DVA-C02 practice questions 221–230

1. Question 221 · 548 in bank

   An application is using Amazon Cognito user pools and identity pools for secure access. A developer wants to integrate the user-specific file upload and download features in the application with Amazon S3. The developer must ensure that the files are saved and retrieved in a secure manner and that users can access only their own files. The file sizes range from 3 KB to 300 MB. Which option will meet these requirements with the HIGHEST level of security?

   • AUse S3 Event Notifications to validate the file upload and download requests and update the user interface (UI).
   • BSave the details of the uploaded files in a separate Amazon DynamoDB table. Filter the list of files in the user interface (UI) by comparing the current user ID with the user ID associated with the file in the table.
   • CUse Amazon API Gateway and an AWS Lambda function to upload and download files. Validate each request in the Lambda function before performing the requested operation.
   • DUse an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.

   Show answer

   Answer: D

   Explanation

   Highest secure => discard A: S3 Event Notifications, it act on notify with event, not blocking risk => discard B: You can't handle by UI or BE code by User ID, but hacker can try to access directly into storage s3 => discard C: I would have said C but that is kind of a custom solution that is both more overhead and more prone to error D ==> The identity prefix in Amazon Cognito allows you to create a unique identity for each user. This prefix can be used as part of the IAM policy to control access at a more granular level.

   Source: Adapted from community discussion — trieudo

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 222 · 548 in bank

   A company has an application that uses Amazon Cognito user pools as an identity provider. The company must secure access to user records. The company has set up multi-factor authentication (MFA). The company also wants to send a login activity notification by email every time a user logs in. What is the MOST operationally efficient solution that meets this requirement?

   • ACreate an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon API Gateway API to invoke the function. Call the API from the client side when login confirmation is received.
   • BCreate an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function.
   • CCreate an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Create an Amazon CloudWatch Logs log subscription filter to invoke the function based on the login status.
   • DConfigure Amazon Cognito to stream all logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to process the streamed logs and to send the email notification based on the login status of each user.

   Show answer

   Answer: B

   Explanation

   B. Create an AWS Lambda function that uses Amazon Simple Email Service (Amazon SES) to send the email notification. Add an Amazon Cognito post authentication Lambda trigger for the function. The most operationally efficient solution for sending login activity notifications by email for Amazon Cognito user pools is to use a Lambda trigger that is automatically invoked by Amazon Cognito every time a user logs in. This eliminates the need for client-side calls to an API or log subscription filter. A Lambda function can be used to send email notifications using Amazon SES. Option B satisfies these requirements and is the most operationally efficient solution.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation

   Next question

3. Question 223 · 548 in bank

   A developer needs approval from a product owner before the developer can deploy code for an application to production. The developer uses AWS CodePipeline to deploy the application. The developer configures an Amazon Simple Notification Service (Amazon SNS) topic to send notifications to the product owner. Which solution is the MOST operationally efficient way for the developer to receive approval from the product owner?

   • AAdd a new stage to CodePipeline before the production deployment. Add a manual approval action to the new stage. Add a new notification rule in the pipeline settings. Specify manual approval as the event that initiates the notification. Specify the SNS topic's Amazon Resource Name (ARN) to notify the product owner.
   • BDevelop an AWS Step Functions state machine that sends a notification to the product owner and accepts an approval. Add a new stage to CodePipeline before the production deployment. Add the state machine as a Step Functions action to the new stage.
   • CAdd a manual approval action to the existing production deployment stage in CodePipeline. Specify the SNS topic's Amazon Resource Name (ARN) while configuring the new manual approval action.
   • DEdit the settings in CodePipeline. Create a new notification rule. Specify manual approval as the event that initiates the notification. Create a new notification target. Specify the SNS topic to notify the product owner. Save the notification rule.

   Show answer

   Answer: A

   Explanation

   This solution directly integrates a manual approval process into the CI/CD pipeline. By adding a specific stage for manual approval before the deployment can proceed to production, it ensures that no changes are deployed without explicit consent. The integration of Amazon SNS for notifications automates the communication process, informing the product owner when their input is needed. This setup not only enforces a governance check but also streamlines the approval process, making it both efficient and auditable.

   Source: Adapted from community discussion — SerialiDr

   Next question

4. Question 224 · 548 in bank

   A developer is building a serverless application on AWS for a workflow that processes high volumes of data. In the workflow, an AWS Step Functions state machine invokes several AWS Lambda functions. One of the Lambda functions occasionally fails because of timeout errors during periods of high demand. The developer must ensure that the workflow automatically retries the failed function invocation if a timeout error occurs. Which solution will meet this requirement?

   • AAdd a Retry field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts and the timeout error type to retry on.
   • BAdd a Timeout field in the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts.
   • CAdd a Fail state to the Step Functions state machine definition. Configure the state machine with the maximum number of retry attempts.
   • DUpdate the Step Functions state machine to pass the invocation request to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe a Lambda function to the SNS topic. Configure the Lambda function with the maximum number of retry attempts for a timeout error type.

   Show answer

   Answer: A

   Explanation

   AWS Step Functions allows you to handle errors and automate retry policies directly within your state machine definition. By adding a Retry field to the state definition of the Lambda function within the Step Functions state machine, you can specify the error types for which retries should occur, including timeout errors. You can also configure the maximum number of retry attempts, the interval between retries, backoff rate, and more. This solution directly addresses the need for automatic retry in case of specific errors such as timeouts, making it an efficient way to enhance the resilience of serverless workflows.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

5. Question 225 · 548 in bank

   A company runs a serverless application on AWS. The application includes an AWS Lambda function. The Lambda function processes data and stores the data in an Amazon RDS for PostgreSQL database. A developer created a user credentials in the database for the application. The developer needs to use AWS Secrets Manager to manage the user credentials. The password must to be rotated on a regular basis. The solution needs to ensure that there is high availability and no downtime for the application during secret rotation. What should the developer do to meet these requirements?

   • AConfigure managed rotation with the single user rotation strategy.
   • BConfigure managed rotation with the alternating users rotation strategy.
   • CConfigure automatic rotation with the single user rotation strategy.
   • DConfigure automatic rotation with the alternating users rotation strategy.

   Show answer

   Answer: D

   Explanation

   Managed rotation vs. automatic rotation: Managed rotation requires manual intervention to specify when a secret should be rotated. This doesn't meet the requirement of automated password rotation on a regular basis. Automatic rotation automatically rotates secrets based on a defined schedule, meeting the requirement for regular password changes. Single user vs. alternating users: Single user rotation means there is only one set of credentials. Rotating this would cause downtime as the application needs to update its connection information. Alternating users rotation uses two sets of credentials. Only one is active at a time. When it's time to rotate, the inactive set is rotated, and then the application switches to using that set, avoiding downtime

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 226 · 548 in bank

   A company runs an application on AWS. The application consists of a static website that is hosted on Amazon S3. The application includes Amazon API Gateway APIs that invoke AWS Lambda functions. During a period of high traffic on the application, application users reported that the application was slow at irregular intervals. There were no failed requests. A developer needs to find the slow executions across all the Lambda functions. Which solution will meet these requirements?

   • APerform a query across all the Lambda function log groups by using Amazon CloudWatch Logs Insights. Filter on type of report and sort descending by Lambda function execution duration.
   • BEnable AWS CloudTrail Insights on the account where the Lambda functions are running. After CloudTrail Insights has finished processing, review CloudTrail Insights to find the anomalous functions.
   • CEnable AWS X-Ray for all the Lambda functions. Configure an X-Ray insight on a new group that includes all the Lambda functions. After the X-Ray insight has finished processing, review the X-Ray logs.
   • DSet up AWS Glue to crawl through the logs in Amazon CloudWatch Logs for the Lambda functions. Configure an AWS Glue job to transform the logs into a structured format and to output the logs into Amazon S3. Use the Amazon CloudWatch dashboard to visualize the slowest functions based on the duration.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

7. Question 227 · 548 in bank

   A company is building a serverless application on AWS. The application uses Amazon API Gateway and AWS Lambda. The company wants to deploy the application to its development, test, and production environments. Which solution will meet these requirements with the LEAST development effort?

   • AUse API Gateway stage variables and create Lambda aliases to reference environment-specific resources.
   • BUse Amazon Elastic Container Service (Amazon ECS) to deploy the application to the environments.
   • CDuplicate the code for each environment. Deploy the code to a separate API Gateway stage.
   • DUse AWS Elastic Beanstalk to deploy the application to the environments.

   Show answer

   Answer: A

   Explanation

   This approach allows for easy management of multiple environments within the same AWS infrastructure. API Gateway stage variables can be used to manage configurations that differ between environments, such as endpoint URLs or configuration settings. Similarly, Lambda aliases can point to different versions of Lambda functions, making it possible to deploy different versions of the codebase to different environments (e.g., development, test, production) without duplicating the code. This solution is both efficient and scalable, enabling quick updates and minimal overhead in managing environment-specific configurations.

   Source: Adapted from community discussion — SerialiDr

   Next question

8. Question 228 · 548 in bank

   A developer uses AWS CloudFormation to deploy an Amazon API Gateway API and an AWS Step Functions state machine. The state machine must reference the API Gateway API after the CloudFormation template is deployed. The developer needs a solution that uses the state machine to reference the API Gateway endpoint. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure the CloudFormation template to reference the API endpoint in the DefinitionSubstitutions property for the AWS::StepFunctions::StateMachine resource.
   • BConfigure the CloudFormation template to store the API endpoint in an environment variable for the AWS::StepFunctions::StateMachine resource. Configure the state machine to reference the environment variable.
   • CConfigure the CloudFormation template to store the API endpoint in a standard AWS::SecretsManager::Secret resource. Configure the state machine to reference the resource.
   • DConfigure the CloudFormation template to store the API endpoint in a standard AWS::AppConfig::ConfigurationProfile resource. Configure the state machine to reference the resource.

   Show answer

   Answer: A

   Explanation

   This approach leverages CloudFormation's ability to dynamically substitute values within the definition of AWS resources. By using the DefinitionSubstitutions property for the AWS::StepFunctions::StateMachine resource, you can directly insert the API Gateway endpoint or other necessary parameters into the state machine's definition. This enables the state machine to reference the API Gateway API without hard-coding values, allowing for flexibility and reusability of the CloudFormation template across different deployments. It's also a cost-effective solution because it uses native CloudFormation capabilities without the need for additional resources or services.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

9. Question 229 · 548 in bank

   A developer is building an application on AWS. The application includes an AWS Lambda function that processes messages from an Amazon Simple Queue Service (Amazon SQS) queue. The Lambda function sometimes fails or times out. The developer needs to figure out why the Lambda function fails to process some messages. Which solution will meet these requirements with the LEAST operational overhead?

   • AIncrease the maximum timeout of the Lambda function to 15 minutes. Check the AWS CloudTrail event history for error details.
   • BIncrease the visibility timeout of the SQS queue. Check logs in Amazon CloudWatch Logs for error details.
   • CCreate a dead-letter queue. Configure the Lambda function to send the failed messages to the dead-letter queue.
   • DCreate an Amazon DynamoDB table. Update the Lambda function to send the failed messages to the DynamoDB table.

   Show answer

   Answer: C

   Explanation

   B, the question is asking how the developer can figure out the issue. it is not asking about where to put the failed messages to.

   Source: Adapted from community discussion — be1dca8

   References

   • AWS documentation

   Next question

10. Question 230 · 548 in bank

    A developer needs to deploy an application in three AWS Regions by using AWS CloudFormation. Each Region will use an AWS Elastic Beanstalk environment with an Application Load Balancer (ALB). The developer wants to use AWS Certificate Manager (ACM) to deploy SSL certificates to each ALB. Which solution will meet these requirements?

    • ACreate a certificate in ACM in any one of the Regions. Import the certificate into the ALB that is in each Region.
    • BCreate a global certificate in ACM. Update the CloudFormation template to deploy the global certificate to each ALB.
    • CCreate a certificate in ACM in each Region. Import the certificate into the ALB for each Region.
    • DCreate a certificate in ACM in the us-east-1 Region. Update the CloudFormation template to deploy the certificate to each ALB.

    Show answer

    Answer: C

    Explanation

    Regional Certificates: ACM certificates are regional resources. They cannot be shared across different Regions. Creating a certificate in each Region ensures proper certificate management and association with the ALBs. CloudFormation Integration: CloudFormation allows you to define resources and their configurations for individual Regions. Creating certificates within the template for each Region aligns well with this approach.

    Source: Adapted from community discussion — SerialiDr

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 221. 548 questions available.