DVA-C02 practice questions 231–240

1. Question 231 · 548 in bank

   A company needs to deploy all its cloud resources by using AWS CloudFormation templates. A developer must create an Amazon Simple Notification Service (Amazon SNS) automatic notification to help enforce this rule. The developer creates an SNS topic and subscribes the email address of the company's security team to the SNS topic. The security team must receive a notification immediately if an IAM role is created without the use of CloudFormation. Which solution will meet this requirement?

   • ACreate an AWS Lambda function to filter events from CloudTrail if a role was created without CloudFormation. Configure the Lambda function to publish to the SNS topic. Create an Amazon EventBridge schedule to invoke the Lambda function every 15 minutes.
   • BCreate an AWS Fargate task in Amazon Elastic Container Service (Amazon ECS) to filter events from CloudTrail if a role was created without CloudFormation. Configure the Fargate task to publish to the SNS topic. Create an Amazon EventBridge schedule to run the Fargate task every 15 minutes.
   • CLaunch an Amazon EC2 instance that includes a script to filter events from CloudTrail if a role was created without CloudFormation. Configure the script to publish to the SNS topic. Create a cron job to run the script on tile EC2 instance every 15 minutes.
   • DCreate an Amazon EventBridge rule to filter events from CloudTrail if a role was created without CloudFormation. Specify the SNS topic as the target of the EventBridge rule.

   Show answer

   Answer: D

   Explanation

   El desarrollador debe crear una regla de Amazon EventBridge para filtrar eventos de CloudTrail si se crea un rol sin el uso de CloudFormation. Luego, debe especificar el tema de SNS como destino de la regla de EventBridge. Esto permitirá que el equipo de seguridad reciba una notificación inmediata a través del tema de SNS cuando se cree una función de IAM sin el uso de CloudFormation.

   Source: Adapted from community discussion — ANDRES715

   References

   • AWS documentation

   Next question

2. Question 232 · 548 in bank

   A company is adopting serverless computing for some of its new services. A development team needs to create a serverless infrastructure by using AWS Serverless Application Model (AWS SAM). All infrastructure must be deployed by using AWS CloudFormation templates. What should the development team do to meet these requirements?

   • AAdd a Resources section to the CloudFormation templates that contains AWS::Lambda::Function resources.
   • BAdd a Mappings section to the CloudFormation templates that contains AWS::Serverless::Function and AWS::Serverless::API.
   • CAdd a Transform section to the CloudFormation templates. Use the AWS SAM syntax to define the resources.
   • DAdd a Parameters section to the CloudFormation templates that specifies the relevant AWS SAM Globals section.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

3. Question 233 · 548 in bank

   A developer has an application that stores data in an Amazon S3 bucket. The application uses an HTTP API to store and retrieve objects. When the PutObject API operation adds objects to the S3 bucket the developer must encrypt these objects at rest by using server-side encryption with Amazon S3 managed keys (SSE-S3). Which solution will meet this requirement?

   • ACreate an AWS Key Management Service (AWS KMS) key. Assign the KMS key to the S3 bucket.
   • BSet the x-amz-server-side-encryption header when invoking the PutObject API operation.
   • CProvide the encryption key in the HTTP header of every request.
   • DApply TLS to encrypt the traffic to the S3 bucket.

   Show answer

   Answer: B

   Explanation

   B. Set the x-amz-server-side-encryption header when invoking the PutObject API operation. When using the PutObject API operation to store objects in an S3 bucket, the x-amz-server-side-encryption header can be set to specify the server-side encryption algorithm used to encrypt the object. Setting this header to "AES256" or "aws:kms" enables server-side encryption with SSE-S3 or SSE-KMS respectively. Option A is incorrect because assigning a KMS key to the S3 bucket will not enable SSE-S3 encryption. Option C is incorrect because providing the encryption key in the HTTP header of every request is not a valid way to enable SSE-S3 encryption. Option D is incorrect because applying TLS encryption to the traffic to the S3 bucket only encrypts the data in transit, but does not encrypt the objects at rest in the bucket.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 234 · 548 in bank

   A developer is building an application that invokes AWS Lambda functions asynchronously to process events. The developer notices that a Lambda function fails to process some events at random times. The developer needs to investigate the failed events and capture the events that the Lambda function fails to process. Which solution will meet these requirements?

   • AAdd an Amazon EventBridge rule for the Lambda function. Configure the EventBridge rule to react to failed events and to store the events in an Amazon DynamoDB table.
   • BConfigure the Lambda function with a dead-letter queue based in Amazon Kinesis. Update the Lambda function's execution role with the required permissions.
   • CConfigure the Lambda function with an Amazon Simple Queue Service (Amazon SQS) dead-letter queue. Update the Lambda function's execution role with the required permissions.
   • DConfigure the Lambda function with an Amazon Simple Queue Service (Amazon SQS) FIFO dead-letter queue. Update the Lambda function's execution role with the required permissions.

   Show answer

   Answer: C

   Explanation

   The standard SQS dead-letter queue should capture the failed events and let the developer debug them, so C is the right solution. B - There's no such thing as a DLQ in Kinesis. D - SQS FIFO DLQ would be too much overkill for this task because you don't need ordering or deduplication. A - This would involve additional costs and too much complexity to use a DynamoDB table for this.

   Source: Adapted from community discussion — tgv

   References

   • AWS documentation

   Next question

5. Question 235 · 548 in bank

   A company has built a serverless application for its ecommerce website. The application includes a REST API in Amazon API Gateway that invokes an AWS Lambda function. The Lambda function processes data and stores the data in Amazon DynamoDB table. The Lambda function calls a third-party stock application API to process the order. After the ordered is processed, the Lambda function returns an HTTP 200 status code with no body to the client. During peak usage when the API calls exceeds a certain threshold, the third-party stock application sometimes fails to process the data and responds with error messages. The company needs a solution that will not overwhelm the third-party stock application. Which solution will meet these requirements?

   • AConfigure the REST API in API Gateway to write the requests directly into DynamoDB. Configure a DynamoDB intrinsic function to perform the transformation. Set up a DynamoDB stream to call the third-party stock application API with each new row. Delete the Lambda function.
   • BConfigure the REST API in API Gateway to write the requests directly into an Amazon Simple Queue Service (Amazon SQS) queue. Configure the Lambda function with a reserved concurrency equal to the third-party stock application's threshold. Set Lambda function to process the messages from the SQS queue.
   • CConfigure the REST API in API Gateway to write the requests directly into an Amazon Simple Notification Service (Amazon SNS) topic. Configure the Lambda function with a provisioned concurrency equal to the third-party stock application's threshold. Set the Lambda function to process the messages from the SNS topic.
   • DConfigure the REST API in API Gateway to write the requests directly into Amazon Athena. Configure the transformation of the data by using SQL with multiple query result locations set up to point to the DynamoDB table and the third-party stock fulfilment application API. Delete the Lambda function.

   Show answer

   Answer: B

   Next question

6. Question 236 · 548 in bank

   A company hosts its application on AWS. The application runs on an Amazon Elastic Container Service (Amazon ECS) cluster that uses AWS Fargate. The cluster runs behind an Application Load Balancer. The application stores data in an Amazon Aurora database. A developer encrypts and manages database credentials inside the application. The company wants to use a more secure credential storage method and implement periodic credential rotation. Which solution will meet these requirements with the LEAST operational overhead?

   • AMigrate the secret credentials to Amazon RDS parameter groups. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant AWS KMS permissions to access Amazon RDS.
   • BMigrate the credentials to AWS Systems Manager Parameter Store. Encrypt the parameter by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager.
   • CMigrate the credentials to ECS Fargate environment variables. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager.
   • DMigrate the credentials to AWS Secrets Manager. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Turn on secret rotation. Use IAM policies and roles to grant Amazon ECS Fargate permissions to access to AWS Secrets Manager by using keys.

   Show answer

   Answer: D

   Next question

7. Question 237 · 548 in bank

   A company has a mobile app. The app includes an Amazon API Gateway REST API that invokes AWS Lambda functions. The Lambda functions process data from the app. The company needs to test updated Lambda functions that have new features. The company must conduct these tests with a subset of users before deployment. The tests must not affect other users of the app. Which solution will meet these requirements with the LEAST amount of operational effort?

   • ACreate a new version of each Lambda function with a weighted alias. Configure a weight value for each version of the Lambda function. Update the new weighted alias Amazon Resource Name (ARN) in the REST API.
   • BCreate a new REST API in API Gateway. Set up a Lambda proxy integration to connect to multiple Lambda functions. Enable canary settings on the deployment stage. Specify a smaller percentage of API traffic to go to the new version of the Lambda function.
   • CCreate a new version of each Lambda function. Integrate a predefined canary deployment in AWS CodeDeploy to slowly shift the traffic to the new versions automatically.
   • DCreate a new REST API in API Gateway. Set up a Lambda non-proxy integration to connect to multiple Lambda functions. Specify the necessary parameters and properties in API Gateway. Enable canary settings on the deployment stage. Specify a smaller percentage of API traffic to go to the new version of the Lambda function.

   Show answer

   Answer: A

   Explanation

   The wording is screaming out weighted alias. During a canary deployment, we are moving code from testing to prod. We can define a subset of users i.e. 10% for a set period of time. After this the other users will be impacted as the percentage will increment or the deployment will push new code to 100% of users. With a weighted alias we can define a subset of users and use this as our guinea pigs to test new code. As this isn't a canary deployment we have no risk of more users becoming impacted. Operational overhead is minimal as we only need to point to a new alias. With weighted alias we can deploy for testing purposes. From my understanding lambda proxy is grouping lambda functions. the traffic splitting would need to be set at the lambda level as this is testing prior to deployment.

   Source: Adapted from community discussion — DeaconStJohn

   Next question

8. Question 238 · 548 in bank

   A developer works for a company that only has a single pre-production AWS account with an AWS CloudFormation AWS Serverless Application Model (AWS SAM) stack. The developer made changes to an existing AWS Lambda function specified in the AWS SAM template and additional Amazon Simple Notification service (Amazon SNS) topics. The developer wants to do a one-time deploy of the changes to test if the changes are working. The developer does not want to impact the existing pre-production application that is currently being used by other team members as part of the release pipeline. Which solution will meet these requirements?

   • AUse the AWS SAM CLI to package and deploy the SAM application to the pre-production AWS account. Specify the debug parameter.
   • BUse the AWS SAM CLI to package and create a change set against the pre-production AWS account. Execute the change set in a new AWS account designated for a development environment.
   • CUse the AWS SAM CLI to package and deploy the SAM application to a new AWS account designated for a development environment.
   • DUpdate the CloudFormation stack in the pre-production account. Add a separate stage that points to a new AWS account designated for a development environment.

   Show answer

   Answer: C

   Explanation

   This option meets the requirements by deploying the changes to a completely separate AWS account, ensuring that the pre-production application is not impacted. This approach allows the developer to test the changes in isolation.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

9. Question 239 · 548 in bank

   A company built an online event platform. For each event, the company organizes quizzes and generates leaderboards that are based on the quiz scores. The company stores the leaderboard data in Amazon DynamoDB and retains the data for 30 days after an event is complete. The company then uses a scheduled job to delete the old leaderboard data. The DynamoDB table is configured with a fixed write capacity. During the months when many events occur, the DynamoDB write API requests are throttled when the scheduled delete job runs. A developer must create a long-term solution that deletes the old leaderboard data and optimizes write throughput. Which solution meets these requirements?

   • AConfigure a TTL attribute for the leaderboard data.
   • BUse DynamoDB Streams to schedule and delete the leaderboard data.
   • CUse AWS Step Functions to schedule and delete the leaderboard data.
   • DSet a higher write capacity when the scheduled delete job runs.

   Show answer

   Answer: A

   Next question

10. Question 240 · 548 in bank

    A company uses an AWS Lambda function that reads messages from an Amazon Simple Queue Service (Amazon SQS) standard queue. The Lambda function makes an HTTP call to a third-party API for each message. The company wants to ensure that the Lambda function does not overwhelm the third-party API with more than two concurrent requests. Which solution will meet these requirements?

    • AConfigure a provisioned concurrency of two on the Lambda function.
    • BConfigure a batch size of two on the Amazon SQS event source mapping for the Lambda function.
    • CConfigure Lambda event filtering to process two messages from Amazon SQS at every invocations.
    • DConfigure a maximum concurrency of two on the Amazon SQS event source mapping for the Lambda function.

    Show answer

    Answer: D

    Explanation

    Didn't like the wording. A - provisioned concurrency keeps 2 functions on warm standby for critical work. this is a minimum. question is asking about a maximum of 2. B - Batch of 2 is fine. latency could see this fall flat on it's face though. lambda invocations between function and SQS are limited to 2, not strictly between lambda and vendor API. C - event filtering is completely irrelevant here. D - Maximum is what the question is asking for. this will limit the amount of requests made to the vendor API. I would much prefer to set the reserved concurrency at the lambda level but this can be overridden at the SQS event source mapping level so I guess this is the best answer.

    Source: Adapted from community discussion — DeaconStJohn

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 231. 548 questions available.