DVA-C02 practice questions 501–510

1. Question 501 · 548 in bank

   A developer is testing a new file storage application that uses an Amazon CloudFront distribution to serve content from an Amazon S3 bucket. The distribution accesses the S3 bucket by using an origin access identity (OAI). The S3 bucket's permissions explicitly deny access to all other users. The application prompts users to authenticate on a login page and then uses signed cookies to allow users to access their personal storage directories. The developer has configured the distribution to use its default cache behavior with restricted viewer access and has set the origin to point to the S3 bucket. However, when the developer tries to navigate to the login page, the developer receives a 403 Forbidden error. The developer needs to implement a solution to allow unauthenticated access to the login page. The solution also must keep all private content secure. Which solution will meet these requirements?

   • AAdd a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to the path of the login page, and make viewer access unrestricted. Keep the default cache behavior's settings unchanged.
   • BAdd a second cache behavior to the distribution with the same origin as the default cache behavior. Set the path pattern for the second cache behavior to *, and make viewer access restricted. Change the default cache behavior's path pattern to the path of the login page, and make viewer access unrestricted.
   • CAdd a second origin as a failover origin to the default cache behavior. Point the failover origin to the S3 bucket. Set the path pattern for the primary origin to *, and make viewer access restricted. Set the path pattern for the failover origin to the path of the login page, and make viewer access unrestricted.
   • DAdd a bucket policy to the S3 bucket to allow read access. Set the resource on the policy to the Amazon Resource Name (ARN) of the login page object in the S3 bucket. Add a CloudFront function to the default cache behavior to redirect unauthorized requests to the login page's S3 URL.

   Show answer

   Answer: A

   Explanation

   A) Adding a second cache behavior allows you to define specific rules for the login page while keeping the default settings for private content unchanged. B) Eliminated - Changing the default cache behavior to allow unrestricted access to the login page affects other private content, potentially compromising security. D) Eliminated - Adding a bucket policy to allow public access to the login page directly contradicts the requirement to use CloudFront for secure content delivery.

   Source: Adapted from community discussion — sumanshu

   References

   • AWS documentation

   Next question

2. Question 502 · 548 in bank

   A developer is using AWS Amplify Hosting to build and deploy an application. The developer is receiving an increased number of bug reports from users. The developer wants to add end-to-end testing to the application to eliminate as many bugs as possible before the bugs reach production. Which solution should the developer implement to meet these requirements?

   • ARun the amplify add test command in the Amplify CLI.
   • BCreate unit tests in the application. Deploy the unit tests by using the amplify push command in the Amplify CLI.
   • CAdd a test phase to the amplify.yml build settings for the application.
   • DAdd a test phase to the aws-exports.js file for the application.

   Show answer

   Answer: C

   Explanation

   Explanation: Adding a test phase to the amplify.yml build settings allows the developer to define and execute end-to-end tests as part of the build and deployment process in AWS Amplify Hosting. This will help ensure that bugs are caught and fixed before the application reaches production, improving the overall quality of the application.

   Source: Adapted from community discussion — gpt_test

   References

   • AWS documentation

   Next question

3. Question 503 · 548 in bank

   A developer is creating an AWS CloudFormation template to deploy Amazon EC2 instances across multiple AWS accounts. The developer must choose the EC2 instances from a list of approved instance types. How can the developer incorporate the list of approved instance types in the CloudFormation template?

   • ACreate a separate CloudFormation template for each EC2 instance type in the list.
   • BIn the Resources section of the CloudFormation template, create resources for each EC2 instance type in the list.
   • CIn the CloudFormation template, create a separate parameter for each EC2 instance type in the list.
   • DIn the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.

   Show answer

   Answer: D

   Explanation

   Option D is the correct answer. In the CloudFormation template, the developer should create a parameter with the list of approved EC2 instance types as AllowedValues. This way, users can select the instance type they want to use when launching the CloudFormation stack, but only from the approved list. Option A is not a scalable solution as it requires creating a separate CloudFormation template for each EC2 instance type, which can become cumbersome and difficult to manage as the number of approved instance types grows. Option B is not necessary as creating resources for each EC2 instance type in the list would not enforce the requirement to choose only from the approved list. It would also increase the complexity of the template and make it difficult to manage. Option C is not ideal as it would require creating a separate parameter for each EC2 instance type, which can become difficult to manage as the number of approved instance types grows. Also, it does not enforce the requirement to choose only from the approved list.

   Source: Adapted from community discussion — Bibay

   References

   • AWS documentation

   Next question

4. Question 504 · 548 in bank

   An ecommerce company is using an AWS Lambda function behind Amazon API Gateway as its application tier. To process orders during checkout, the application calls a POST API from the frontend. The POST API invokes the Lambda function asynchronously. In rare situations, the application has not processed orders. The Lambda application logs show no errors or failures. What should a developer do to solve this problem?

   • AInspect the frontend logs for API failures. Call the POST API manually by using the requests from the log file.
   • BCreate and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events.
   • CInspect the Lambda logs in Amazon CloudWatch for possible errors. Fix the errors.
   • DMake sure that caching is disabled for the POST API in API Gateway.

   Show answer

   Answer: B

   Explanation

   B. Create and inspect the Lambda dead-letter queue. Troubleshoot the failed functions. Reprocess the events. When Lambda functions are invoked asynchronously, there is a possibility that the function fails without logging errors if there is no proper error handling. Configuring a dead-letter queue (DLQ) allows you to capture and review events that were not processed successfully. By creating and inspecting the DLQ, you can identify and troubleshoot the issues with the failed Lambda invocations and reprocess those events if needed. This will help ensure that no orders are missed without leaving any errors in the Lambda logs.

   Source: Adapted from community discussion — [Removed]

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 505 · 548 in bank

   A company is building a web application on AWS. When a customer sends a request, the application will generate reports and then make the reports available to the customer within one hour. Reports should be accessible to the customer for 8 hours. Some reports are larger than 1 MB. Each report is unique to the customer. The application should delete all reports that are older than 2 days. Which solution will meet these requirements with the LEAST operational overhead?

   • AGenerate the reports and then store the reports as Amazon DynamoDB items that have a specified TTL. Generate a URL that retrieves the reports from DynamoDB. Provide the URL to customers through the web application.
   • BGenerate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Attach the reports to an Amazon Simple Notification Service (Amazon SNS) message. Subscribe the customer to email notifications from Amazon SNS.
   • CGenerate the reports and then store the reports in an Amazon S3 bucket that uses server-side encryption. Generate a presigned URL that contains an expiration date Provide the URL to customers through the web application. Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports.
   • DGenerate the reports and then store the reports in an Amazon RDS database with a date stamp. Generate an URL that retrieves the reports from the RDS database. Provide the URL to customers through the web application. Schedule an hourly AWS Lambda function to delete database records that have expired date stamps.

   Show answer

   Answer: C

   Explanation

   Explanation: Storing the reports in an Amazon S3 bucket provides a cost-effective and scalable solution for handling files larger than 1 MB. Server-side encryption ensures data security. Generating a presigned URL with an expiration date allows the customer to access the report for 8 hours, and S3 Lifecycle configuration rules automatically delete the reports older than 2 days, reducing operational overhead.

   Source: Adapted from community discussion — gpt_test

   References

   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 506 · 548 in bank

   A company has deployed an application on AWS Elastic Beanstalk. The company has configured the Auto Scaling group that is associated with the Elastic Beanstalk environment to have five Amazon EC2 instances. If the capacity is fewer than four EC2 instances during the deployment, application performance degrades. The company is using the all-at-once deployment policy. What is the MOST cost-effective way to solve the deployment issue?

   • AChange the Auto Scaling group to six desired instances.
   • BChange the deployment policy to traffic splitting. Specify an evaluation time of 1 hour.
   • CChange the deployment policy to rolling with additional batch. Specify a batch size of 1.
   • DChange the deployment policy to rolling. Specify a batch size of 2.

   Show answer

   Answer: C

   Explanation

   Explanation: The rolling with additional batch deployment policy allows Elastic Beanstalk to launch additional instances in a new batch before terminating the old instances. In this case, specifying a batch size of 1 means that Elastic Beanstalk will deploy the application updates to 1 new instance at a time, ensuring that there are always at least 4 instances available during the deployment process. This method maintains application performance while minimizing the additional cost.

   Source: Adapted from community discussion — gpt_test

   References

   • AWS documentation

   Next question

7. Question 507 · 548 in bank

   A developer is incorporating AWS X-Ray into an application that handles personal identifiable information (PII). The application is hosted on Amazon EC2 instances. The application trace messages include encrypted PII and go to Amazon CloudWatch. The developer needs to ensure that no PII goes outside of the EC2 instances. Which solution will meet these requirements?

   • AManually instrument the X-Ray SDK in the application code.
   • BUse the X-Ray auto-instrumentation agent.
   • CUse Amazon Macie to detect and hide PII. Call the X-Ray API from AWS Lambda.
   • DUse AWS Distro for Open Telemetry.

   Show answer

   Answer: A

   Explanation

   Explanation: By manually instrumenting the X-Ray SDK in the application code, the developer can have full control over which data is included in the trace messages. This way, the developer can ensure that no PII is sent to X-Ray by carefully handling the PII within the application and not including it in the trace messages.

   Source: Adapted from community discussion — gpt_test

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 508 · 548 in bank

   A developer is migrating some features from a legacy monolithic application to use AWS Lambda functions instead. The application currently stores data in an Amazon Aurora DB cluster that runs in private subnets in a VPC. The AWS account has one VPC deployed. The Lambda functions and the DB cluster are deployed in the same AWS Region in the same AWS account. The developer needs to ensure that the Lambda functions can securely access the DB cluster without crossing the public internet. Which solution will meet these requirements?

   • AConfigure the DB cluster's public access setting to Yes.
   • BConfigure an Amazon RDS database proxy for he Lambda functions.
   • CConfigure a NAT gateway and a security group for the Lambda functions.
   • DConfigure the VPC, subnets, and a security group for the Lambda functions.

   Show answer

   Answer: D

   Explanation

   Option D is the right answer. When we want the lambda to privately access the DB cluster instead of moving the traffic over the public internet, we need to have the lambda and db cluster to be in the same VPC. When we configure the VPC, subnets, and a security group for the lambda function, the lambda function will be able to communicate with the db cluster using the private IPs that are associated to the VPC. NAT gateway comes into use when you have the lambda deployed in a private subnet and you would want to provide internet access to it.

   Source: Adapted from community discussion — jayvarma

   References

   • repost.aws documentation
   • AWS documentation

   Next question

9. Question 509 · 548 in bank

   A developer is building a new application on AWS. The application uses an AWS Lambda function that retrieves information from an Amazon DynamoDB table. The developer hard coded the DynamoDB table name into the Lambda function code. The table name might change over time. The developer does not want to modify the Lambda code if the table name changes. Which solution will meet these requirements MOST efficiently?

   • ACreate a Lambda environment variable to store the table name. Use the standard method for the programming language to retrieve the variable.
   • BStore the table name in a file. Store the file in the /tmp folder. Use the SDK for the programming language to retrieve the table name.
   • CCreate a file to store the table name. Zip the file and upload the file to the Lambda layer. Use the SDK for the programming language to retrieve the table name.
   • DCreate a global variable that is outside the handler in the Lambda function to store the table name.

   Show answer

   Answer: A

   Explanation

   Explanation: Using Lambda environment variables allows you to store configuration information separate from your code, which makes it easy to update the table name without changing the Lambda function code. AWS Lambda provides built-in support for environment variables, making it the most efficient solution.

   Source: Adapted from community discussion — gpt_test

   References

   • AWS documentation

   Next question

10. Question 510 · 548 in bank

    A company has a critical application on AWS. The application exposes an HTTP API by using Amazon API Gateway. The API is integrated with an AWS Lambda function. The application stores data in an Amazon RDS for MySQL DB instance with 2 virtual CPUs (vCPUs) and 64 GB of RAM. Customers have reported that some of the API calls return HTTP 500 Internal Server Error responses. Amazon CloudWatch Logs shows errors for “too many connections.” The errors occur during peak usage times that are unpredictable. The company needs to make the application resilient. The database cannot be down outside of scheduled maintenance hours. Which solution will meet these requirements?

    • ADecrease the number of vCPUs for the DB instance. Increase the max_connections setting.
    • BUse Amazon RDS Proxy to create a proxy that connects to the DB instance. Update the Lambda function to connect to the proxy.
    • CAdd a CloudWatch alarm that changes the DB instance class when the number of connections increases to more than 1,000.
    • DAdd an Amazon EventBridge rule that increases the max_connections setting of the DB instance when CPU utilization is above 75%.

    Show answer

    Answer: B

    Explanation

    The best solution to meet these requirements would be to use Amazon RDS Proxy to create a proxy that connects to the DB instance and update the Lambda function to connect to the proxy.

    Source: Adapted from community discussion — MrTee

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 501. 548 questions available.