03-26 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. U

       Untamables

       2023-03-26

       Selected B11 upvotes

       The correct answer is B. https://repost.aws/knowledge-center/ec2-instance-access-s3-bucket Option A also works, but it is not compliant to the AWS security practice of the least privilege permissions.

    2. Y

       yashika2005

       2023-06-03

       Selected B3 upvotes

       the s3:ListBucket permission allows the user to use the Amazon S3 GET Bucket (List Objects) operation. Reference: https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html

    3. S

       sumanshu

       2024-12-22

       Selected B1 upvote

       A) Eliminated - Too permissive: Grants more permissions than needed (S3:*), violating the principle of least privilege. B) Correct - Minimal permissions: Only grants the permission needed for the application to perform the ListBucket operation. Permissions are tied to the EC2 instance's IAM instance profile, limiting access to that instance. C) Eliminated - The developer’s permissions are unrelated to the application running on the EC2 instance. D) Eliminated - Grants permissions at the S3 bucket policy level, which applies to all resources in the account, not just the EC2 instance.

    4. A

       aaaaatoz

       2024-12-25

       Selected B2 upvotes

       https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-policy-language-overview.html For example, the s3:ListBucket permission allows the user to use the Amazon S3 ListObjectsV2 operation. (The s3:ListBucket permission is a case where the action name doesn't map directly to the operation name.)

17. Question 17 of 25

    Select 2

    A developer is building a web application that uses Amazon API Gateway to expose an AWS Lambda function to process requests from clients. During testing, the developer notices that the API Gateway times out even though the Lambda function finishes under the set time limit. Which of the following API Gateway metrics in Amazon CloudWatch can help the developer troubleshoot the issue? (Choose two.)

    • ACacheHitCount
    • BIntegrationLatency
    • CCacheMissCount
    • DLatency
    • ECount

    Show answer

    Correct answer: B, D

    How others answered

    • BD100%

    Explanation

    B and D The issue is caused by timeout. So the developer needs to know the latency information. https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-metrics-and-dimensions.html https://repost.aws/knowledge-center/api-gateway-rest-api-504-errors

    Adapted from community discussion by Untamables · 2023-09-25 · 14 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. U

       Untamables

       2023-09-25

       Selected B, D14 upvotes

       B and D The issue is caused by timeout. So the developer needs to know the latency information. https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-metrics-and-dimensions.html https://repost.aws/knowledge-center/api-gateway-rest-api-504-errors

    2. W

       Watascript

       2023-09-25

       Selected B, D5 upvotes

       https://docs.aws.amazon.com/apigateway/latest/developerguide/monitoring-cloudwatch.html

    3. S

       sumanshu

       2024-12-23

       Selected B, D2 upvotes

       A) Eliminated - there is no mention of caching being involved in the problem, this metric is irrelevant for troubleshooting a timeout issue. B) Correct - A high value for IntegrationLatency can indicate that the API Gateway is experiencing delays in receiving responses from Lambda C) Eliminated - this metric is related to caching, which is not mentioned as part of the problem D) Correct - high value for Latency can indicate where delays are occurring overall, including the Lambda function's processing time and any overhead in API Gateway. E) Eliminated - While this metric provides information about the volume of requests, it does not help identify the cause of a timeout or latency issues.

    4. J

       Jonalb

       2024-04-26

       Selected B, D1 upvote

       As melhores opções são, portanto, B. IntegraçãoLatência e D. Latência. Ambas as métricas fornecerão insights sobre onde pode estar ocorrendo a latência ou o atraso, ajudando o desenvolvedor a solucionar o problema.

18. Question 18 of 25

    A developer is creating an application on Amazon Elastic Container Service (Amazon ECS). The developer needs to configure the application parameters. The developer must configure limits for the application's maximum number of simultaneous connections and maximum number of transactions per second. The maximum number of connections and transactions can change in the future. The developer needs a solution that can automatically deploy these changes to the application, as needed, without causing downtime. Which solution will meet these requirements?

    • AMake the configuration changes for the application. Use AWS CodeDeploy to create a deployment configuration. Specify an in-place deployment to deploy the changes.
    • BBootstrap the application to use the AWS Cloud Development Kit (AWS CDK) and make the configuration changes. Specify the ECSCanary10Percent15Minutes launch type in the properties section of the ECS resource. Deploy the application by using the AWS CDK to implement the changes.
    • CInstall the AWS AppConfig agent on Amazon ECS. Configure an IAM role with access to AWS AppConfig. Make the deployment changes by using AWS AppConfig. Specify Canary10Percent20Minutes as the deployment strategy.
    • DCreate an AWS Lambda function to make the configuration changes. Create an Amazon CloudWatch alarm that monitors the Lambda function every 5 minutes to check if the Lambda function has been updated. When the Lambda function is updated, deploy the changes by using AWS CodeDeploy.

    Show answer

    Correct answer: C

    How others answered

    • C75%
    • D25%

    Explanation

    The agent calls AWS AppConfig on your behalf by using an AWS Identity and Access Management (IAM) role and managing a local cache of configuration data. By pulling configuration data from the local cache, your application requires fewer code updates to manage configuration data, retrieves configuration data in milliseconds, and isn't affected by network issues that can disrupt calls for such data. https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-integration-ec2.html

    Adapted from community discussion by jasonczx · 2024-09-04 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion3

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. J

       jasonczx

       2024-09-04

       Selected C3 upvotes

       The agent calls AWS AppConfig on your behalf by using an AWS Identity and Access Management (IAM) role and managing a local cache of configuration data. By pulling configuration data from the local cache, your application requires fewer code updates to manage configuration data, retrieves configuration data in milliseconds, and isn't affected by network issues that can disrupt calls for such data. https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-integration-ec2.html

    2. J

       jasonczx

       2024-09-04

       Selected C2 upvotes

       The AWS AppConfig Agent is the recommended method for retrieving AWS AppConfig feature flags or free form configuration data. The agent automatically implements best practices and may lower your cost of using AWS AppConfig as a result of fewer API calls to retrieve configurations. https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-agent-how-to-use.html

    3. J

       jasonczx

       2024-09-04

       Selected C1 upvote

       This environment variable configures the maximum number of connections that the agent uses to retrieve configurations from AWS AppConfig. https://docs.aws.amazon.com/appconfig/latest/userguide/appconfig-integration-containers-agent.html

19. Question 19 of 25

    A developer is writing an AWS Lambda function. The developer wants to log key events that occur while the Lambda function runs. The developer wants to include a unique identifier to associate the events with a specific function invocation. The developer adds the following code to the Lambda function:

    

    Which solution will meet this requirement?

    • AObtain the request identifier from the AWS request ID field in the context object. Configure the application to write logs to standard output.
    • BObtain the request identifier from the AWS request ID field in the event object. Configure the application to write logs to a file.
    • CObtain the request identifier from the AWS request ID field in the event object. Configure the application to write logs to standard output.
    • DObtain the request identifier from the AWS request ID field in the context object. Configure the application to write logs to a file.

    Show answer

    Correct answer: A

    How others answered

    • A94%

    Explanation

    Both A and D could work here, as both rely on the context object to get access to execution ID https://docs.aws.amazon.com/us_en/lambda/latest/dg/python-context.html While A uses stoud to send log to CloudWatch Log, D writes to a file. D is less specific (where is the file stored? A single file for each execution?) and looks more comples (manage file(s), manage concurrency access to the file ...), thus I'll go for A

    Adapted from community discussion by ninomfr64 · 2024-02-19 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. N

       ninomfr64

       2024-02-19

       Selected A15 upvotes

       Both A and D could work here, as both rely on the context object to get access to execution ID https://docs.aws.amazon.com/us_en/lambda/latest/dg/python-context.html While A uses stoud to send log to CloudWatch Log, D writes to a file. D is less specific (where is the file stored? A single file for each execution?) and looks more comples (manage file(s), manage concurrency access to the file ...), thus I'll go for A

    2. U

       Untamables

       2023-09-26

       Selected A8 upvotes

       A https://docs.aws.amazon.com/lambda/latest/dg/nodejs-context.html https://docs.aws.amazon.com/lambda/latest/dg/nodejs-logging.html There is no explicit information for the runtime, the code is written in Node.js.

    3. P

       Prem28

       2023-11-20

       Selected A5 upvotes

       The application can write logs to standard output or to a file. Standard output is the default destination for logs. Logs that are written to standard output are sent to Amazon CloudWatch Logs. Logs that are written to a file are stored on the Lambda function's execution environment.

    4. W

       Watascript

       2023-09-25

       Selected A4 upvotes

       https://docs.aws.amazon.com/us_en/lambda/latest/dg/python-context.html https://docs.aws.amazon.com/us_en/lambda/latest/dg/python-logging.html

20. Question 20 of 25

    A developer is creating an AWS Lambda function that needs credentials to connect to an Amazon RDS for MySQL database. An Amazon S3 bucket currently stores the credentials. The developer needs to improve the existing solution by implementing credential rotation and secure storage. The developer also needs to provide integration with the Lambda function. Which solution should the developer use to store and retrieve the credentials with the LEAST management overhead?

    • AStore the credentials in AWS Systems Manager Parameter Store. Select the database that the parameter will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the parameter. Enable automatic rotation for the parameter. Use the parameter from Parameter Store on the Lambda function to connect to the database.
    • BEncrypt the credentials with the default AWS Key Management Service (AWS KMS) key. Store the credentials as environment variables for the Lambda function. Create a second Lambda function to generate new credentials and to rotate the credentials by updating the environment variables of the first Lambda function. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the database to use the new credentials. On the first Lambda function, retrieve the credentials from the environment variables. Decrypt the credentials by using AWS KMS, Connect to the database.
    • CStore the credentials in AWS Secrets Manager. Set the secret type to Credentials for Amazon RDS database. Select the database that the secret will access. Use the default AWS Key Management Service (AWS KMS) key to encrypt the secret. Enable automatic rotation for the secret. Use the secret from Secrets Manager on the Lambda function to connect to the database.
    • DEncrypt the credentials by using AWS Key Management Service (AWS KMS). Store the credentials in an Amazon DynamoDB table. Create a second Lambda function to rotate the credentials. Invoke the second Lambda function by using an Amazon EventBridge rule that runs on a schedule. Update the DynamoDB table. Update the database to use the generated credentials. Retrieve the credentials from DynamoDB with the first Lambda function. Connect to the database.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C This solution minimizes management overhead by leveraging the built-in capabilities of AWS Secrets Manager, such as encryption, automatic rotation, and integration with AWS Lambda. It provides a secure and efficient way to store and retrieve https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_database_secret.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html

    Adapted from community discussion by Mtho96 · 2023-07-09 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. U

       Untamables

       2023-03-26

       Selected C11 upvotes

       C https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_database_secret.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html

    2. M

       Mtho96

       2023-07-09

       2 upvotes

       C This solution minimizes management overhead by leveraging the built-in capabilities of AWS Secrets Manager, such as encryption, automatic rotation, and integration with AWS Lambda. It provides a secure and efficient way to store and retrieve https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/create_database_secret.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_lambda.html

    3. M

       mooncake1

       2025-01-24

       Selected C2 upvotes

       A - KMS provides automatic rotation for AWS Managed Keys, but Custom Managed Keys are not provided (needs to implement rotation logic by dev). A did not specify which key the dev should use. ANW : C - SM provides automatic rotation lambda for RDS Param rotation.

    4. S

       sumanshu

       2024-12-23

       Selected C1 upvote

       A) Eliminated - automatic credential rotation is limited C) Correct - Secrets Manager is specifically designed for securely storing and retrieving secrets. Automatic rotation of credentials is fully supported

21. Question 21 of 25

    A company needs to harden its container images before the images are in a running state. The company's application uses Amazon Elastic Container Registry (Amazon ECR) as an image registry. Amazon Elastic Kubernetes Service (Amazon EKS) for compute, and an AWS CodePipeline pipeline that orchestrates a continuous integration and continuous delivery (CI/CD) workflow. Dynamic application security testing occurs in the final stage of the pipeline after a new image is deployed to a development namespace in the EKS cluster. A developer needs to place an analysis stage before this deployment to analyze the container image earlier in the CI/CD pipeline. Which solution will meet these requirements with the MOST operational efficiency?

    • ABuild the container image and run the docker scan command locally. Mitigate any findings before pushing changes to the source code repository. Write a pre-commit hook that enforces the use of this workflow before commit.
    • BCreate a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.
    • CCreate a new CodePipeline stage that occurs after source code has been retrieved from its repository. Run a security scanner on the latest revision of the source code. Fail the pipeline if there are findings.
    • DAdd an action to the deployment stage of the pipeline so that the action occurs before the deployment to the EKS cluster. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings.

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • D17%

    Explanation

    B https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html The below blog post refers to the solution using Amazon Inspector and ECS, but the architecture is almost same as required in this scenario. The built in image scanning in Amazon ECR provides a simpler solution. https://aws.amazon.com/blogs/security/use-amazon-inspector-to-manage-your-build-and-deploy-pipelines-for-containerized-applications/

    Adapted from community discussion by Untamables · 2023-09-26 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. U

       Untamables

       2023-09-26

       Selected B18 upvotes

       B https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning-basic.html The below blog post refers to the solution using Amazon Inspector and ECS, but the architecture is almost same as required in this scenario. The built in image scanning in Amazon ECR provides a simpler solution. https://aws.amazon.com/blogs/security/use-amazon-inspector-to-manage-your-build-and-deploy-pipelines-for-containerized-applications/

    2. L

       love777

       2024-02-25

       Selected B10 upvotes

       This approach integrates security scanning directly into the CI/CD pipeline and leverages AWS services for image scanning. Here's how it works: A new CodePipeline stage is added after the container image is built, but before it's pushed to Amazon ECR. ECR basic image scanning is configured to scan the image automatically upon push. This ensures that security scanning is part of the process. An AWS Lambda function is used as an action provider in the pipeline. This Lambda function can be configured to analyze the scan results of the image. If the Lambda function detects any security findings in the scan results, it can fail the pipeline, preventing the deployment of images with security vulnerabilities.

    3. M

       MrTee

       2023-10-18

       Selected B5 upvotes

       The developer should choose option B. Create a new CodePipeline stage that occurs after the container image is built. Configure ECR basic image scanning to scan on image push. Use an AWS Lambda function as the action provider. Configure the Lambda function to check the scan results and to fail the pipeline if there are findings. This will allow the developer to place an analysis stage before deployment to analyze the container image earlier in the CI/CD pipeline with the most operational efficiency. CHATGPT

    4. N

       ninomfr64

       2024-02-19

       Selected B2 upvotes

       B as per https://docs.aws.amazon.com/amplify/latest/userguide/running-tests.html You can run end-to-end (E2E) tests in the test phase of your Amplify app to catch regressions before pushing code to production. The test phase can be configured in the build specification YAML. Currently, you can run only the Cypress testing framework during a build. build specification is provided in the amplify.yml file

22. Question 22 of 25

    A company is building a web application on AWS. When a customer sends a request, the application will generate reports and then make the reports available to the customer within one hour. Reports should be accessible to the customer for 8 hours. Some reports are larger than 1 MB. Each report is unique to the customer. The application should delete all reports that are older than 2 days. Which solution will meet these requirements with the LEAST operational overhead?

    • AGenerate the reports and then store the reports as Amazon DynamoDB items that have a specified TTL. Generate a URL that retrieves the reports from DynamoDB. Provide the URL to customers through the web application.
    • BGenerate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Attach the reports to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe the customer to email notifications from Amazon SNS.
    • CGenerate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Generate a presigned URL that contains an expiration date Provide the URL to customers through the web application. Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports.
    • DGenerate the reports and then store the reports in an Amazon RDS database with a date stamp. Generate an URL that retrieves the reports from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records that have expired date stamps.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Explanation: Storing the reports in an Amazon S3 bucket provides a cost-effective and scalable solution for handling files larger than 1 MB. Server-side encryption ensures data security. Generating a presigned URL with an expiration date allows the customer to access the report for 8 hours, and S3 Lifecycle configuration rules automatically delete the reports older than 2 days, reducing operational overhead.

    Adapted from community discussion by gpt_test · 2023-10-03 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • repost.aws documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. G

       gpt_test

       2023-10-03

       Selected C15 upvotes

       Explanation: Storing the reports in an Amazon S3 bucket provides a cost-effective and scalable solution for handling files larger than 1 MB. Server-side encryption ensures data security. Generating a presigned URL with an expiration date allows the customer to access the report for 8 hours, and S3 Lifecycle configuration rules automatically delete the reports older than 2 days, reducing operational overhead.

    2. N

       ninomfr64

       2024-02-19

       6 upvotes

       A) DynamoDB cannot store object larger than 400K B) SNS cannot send email with attachment - https://repost.aws/questions/QUOvaKJVb3QzOqVENONBZUag/sns-send-file-attachment D) the nature or format of the report is not specified, however RDS doent look like a great place to store large document file. Also generating a url to the reports from the RDS database requires some work while it is a native capabilities in S3 C) is a workable solution as S3 is designed to store file objects, it allows to easily generate pre-signed url, and provide lifecycle management rule that allows to expire objects

    3. I

       imvb88

       2023-11-24

       Selected C5 upvotes

       Dynamo DB cannot store object > 400KB -> option A is out immediately. Limited access to S3 calls for presigned URL which is option C. C also has lifecycle config to delete old object while B does not have that. D is possible but too much effort compared to design pattern in C.

    4. U

       Untamables

       2023-09-27

       Selected C5 upvotes

       C https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html

23. Question 23 of 25

    A developer is incorporating AWS X-Ray into an application that handles personal identifiable information (PII). The application is hosted on Amazon EC2 instances. The application trace messages include encrypted PII and go to Amazon CloudWatch. The developer needs to ensure that no PII goes outside of the EC2 instances. Which solution will meet these requirements?

    • AManually instrument the X-Ray SDK in the application code.
    • BUse the X-Ray auto-instrumentation agent.
    • CUse Amazon Macie to detect and hide PII. Call the X-Ray API from AWS Lambda.
    • DUse AWS Distro for Open Telemetry.

    Show answer

    Correct answer: A

    How others answered

    • A81%

    Explanation

    Explanation: By manually instrumenting the X-Ray SDK in the application code, the developer can have full control over which data is included in the trace messages. This way, the developer can ensure that no PII is sent to X-Ray by carefully handling the PII within the application and not including it in the trace messages.

    Adapted from community discussion by gpt_test · 2023-10-03 · 25 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. G

       gpt_test

       2023-10-03

       Selected A25 upvotes

       Explanation: By manually instrumenting the X-Ray SDK in the application code, the developer can have full control over which data is included in the trace messages. This way, the developer can ensure that no PII is sent to X-Ray by carefully handling the PII within the application and not including it in the trace messages.

    2. U

       Untamables

       2023-09-27

       Selected A7 upvotes

       A Not to send any PII to AWS X-Ray service, add instrumentation code in your application at each location to send trace information that PII is eliminated. https://docs.aws.amazon.com/xray/latest/devguide/xray-instrumenting-your-app.html

    3. T

       TheFivePips

       2024-09-04

       Selected A2 upvotes

       X-Ray auto-instrumentation agent itself does not inherently remove or redact Personally Identifiable Information (PII). The primary purpose of the auto-instrumentation agent is to automate the process of instrumenting supported frameworks and libraries for tracing with AWS X-Ray. When dealing with PII or any sensitive information, the responsibility for ensuring that such data is not exposed in traces lies with the application code and configuration, rather than the X-Ray auto-instrumentation agent. While the X-Ray auto-instrumentation agent simplifies the instrumentation process, the need for precise control over PII and the ability to implement custom security measures make manual instrumentation more suitable in this scenario.

    4. S

       StarLoard

       2023-09-26

       3 upvotes

       C : Amazon Macie is a data security service that discovers sensitive data using machine learning and pattern matching, provides visibility into data security risks, and enables you to automate protection against those risks. https://aws.amazon.com/macie/features/?nc1=h_ls

24. Question 24 of 25

    Select 2

    A developer has an application that makes batch requests directly to Amazon DynamoDB by using the BatchGetItem low-level API operation. The responses frequently return values in the UnprocessedKeys element. Which actions should the developer take to increase the resiliency of the application when the batch response includes values in UnprocessedKeys? (Choose two.)

    • ARetry the batch operation immediately.
    • BRetry the batch operation with exponential backoff and randomized delay.
    • CUpdate the application to use an AWS software development kit (AWS SDK) to make the requests.
    • DIncrease the provisioned read capacity of the DynamoDB tables that the operation accesses.
    • EIncrease the provisioned write capacity of the DynamoDB tables that the operation accesses.

    Show answer

    Correct answer: B, D

    How others answered

    • BD60%
    • BC38%

    Only 60% agreed on this answer — treat it as contested rather than settled.

    Explanation

    (B) If you delay the batch operation using exponential backoff, the individual requests in the batch are much more likely to succeed. (D) The most likely cause of a failed read or a failed write is throttling. For BatchGetItem, one or more of the tables in the batch request does not have enough provisioned read capacity to support the operation https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html#Programming.Errors.RetryAndBackoff

    Adapted from community discussion by brandon87 · 2023-04-02 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. B

       brandon87

       2023-04-02

       Selected B, D23 upvotes

       (B) If you delay the batch operation using exponential backoff, the individual requests in the batch are much more likely to succeed. (D) The most likely cause of a failed read or a failed write is throttling. For BatchGetItem, one or more of the tables in the batch request does not have enough provisioned read capacity to support the operation https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html#Programming.Errors.RetryAndBackoff

    2. M

       mrsoa

       2023-08-26

       Selected B, D9 upvotes

       B D From Stephan's maarek course BatchGetItem • Return items from one or more tables • Up to 100 items, up to 16 MB of data • Items are retrieved in parallel to minimize latency • UnprocessedKeys for failed read operations (exponential backoff or add RCU)

    3. A

       aanataliya

       2023-08-22

       Selected B, D6 upvotes

       B and D is correct answer. AWS SDK automatically takes care of both retry and exponential backoff. If we choose C, selecting only C will answer our question(no need of B) but We need to choose 2 answer. In addition, question doesnot specifically say to change core logic from low level api to SDK. by choosing B and D we can improve resiliency. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html#Programming.Errors.RetryAndBackoff

    4. P

       Phongsanth

       2024-09-25

       Selected B, D3 upvotes

       I vote for B,D Scroll down to the bottom of this page and you will see the reason. I paste some of words here. The most likely cause of a failed read or a failed write is throttling. For BatchGetItem, one or more of the tables in the batch request does not have enough provisioned read capacity to support the operation. For BatchWriteItem, one or more of the tables does not have enough provisioned write capacity. If DynamoDB returns any unprocessed items, you should retry the batch operation on those items. However, we strongly recommend that you use an exponential backoff algorithm. If you retry the batch operation immediately, the underlying read or write requests can still fail due to throttling on the individual tables. If you delay the batch operation using exponential backoff, the individual requests in the batch are much more likely to succeed. https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Programming.Errors.html

25. Question 25 of 25

    A developer is implementing an AWS Cloud Development Kit (AWS CDK) serverless application. The developer will provision several AWS Lambda functions and Amazon API Gateway APIs during AWS CloudFormation stack creation. The developer's workstation has the AWS Serverless Application Model (AWS SAM) and the AWS CDK installed locally. How can the developer test a specific Lambda function locally?

    • ARun the sam package and sam deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
    • BRun the cdk synth and cdk deploy commands. Create a Lambda test event from the AWS Management Console. Test the Lambda function.
    • CRun the cdk synth and sam local invoke commands with the function construct identifier and the path to the synthesized CloudFormation template.
    • DRun the cdk synth and sam local start-lambda commands with the function construct identifier and the path to the synthesized CloudFormation template.

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    The developer can test a specific Lambda function locally by running the cdk synth command to synthesize the AWS CDK application into an AWS CloudFormation template. Then, the developer can use the sam local invoke command with the function construct identifier and the path to the synthesized CloudFormation template to test the Lambda function locally (option C).

    Adapted from community discussion by MrTee · 2023-04-21 · 13 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • AWS documentation
    • AWS documentation
    • AWS documentation

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by DVA-C02 or CertExamHQ.

    1. M

       MrTee

       2023-04-21

       Selected C13 upvotes

       The developer can test a specific Lambda function locally by running the cdk synth command to synthesize the AWS CDK application into an AWS CloudFormation template. Then, the developer can use the sam local invoke command with the function construct identifier and the path to the synthesized CloudFormation template to test the Lambda function locally (option C).

    2. D

       Dushank

       2023-09-09

       Selected C5 upvotes

       o test a specific Lambda function locally when using the AWS Cloud Development Kit (AWS CDK), the developer can use the AWS Serverless Application Model (AWS SAM) CLI's local testing capabilities in conjunction with the CDK. The typical process would be: Run cdk synth to synthesize the AWS CDK app into a CloudFormation template. Use sam local invoke to run the specific Lambda function locally, providing the function's logical identifier and the path to the synthesized CloudFormation template as arguments.

    3. Z

       zodraz

       2023-05-08

       Selected C4 upvotes

       sam local invoke StackLogicalId/FunctionLogicalId https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/using-sam-cli-local-invoke.html

    4. F

       fossil123

       2023-08-30

       Selected C2 upvotes

       Use the AWS SAM CLI sam local invoke subcommand to initiate a one-time invocation of an AWS Lambda function locally. https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/using-sam-cli-local-invoke.html

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 1 of 25