DVA-C02 practice questions 311–320

1. Question 311 · 548 in bank

   A company has a web application that contains an Amazon API Gateway REST API. A developer has created an AWS CloudFormation template for the initial deployment of the application. The developer has deployed the application successfully as part of an AWS CodePipeline continuous integration and continuous delivery (CI/CD) process. All resources and methods are available through the deployed stage endpoint. The CloudFormation template contains the following resource types: • AWS::ApiGateway::RestApi • AWS::ApiGateway::Resource • AWS::ApiGateway::Method • AWS::ApiGateway::Stage • AWS::ApiGateway::Deployment The developer adds a new resource to the REST API with additional methods and redeploys the template. CloudFormation reports that the deployment is successful and that the stack is in the UPDATE_COMPLETE state. However, calls to all new methods are returning 404 (Not Found) errors. What should the developer do to make the new methods available?

   • ASpecify the disable-rollback option during the update-stack operation.
   • BUnset the CloudFormation stack failure options.
   • CAdd an AWS CodeBuild stage to CodePipeline to run the aws apigateway create-deployment AWS CLI command.
   • DAdd an action to CodePipeline to run the aws cloudfront create-invalidation AWS CLI command.

   Show answer

   Answer: C

   Explanation

   to ensure that new resources and methods are properly deployed and available in API Gateway, you need to create a new deployment of the API configuration. Adding an AWS CodeBuild stage to your CodePipeline to run the aws apigateway create-deployment command (Option C) is the correct approach to accomplish this.

   Source: Adapted from community discussion — rdiaz

   Next question

2. Question 312 · 548 in bank

   A developer updates an AWS Lambda function that an Amazon API Gateway API uses. The API is the backend for a web application. The developer needs to test the updated Lambda function before deploying the Lambda function to production. The testing must not affect any production users of the web application. Which solution will meet these requirements in the MOST operationally efficient way?

   • ACreate a canary release deployment for the existing API stage. Deploy the API to the existing stage. Test the updated Lambda function by using the existing URL.
   • BUpdate the API Gateway API endpoint type to private. Deploy the changes to the existing API stage. Test the API by using the existing URL.
   • CCreate a new test API stage in API Gateway. Add stage variables to deploy the updated Lambda function to only the test stage. Test the updated Lambda function by using the new stage URL.
   • DCreate a new AWS CloudFormation stack to deploy a copy of the entire production API and Lambda function. Use the stack's API URL to test the updated Lambda function.

   Show answer

   Answer: C

   Explanation

   creating a new test API stage in API Gateway and deploying the updated Lambda function to this stage (Option C) is the most efficient and least disruptive way to test the function while ensuring that no changes affect the production environment.

   Source: Adapted from community discussion — rdiaz

   Next question

3. Question 313 · 548 in bank

   A developer wants the ability to roll back to a previous version of an AWS Lambda function in the event of errors caused by a new deployment. How can the developer achieve this with MINIMAL impact on users?

   • AChange the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to use the newly deployed version. If too many errors are encountered, point the alias back to the previous version.
   • BChange the application to use an alias that points to the current version. Deploy the new version of the code. Update the alias to direct 10% of users to the newly deployed version. If too many errors are encountered, send 100% of traffic to the previous version.
   • CDo not make any changes to the application. Deploy the new version of the code. If too many errors are encountered, point the application back to the previous version using the version number in the Amazon Resource Name (ARN).
   • DCreate three aliases: new, existing, and router. Point the existing alias to the current version. Have the router alias direct 100% of users to the existing alias. Update the application to use the router alias. Deploy the new version of the code. Point the new alias to this version. Update the router alias to direct 10% of users to the new alias. If too many errors are encountered, send 100% of traffic to the existing alias.

   Show answer

   Answer: B

   Explanation

   Option B is the best choice for achieving the objective with minimal impact on users. It uses a canary deployment strategy, which allows for testing the new version on a smaller scale before a full rollout. This method provides a balance between risk management and operational simplicity, ensuring that any potential negative impacts of the new deployment are contained and easily reversible.

   Source: Adapted from community discussion — tomchandler077

   References

   • AWS documentation

   Next question

4. Question 314 · 548 in bank

   A company maintains a REST service using Amazon API Gateway and the API Gateway native API key validation. The company recently launched a new registration page, which allows users to sign up for the service. The registration page creates a new API key using CreateApiKey and sends the new key to the user. When the user attempts to call the API using this key, the user receives a 403 Forbidden error. Existing users are unaffected and can still call the API. What code updates will grant these new users access to the API?

   • AThe createDeployment method must be called so the API can be redeployed to include the newly created API key.
   • BThe updateAuthorizer method must be called to update the API's authorizer to include the newly created API key.
   • CThe importApiKeys method must be called to import all newly created API keys into the current stage of the API.
   • DThe createUsagePlanKey method must be called to associate the newly created API key with the correct usage plan.

   Show answer

   Answer: D

   References

   • AWS documentation

   Next question

5. Question 315 · 548 in bank

   A company uses an AWS CloudFormation template to deploy and manage its AWS infrastructure. The CloudFormation template creates Amazon VPC security groups and Amazon EC2 security groups. A manager finds out that some engineers modified the security groups of a few EC2 instances for testing purposes. A developer needs to determine what modifications occurred. Which solution will meet this requirement?

   • AAdd a Conditions section statement in the source YAML file of the template. Run the CloudFormation stack.
   • BPerform a drift detection operation on the CloudFormation stack.
   • CExecute a change set for the CloudFormation stack.
   • DUse Amazon Detective to detect the modifications.

   Show answer

   Answer: B

   References

   • AWS documentation

   Next question

6. Question 316 · 548 in bank

   An IAM role is attached to an Amazon EC2 instance that explicitly denies access to all Amazon S3 API actions. The EC2 instance credentials file specifies the IAM access key and secret access key, which allow full administrative access. Given that multiple modes of IAM access are present for this EC2 instance, which of the following is correct?

   • AThe EC2 instance will only be able to list the S3 buckets.
   • BThe EC2 instance will only be able to list the contents of one S3 bucket at a time.
   • CThe EC2 instance will be able to perform all actions on any S3 bucket.
   • DThe EC2 instance will not be able to perform any S3 action on any S3 bucket.

   Show answer

   Answer: D

   Explanation

   D Explicit deny policies in IAM take precedence over any allow policies. If the IAM role attached to the EC2 instance explicitly denies access to S3, this deny will apply regardless of any other credentials or policies that might grant access. Even though the EC2 instance's credentials file specifies keys with full administrative access, the explicit deny in the IAM role will override these permissions for S3 actions.

   Source: Adapted from community discussion — tomchandler077

   References

   • AWS documentation

   Next question

7. Question 317 · 548 in bank

   A company uses an AWS Lambda function to transfer files from an Amazon S3 bucket to the company's SFTP server. The Lambda function connects to the SFTP server by using credentials such as username and password. The company uses Lambda environment variables to store these credentials. A developer needs to implement encrypted username and password credentials. Which solution will meet these requirements?

   • ARemove the user credentials from the Lambda environment. Implement IAM database authentication.
   • BMove the user credentials from Lambda environment variables to AWS Systems Manager Parameter Store.
   • CMove the user credentials from Lambda environment variables to AWS Key Management Service (AWS KMS).
   • DMove the user credentials from the Lambda environment to an encrypted .txt file. Store the file in an S3 bucket.

   Show answer

   Answer: B

   Next question

8. Question 318 · 548 in bank

   A developer is creating a new batch application that will run on an Amazon EC2 instance. The application requires read access to an Amazon S3 bucket. The developer needs to follow security best practices to grant S3 read access to the application. Which solution meets these requirements?

   • AAdd the permissions to an IAM policy. Attach the policy to a role. Attach the role to the EC2 instance profile.
   • BAdd the permissions inline to an IAM group. Attach the group to the EC2 instance profile.
   • CAdd the permissions to an IAM policy. Attach the policy to a user. Attach the user to the EC2 instance profile.
   • DAdd the permissions to an IAM policy. Use IAM web identity federation to access the S3 bucket with the policy.

   Show answer

   Answer: A

   Explanation

   using an IAM role attached to an EC2 instance profile with the appropriate IAM policy for S3 read access is the best practice. This approach ensures that the EC2 instance has the necessary permissions without embedding credentials or using less appropriate methods.

   Source: Adapted from community discussion — rdiaz

   Next question

9. Question 319 · 548 in bank

   Select 2

   A company has an application that receives batches of orders from partners every day. The application uses an AWS Lambda function to process the batches. If a batch contains no orders, the Lambda function must publish to an Amazon Simple Notification Service (Amazon SNS) topic as soon as possible. Which combination of steps will meet this requirement with the LEAST implementation effort? (Choose two.)

   • AUpdate the existing Lambda function's code to send an Amazon CloudWatch custom metric for the number of orders in a batch for each partner.
   • BCreate a new Lambda function as an Amazon Kinesis data stream consumer. Configure the new Lambda function to track orders and to publish to the SNS topic when a batch contains no orders.
   • CSet up an Amazon CloudWatch alarm that will send a notification to the SNS topic when the value of the custom metric is 0.
   • DSchedule a new Lambda function to analyze Amazon CloudWatch metrics every 24 hours to identify batches that contain no orders. Configure the Lambda function to publish to the SNS topic.
   • EModify the existing Lambda function to log orders to an Amazon Kinesis data stream.

   Show answer

   Answer: AC

   Next question

10. Question 320 · 548 in bank

    A developer has an application that uses an Amazon DynamoDB table with a configured local secondary index (LSI). During application testing, the DynamoDB table metrics report a ProvisionedThroughputExceededException error message. The number of requests made by the test suite did not exceed the table's provisioned capacity limits. What is the cause of this issue?

    • AThe data in the table's partition key column is not evenly distributed.
    • BThe LSI's capacity is different from the table's capacity.
    • CThe application is not implementing exponential backoff retry logic while interacting with the DynamoDB API.
    • DThe application has the IAM permission to query the DynamoDB table but not to query the LSI.

    Show answer

    Answer: A

    Explanation

    The most likely cause of the ProvisionedThroughputExceededException error message is: A. The data in the table's partition key column is not evenly distributed. Explanation In DynamoDB, the provisioned throughput capacity is distributed across all the partitions in the table. If the data in the partition key column is not evenly distributed, some partitions may receive more traffic than others. This can lead to hot partitions, which consume more read/write capacity units than others, resulting in ProvisionedThroughputExceededException errors even if the overall request rate is within the table's provisioned throughput limits.

    Source: Adapted from community discussion — Alabi

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 311. 548 questions available.