DVA-C02 practice questions 21–30

1. Question 21 · 548 in bank

   A developer maintains a critical business application that uses Amazon DynamoDB as the primary data store. The DynamoDB table contains millions of documents and receives 30-60 requests each minute. The developer needs to perform processing in near-real time on the documents when they are added or updated in the DynamoDB table. How can the developer implement this feature with the LEAST amount of change to the existing application code?

   • ASet up a cron job on an Amazon EC2 instance. Run a script every hour to query the table for changes and process the documents.
   • BEnable a DynamoDB stream on the table. Invoke an AWS Lambda function to process the documents.
   • CUpdate the application to send a PutEvents request to Amazon EventBridge. Create an EventBridge rule to invoke an AWS Lambda function to process the documents.
   • DUpdate the application to synchronously process the documents directly after the DynamoDB write.

   Show answer

   Answer: B

   Explanation

   Option B is the best solution because it proposes enabling a DynamoDB stream on the table, which allows the developer to capture document-level changes in near-real time without modifying the application code. Then, the stream can be configured to invoke an AWS Lambda function to process the documents in near-real time. This solution requires minimal changes to the existing application code, and the Lambda function can be developed and deployed separately, enabling the developer to easily maintain and update it as needed.

   Source: Adapted from community discussion — MrTee

   Next question

2. Question 22 · 548 in bank

   A developer is writing an application for a company. The application will be deployed on Amazon EC2 and will use an Amazon RDS for Microsoft SQL Server database. The company's security team requires that database credentials are rotated at least weekly. How should the developer configure the database credentials for this application?

   • ACreate a database user. Store the user name and password in an AWS Systems Manager Parameter Store secure string parameter. Enable rotation of the AWS Key Management Service (AWS KMS) key that is used to encrypt the parameter.
   • BEnable IAM authentication for the database. Create a database user for use with IAM authentication. Enable password rotation.
   • CCreate a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled.
   • DUse the EC2 user data to create a database user. Provide the user name and password in environment variables to the application.

   Show answer

   Answer: C

   Explanation

   option C: Create a database user. Store the user name and password in an AWS Secrets Manager secret that has daily rotation enabled. This will allow the developer to securely store the database credentials and automatically rotate them at least weekly to meet the company’s security requirements.

   Source: Adapted from community discussion — MrTee

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 23 · 548 in bank

   Select 2

   A real-time messaging application uses Amazon API Gateway WebSocket APIs with backend HTTP service. A developer needs to build a feature in the application to identify a client that keeps connecting to and disconnecting from the WebSocket connection. The developer also needs the ability to remove the client. Which combination of changes should the developer make to the application to meet these requirements? (Choose two.)

   • ASwitch to HTTP APIs in the backend service.
   • BSwitch to REST APIs in the backend service.
   • CUse the callback URL to disconnect the client from the backend service.
   • DAdd code to track the client status in Amazon ElastiCache in the backend service.
   • EImplement $connect and $disconnect routes in the backend service.

   Show answer

   Answer: DE

   Explanation

   Option D because by storing the client status in the cache, the backend service can quickly access the client status data without the need to query the database or perform other time-consuming operations. Option E. Implement $connect and $disconnect routes in the backend service: $connect and $disconnect are the reserved routes in WebSocket APIs, which are automatically called by API Gateway whenever a client connects or disconnects from the WebSocket. By implementing these routes in the backend service, the developer can track and manage the client status, including identifying and removing the client when needed.

   Source: Adapted from community discussion — MrTee

   Next question

4. Question 24 · 548 in bank

   A developer is creating an application that will give users the ability to store photos from their cellphones in the cloud. The application needs to support tens of thousands of users. The application uses an Amazon API Gateway REST API that is integrated with AWS Lambda functions to process the photos. The application stores details about the photos in Amazon DynamoDB. Users need to create an account to access the application. In the application, users must be able to upload photos and retrieve previously uploaded photos. The photos will range in size from 300 KB to 5 MB. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos and details in the DynamoDB table. Retrieve previously uploaded photos directly from the DynamoDB table.
   • BUse Amazon Cognito user pools to manage user accounts. Create an Amazon Cognito user pool authorizer in API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
   • CCreate an IAM user for each user of the application during the sign-up process. Use IAM authentication to access the API Gateway API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as part of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.
   • DCreate a users table in DynamoDB. Use the table to manage user accounts. Create a Lambda authorizer that validates user credentials against the users table. Integrate the Lambda authorizer with API Gateway to control access to the API. Use the Lambda function to store the photos in Amazon S3. Store the object's S3 key as par of the photo details in the DynamoDB table. Retrieve previously uploaded photos by querying DynamoDB for the S3 key.

   Show answer

   Answer: B

   Explanation

   As it is not a good practice to create a new IAM user for each user that signs up for the application, Option C is ruled out. Amazon Cognito user pools primary purpose is to authenticate and authorize web and mobile applications. As the solution requires the application to store images that are between 300KB and 5MB in size, The idea of storing the images in the DynamoDB is ruled out because the object size in a dynamoDb table cannot exceed 400kb. The ideal solution for this problem would be to store the photos in S3 and store the object's key in the DynamoDB table. So, Option B is the right answer

   Source: Adapted from community discussion — jayvarma

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 25 · 548 in bank

   A developer has written code for an application and wants to share it with other developers on the team to receive feedback. The shared application code needs to be stored long-term with multiple versions and batch change tracking. Which AWS service should the developer use?

   • AAWS CodeBuild
   • BAmazon S3
   • CAWS CodeCommit
   • DAWS Cloud9

   Show answer

   Answer: C

   Next question

6. Question 26 · 548 in bank

   A company's developer is building a static website to be deployed in Amazon S3 for a production environment. The website integrates with an Amazon Aurora PostgreSQL database by using an AWS Lambda function. The website that is deployed to production will use a Lambda alias that points to a specific version of the Lambda function. The company must rotate the database credentials every 2 weeks. Lambda functions that the company deployed previously must be able to use the most recent credentials. Which solution will meet these requirements?

   • AStore the database credentials in AWS Secrets Manager. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Secrets Manager.
   • BInclude the database credentials as part of the Lambda function code. Update the credentials periodically and deploy the new Lambda function.
   • CUse Lambda environment variables. Update the environment variables when new credentials are available.
   • DStore the database credentials in AWS Systems Manager Parameter Store. Turn on rotation. Write code in the Lambda function to retrieve the credentials from Systems Manager Parameter Store.

   Show answer

   Answer: A

   Explanation

   Option A is the correct solution; Option D is also a valid solution, but it is not the best option since Secrets Manager provides built-in rotation, which ensures that the latest credentials are automatically updated. Additionally, AWS Systems Manager Parameter Store does not provide the ability to rotate secrets automatically.

   Source: Adapted from community discussion — MrTee

   Next question

7. Question 27 · 548 in bank

   Select 2

   A developer is developing an application that uses signed requests (Signature Version 4) to call other AWS services. The developer has created a canonical request, has created the string to sign, and has calculated signing information. Which methods could the developer use to complete a signed request? (Choose two.)

   • AAdd the signature to an HTTP header that is named Authorization.
   • BAdd the signature to a session cookie.
   • CAdd the signature to an HTTP header that is named Authentication.
   • DAdd the signature to a query string parameter that is named X-Amz-Signature.
   • EAdd the signature to an HTTP header that is named WWW-Authenticate.

   Show answer

   Answer: AD

   Explanation

   A. Add the signature to an HTTP header that is named Authorization: This is a correct method. In Signature Version 4, the completed signature is typically added to the request's Authorization header. This header includes the signing information along with other necessary components such as the Credential Scope and the Signed Headers. D. Add the signature to a query string parameter that is named X-Amz-Signature: This is a correct method. In addition to including the signature in the Authorization header, Signature Version 4 also allows for presigned URLs where the signature is part of the query string parameters. The signature is included in the X-Amz-Signature query string parameter.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

8. Question 28 · 548 in bank

   A company must deploy all its Amazon RDS DB instances by using AWS CloudFormation templates as part of AWS CodePipeline continuous integration and continuous delivery (CI/CD) automation. The primary password for the DB instance must be automatically generated as part of the deployment process. Which solution will meet these requirements with the LEAST development effort?

   • ACreate an AWS Lambda-backed CloudFormation custom resource. Write Lambda code that generates a secure string. Return the value of the secure string as a data field of the custom resource response object. Use the CloudFormation Fn::GetAtt intrinsic function to get the value of the secure string. Use the value to create the DB instance.
   • BUse the AWS CodeBuild action of CodePipeline to generate a secure string by using the following AWS CLI command: aws secretsmanager get-random-password. Pass the generated secure string as a CloudFormation parameter with the NoEcho attribute set to true. Use the parameter reference to create the DB instance.
   • CCreate an AWS Lambda-backed CloudFormation custom resource. Write Lambda code that generates a secure string. Return the value of the secure string as a data field of the custom resource response object. Use the CloudFormation Fn::GetAtt intrinsic function to get a value of the secure string. Create secrets in AWS Secrets Manager. Use the secretsmanager dynamic reference to use the value stored in the secret to create the DB instance.
   • DUse the AWS::SecretsManager::Secret resource to generate a secure string. Store the secure string as a secret in AWS Secrets Manager. Use the secretsmanager dynamic reference to use the value stored in the secret to create the DB instance.

   Show answer

   Answer: D

   Explanation

   Its a difficult choice between B and D Option B leverages the existing AWS CLI command to generate a secure string, and then passes it as a parameter to CloudFormation, where it can be used to create the DB instance. But, if the use of Secrets Manager is already part of the organization's infrastructure, and the setup has already been completed, then option D may indeed be the simplest solution.

   Source: Adapted from community discussion — MrTee

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 29 · 548 in bank

   An organization is storing large files in Amazon S3, and is writing a web application to display meta-data about the files to end-users. Based on the metadata a user selects an object to download. The organization needs a mechanism to index the files and provide single-digit millisecond latency retrieval for the metadata. What AWS service should be used to accomplish this?

   • AAmazon DynamoDB
   • BAmazon EC2
   • CAWS Lambda
   • DAmazon RDS

   Show answer

   Answer: A

   Explanation

   In this scenario, the metadata about the files can be stored in a DynamoDB table with a primary key based on the metadata attributes. This would enable the organization to quickly query and retrieve metadata about the files in real-time, with single-digit millisecond latency.

   Source: Adapted from community discussion — MrTee

   Next question

10. Question 30 · 548 in bank

    A developer is creating an AWS Serverless Application Model (AWS SAM) template. The AWS SAM template contains the definition of multiple AWS Lambda functions, an Amazon S3 bucket, and an Amazon CloudFront distribution. One of the Lambda functions runs on Lambda@Edge in the CloudFront distribution. The S3 bucket is configured as an origin for the CloudFront distribution. When the developer deploys the AWS SAM template in the eu-west-1 Region, the creation of the stack fails. Which of the following could be the reason for this issue?

    • ACloudFront distributions can be created only in the us-east-1 Region.
    • BLambda@Edge functions can be created only in the us-east-1 Region.
    • CA single AWS SAM template cannot contain multiple Lambda functions.
    • DThe CloudFront distribution and the S3 bucket cannot be created in the same Region.

    Show answer

    Answer: B

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 21. 548 questions available.