DVA-C02 practice questions 161–170

1. Question 161 · 548 in bank

   Select 2

   A developer is building a new application that will be deployed on AWS. The developer has created an AWS CodeCommit repository for the application. The developer has initialized a new project for the application by invoking the AWS Cloud Development Kit (AWS CDK) cdk init command. The developer must write unit tests for the infrastructure as code (IaC) templates that the AWS CDK generates. The developer also must run a validation tool across all constructs in the CDK application to ensure that critical security configurations are activated. Which combination of actions will meet these requirements with the LEAST development overhead? (Choose two.)

   • AUse a unit testing framework to write custom unit tests against the cdk.out file that the AWS CDK generates. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository.
   • BUse the CDK assertions module to integrate unit tests with the application. Run the unit tests in a continuous integration and continuous delivery (CI/CD) pipeline that is invoked after any commit to the repository.
   • CUse the CDK runtime context to set key-value pairs that must be present in the cdk.out file that the AWS CDK generates. Fail the stack synthesis if any violations are present.
   • DWrite a script that searches the application for specific key configuration strings. Configure the script to produce a report of any security violations.
   • EUse the CDK Aspects class to create custom rules to apply to the CDK application. Fall the stack synthesis if any violations are present.

   Show answer

   Answer: BE

   Explanation

   B. The AWS CDK assertions library provides a convenient way to write unit tests for CDK applications. It allows developers to assert various aspects of the CDK constructs, such as properties and resource counts. Integrating these unit tests into the CI/CD pipeline ensures that they are automatically run after any commit, providing continuous validation of the infrastructure code. E. Aspects in AWS CDK are a way to apply operations to all constructs in a CDK app or a part of the app. By using the Aspects class, the developer can create custom rules (like security configuration checks) and apply them across all constructs in the CDK application. If these rules find any violations, the stack synthesis can be set to fail, ensuring that the application adheres to critical security configurations.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 162 · 548 in bank

   An online sales company is developing a serverless application that runs on AWS. The application uses an AWS Lambda function that calculates order success rates and stores the data in an Amazon DynamoDB table. A developer wants an efficient way to invoke the Lambda function every 15 minutes. Which solution will meet this requirement with the LEAST development effort?

   • ACreate an Amazon EventBridge rule that has a rate expression that will run the rule every 15 minutes. Add the Lambda function as the target of the EventBridge rule.
   • BCreate an AWS Systems Manager document that has a script that will invoke the Lambda function on Amazon EC2. Use a Systems Manager Run Command task to run the shell script every 15 minutes.
   • CCreate an AWS Step Functions state machine. Configure the state machine to invoke the Lambda function execution role at a specified interval by using a Wait state. Set the interval to 15 minutes.
   • DProvision a small Amazon EC2 instance. Set up a cron job that invokes the Lambda function every 15 minutes.

   Show answer

   Answer: A

   Explanation

   option A is the most efficient and least development effort option for invoking the Lambda function every 15 minutes, as it leverages Amazon EventBridge's built-in scheduling capabilities and is fully serverless.

   Source: Adapted from community discussion — LemonGremlin

   Next question

3. Question 163 · 548 in bank

   A company deploys a photo-processing application to an Amazon EC2 instance. The application needs to process each photo in less than 5 seconds. If processing takes longer than 5 seconds, the company’s development team must receive a notification. How can a developer implement the required time measurement and notification with the LEAST operational overhead?

   • ACreate an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that is based on a static threshold of 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.
   • BCreate an Amazon Simple Queue Service (Amazon SQS) queue. Each time a photo is processed, publish the processing time to the queue. Create an application to consume from the queue and to determine whether any values are more than 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.
   • CCreate an Amazon CloudWatch custom metric. Each time a photo is processed, publish the processing time as a metric value. Create a CloudWatch alarm that enters ALARM state if the average of values is greater than 5 seconds. Notify the development team by sending an Amazon Simple Email Service (Amazon SES) message.
   • DCreate an Amazon Kinesis data stream. Each time a photo is processed, publish the processing time to the data stream. Create an Amazon CloudWatch alarm that enters ALARM state if any values are more than 5 seconds. Notify the development team by using an Amazon Simple Notification Service (Amazon SNS) topic.

   Show answer

   Answer: A

   Explanation

   This approach directly leverages AWS services for monitoring and notification with minimal setup and maintenance. CloudWatch custom metrics can be used to track the processing time for each photo. A CloudWatch alarm can then be configured to trigger when any metric value exceeds the threshold of 5 seconds, sending a notification to the development team via an SNS topic.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

4. Question 164 · 548 in bank

   Select 2

   A company is using AWS Elastic Beanstalk to manage web applications that are running on Amazon EC2 instances. A developer needs to make configuration changes. The developer must deploy the changes to new instances only. Which types of deployment can the developer use to meet this requirement? (Choose two.)

   • AAll at once
   • BImmutable
   • CRolling
   • DBlue/green
   • ERolling with additional batch

   Show answer

   Answer: BD

   Explanation

   B. Immutable: In an immutable deployment, AWS Elastic Beanstalk deploys the application version to a fresh group of instances in a new Auto Scaling group. Once the new instances pass health checks, they are moved to the existing Auto Scaling group, and the old instances are terminated. This approach ensures that new instances are used for the deployment, minimizing the impact on the existing environment. D. Blue/Green: Blue/green deployment involves deploying the new version of the application to a separate environment (the "green" environment). Once the new environment is ready and tested, the traffic is switched from the old environment (the "blue" environment) to the new one. This type of deployment is effective for ensuring that the new version is deployed on new instances and provides a straightforward way to rollback if needed.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

5. Question 165 · 548 in bank

   A developer needs to use Amazon DynamoDB to store customer orders. The developer’s company requires all customer data to be encrypted at rest with a key that the company generates. What should the developer do to meet these requirements?

   • ACreate the DynamoDB table with encryption set to None. Code the application to use the key to decrypt the data when the application reads from the table. Code the application to use the key to encrypt the data when the application writes to the table.
   • BStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS customer managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.
   • CStore the key by using AWS Key Management Service (AWS KMS). Create the DynamoDB table with default encryption. Include the kms:Encrypt parameter with the Amazon Resource Name (ARN) of the AWS KMS key when using the DynamoDB software development kit (SDK).
   • DStore the key by using AWS Key Management Service (AWS KMS). Choose an AWS KMS AWS managed key during creation of the DynamoDB table. Provide the Amazon Resource Name (ARN) of the AWS KMS key.

   Show answer

   Answer: B

   Explanation

   This option allows the developer to use a customer-managed key in AWS KMS for encryption at rest in DynamoDB. The customer-managed key offers more flexibility and control over the key management compared to AWS managed keys. When creating the DynamoDB table, the developer can specify the KMS key to be used for encryption.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

6. Question 166 · 548 in bank

   A company is migrating an on-premises database to Amazon RDS for MySQL. The company has read-heavy workloads. The company wants to refactor the code to achieve optimum read performance for queries. Which solution will meet this requirement with LEAST current and future effort?

   • AUse a multi-AZ Amazon RDS deployment. Increase the number of connections that the code makes to the database or increase the connection pool size if a connection pool is in use.
   • BUse a multi-AZ Amazon RDS deployment. Modify the code so that queries access the secondary RDS instance.
   • CDeploy Amazon RDS with one or more read replicas. Modify the application code so that queries use the URL for the read replicas.
   • DUse open source replication software to create a copy of the MySQL database on an Amazon EC2 instance. Modify the application code so that queries use the IP address of the EC2 instance.

   Show answer

   Answer: C

   Explanation

   keyword: read-heavy workloads, LEAST current and future effort ==> discard A, B: multiAZ, just only make high availibity, option A: it make you can handler bigger cocurency request, option B you can access to secondary RDS in normal case by modifying code. Both are not help for 'read-heavy workloads' ==> discard D: take time to execute, maintain, ... when use not-intergated source, violate 'LEAST current and future effort' C is best choice

   Source: Adapted from community discussion — trieudo

   References

   • AWS documentation

   Next question

7. Question 167 · 548 in bank

   A company uses AWS CloudFormation to deploy an application that uses an Amazon API Gateway REST API with AWS Lambda function integration. The application uses Amazon DynamoDB for data persistence. The application has three stages: development, testing, and production. Each stage uses its own DynamoDB table. The company has encountered unexpected issues when promoting changes to the production stage. The changes were successful in the development and testing stages. A developer needs to route 20% of the traffic to the new production stage API with the next production release. The developer needs to route the remaining 80% of the traffic to the existing production stage. The solution must minimize the number of errors that any single customer experiences. Which approach should the developer take to meet these requirements?

   • AUpdate 20% of the planned changes to the production stage. Deploy the new production stage. Monitor the results. Repeat this process five times to test all planned changes.
   • BUpdate the Amazon Route 53 DNS record entry for the production stage API to use a weighted routing policy. Set the weight to a value of 80. Add a second record for the production domain name. Change the second routing policy to a weighted routing policy. Set the weight of the second policy to a value of 20. Change the alias of the second policy to use the testing stage API.
   • CDeploy an Application Load Balancer (ALB) in front of the REST API. Change the production API Amazon Route 53 record to point traffic to the ALB. Register the production and testing stages as targets of the ALB with weights of 80% and 20%, respectively.
   • DConfigure canary settings for the production stage API. Change the percentage of traffic directed to canary deployment to 20%. Make the planned updates to the production stage. Deploy the changes

   Show answer

   Answer: D

   Explanation

   Amazon API Gateway supports canary release deployments, which are specifically designed for this type of scenario. By configuring canary settings, the developer can gradually roll out changes to a small percentage of users (20% in this case) while still serving the majority of users (80%) with the current production stage. This approach helps in minimizing the impact of potential issues with new deployments.

   Source: Adapted from community discussion — SerialiDr

   Next question

8. Question 168 · 548 in bank

   A developer has created a data collection application that uses Amazon API Gateway, AWS Lambda, and Amazon S3. The application’s users periodically upload data files and wait for the validation status to be reflected on a processing dashboard. The validation process is complex and time-consuming for large files. Some users are uploading dozens of large files and have to wait and refresh the processing dashboard to see if the files have been validated. The developer must refactor the application to immediately update the validation result on the user’s dashboard without reloading the full dashboard. What is the MOST operationally efficient solution that meets these requirements?

   • AIntegrate the client with an API Gateway WebSocket API. Save the user-uploaded files with the WebSocket connection ID. Push the validation status to the connection ID when the processing is complete to initiate an update of the user interface.
   • BLaunch an Amazon EC2 micro instance, and set up a WebSocket server. Send the user-uploaded file and user detail to the EC2 instance after the user uploads the file. Use the WebSocket server to send updates to the user interface when the uploaded file is processed.
   • CSave the user’s email address along with the user-uploaded file. When the validation process is complete, send an email notification through Amazon Simple Notification Service (Amazon SNS) to the user who uploaded the file.
   • DSave the user-uploaded file and user detail to Amazon DynamoDB. Use Amazon DynamoDB Streams with Amazon Simple Notification Service (Amazon SNS) push notifications to send updates to the browser to update the user interface.

   Show answer

   Answer: A

   Explanation

   Option B involves setting up a WebSocket server on an EC2 instance, which is more manual and may require additional management overhead. Option C relies on email notifications, which might introduce delays and may not provide the desired real-time updates. Option D involves DynamoDB and SNS, which may add complexity without the direct support for real-time updates that WebSocket provides. So, Option A

   Source: Adapted from community discussion — PrakashM14

   References

   • AWS documentation

   Next question

9. Question 169 · 548 in bank

   A company’s developer is creating an application that uses Amazon API Gateway. The company wants to ensure that only users in the Sales department can use the application. The users authenticate to the application by using federated credentials from a third-party identity provider (IdP) through Amazon Cognito. The developer has set up an attribute mapping to map an attribute that is named Department and to pass the attribute to a custom AWS Lambda authorizer. To test the access limitation, the developer sets their department to Engineering in the IdP and attempts to log in to the application. The developer is denied access. The developer then updates their department to Sales in the IdP and attempts to log in. Again, the developer is denied access. The developer checks the logs and discovers that access is being denied because the developer’s access token has a department value of Engineering. Which of the following is a possible reason that the developer’s department is still being reported as Engineering instead of Sales?

   • AAuthorization caching is enabled in the custom Lambda authorizer.
   • BAuthorization caching is enabled on the Amazon Cognito user pool.
   • CThe IAM role for the custom Lambda authorizer does not have a Department tag.
   • DThe IAM role for the Amazon Cognito user pool does not have a Department tag.

   Show answer

   Answer: A

   Explanation

   When authorization caching is enabled in a custom Lambda authorizer, the authorizer can cache the policy associated with an access token. This caching is designed to improve performance by reducing the number of calls to the Lambda function. However, it can also lead to outdated authorization information being used if the user's attributes change in the identity provider (IdP) but the cached policy in the Lambda authorizer is still based on the old attributes. In this case, when the developer initially logged in with the department set to Engineering, the custom Lambda authorizer created and cached a policy based on this information. Subsequently, even after the developer updated their department to Sales in the IdP, the cached policy (which still reflects the Engineering department) was used, leading to the access denial.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 170 · 548 in bank

    A company has migrated an application to Amazon EC2 instances. Automatic scaling is working well for the application user interface. However, the process to deliver shipping requests to the company’s warehouse staff is encountering issues. Duplicate shipping requests are arriving, and some requests are lost or arrive out of order. The company must avoid duplicate shipping requests and must process the requests in the order that the requests arrive. Requests are never more than 250 KB in size and take 5-10 minutes to process. A developer needs to rearchitect the application to improve the reliability of the delivery and processing of the requests. What should the developer do to meet these requirements?

    • ACreate an Amazon Kinesis Data Firehose delivery stream to process the requests. Create an Amazon Kinesis data stream. Modify the application to write the requests to the Kinesis data stream.
    • BCreate an AWS Lambda function to process the requests. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the Lambda function to the SNS topic. Modify the application to write the requests to the SNS topic.
    • CCreate an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) standard queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the requests to the SQS queue.
    • DCreate an AWS Lambda function to process the requests. Create an Amazon Simple Queue Service (Amazon SQS) FIFO queue. Set the SQS queue as an event source for the Lambda function. Modify the application to write the requests to the SQS queue.

    Show answer

    Answer: D

    Explanation

    Amazon SQS FIFO (First-In-First-Out) queues are designed to ensure that messages are processed exactly once and in the exact order that they are sent. This characteristic makes FIFO queues suitable for scenarios where order and uniqueness are critical. By integrating the FIFO queue with an AWS Lambda function, the developer can automate the processing of the shipping requests as they arrive in the queue.

    Source: Adapted from community discussion — SerialiDr

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 161. 548 questions available.