DVA-C02 practice questions 281–290

1. Question 281 · 548 in bank

   Select 2

   A developer at a company writes an AWS CloudFormation template. The template refers to subnets that were created by a separate AWS CloudFormation template that the company's network team wrote. When the developer attempts to launch the stack for the first time, the launch fails. Which template coding mistakes could have caused this failure? (Choose two.)

   • AThe developer's template does not use the Ref intrinsic function to refer to the subnets.
   • BThe developer's template does not use the ImportValue intrinsic function to refer to the subnets.
   • CThe Mappings section of the developer's template does not refer to the subnets.
   • DThe network team's template does not export the subnets in the Outputs section.
   • EThe network team's template does not export the subnets in the Mappings section.

   Show answer

   Answer: BD

   Explanation

   B. When referencing resources from another stack, the ImportValue function should be used. If the developer didn't use this, it would cause a failure when trying to reference the subnets. D. For a resource to be imported by another stack, it needs to be exported in the Outputs section of the original stack. If the network team didn't export the subnets, they can't be imported by the developer's stack.

   Source: Adapted from community discussion — KennethNg923

   References

   • AWS documentation

   Next question

2. Question 282 · 548 in bank

   A developer is running an application on an Amazon EC2 instance. When the application tries to read an Amazon S3 bucket, the application fails. The developer notices that the associated IAM role is missing the S3 read permission. The developer needs to give the application the ability to read the S3 bucket. Which solution will meet this requirement with the LEAST application disruption?

   • AAdd the permission to the role. Terminate the existing EC2 instance. Launch a new EC2 instance.
   • BAdd the permission to the role so that the change will take effect automatically.
   • CAdd the permission to the role. Hibernate and restart the existing EC2 instance.
   • DAdd the permission to the S3 bucket. Restart the EC2 instance.

   Show answer

   Answer: B

   Explanation

   When you modify an IAM role's permissions, the changes take effect almost immediately (typically within a few minutes) without requiring any instance restart or replacement.

   Source: Adapted from community discussion — KennethNg923

   Next question

3. Question 283 · 548 in bank

   Select 2

   A developer is writing a web application that is deployed on Amazon EC2 instances behind an internet-facing Application Load Balancer (ALB). The developer must add an Amazon CloudFront distribution in front of the ALB. The developer also must ensure that customer data from outside the VPC is encrypted in transit. Which combination of CloudFront configuration settings should the developer use to meet these requirements? (Choose two.)

   • ARestrict viewer access by using signed URLs.
   • BSet the Origin Protocol Policy setting to Match Viewer.
   • CEnable field-level encryption.
   • DEnable automatic object compression.
   • ESet the Viewer Protocol Policy setting to Redirect HTTP to HTTPS.

   Show answer

   Answer: BE

   Explanation

   B. Set the Origin Protocol Policy setting to Match Viewer. then if it is HTTP, Viewer Protocol Policy setting can Redirect HTTP to HTTPS (Option E).

   Source: Adapted from community discussion — KennethNg923

   References

   • AWS documentation

   Next question

4. Question 284 · 548 in bank

   A developer is implementing an AWS Lambda function that will be invoked when an object is uploaded to Amazon S3. The developer wants to test the Lambda function in a local development machine before publishing the function to a production AWS account. Which solution will meet these requirements with the LEAST operational overhead?

   • AUpload an object to Amazon S3 by using the aws s3api put-object CLI command. Wait for the local Lambda invocation from the S3 event.
   • BCreate a sample JSON text file for a put object S3 event. Invoke the Lambda function locally. Use the aws lambda invoke CLI command with the JSON file and Lambda function name as arguments.
   • CUse the sam local start-lambda CLI command to start Lambda. Use the sam local generate-event s3 put CLI command to create the Lambda test JSON file. Use the sam local invoke CLI command with the JSON file as the argument to invoke the Lambda function.
   • DCreate a JSON string for the put object S3 event. In the AWS Management Console, use the JSON string to create a test event for the local Lambda function. Perform the test.

   Show answer

   Answer: C

   References

   • AWS documentation

   Next question

5. Question 285 · 548 in bank

   A developer is publishing critical log data to a log group in Amazon CloudWatch Logs. The log group was created 2 months ago. The developer must encrypt the log data by using an AWS Key Management Service (AWS KMS) key so that future data can be encrypted to comply with the company's security policy. Which solution will meet this requirement with the LEAST effort?

   • AUse the AWS Encryption SDK for encryption and decryption of the data before writing to the log group.
   • BUse the AWS KMS console to associate the KMS key with the log group.
   • CUse the AWS CLI aws logs create-log-group command, and specify the key Amazon Resource Name (ARN).
   • DUse the AWS CLI aws logs associate-kms-key command, and specify the key Amazon Resource Name (ARN).

   Show answer

   Answer: D

   Explanation

   associate-kms-key command. This command specifically associates a KMS key with an existing log group, which is exactly what the developer needs to do.

   Source: Adapted from community discussion — cachac

   References

   • AWS documentation

   Next question

6. Question 286 · 548 in bank

   A developer is working on an app for a company that uses an Amazon DynamoDB table named Orders to store customer orders. The table uses OrderID as the partition key and there is no sort key. The table contains more than 100,000 records. The developer needs to add a functionality that will retrieve all Orders records that contain an OrderSource attribute with the MobileApp value. Which solution will improve the user experience in the MOST efficient way?

   • APerform a Scan operation on the Orders table. Provide a QueryFilter condition to filter to only the items where the OrderSource attribute is equal to the MobileApp value.
   • BCreate a local secondary index (LSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.
   • CCreate a global secondary index (GSI) with OrderSource as the sort key. Perform a Query operation by using MobileApp as the key.
   • DCreate a global secondary index (GSI) with OrderSource as the partition key. Perform a Query operation by using MobileApp as the key.

   Show answer

   Answer: D

   Next question

7. Question 287 · 548 in bank

   A company has an application that uses an AWS Lambda function to process data. A developer must implement encryption in transit for all sensitive configuration data, such as API keys, that is stored in the application. The developer creates an AWS Key Management Service (AWS KMS) customer managed key. What should the developer do next to meet the encryption requirement?

   • ACreate parameters of the String type in AWS Systems Manager Parameter Store. For each parameter, specify the KMS key ID to encrypt the parameter in transit. Reference the GetParameter API call in the Lambda environment variables.
   • BCreate secrets in AWS Secrets Manager by using the customer managed KMS key. Create a new Lambda function and set up a Lambda layer. Configure the Lambda layer to retrieve the values from Secrets Manager.
   • CCreate objects in Amazon S3 for each sensitive data field. Specify the customer managed KMS key to encrypt the object. Configure the Lambda function to retrieve the objects from Amazon S3 during data processing.
   • DCreate encrypted Lambda environment variables. Specify the customer managed KMS key to encrypt the variables. Enable encryption helpers for encryption in transit. Grant permission to the Lambda function's execution role to access the KMS key.

   Show answer

   Answer: D

   Explanation

   Considering: "API keys, that is stored in the application". D is the most direct approach. Lambda supports encrypting environment variables with a KMS key, eliminating the need for additional services or layers.

   Source: Adapted from community discussion — cachac

   References

   • AWS documentation

   Next question

8. Question 288 · 548 in bank

   Select 2

   A development team maintains a web application by using a single AWS CloudFormation template. The template defines web servers and an Amazon RDS database. The team uses the Cloud Formation template to deploy the Cloud Formation stack to different environments. During a recent application deployment, a developer caused the primary development database to be dropped and recreated. The result of this incident was a loss of data. The team needs to avoid accidental database deletion in the future. Which solutions will meet these requirements? (Choose two.)

   • AAdd a CloudFormation Deletion Policy attribute with the Retain value to the database resource.
   • BUpdate the CloudFormation stack policy to prevent updates to the database.
   • CModify the database to use a Multi-AZ deployment.
   • DCreate a CloudFormation stack set for the web application and database deployments.
   • EAdd a Cloud Formation DeletionPolicy attribute with the Retain value to the stack.

   Show answer

   Answer: AB

   Explanation

   A. Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource: By adding a DeletionPolicy attribute with the Retain value to the database resource in the CloudFormation template, the database will not be deleted even if the CloudFormation stack is deleted. This helps prevent accidental database loss during stack deletion. B. Update the CloudFormation stack policy to prevent updates to the database: By updating the CloudFormation stack policy, the development team can restrict updates to the database resource. This prevents accidental modifications or recreations of the database during stack updates. The stack policy can define specific actions that are allowed or denied, providing an additional layer of protection against unintentional database changes.

   Source: Adapted from community discussion — Mtho96

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 289 · 548 in bank

   A developer is building an ecommerce application. When there is a sale event, the application needs to concurrently call three third-party systems to record the sale. The developer wrote three AWS Lambda functions. There is one Lambda function for each third-party system, which contains complex integration logic. These Lambda functions are all independent. The developer needs to design the application so each Lambda function will run regardless of others' success or failure. Which solution will meet these requirements?

   • APublish the sale event from the application to an Amazon Simple Queue Service (Amazon SQS) queue. Configure the three Lambda functions to poll the queue.
   • BPublish the sale event from the application to an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the three Lambda functions to be triggered by the SNS topic.
   • CPublish the sale event from the application to an Application Load Balancer (ALB). Add the three Lambda functions as ALB targets.
   • DPublish the sale event from the application to an AWS Step Functions state machine. Move the logic from the three Lambda functions into the Step Functions state machine.

   Show answer

   Answer: B

   Explanation

   1. create sns topic aws sns create-topic --name SaleEvents 2. create three lambda function to subscribe sns topic aws sns subscribe --topic-arn arn:aws:sns:region:account-id:SaleEvents --protocol lambda --notification-endpoint arn:aws:lambda:region:account-id:function:Function1 aws sns subscribe --topic-arn arn:aws:sns:region:account-id:SaleEvents --protocol lambda --notification-endpoint arn:aws:lambda:region:account-id:function:Function2 aws sns subscribe --topic-arn arn:aws:sns:region:account-id:SaleEvents --protocol lambda --notification-endpoint arn:aws:lambda:region:account-id:function:Function3

   Source: Adapted from community discussion — albert_kuo

   Next question

10. Question 290 · 548 in bank

    A developer is writing an application, which stores data in an Amazon DynamoDB table. The developer wants to query the DynamoDB table by using the partition key and a different sort key value. The developer needs the latest data with all recent write operations. How should the developer write the DynamoDB query?

    • AAdd a local secondary index (LSI) during table creation. Query the LSI by using eventually consistent reads.
    • BAdd a local secondary index (LSI) during table creation. Query the LSI by using strongly consistent reads.
    • CAdd a global secondary index (GSI) during table creation. Query the GSI by using eventually consistent reads.
    • DAdd a global secondary index (GSI) during table creation. Query the GSI by using strongly consistent reads.

    Show answer

    Answer: B

    Explanation

    The correct answer is: B. Local Secondary Index (LSI): An LSI allows you to create an index with a different sort key for the same partition key as the base table. This lets you query the table using the same partition key but with a different sort key. LSIs are created at the same time as the table and cannot be added to an existing table. Strongly consistent reads ensure that you always receive the most up-to-date data after all previous write operations are acknowledged. This is important when the developer needs to ensure they are getting the latest data, as stated in the question.

    Source: Adapted from community discussion — tomchandler077

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 281. 548 questions available.