DVA-C02 practice questions 271–280

1. Question 271 · 548 in bank

   A developer is creating a new application for a pet store. The application will manage customer rewards points. The developer will use Amazon DynamoDB to store the data for the application. The developer needs to optimize query performance and limit partition overload before actual performance analysis. Which option should the developer use for a partition key to meet these requirements?

   • AA randomly generated universally unique identifier (UUID)
   • BThe customer's full name
   • CThe date when the customer signed up for the rewards program
   • DThe name of the customer's pet

   Show answer

   Answer: A

   Explanation

   This is the only feasible option for a partition key.. B - Two John Smith's sign up for the programme C - Both John Smith's signed up on the same day D - Both John Smith's signed up on the same day with a poodle called Betsy May. Cant rule it out.

   Source: Adapted from community discussion — DeaconStJohn

   Next question

2. Question 272 · 548 in bank

   A developer uses AWS IAM Identity Center (AWS Single Sign-On) to interact with the AWS CLI and AWS SDKs on a local workstation. API calls to AWS services were working when the SSO access was first configured. However, the developer is now receiving Access Denied errors. The developer has not changed any configuration files or scripts that were previously working on the workstation. What is the MOST likely cause of the developer's access issue?

   • AThe access permissions to the developer's AWS CLI binary file have changed.
   • BThe permission set that is assumed by IAM Identity Center does not have the necessary permissions to complete the API call.
   • CThe credentials from the IAM Identity Center federated role have expired.
   • DThe developer is attempting to make API calls to the incorrect AWS account.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

3. Question 273 · 548 in bank

   A company is building a serverless application. The application uses an API key to authenticate with a third-party application. The company wants to store the external API key as a part of an AWS Lambda configuration. The company needs to have full control over the AWS Key Management Service (AWS KMS) keys that will encrypt the API key and should be visible only to authorized entities. Which solution will meet these requirements?

   • AStore the API key in AWS Systems Manager Parameter Store as a string parameter. Use the default AWS KMS key that AWS provides to encrypt the API key.
   • BStore the API key in AWS Lambda environment variables. Create an AWS KMS customer managed key to encrypt the API key.
   • CStore the API key in the code repository. Use an AWS managed key to encrypt the code repository.
   • DStore the API key as an Amazon DynamoDB table record. Use an AWS managed key to encrypt the API key.

   Show answer

   Answer: B

   Explanation

   By creating a customer managed key in AWS Key Management Service (KMS), you gain full control over the encryption process.

   Source: Adapted from community discussion — Lucky4Life

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 274 · 548 in bank

   A developer is writing an application to analyze the traffic to a fleet of Amazon EC2 instances. The EC2 instances run behind a public Application Load Balancer (ALB). An HTTP server runs on each of the EC2 instances, logging all requests to a log file. The developer wants to capture the client public IP addresses. The developer analyzes the log files and notices only the IP address of the ALB. What must the developer do to capture the client public IP addresses in the log file?

   • AAdd a Host header to the HTTP server log configuration file.
   • BInstall the Amazon CloudWatch Logs agent on each EC2 instance. Configure the agent to write to the log file.
   • CInstall the AWS X-Ray daemon on each EC2 instance. Configure the daemon to write to the log file.
   • DAdd an X-Forwarded-For header to the HTTP server log configuration file.

   Show answer

   Answer: D

   Explanation

   D. Add an X-Forwarded-For header to the HTTP server log configuration file. The `X-Forwarded-For` header is used to capture the original client IP address when requests are routed through a load balancer like the ALB.

   Source: Adapted from community discussion — 608064a

   Next question

5. Question 275 · 548 in bank

   A company is developing a serverless application by using AWS Lambda functions. One of the Lambda functions needs to access an Amazon RDS DB instance. The DB instance is in a private subnet inside a VPC. The company creates a role that includes the necessary permissions to access the DB instance. The company then assigns the role to the Lambda function. A developer must take additional action to give the Lambda function access to the DB instance. What should the developer do to meet these requirements?

   • AAssign a public IP address to the DB instance. Modify the security group of the DB instance to allow inbound traffic from the IP address of the Lambda function.
   • BSet up an AWS Direct Connect connection between the Lambda function and the DB instance.
   • CConfigure an Amazon CloudFront distribution to create a secure connection between the Lambda function and the DB instance.
   • DConfigure the Lambda function to connect to the private subnets in the VPC. Add security group rules to allow traffic to the DB instance from the Lambda function.

   Show answer

   Answer: D

   Next question

6. Question 276 · 548 in bank

   A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?

   • AUse the Amazon Cognito user pools to get short-lived credentials for the second account.
   • BCreate a dedicated IAM access key for the second account, and send it by mail.
   • CCreate a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.
   • DEstablish trust, and add an SSH key for the second account to the IAM user.

   Show answer

   Answer: C

   Explanation

   Here's how it works: 1. Create an IAM Role in the Second Account: The administrator of the second account creates an IAM role and attaches policies that grant permissions to the resources that the developer needs to access. The trust policy of the role allows the first account (the developer's account) to assume this role. 2. Assume the IAM Role: The developer in the first account can then call the sts:AssumeRole API operation, passing the ARN of the role to assume in the second account. If the request is successful, the response includes temporary security credentials that the developer can use to access resources in the second account.

   Source: Adapted from community discussion — trungtd

   Next question

7. Question 277 · 548 in bank

   A developer wants to insert a record into an Amazon DynamoDB table as soon as a new file is added to an Amazon S3 bucket. Which set of steps would be necessary to achieve this?

   • ACreate an event with Amazon EventBridge that will monitor the S3 bucket and then insert the records into DynamoDB.
   • BConfigure an S3 event to invoke an AWS Lambda function that inserts records into DynamoDB.
   • CCreate an AWS Lambda function that will poll the S3 bucket and then insert the records into DynamoDB.
   • DCreate a cron job that will run at a scheduled time and insert the records into DynamoDB.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. To insert a record into DynamoDB as soon as a new file is added to an S3 bucket, you can configure an S3 event notification to invoke an AWS Lambda function that inserts the records into DynamoDB. When a new file is added to the S3 bucket, the S3 event notification will trigger the Lambda function, which will insert the record into the DynamoDB table. Option A is incorrect because Amazon EventBridge is not necessary to achieve this. S3 event notifications can directly invoke a Lambda function to insert records into DynamoDB. Option C is incorrect because polling the S3 bucket periodically to check for new files is inefficient and not necessary with S3 event notifications. Option D is incorrect because running a cron job at a scheduled time is not real-time and would not insert the record into DynamoDB as soon as a new file is added to the S3 bucket.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation

   Next question

8. Question 278 · 548 in bank

   A company wants to migrate applications from its on-premises servers to AWS. As a first step, the company is modifying and migrating a non-critical application to a single Amazon EC2 instance. The application will store information in an Amazon S3 bucket. The company needs to follow security best practices when deploying the application on AWS. Which approach should the company take to allow the application to interact with Amazon S3?

   • ACreate an IAM role that has administrative access to AWS. Attach the role to the EC2 instance.
   • BCreate an IAM user. Attach the AdministratorAccess policy. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.
   • CCreate an IAM role that has the necessary access to Amazon S3. Attach the role to the EC2 instance.
   • DCreate an IAM user. Attach a policy that provides the necessary access to Amazon S3. Copy the generated access key and secret key. Within the application code, use the access key and secret key along with the AWS SDK to communicate with Amazon S3.

   Show answer

   Answer: C

   Next question

9. Question 279 · 548 in bank

   Select 2

   A company has an internal website that contains sensitive data. The company wants to make the website public. The company must ensure that only employees who authenticate through the company's OpenID Connect (OIDC) identity provider (IdP) can access the website. A developer needs to implement authentication without editing the website. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate a public Network Load Balancer.
   • BCreate a public Application Load Balancer.
   • CConfigure a listener for the load balancer that listens on HTTPS port 443. Add a default authenticate action providing the OIDC IdP configuration.
   • DConfigure a listener for the load balancer that listens on HTTP port 80. Add a default authenticate action providing the OIDC IdP configuration.
   • EConfigure a listener for the load balancer that listens on HTTPS port 443. Add a default AWS Lambda action providing an Amazon Resource Name (ARN) to a Lambda authentication function.

   Show answer

   Answer: BC

   References

   • AWS documentation

   Next question

10. Question 280 · 548 in bank

    A developer is working on a web application that requires selective activation of specific features. The developer wants to keep the features hidden from end users until the features are ready for public access. Which solution will meet these requirements?

    • ACreate a feature flag configuration profile in AWS AppSync. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.
    • BStore prerelease data in an Amazon DynamoDB table. Enable Amazon DynamoDB Streams in the table. Toggle between hidden and visible states by using DynamoDB Streams.
    • CCreate a feature flag configuration profile in AWS AppConfig. Store the feature flag values in the configuration profile. Activate and deactivate feature flags as needed.
    • DStore prerelease data in AWS Amplify DataStore. Toggle between hidden and visible states by using Amplify DataStore cloud synchronization.

    Show answer

    Answer: C

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 271. 548 questions available.