DVA-C02 practice questions 181–190

1. Question 181 · 548 in bank

   A developer manages three AWS accounts. Each account contains an Amazon RDS DB instance in a private subnet. The developer needs to define users in each database in a consistent way. The developer must ensure that the same users are created and updated later in all three accounts. Which solution will meet these requirements with the MOST operational efficiency?

   • ACreate an AWS CloudFormation template. Declare the users in the template. Attach the users to the database. Deploy the template in each account.
   • BCreate an AWS CloudFormation template that contains a custom resource to create the users in the database. Deploy the template in each account.
   • CWrite a script that creates the users. Deploy an Amazon EC2 instance in each account to run the script on the databases. Run the script in each account.
   • DImplement an AWS Lambda function that creates the users in the database. Provide the function with the details of all three accounts.

   Show answer

   Answer: B

   Explanation

   CloudFormation itself does not natively manage database users within RDS. You would need a custom resource or some additional automation to create users within the RDS instance.

   Source: Adapted from community discussion — CrescentShared

   References

   • AWS documentation

   Next question

2. Question 182 · 548 in bank

   A company is building a new application that runs on AWS and uses Amazon API Gateway to expose APIs. Teams of developers are working on separate components of the application in parallel. The company wants to publish an API without an integrated backend so that teams that depend on the application backend can continue the development work before the API backend development is complete. Which solution will meet these requirements?

   • ACreate API Gateway resources and set the integration type value to MOCK. Configure the method integration request and integration response to associate a response with an HTTP status code. Create an API Gateway stage and deploy the API.
   • BCreate an AWS Lambda function that returns mocked responses and various HTTP status codes. Create API Gateway resources and set the integration type value to AWS_PROXY. Deploy the API.
   • CCreate an EC2 application that returns mocked HTTP responses. Create API Gateway resources and set the integration type value to AWS. Create an API Gateway stage and deploy the API.
   • DCreate API Gateway resources and set the integration type value set to HTTP_PROXY. Add mapping templates and deploy the API. Create an AWS Lambda layer that returns various HTTP status codes. Associate the Lambda layer with the API deployment.

   Show answer

   Answer: A

   Explanation

   Al crear recursos de API Gateway y establecer el tipo de integración en MOCK, se puede simular la respuesta de la API sin necesidad de un backend real. Esto permite que los equipos de desarrollo trabajen en paralelo en componentes separados de la aplicación y continúen el trabajo de desarrollo antes de que se complete el backend de la API.

   Source: Adapted from community discussion — ANDRES715

   Next question

3. Question 183 · 548 in bank

   An application that runs on AWS receives messages from an Amazon Simple Queue Service (Amazon SQS) queue and processes the messages in batches. The application sends the data to another SQS queue to be consumed by another legacy application. The legacy system can take up to 5 minutes to process some transaction data. A developer wants to ensure that there are no out-of-order updates in the legacy system. The developer cannot alter the behavior of the legacy system. Which solution will meet these requirements?

   • AUse an SQS FIFO queue. Configure the visibility timeout value.
   • BUse an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the DelaySeconds values.
   • CUse an SQS standard queue with a SendMessageBatchRequestEntry data type. Configure the visibility timeout value.
   • DUse an SQS FIFO queue. Configure the DelaySeconds value.

   Show answer

   Answer: A

   Explanation

   Al utilizar una cola SQS FIFO, se garantiza que los mensajes se procesen en el orden en que se reciben. Esto evita actualizaciones desordenadas en el sistema heredado y asegura la coherencia en el procesamiento de los datos de transacciones. Además, al configurar el valor del tiempo de espera de visibilidad, se puede controlar el tiempo durante el cual un mensaje permanece invisible para otros consumidores después de que un consumidor lo recibe. Esto permite que el sistema heredado tenga hasta 5 minutos para procesar algunos datos de transacciones antes de que estén disponibles para otros consumidores.

   Source: Adapted from community discussion — ANDRES715

   Next question

4. Question 184 · 548 in bank

   A company is building a compute-intensive application that will run on a fleet of Amazon EC2 instances. The application uses attached Amazon Elastic Block Store (Amazon EBS) volumes for storing data. The Amazon EBS volumes will be created at time of initial deployment. The application will process sensitive information. All of the data must be encrypted. The solution should not impact the application's performance. Which solution will meet these requirements?

   • AConfigure the fleet of EC2 instances to use encrypted EBS volumes to store data.
   • BConfigure the application to write all data to an encrypted Amazon S3 bucket.
   • CConfigure a custom encryption algorithm for the application that will encrypt and decrypt all data.
   • DConfigure an Amazon Machine Image (AMI) that has an encrypted root volume and store the data to ephemeral disks.

   Show answer

   Answer: A

   Explanation

   Option B is not ideal because writing all data to an S3 bucket would introduce network latency and might impact performance. By default, Amazon EBS volumes can only be attached to one EC2 instance at a time, and they cannot be mounted to multiple instances simultaneously. However, AWS does offer a feature called Amazon EBS Multi-Attach, which allows you to attach a Provisioned IOPS SSD (io1 or io2) EBS volume to up to 16 Nitro-based EC2 instances within the same Availability Zone. This feature is designed for applications that require concurrent access to the same data from multiple instances, such as clustered databases or parallel file systems.

   Source: Adapted from community discussion — CrescentShared

   Next question

5. Question 185 · 548 in bank

   A developer is updating the production version of an AWS Lambda function to fix a defect. The developer has tested the updated code in a test environment. The developer wants to slowly roll out the updates to a small subset of production users before rolling out the changes to all users. Only 10% of the users should be initially exposed to the new code in production. Which solution will meet these requirements?

   • AUpdate the Lambda code and create a new version of the Lambda function. Create a Lambda function trigger. Configure the traffic weights in the trigger between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
   • BCreate a new Lambda function that uses the updated code. Create a Lambda alias for the production Lambda function. Configure the Lambda alias to send 90% of the traffic to the production Lambda function, and send 10% of the traffic to the test Lambda function.
   • CUpdate the Lambda code and create a new version of the Lambda function. Create a Lambda proxy integration. Configure the Lambda proxy to split traffic between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.
   • DUpdate the Lambda code and create a new version of the Lambda function. Create a Lambda function alias. Configure the traffic weights in the Lambda alias between the two Lambda function versions. Send 90% of the traffic to the production version, and send 10% of the traffic to the new version.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

6. Question 186 · 548 in bank

   A developer is creating an AWS Lambda function that consumes messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The developer notices that the Lambda function processes some messages multiple times. How should developer resolve this issue MOST cost-effectively?

   • AChange the Amazon SQS standard queue to an Amazon SQS FIFO queue by using the Amazon SQS message deduplication ID.
   • BSet up a dead-letter queue.
   • CSet the maximum concurrency limit of the AWS Lambda function to 1.
   • DChange the message processing to use Amazon Kinesis Data Streams instead of Amazon SQS.

   Show answer

   Answer: A

   Explanation

   Given this, based on AWS best practices, changing the Amazon SQS standard queue to an Amazon SQS FIFO (First-In, First-Out) queue using the Amazon SQS message deduplication ID (Option A) is the most effective way to ensure messages are processed once and in the order they are sent. FIFO queues are designed to prevent duplicate processing and maintain the order of messages, which aligns with the requirement to resolve the issue of Lambda functions processing some messages multiple times.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

7. Question 187 · 548 in bank

   A developer is optimizing an AWS Lambda function and wants to test the changes in production on a small percentage of all traffic. The Lambda function serves requests to a RE ST API in Amazon API Gateway. The developer needs to deploy their changes and perform a test in production without changing the API Gateway URL. Which solution will meet these requirements?

   • ADefine a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish the API to the canary stage.
   • BDefine a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy a new API Gateway stage.
   • CDefine an alias on the $LATEST version of the Lambda function. Update the API Gateway endpoint to reference the new Lambda function alias. Upload and publish the optimized Lambda function code. On the production API Gateway stage, define a canary release and set the percentage of traffic to direct to the canary release. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Publish to the canary stage.
   • DDefine a function version for the currently deployed production Lambda function. Update the API Gateway endpoint to reference the new Lambda function version. Upload and publish the optimized Lambda function code. Update the API Gateway endpoint to use the $LATEST version of the Lambda function. Deploy the API to the production API Gateway stage.

   Show answer

   Answer: C

   Explanation

   Al definir un alias en la versión $LATEST de la función Lambda, el desarrollador puede referenciar este alias en el punto final de API Gateway. Luego, al cargar y publicar el código de función Lambda optimizado, se asegura de que la API Gateway haga referencia al nuevo alias de la función Lambda. Después, en la etapa de producción de API Gateway, se puede definir una versión canary y establecer el porcentaje de tráfico que se dirigirá a la versión canary. Esto permite probar los cambios en producción en un pequeño porcentaje del tráfico sin cambiar la URL de API Gateway.

   Source: Adapted from community discussion — ANDRES715

   Next question

8. Question 188 · 548 in bank

   A developer wants to expand an application to run in multiple AWS Regions. The developer wants to copy Amazon Machine Images (AMIs) with the latest changes and create a new application stack in the destination Region. According to company requirements, all AMIs must be encrypted in all Regions. However, not all the AMIs that the company uses are encrypted. How can the developer expand the application to run in the destination Region while meeting the encryption requirement?

   • ACreate new AMIs, and specify encryption parameters. Copy the encrypted AMIs to the destination Region. Delete the unencrypted AMIs.
   • BUse AWS Key Management Service (AWS KMS) to enable encryption on the unencrypted AMIs. Copy the encrypted AMIs to the destination Region.
   • CUse AWS Certificate Manager (ACM) to enable encryption on the unencrypted AMIs. Copy the encrypted AMIs to the destination Region.
   • DCopy the unencrypted AMIs to the destination Region. Enable encryption by default in the destination Region.

   Show answer

   Answer: A

   Explanation

   A. Create new AMIs, and specify encryption parameters. Copy the encrypted AMIs to the destination Region. Delete the unencrypted AMIs. The best solution for meeting the encryption requirement is to create new AMIs with encryption enabled and copy them to the destination Region. By default, when an AMI is copied to another Region, it is not encrypted in the destination Region even if it is encrypted in the source Region. Therefore, the developer must create new encrypted AMIs that can be used in the destination Region. Once the new encrypted AMIs have been created, they can be copied to the destination Region. The unencrypted AMIs can then be deleted to ensure that all instances running in all Regions are using only encrypted AMIs.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 189 · 548 in bank

   A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext. The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis. Which solution will meet these requirements MOST securely?

   • AUse AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.
   • BRetrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.
   • CStore the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.
   • DStore the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.

   Show answer

   Answer: C

   Next question

10. Question 190 · 548 in bank

    Select 2

    A company has an application that is hosted on Amazon EC2 instances. The application stores objects in an Amazon S3 bucket and allows users to download objects from the S3 bucket. A developer turns on S3 Block Public Access for the S3 bucket. After this change, users report errors when they attempt to download objects. The developer needs to implement a solution so that only users who are signed in to the application can access objects in the S3 bucket. Which combination of steps will meet these requirements in the MOST secure way? (Choose two.)

    • ACreate an EC2 instance profile and role with an appropriate policy. Associate the role with the EC2 instances.
    • BCreate an IAM user with an appropriate policy. Store the access key ID and secret access key on the EC2 instances.
    • CModify the application to use the S3 GeneratePresignedUrl API call.
    • DModify the application to use the S3 GetObject API call and to return the object handle to the user.
    • EModify the application to delegate requests to the S3 bucket.

    Show answer

    Answer: AC

    Explanation

    A. Creating an EC2 instance profile and role with an appropriate policy and associating the role with the EC2 instances follows the principle of least privilege. The EC2 instances will have temporary security credentials provided by the role, and the permissions granted to the role can be tightly controlled using IAM policies. This approach eliminates the need to manage and store long-term access keys on the EC2 instances, which can be a security risk. C. Using the S3 GeneratePresignedUrl API call allows the application to generate time-limited URLs that provide temporary access to objects in the S3 bucket. These pre-signed URLs can be generated for authenticated users, ensuring that only authorized users can access the objects. This approach ensures that the objects in the S3 bucket remain private and are not publicly accessible.

    Source: Adapted from community discussion — SerialiDr

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 181. 548 questions available.