DVA-C02 practice questions 201–210

1. Question 201 · 548 in bank

   A developer creates a static website for their department. The developer deploys the static assets for the website to an Amazon S3 bucket and serves the assets with Amazon CloudFront. The developer uses origin access control (OAC) on the CloudFront distribution to access the S3 bucket. The developer notices users can access the root URL and specific pages but cannot access directories without specifying a file name. For example, /products/index.html works, but /products/ returns an error. The developer needs to enable accessing directories without specifying a file name without exposing the S3 bucket publicly. Which solution will meet these requirements?

   • AUpdate the CloudFront distribution's settings to index.html as the default root object is set.
   • BUpdate the Amazon S3 bucket settings and enable static website hosting. Specify index.html as the Index document. Update the S3 bucket policy to enable access. Update the CloudFront distribution's origin to use the S3 website endpoint.
   • CCreate a CloudFront function that examines the request URL and appends index.html when directories are being accessed. Add the function as a viewer request CloudFront function to the CloudFront distribution's behavior.
   • DCreate a custom error response on the CloudFront distribution with the HTTP error code set to the HTTP 404 Not Found response code and the response page path to /index.html. Set the HTTP response code to the HTTP 200 OK response code.

   Show answer

   Answer: C

   Explanation

   This solution allows for the dynamic handling of requests to directories by automatically appending index.html to the path when a directory is requested. This approach does not require exposing the S3 bucket publicly or modifying S3 bucket settings for static website hosting. It leverages CloudFront's capabilities to manipulate the request at the edge location before it reaches the origin, ensuring that users can access directories without specifying a file name in the most secure and efficient manner.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

2. Question 202 · 548 in bank

   A developer is testing a RESTful application that is deployed by using Amazon API Gateway and AWS Lambda. When the developer tests the user login by using credentials that are not valid, the developer receives an HTTP 405: METHOD_NOT_ALLOWED error. The developer has verified that the test is sending the correct request for the resource. Which HTTP error should the application return in response to the request?

   • AHTTP 401
   • BHTTP 404
   • CHTTP 503
   • DHTTP 505

   Show answer

   Answer: A

   Explanation

   C. HTTP 503: Service Unavailable - This status code indicates that the server is not ready to handle the request. It is usually a temporary state, often due to maintenance or overloading. D. HTTP 505: HTTP Version Not Supported - This status code means that the server does not support the HTTP protocol version used in the request. It is a rare occurrence and typically indicates that the client is using an outdated or unsupported version of HTTP.

   Source: Adapted from community discussion — CrescentShared

   References

   • AWS documentation

   Next question

3. Question 203 · 548 in bank

   A developer must use multi-factor authentication (MFA) to access data in an Amazon S3 bucket that is in another AWS account. Which AWS Security Token Service (AWS STS) API operation should the developer use with the MFA information to meet this requirement?

   • AAssumeRoleWithWebIdentity
   • BGetFederationToken
   • CAssumeRoleWithSAML
   • DAssumeRole

   Show answer

   Answer: D

   Explanation

   Using MFA with AssumeRole (Optional) You can include multi-factor authentication (MFA) information when you call AssumeRole. This is useful for cross-account scenarios to ensure that the user that assumes the role has been authenticated with an AWS MFA device. In that scenario, the trust policy of the role being assumed includes a condition that tests for MFA authentication. If the caller does not include valid MFA information, the request to assume the role is denied.

   Source: Adapted from community discussion — Abdullah22

   References

   • AWS documentation

   Next question

4. Question 204 · 548 in bank

   Select 2

   A developer designed an application on an Amazon EC2 instance. The application makes API requests to objects in an Amazon S3 bucket. Which combination of steps will ensure that the application makes the API requests in the MOST secure manner? (Choose two.)

   • ACreate an IAM user that has permissions to the S3 bucket. Add the user to an IAM group.
   • BCreate an IAM role that has permissions to the S3 bucket.
   • CAdd the IAM role to an instance profile. Attach the instance profile to the EC2 instance.
   • DCreate an IAM role that has permissions to the S3 bucket. Assign the role to an IAM group.
   • EStore the credentials of the IAM user in the environment variables on the EC2 instance.

   Show answer

   Answer: BC

   Explanation

   Option B (Amazon S3 Static Website Hosting): Enable static website hosting on the S3 bucket. Specify index.html as the Index document. Update the S3 bucket policy to allow access. Configure the CloudFront distribution’s origin to use the S3 website endpoint. Pros: Handles both root and subdirectories. Keeps the S3 bucket private. Cons: Requires S3 bucket policy adjustments. Verdict: Recommended solution. Option C (CloudFront Function for Directory Indexes): Create a CloudFront function that appends index.html to request URLs for directories. Add this function as a viewer request CloudFront function. Pros: Customizable behavior. Works for subdirectories. Cons: Adds complexity. Verdict: Suitable if you need custom logic

   Source: Adapted from community discussion — Saurabh04

   Next question

5. Question 205 · 548 in bank

   An AWS Lambda function requires read access to an Amazon S3 bucket and requires read/write access to an Amazon DynamoDB table. The correct IAM policy already exists. What is the MOST secure way to grant the Lambda function access to the S3 bucket and the DynamoDB table?

   • AAttach the existing IAM policy to the Lambda function.
   • BCreate an IAM role for the Lambda function. Attach the existing IAM policy to the role. Attach the role to the Lambda function.
   • CCreate an IAM user with programmatic access. Attach the existing IAM policy to the user. Add the user access key ID and secret access key as environment variables in the Lambda function.
   • DAdd the AWS account root user access key ID and secret access key as encrypted environment variables in the Lambda function.

   Show answer

   Answer: B

   Next question

6. Question 206 · 548 in bank

   A developer is using AWS Step Functions to automate a workflow. The workflow defines each step as an AWS Lambda function task. The developer notices that runs of the Step Functions state machine fail in the GetResource task with either an IllegalArgumentException error or a TooManyRequestsException error. The developer wants the state machine to stop running when the state machine encounters an IllegalArgumentException error. The state machine needs to retry the GetResource task one additional time after 10 seconds if the state machine encounters a TooManyRequestsException error. If the second attempt fails, the developer wants the state machine to stop running. How can the developer implement the Lambda retry functionality without adding unnecessary complexity to the state machine?

   • AAdd a Delay task after the GetResource task. Add a catcher to the GetResource task. Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be the Delay task. Configure the Delay task to wait for an interval of 10 seconds. Configure the next step to be the GetResource task.
   • BAdd a catcher to the GetResource task. Configure the catcher with an error type of TooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of 1. Configure the next step to be the GetResource task.
   • CAdd a retrier to the GetResource task. Configure the retrier with an error type of TooManyRequestsException, an interval of 10 seconds, and a maximum attempts value of 1.
   • DDuplicate the GetResource task. Rename the new GetResource task to TryAgain. Add a catcher to the original GetResource task. Configure the catcher with an error type of TooManyRequestsException. Configure the next step to be TryAgain.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

7. Question 207 · 548 in bank

   A developer is creating a serverless application that uses an AWS Lambda function. The developer will use AWS CloudFormation to deploy the application. The application will write logs to Amazon CloudWatch Logs. The developer has created a log group in a CloudFormation template for the application to use. The developer needs to modify the CloudFormation template to make the name of the log group available to the application at runtime. Which solution will meet this requirement?

   • AUse the AWS::Include transform in CloudFormation to provide the log group's name to the application.
   • BPass the log group's name to the application in the user data section of the CloudFormation template.
   • CUse the CloudFormation template's Mappings section to specify the log group's name for the application.
   • DPass the log group's Amazon Resource Name (ARN) as an environment variable to the Lambda function.

   Show answer

   Answer: D

   Explanation

   Explanation of why other options are less suitable: A. AWS::Include transform: While the AWS::Include transform allows importing values from other templates, it's generally used for larger configurations and not ideal for this specific purpose of passing a single value to the application. B. User data: The user data section in CloudFormation is typically used for one-time configuration scripts and not intended for passing sensitive information like log group names or ARNs, raising security concerns. C. CloudFormation Mappings: While mappings can store key-value pairs within the template, they are not directly accessible as environment variables within the application code.

   Source: Adapted from community discussion — Abdullah22

   Next question

8. Question 208 · 548 in bank

   A developer is creating an Amazon DynamoDB table by using the AWS CLI. The DynamoDB table must use server-side encryption with an AWS owned encryption key. How should the developer create the DynamoDB table to meet these requirements?

   • ACreate an AWS Key Management Service (AWS KMS) customer managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
   • BCreate an AWS Key Management Service (AWS KMS) AWS managed key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
   • CCreate an AWS owned key. Provide the key's Amazon Resource Name (ARN) in the KMSMasterKeyId parameter during creation of the DynamoDB table.
   • DCreate the DynamoDB table with the default encryption options.

   Show answer

   Answer: D

   Explanation

   When creating a DynamoDB table, if no specific encryption options are provided, it uses the default encryption setting which is server-side encryption with AWS managed keys (SSE with AWS owned key). This option does not require specifying a key ARN in the creation process, making it the simplest and most straightforward way to ensure data at rest is encrypted using keys managed by AWS.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

9. Question 209 · 548 in bank

   A company has an application that runs across multiple AWS Regions. The application is experiencing performance issues at irregular intervals. A developer must use AWS X-Ray to implement distributed tracing for the application to troubleshoot the root cause of the performance issues. What should the developer do to meet this requirement?

   • AUse the X-Ray console to add annotations for AWS services and user-defined services.
   • BUse Region annotation that X-Ray adds automatically for AWS services. Add Region annotation for user-defined services.
   • CUse the X-Ray daemon to add annotations for AWS services and user-defined services.
   • DUse Region annotation that X-Ray adds automatically for user-defined services. Configure X-Ray to add Region annotation for AWS services.

   Show answer

   Answer: B

   Explanation

   User-defined services: Developed by users: These services are applications, microservices, or any software components specifically built and deployed by the user or organization using AWS. They can be written in any programming language and deployed on various platforms, including EC2 instances, Lambda functions, or containers on platforms like Amazon ECS or EKS.

   Source: Adapted from community discussion — Abdullah22

   References

   • AWS documentation

   Next question

10. Question 210 · 548 in bank

    Select 2

    An application is processing clickstream data using Amazon Kinesis. The clickstream data feed into Kinesis experiences periodic spikes. The PutRecords API call occasionally fails and the logs show that the failed call returns the response shown below:

    

    Which techniques will help mitigate this exception? (Choose two.)

    • AImplement retries with exponential backoff.
    • BUse a PutRecord API instead of PutRecords.
    • CReduce the frequency and/or size of the requests.
    • DUse Amazon SNS instead of Kinesis.
    • EReduce the number of KCL consumers.

    Show answer

    Answer: AC

    Explanation

    100% AC as per AWS : ProvisionedThroughputExceededException The request rate for the stream is too high, or the requested data is too large for the available throughput. Reduce the frequency or size of your requests. For more information, see Streams Limits in the Amazon Kinesis Data Streams Developer Guide, and Error Retries and Exponential Backoff in AWS in the AWS General Reference. https://docs.aws.amazon.com/kinesis/latest/APIReference/API_PutRecords.html

    Source: Adapted from community discussion — eboehm2

    References

    • AWS documentation
    • repost.aws documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 201. 548 questions available.