DVA-C02 practice questions 11–20

1. Question 11 · 548 in bank

   A developer is updating several AWS Lambda functions and notices that all the Lambda functions share the same custom libraries. The developer wants to centralize all the libraries, update the libraries in a convenient way, and keep the libraries versioned. Which solution will meet these requirements with the LEAST development effort?

   • ACreate an AWS CodeArtifact repository that contains all the custom libraries.
   • BCreate a custom container image for the Lambda functions to save all the custom libraries.
   • CCreate a Lambda layer that contains all the custom libraries.
   • DCreate an Amazon Elastic File System (Amazon EFS) file system to store all the custom libraries.

   Show answer

   Answer: C

   Explanation

   the most efficient solution is to use a Lambda layer to store the common libraries, update them in one place, and reference them from each Lambda function that requires them.

   Source: Adapted from community discussion — MrTee

   Next question

2. Question 12 · 548 in bank

   A developer wants to use AWS Elastic Beanstalk to test a new version of an application in a test environment. Which deployment method offers the FASTEST deployment?

   • AImmutable
   • BRolling
   • CRolling with additional batch
   • DAll at once

   Show answer

   Answer: D

   Explanation

   The "All at once" deployment method deploys the new version of the application to all instances simultaneously. It updates all instances of the environment in a short period of time, resulting in the fastest overall deployment.

   Source: Adapted from community discussion — loctong

   References

   • AWS documentation

   Next question

3. Question 13 · 548 in bank

   A company is migrating legacy internal applications to AWS. Leadership wants to rewrite the internal employee directory to use native AWS services. A developer needs to create a solution for storing employee contact details and high-resolution photos for use with the new application. Which solution will enable the search and retrieval of each employee's individual details and high-resolution photos using AWS APIs?

   • AEncode each employee's contact information and photos using Base64. Store the information in an Amazon DynamoDB table using a sort key.
   • BStore each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3.
   • CUse Amazon Cognito user pools to implement the employee directory in a fully managed software-as-a-service (SaaS) method.
   • DStore employee contact information in an Amazon RDS DB instance with the photos stored in Amazon Elastic File System (Amazon EFS).

   Show answer

   Answer: B

   Explanation

   B. Store each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3. Storing each employee's contact information in an Amazon DynamoDB table along with the object keys for the photos stored in Amazon S3 provides a scalable and efficient solution for storing and retrieving employee details and high-resolution photos using AWS APIs. The developer can use the DynamoDB table to query and retrieve employee details, while the S3 bucket can be used to store the high-resolution photos. By using S3, the solution can support large amounts of data while enabling fast retrieval times. The combination of DynamoDB and S3 can provide a cost-effective and scalable solution for storing employee data and photos.

   Source: Adapted from community discussion — Bibay

   Next question

4. Question 14 · 548 in bank

   A company is providing read access to objects in an Amazon S3 bucket for different customers. The company uses IAM permissions to restrict access to the S3 bucket. The customers can access only their own files. Due to a regulation requirement, the company needs to enforce encryption in transit for interactions with Amazon S3. Which solution will meet these requirements?

   • AAdd a bucket policy to the S3 bucket to deny S3 actions when the aws:SecureTransport condition is equal to false.
   • BAdd a bucket policy to the S3 bucket to deny S3 actions when the s3:x-amz-acl condition is equal to public-read.
   • CAdd an IAM policy to the IAM users to enforce the usage of the AWS SDK.
   • DAdd an IAM policy to the IAM users that allows S3 actions when the s3:x-amz-acl condition is equal to bucket-owner-read.

   Show answer

   Answer: A

   Explanation

   This solution enforces encryption in transit for interactions with Amazon S3 by denying access to the S3 bucket if the request is not made over an HTTPS connection. This condition can be enforced by using the "aws:SecureTransport" condition key in a bucket policy.

   Source: Adapted from community discussion — MrTee

   References

   • repost.aws documentation

   Next question

5. Question 15 · 548 in bank

   A company has an image storage web application that runs on AWS. The company hosts the application on Amazon EC2 instances in an Auto Scaling group. The Auto Scaling group acts as the target group for an Application Load Balancer (ALB) and uses an Amazon S3 bucket to store the images for sale. The company wants to develop a feature to test system requests. The feature will direct requests to a separate target group that hosts a new beta version of the application. Which solution will meet this requirement with the LEAST effort?

   • ACreate a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Update the test system code to use this cookie to test the beta version of the application.
   • BCreate a new ALB, Auto Scaling group, and target group for the beta version of the application. Configure an alternate Amazon Route 53 record for the new ALB endpoint. Use the alternate Route 53 endpoint in the test system requests to test the beta version of the application.
   • CCreate a new ALB, Auto Scaling group, and target group for the beta version of the application. Use Amazon CloudFront with Lambda@Edge to determine which specific request will go to the new ALB. Use the CloudFront endpoint to send the test system requests to test the beta version of the application.
   • DCreate a new Auto Scaling group and target group for the beta version of the application. Update the ALB routing rule with a condition that looks for a cookie named version that has a value of beta. Use Amazon CloudFront with Lambda@Edge to update the test system requests to add the required cookie when the requests go to the ALB.

   Show answer

   Answer: A

   Explanation

   This solution will allow the company to direct requests to a separate target group that hosts the new beta version of the application without having to create a new ALB or use additional services such as Amazon Route 53 or Amazon CloudFront. Option D adds additional complexity and effort compared to option A, which simply involves updating the ALB routing rule with a condition that looks for a cookie named version that has a value of beta and updating the test system code to use this cookie to test the beta version of the application.

   Source: Adapted from community discussion — MrTee

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 16 · 548 in bank

   Select 2

   A team is developing an application that is deployed on Amazon EC2 instances. During testing, the team receives an error. The EC2 instances are unable to access an Amazon S3 bucket. Which steps should the team take to troubleshoot this issue? (Choose two.)

   • ACheck whether the policy that is assigned to the IAM role that is attached to the EC2 instances grants access to Amazon S3.
   • BCheck the S3 bucket policy to validate the access permissions for the S3 bucket.
   • CCheck whether the policy that is assigned to the IAM user that is attached to the EC2 instances grants access to Amazon S3.
   • DCheck the S3 Lifecycle policy to validate the permissions that are assigned to the S3 bucket.
   • ECheck the security groups that are assigned to the EC2 instances. Make sure that a rule is not blocking the access to Amazon S3.

   Show answer

   Answer: AB

   Explanation

   Option A is correct because IAM roles are used to grant permissions to AWS services, such as EC2 instances, to access other AWS services, such as S3 buckets. The policy assigned to the IAM role attached to the EC2 instances should be checked to ensure that it grants access to the S3 bucket. Option B is also correct because the S3 bucket policy controls access to the S3 bucket. The S3 bucket policy should be checked to ensure that the access permissions are correctly configured.

   Source: Adapted from community discussion — MrTee

   References

   • repost.aws documentation

   Next question

7. Question 17 · 548 in bank

   A developer is working on an ecommerce website. The developer wants to review server logs without logging in to each of the application servers individually. The website runs on multiple Amazon EC2 instances, is written in Python, and needs to be highly available. How can the developer update the application to meet these requirements with MINIMUM changes?

   • ARewrite the application to be cloud native and to run on AWS Lambda, where the logs can be reviewed in Amazon CloudWatch.
   • BSet up centralized logging by using Amazon OpenSearch Service, Logstash, and OpenSearch Dashboards.
   • CScale down the application to one larger EC2 instance where only one instance is recording logs.
   • DInstall the unified Amazon CloudWatch agent on the EC2 instances. Configure the agent to push the application logs to CloudWatch.

   Show answer

   Answer: D

   Explanation

   D. Install the unified Amazon CloudWatch agent on the EC2 instances. Configure the agent to push the application logs to CloudWatch: This is the most appropriate solution. The unified CloudWatch agent can be easily installed and configured on each EC2 instance to push logs to Amazon CloudWatch. This allows for centralized log storage and access without a significant change to the application architecture or its high availability setup. It provides a straightforward way to aggregate logs from multiple instances in one place.

   Source: Adapted from community discussion — SerialiDr

   Next question

8. Question 18 · 548 in bank

   Select 2

   A company is creating an application that processes .csv files from Amazon S3. A developer has created an S3 bucket. The developer has also created an AWS Lambda function to process the .csv files from the S3 bucket. Which combination of steps will invoke the Lambda function when a .csv file is uploaded to Amazon S3? (Choose two.)

   • ACreate an Amazon EventBridge rule. Configure the rule with a pattern to match the S3 object created event.
   • BSchedule an Amazon EventBridge rule to run a new Lambda function to scan the S3 bucket.
   • CAdd a trigger to the existing Lambda function. Set the trigger type to EventBridge. Select the Amazon EventBridge rule.
   • DCreate a new Lambda function to scan the S3 bucket for recently added S3 objects.
   • EAdd S3 Lifecycle rules to invoke the existing Lambda function.

   Show answer

   Answer: AC

   Explanation

   Option A is correct because an Amazon EventBridge rule can be created to detect when an object is created in an S3 bucket. The rule should be configured with a pattern to match the S3 object created event. Option C is correct because the existing Lambda function can be updated with an EventBridge trigger. The trigger type should be set to EventBridge, and the Amazon EventBridge rule created in step A should be selected.

   Source: Adapted from community discussion — MrTee

   Next question

9. Question 19 · 548 in bank

   A developer needs to build an AWS CloudFormation template that self-populates the AWS Region variable that deploys the CloudFormation template. What is the MOST operationally efficient way to determine the Region in which the template is being deployed?

   • AUse the AWS::Region pseudo parameter.
   • BRequire the Region as a CloudFormation parameter.
   • CFind the Region from the AWS::StackId pseudo parameter by using the Fn::Split intrinsic function.
   • DDynamically import the Region by referencing the relevant parameter in AWS Systems Manager Parameter Store.

   Show answer

   Answer: A

   Explanation

   https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/mappings-section-structure.html AWS::Region is a pseudo parameter that automatically provides the Region where the stack is being deployed (e.g., us-east-1 if deploying in the US East Region). B) Eliminated - Adding a parameter for the Region means users would need to manually specify the Region every time they deploy the template C) Eliminated - While the stack ID contains the Region as part of its value (e.g., arn:aws:cloudformation:us-east-1:123456789012:stack/MyStack/...), extracting it with Fn::Split is a complicated workaround. D) Eliminated

   Source: Adapted from community discussion — sumanshu

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 20 · 548 in bank

    A company has hundreds of AWS Lambda functions that the company's QA team needs to test by using the Lambda function URLs. A developer needs to configure the authentication of the Lambda functions to allow access so that the QA IAM group can invoke the Lambda functions by using the public URLs. Which solution will meet these requirements?

    • ACreate a CLI script that loops on the Lambda functions to add a Lambda function URL with the AWS_IAM auth type. Run another script to create an IAM identity-based policy that allows the lambda:InvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). Attach the policy to the QA IAM group.
    • BCreate a CLI script that loops on the Lambda functions to add a Lambda function URL with the NONE auth type. Run another script to create an IAM resource-based policy that allows the lambda:InvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). Attach the policy to the QA IAM group.
    • CCreate a CLI script that loops on the Lambda functions to add a Lambda function URL with the AWS_IAM auth type. Run another script to loop on the Lambda functions to create an IAM identity-based policy that allows the lambda:InvokeFunctionUrl action from the QA IAM group's Amazon Resource Name (ARN).
    • DCreate a CLI script that loops on the Lambda functions to add a Lambda function URL with the NONE auth type. Run another script to loop on the Lambda functions to create an IAM resource-based policy that allows the lambda:InvokeFunctionUrl action from the QA IAM group's Amazon Resource Name (ARN).

    Show answer

    Answer: A

    Explanation

    pay attention to the wording of the answers: A - Run another script to create an IAM identity-based policy that allows the lambda:InvokeFunctionUrl action to all the Lambda function Amazon Resource Names (ARNs). *This option is very clear. You are creating an IAM identity based policy allowing access to invoke the function and then attaching this policy to the QA IAM group. C - Run another script to loop on the Lambda functions to create an IAM identity-based policy that allows the lambda:InvokeFunctionUrl action from the QA IAM group's Amazon Resource Name (ARN). *What does "Run another script to loop on the Lambda functions" What does this even mean?? are we doing some sort of while loop here? Wording for this option is very confusing and makes no sense to me. I go with A

    Source: Adapted from community discussion — [Removed]

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 11. 548 questions available.