DVA-C02 practice questions 41–50

1. Question 41 · 548 in bank

   A company created four AWS Lambda functions that connect to a relational database server that runs on an Amazon RDS instance. A security team requires the company to automatically change the database password every 30 days. Which solution will meet these requirements MOST securely?

   • AStore the database credentials in the environment variables of the Lambda function. Deploy the Lambda function with the new credentials every 30 days.
   • BStore the database credentials in AWS Secrets Manager. Configure a 30-day rotation schedule for the credentials.
   • CStore the database credentials in AWS Systems Manager Parameter Store secure strings. Configure a 30-day schedule for the secure strings.
   • DStore the database credentials in an Amazon S3 bucket that uses server-side encryption with customer-provided encryption keys (SSE-C). Configure a 30-day key rotation schedule for the customer key.

   Show answer

   Answer: B

   Explanation

   The most secure and automated way to handle database credential rotation is to use AWS Secrets Manager. Secrets Manager can automatically rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. You can configure Secrets Manager to automatically rotate the secrets for you according to a schedule you specify, making it easier to adhere to best practices for security.

   Source: Adapted from community discussion — Dushank

   Next question

2. Question 42 · 548 in bank

   A developer is setting up a deployment pipeline. The pipeline includes an AWS CodeBuild build stage that requires access to a database to run integration tests. The developer is using a buildspec.yml file to configure the database connection. Company policy requires automatic rotation of all database credentials. Which solution will handle the database credentials MOST securely?

   • ARetrieve the credentials from variables that are hardcoded in the buildspec.yml file. Configure an AWS Lambda function to rotate the credentials.
   • BRetrieve the credentials from an environment variable that is linked to a SecureString parameter in AWS Systems Manager Parameter Store. Configure Parameter Store for automatic rotation.
   • CRetrieve the credentials from an environment variable that is linked to an AWS Secrets Manager secret. Configure Secrets Manager for automatic rotation.
   • DRetrieve the credentials from an environment variable that contains the connection string in plaintext. Configure an Amazon EventBridge event to rotate the credentials.

   Show answer

   Answer: C

   Explanation

   C is correct. Explanation: "requires automatic rotation of all database credentials" => "Secrets Manager for automatic rotation." With the Systems Manager Parameter Store, you have to do that manually.

   Source: Adapted from community discussion — Parsons

   Next question

3. Question 43 · 548 in bank

   A company is developing a serverless multi-tier application on AWS. The company will build the serverless logic tier by using Amazon API Gateway and AWS Lambda. While the company builds the logic tier, a developer who works on the frontend of the application must develop integration tests. The tests must cover both positive and negative scenarios, depending on success and error HTTP status codes. Which solution will meet these requirements with the LEAST effort?

   • ASet up a mock integration for API methods in API Gateway. In the integration request from Method Execution, add simple logic to return either a success or error based on HTTP status code. In the integration response, add messages that correspond to the HTTP status codes.
   • BCreate two mock integration resources for API methods in API Gateway. In the integration request, return a success HTTP status code for one resource and an error HTTP status code for the other resource. In the integration response, add messages that correspond to the HTTP status codes.
   • CCreate Lambda functions to perform tests. Add simple logic to return either success or error, based on the HTTP status codes. Build an API Gateway Lambda integration. Select appropriate Lambda functions that correspond to the HTTP status codes.
   • DCreate a Lambda function to perform tests. Add simple logic to return either success or error-based HTTP status codes. Create a mock integration in API Gateway. Select the Lambda function that corresponds to the HTTP status codes.

   Show answer

   Answer: A

   Explanation

   A is correct (with the LEAST effort) "API Gateway supports mock integrations for API methods" "As an API developer, you decide how API Gateway responds to a mock integration request. For this, you configure the method's integration request and integration response to associate a response with a given status code. " https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-mock-integration.html

   Source: Adapted from community discussion — Parsons

   References

   • AWS documentation

   Next question

4. Question 44 · 548 in bank

   Users are reporting errors in an application. The application consists of several microservices that are deployed on Amazon Elastic Container Service (Amazon ECS) with AWS Fargate. Which combination of steps should a developer take to fix the errors? (Choose two.)

   • ADeploy AWS X-Ray as a sidecar container to the microservices. Update the task role policy to allow access to the X-Ray API.
   • BDeploy AWS X-Ray as a daemonset to the Fargate cluster. Update the service role policy to allow access to the X-Ray API.
   • CInstrument the application by using the AWS X-Ray SDK. Update the application to use the PutXrayTrace API call to communicate with the X-Ray API.
   • DInstrument the application by using the AWS X-Ray SDK. Update the application to communicate with the X-Ray daemon.
   • EInstrument the ECS task to send the stdout and stderr output to Amazon CloudWatch Logs. Update the task role policy to allow the cloudwatch:PullLogs action.

   Show answer

   Answer: A

   Explanation

   AD A. You can only use X-ray with Fargate as a side car because there is not EC2 image. D. https://github.com/aws-samples/aws-xray-fargate

   Source: Adapted from community discussion — MG1407

   Next question

5. Question 45 · 548 in bank

   A financial company must store original customer records for 10 years for legal reasons. A complete record contains personally identifiable information (PII). According to local regulations, PII is available to only certain people in the company and must not be shared with third parties. The company needs to make the records available to third-party organizations for statistical analysis without sharing the PII. A developer wants to store the original immutable record in Amazon S3. Depending on who accesses the S3 document, the document should be returned as is or with all the PII removed. The developer has written an AWS Lambda function to remove the PII from the document. The function is named removePii. What should the developer do so that the company can meet the PII requirements while maintaining only one copy of the document?

   • ASet up an S3 event notification that invokes the removePii function when an S3 GET request is made. Call Amazon S3 by using a GET request to access the object without PII.
   • BSet up an S3 event notification that invokes the removePii function when an S3 PUT request is made. Call Amazon S3 by using a PUT request to access the object without PII.
   • CCreate an S3 Object Lambda access point from the S3 console. Select the removePii function. Use S3 Access Points to access the object without PII.
   • DCreate an S3 access point from the S3 console. Use the access point name to call the GetObjectLegalHold S3 API function. Pass in the removePii function name to access the object without PII.

   Show answer

   Answer: C

   Explanation

   An S3 Object Lambda access point is a new type of access point that you can create to invoke your own AWS Lambda function to modify the content of an S3 object. You can use S3 Object Lambda access points to transform data as it is being retrieved from an S3 bucket, without modifying the original data stored in the bucket

   Source: Adapted from community discussion — gcmrjbr

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 46 · 548 in bank

   A company has an application that uses AWS CodePipeline to automate its continuous integration and continuous delivery (CI/CD) workflow. The application uses AWS CodeCommit for version control. A developer who was working on one of the tasks did not pull the most recent changes from the main branch. A week later, the developer noticed merge conflicts. How can the developer resolve the merge conflicts in the developer's branch with the LEAST development effort?

   • AClone the repository. Create a new branch. Update the branch with the changes.
   • BCreate a new branch. Apply the changes from the previous branch.
   • CUse the Commit Visualizer view to compare the commits when a feature was added. Fix the merge conflicts.
   • DStop the pull from the main branch to the feature branch. Rebase the feature branch from the main branch.

   Show answer

   Answer: D

   Explanation

   Option D is the best approach for resolving the merge conflicts with minimal development effort. Here's how it works: Stop Pull from Main: By stopping the pull from the main branch to the feature branch, the developer can prevent the introduction of new conflicts while they are resolving the existing ones. Rebase the Feature Branch: After stopping the pull, the developer can rebase the feature branch onto the main branch. This essentially replays the feature branch's changes on top of the main branch's latest changes. This allows the developer to resolve conflicts one commit at a time, addressing any conflicts that arise from the difference between the feature branch and the main branch.

   Source: Adapted from community discussion — love777

   References

   • AWS documentation

   Next question

7. Question 47 · 548 in bank

   A developer wants to add request validation to a production environment Amazon API Gateway API. The developer needs to test the changes before the API is deployed to the production environment. For the test, the developer will send test requests to the API through a testing tool. Which solution will meet these requirements with the LEAST operational overhead?

   • AExport the existing API to an OpenAPI file. Create a new API. Import the OpenAPI file. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
   • BModify the existing API to add request validation. Deploy the updated API to a new API Gateway stage. Perform the tests. Deploy the updated API to the API Gateway production stage.
   • CCreate a new API. Add the necessary resources and methods, including new request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production
   • DClone the existing API. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.

   Show answer

   Answer: B

   Explanation

   In this option, you are making changes directly to the existing API, adding request validation. Then, you deploy the updated API to a new API Gateway stage, which allows you to test the changes without affecting the production environment. After performing the tests and ensuring everything works as expected, you can then deploy the updated API to the production stage, thus minimizing operational overhead.

   Source: Adapted from community discussion — AWSdeveloper08

   Next question

8. Question 48 · 548 in bank

   An online food company provides an Amazon API Gateway HTTP API to receive orders for partners. The API is integrated with an AWS Lambda function. The Lambda function stores the orders in an Amazon DynamoDB table. The company expects to onboard additional partners. Some of the partners require additional Lambda functions to receive orders. The company has created an Amazon S3 bucket. The company needs to store all orders and updates in the S3 bucket for future analysis. How can the developer ensure that all orders and updates are stored to Amazon S3 with the LEAST development effort?

   • ACreate a new Lambda function and a new API Gateway API endpoint. Configure the new Lambda function to write to the S3 bucket. Modify the original Lambda function to post updates to the new API endpoint.
   • BUse Amazon Kinesis Data Streams to create a new data stream. Modify the Lambda function to publish orders to the data stream. Configure the data stream to write to the S3 bucket.
   • CEnable DynamoDB Streams on the DynamoDB table. Create a new Lambda function. Associate the stream’s Amazon Resource Name (ARN) with the Lambda function. Configure the Lambda function to write to the S3 bucket as records appear in the table's stream.
   • DModify the Lambda function to publish to a new Amazon Simple Notification Service (Amazon SNS) topic as the Lambda function receives orders. Subscribe a new Lambda function to the topic. Configure the new Lambda function to write to the S3 bucket as updates come through the topic.

   Show answer

   Answer: C

   Explanation

   By enabling DynamoDB Streams on the DynamoDB table, you can capture changes (orders and updates) to the table. Whenever a new order or an update is made to the table, a stream record is generated. You can then create a new Lambda function, associate the stream's ARN with this Lambda function, and configure it to write the stream records (orders and updates) to the S3 bucket. This approach leverages built-in features of DynamoDB and Lambda, minimizing the development effort required to achieve the desired outcome.

   Source: Adapted from community discussion — AWSdeveloper08

   Next question

9. Question 49 · 548 in bank

   Select 2

   A company’s website runs on an Amazon EC2 instance and uses Auto Scaling to scale the environment during peak times. Website users across the world are experiencing high latency due to static content on the EC2 instance, even during non-peak hours. Which combination of steps will resolve the latency issue? (Choose two.)

   • ADouble the Auto Scaling group’s maximum number of servers.
   • BHost the application code on AWS Lambda.
   • CScale vertically by resizing the EC2 instances.
   • DCreate an Amazon CloudFront distribution to cache the static content.
   • EStore the application’s static content in Amazon S3.

   Show answer

   Answer: DE

   Explanation

   D. Create an Amazon CloudFront distribution to cache the static content: This is an effective solution. Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. Using CloudFront to cache static content closer to users can significantly reduce latency. E. Store the application’s static content in Amazon S3: This is another effective solution. Amazon S3 can serve as a highly durable and scalable storage solution for static content. When combined with Amazon CloudFront, it provides an efficient way to manage and deliver static content with reduced latency. The combination of steps that will best resolve the latency issue is: D. Create an Amazon CloudFront distribution to cache the static content. E. Store the application’s static content in Amazon S3.

   Source: Adapted from community discussion — SerialiDr

   Next question

10. Question 50 · 548 in bank

    A company has an Amazon S3 bucket containing premier content that it intends to make available to only paid subscribers of its website. The S3 bucket currently has default permissions of all objects being private to prevent inadvertent exposure of the premier content to non-paying website visitors. How can the company limit the ability to download a premier content file in the S3 bucket to paid subscribers only?

    • AApply a bucket policy that allows anonymous users to download the content from the S3 bucket.
    • BGenerate a pre-signed object URL for the premier content file when a paid subscriber requests a download.
    • CAdd a bucket policy that requires multi-factor authentication for requests to access the S3 bucket objects.
    • DEnable server-side encryption on the S3 bucket for data protection against the non-paying website visitors.

    Show answer

    Answer: B

    Explanation

    The correct answer is (B). By generating a pre-signed object URL for the main content file when a paid subscriber requests a download, the company can control who can download the file. The pre-signed object URL will be valid for a limited period of time and can only be used by the paid subscriber who requested the download.

    Source: Adapted from community discussion — Digo30sp

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 41. 548 questions available.