DVA-C02 practice questions 151–160

1. Question 151 · 548 in bank

   A company has a three-tier application that is deployed in Amazon Elastic Container Service (Amazon ECS). The application is using an Amazon RDS for MySQL DB instance. The application performs more database reads than writes. During times of peak usage, the application’s performance degrades. When this performance degradation occurs, the DB instance’s ReadLatency metric in Amazon CloudWatch increases suddenly. How should a developer modify the application to improve performance?

   • AUse Amazon ElastiCache to cache query results.
   • BScale the ECS cluster to contain more ECS instances.
   • CAdd read capacity units (RCUs) to the DB instance.
   • DModify the ECS task definition to increase the task memory.

   Show answer

   Answer: A

   Explanation

   Amazon ElastiCache can significantly enhance the read performance of the application by caching frequently accessed data. This reduces the load on the RDS database by serving repeated read requests from the cache rather than querying the database each time. This is particularly effective for applications with a high read-to-write ratio and can lead to a substantial reduction in the ReadLatency metric of the database.

   Source: Adapted from community discussion — SerialiDr

   Next question

2. Question 152 · 548 in bank

   A developer is writing an application to encrypt files outside of AWS before uploading the files to an Amazon S3 bucket. The encryption must be symmetric and must be performed inside the application. How can the developer implement the encryption in the application to meet these requirements?

   • ACreate a data key in AWS Key Management Service (AWS KMS). Use the AWS Encryption SDK to encrypt the files.
   • BCreate a Hash-Based Message Authentication Code (HMAC) key in AWS Key Management Service (AWS KMS). Use the AWS Encryption SDK to encrypt the files.
   • CCreate a data key pair in AWS Key Management Service (AWS KMS). Use the AWS CLI to encrypt the files.
   • DCreate a data key in AWS Key Management Service (AWS KMS). Use the AWS CLI to encrypt the files.

   Show answer

   Answer: A

   Explanation

   This option aligns with the requirements. AWS KMS allows the creation of symmetric data keys which can be used for encryption outside of AWS. The AWS Encryption SDK is designed to simplify encryption and decryption operations, making it a suitable choice for implementing encryption within the application. The developer can use the data key obtained from AWS KMS for the encryption process.

   Source: Adapted from community discussion — SerialiDr

   Next question

3. Question 153 · 548 in bank

   A developer is working on an application that is deployed on an Amazon EC2 instance. The developer needs a solution that will securely transfer files from the application to an Amazon S3 bucket. What should the developer do to meet these requirements in the MOST secure way?

   • ACreate an IAM user. Create an access key for the IAM user. Store the access key in the application’s environment variables.
   • BCreate an IAM role. Create an access key for the IAM role. Store the access key in the application’s environment variables.
   • CCreate an IAM role. Configure the IAM role to access the specific Amazon S3 API calls the application requires. Associate the IAM role with the EC2 instance.
   • DConfigure an S3 bucket policy for the S3 bucket. Configure the S3 bucket policy to allow access for the EC2 instance ID.

   Show answer

   Answer: C

   Explanation

   This approach follows AWS best practices. An IAM role can be created with the necessary permissions to access the S3 bucket. Then, this role can be associated with the EC2 instance. Applications running on the instance can then use the role's permissions to access S3 securely, without needing to manage access keys. This method leverages AWS's built-in security mechanisms and avoids the risks associated with managing static credentials.

   Source: Adapted from community discussion — SerialiDr

   Next question

4. Question 154 · 548 in bank

   A developer created a web API that receives requests by using an internet-facing Application Load Balancer (ALB) with an HTTPS listener. The developer configures an Amazon Cognito user pool and wants to ensure that every request to the API is authenticated through Amazon Cognito. What should the developer do to meet this requirement?

   • AAdd a listener rule to the listener to return a fixed response if the Authorization header is missing. Set the fixed response to 401 Unauthorized.
   • BCreate an authentication action for the listener rules of the ALSet the rule action type to authenticate-cognito. Set the OnUnauthenticatedRequest field to “deny.”
   • CCreate an Amazon API Gateway API. Configure all API methods to be forwarded to the ALB endpoint. Create an authorizer of the COGNITO_USER_POOLS type. Configure every API method to use that authorizer.
   • DCreate a new target group that includes an AWS Lambda function target that validates the Authorization header by using Amazon Cognito. Associate the target group with the listener.

   Show answer

   Answer: B

   Explanation

   This approach uses the built-in capabilities of the ALB to authenticate requests with Amazon Cognito. By configuring a rule action to authenticate with a Cognito user pool, the ALB can handle authentication before the request is forwarded to the target group. The OnUnauthenticatedRequest setting of "deny" ensures that unauthenticated requests are not allowed access, which aligns with the requirement to authenticate every request.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 155 · 548 in bank

   A company wants to deploy and maintain static websites on AWS. Each website's source code is hosted in one of several version control systems, including AWS CodeCommit, Bitbucket, and GitHub. The company wants to implement phased releases by using development, staging, user acceptance testing, and production environments in the AWS Cloud. Deployments to each environment must be started by code merges on the relevant Git branch. The company wants to use HTTPS for all data exchange. The company needs a solution that does not require servers to run continuously. Which solution will meet these requirements with the LEAST operational overhead?

   • AHost each website by using AWS Amplify with a serverless backend. Conned the repository branches that correspond to each of the desired environments. Start deployments by merging code changes to a desired branch.
   • BHost each website in AWS Elastic Beanstalk with multiple environments. Use the EB CLI to link each repository branch. Integrate AWS CodePipeline to automate deployments from version control code merges.
   • CHost each website in different Amazon S3 buckets for each environment. Configure AWS CodePipeline to pull source code from version control. Add an AWS CodeBuild stage to copy source code to Amazon S3.
   • DHost each website on its own Amazon EC2 instance. Write a custom deployment script to bundle each website's static assets. Copy the assets to Amazon EC2. Set up a workflow to run the script when code is merged.

   Show answer

   Answer: A

   Explanation

   a The solution that will meet these requirements with the LEAST operational overhead is option A: Host each website by using AWS Amplify with a serverless backend. AWS Amplify is a fully managed service that allows developers to build and deploy web applications and static websites. With Amplify, developers can easily connect their repositories, such as AWS CodeCommit, Bitbucket, and GitHub, to automatically build and deploy changes to the website based on code merges. Amplify also supports phased releases with multiple environments, including development, staging, user acceptance testing, and production, which can be linked to specific branches in the repository. Additionally, Amplify uses HTTPS for all data exchange by default and has a serverless backend, which means there are no servers to maintain. Overall, this solution provides the least operational overhead while meeting all the specified requirements.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 156 · 548 in bank

   Select 2

   A company recently deployed an AWS Lambda function. A developer notices an increase in the function throttle metrics in Amazon CloudWatch. What are the MOST operationally efficient solutions to reduce the function throttling? (Choose two.)

   • AMigrate the function to Amazon Elastic Kubernetes Service (Amazon EKS).
   • BIncrease the maximum age of events in Lambda.
   • CIncrease the function’s reserved concurrency.
   • DAdd the lambda:GetFunctionConcurrency action to the execution role.
   • ERequest a service quota change for increased concurrency.

   Show answer

   Answer: CE

   Explanation

   C. Increase the function’s reserved concurrency. Reserved concurrency is a feature in AWS Lambda that allows you to allocate a specific amount of concurrency to a particular function. This ensures that the function has a dedicated amount of concurrency and is not affected by throttling due to high usage of other functions in your account. Increasing the reserved concurrency can help mitigate throttling issues, especially if the throttling is due to reaching account-level concurrency limits. E. Request a service quota change for increased concurrency. AWS Lambda has default service quotas (formerly known as limits) for the maximum number of concurrent executions across all functions in your account. If your Lambda function is experiencing throttling due to reaching these account-level concurrency limits, requesting an increase in the service quota for Lambda concurrency can provide a solution.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation
   • AWS documentation

   Next question

7. Question 157 · 548 in bank

   A company is creating a REST service using an Amazon API Gateway with AWS Lambda integration. The service must run different versions for testing purposes. What would be the BEST way to accomplish this?

   • AUse an X-Version header to denote which version is being called and pass that header to the Lambda function(s).
   • BCreate an API Gateway Lambda authorizer to route API clients to the correct API version.
   • CCreate an API Gateway resource policy to isolate versions and provide context to the Lambda function(s).
   • DDeploy the API versions as unique stages with unique endpoints and use stage variables to provide further context.

   Show answer

   Answer: D

   Explanation

   Creating unique stages for different versions is a common practice for managing and deploying different versions of REST APIs. => D

   Source: Adapted from community discussion — TanTran04

   References

   • AWS documentation

   Next question

8. Question 158 · 548 in bank

   Select 2

   A company is using AWS CodePipeline to deliver one of its applications. The delivery pipeline is triggered by changes to the main branch of an AWS CodeCommit repository and uses AWS CodeBuild to implement the test and build stages of the process and AWS CodeDeploy to deploy the application. The pipeline has been operating successfully for several months and there have been no modifications. Following a recent change to the application’s source code, AWS CodeDeploy has not deployed the updated application as expected. What are the possible causes? (Choose two.)

   • AThe change was not made in the main branch of the AWS CodeCommit repository.
   • BOne of the earlier stages in the pipeline failed and the pipeline has terminated.
   • COne of the Amazon EC2 instances in the company’s AWS CodePipeline cluster is inactive.
   • DThe AWS CodePipeline is incorrectly configured and is not invoking AWS CodeDeploy.
   • EAWS CodePipeline does not have permissions to access AWS CodeCommit.

   Show answer

   Answer: AB

   Explanation

   A. The change was not made in the main branch of the AWS CodeCommit repository: In this pipeline setup, if the change was made in a branch other than the main branch, it would not trigger the pipeline, and therefore, AWS CodeDeploy wouldn't deploy the updated application. B. One of the earlier stages in the pipeline failed and the pipeline has terminated: If one of the preceding stages in the pipeline failed, it would prevent the subsequent stages, including AWS CodeDeploy, from being executed.

   Source: Adapted from community discussion — tapan666

   Next question

9. Question 159 · 548 in bank

   A developer is building a serverless application by using AWS Serverless Application Model (AWS SAM) on multiple AWS Lambda functions. When the application is deployed, the developer wants to shift 10% of the traffic to the new deployment of the application for the first 10 minutes after deployment. If there are no issues, all traffic must switch over to the new version. Which change to the AWS SAM template will meet these requirements?

   • ASet the Deployment Preference Type to Canary10Percent10Minutes. Set the AutoPublishAlias property to the Lambda alias.
   • BSet the Deployment Preference Type to Linear10PercentEvery10Minutes. Set AutoPublishAlias property to the Lambda alias.
   • CSet the Deployment Preference Type to Canary10Percent10Minutes. Set the PreTraffic and PostTraffic properties to the Lambda alias.
   • DSet the Deployment Preference Type to Linear10PercentEvery10Minutes. Set PreTraffic and PostTraffic properties to the Lambda alias.

   Show answer

   Answer: A

   Explanation

   Answer is A: https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/automating-updates-to-serverless-apps.html When deploying a Lambda function gradually, CodeDeploy requires a previously deployed function version to shift traffic from. Therefore, your first deployment should be accomplished in two steps: Step 1: Deploy your Lambda function and automatically create aliases with AutoPublishAlias. Step 2: Perform your gradual deployment with DeploymentPreference.

   Source: Adapted from community discussion — ahadh7621

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 160 · 548 in bank

    An AWS Lambda function is running in a company’s shared AWS account. The function needs to perform an additional ec2:DescribeInstances action that is directed at the company’s development accounts. A developer must configure the required permissions across the accounts. How should the developer configure the permissions to adhere to the principle of least privilege?

    • ACreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship between the development accounts for this role. Update the Lambda function IAM role in the shared account by adding the ec2:DescribeInstances permission to the role.
    • BCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions.
    • CCreate an IAM role in the shared account. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship between the development accounts for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions.
    • DCreate an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the ec2:DescribeInstances permission to the role.

    Show answer

    Answer: B

    Explanation

    Create an IAM role in the development accounts. Add the ec2:DescribeInstances permission to the role. Establish a trust relationship with the shared account for this role. Update the Lambda function IAM role in the shared account by adding the iam:AssumeRole permissions.

    Source: Adapted from community discussion — PrakashM14

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 151. 548 questions available.