DVA-C02 practice questions 51–60

1. Question 51 · 548 in bank

   A developer is creating an AWS Lambda function that searches for items from an Amazon DynamoDB table that contains customer contact information. The DynamoDB table items have the customer’s email_address as the partition key and additional properties such as customer_type, name and job_title. The Lambda function runs whenever a user types a new character into the customer_type text input. The developer wants the search to return partial matches of all the email_address property of a particular customer_type. The developer does not want to recreate the DynamoDB table. What should the developer do to meet these requirements?

   • AAdd a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the GSI by using the begins_with key condition expression with the email_address property.
   • BAdd a global secondary index (GSI) to the DynamoDB table with email_address as the partition key and customer_type as the sort key. Perform a query operation on the GSI by using the begins_with key condition expression with the email_address property.
   • CAdd a local secondary index (LSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the LSI by using the begins_with key condition expression with the email_address property.
   • DAdd a local secondary index (LSI) to the DynamoDB table with job_title as the partition key and email_address as the sort key. Perform a query operation on the LSI by using the begins_with key condition expression with the email_address property.

   Show answer

   Answer: A

   Explanation

   The correct answer is (A). By adding a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key, the developer can perform a query operation on the GSI using the Begins_with key condition expression with the email_address property. This will return partial matches of all email_address properties of a specific customer_type.

   Source: Adapted from community discussion — Digo30sp

   Next question

2. Question 52 · 548 in bank

   A developer is building an application that uses AWS API Gateway APIs, AWS Lambda functions, and AWS DynamoDB tables. The developer uses the AWS Serverless Application Model (AWS SAM) to build and run serverless applications on AWS. Each time the developer pushes changes for only to the Lambda functions, all the artifacts in the application are rebuilt. The developer wants to implement AWS SAM Accelerate by running a command to only redeploy the Lambda functions that have changed. Which command will meet these requirements?

   • Asam deploy --force-upload
   • Bsam deploy --no-execute-changeset
   • Csam package
   • Dsam sync --watch

   Show answer

   Answer: D

   Explanation

   The correct answer is (D). The sam sync --watch command will only deploy the Lambda functions that have changed. This command uses AWS SAM Accelerate to compare the local versions of your Lambda functions to the versions deployed in AWS. If there are differences, the command deploys only the changed Lambda functions.

   Source: Adapted from community discussion — Digo30sp

   Next question

3. Question 53 · 548 in bank

   A developer is building an application that gives users the ability to view bank accounts from multiple sources in a single dashboard. The developer has automated the process to retrieve API credentials for these sources. The process invokes an AWS Lambda function that is associated with an AWS CloudFormation custom resource. The developer wants a solution that will store the API credentials with minimal operational overhead. Which solution will meet these requirements in the MOST secure way?

   • AAdd an AWS Secrets Manager GenerateSecretString resource to the CloudFormation template. Set the value to reference new credentials for the CloudFormation resource.
   • BUse the AWS SDK ssm:PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter type to SecureString.
   • CAdd an AWS Systems Manager Parameter Store resource to the CloudFormation template. Set the CloudFormation resource value to reference the new credentials. Set the resource NoEcho attribute to true.
   • DUse the AWS SDK ssm:PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter NoEcho attribute to true.

   Show answer

   Answer: B

   Explanation

   Answer is B A is not correct as the requirement asked to store API credentials, GenerateSecretString will create a random string as password. C the API credential will be retrieved by the Lambda function, it is un-available to the template. D no echo is a attribute of cloud formation template.

   Source: Adapted from community discussion — Jing2023

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 54 · 548 in bank

   A developer is trying to get data from an Amazon DynamoDB table called demoman-table. The developer configured the AWS CLI to use a specific IAM user’s credentials and ran the following command: aws dynamodb get-item --table-name demoman-table --key '{"id": {"N":"1993"}}' The command returned errors and no rows were returned. What is the MOST likely cause of these issues?

   • AThe command is incorrect; it should be rewritten to use put-item with a string argument.
   • BThe developer needs to log a ticket with AWS Support to enable access to the demoman-table.
   • CAmazon DynamoDB cannot be accessed from the AWS CLI and needs to be called via the REST API.
   • DThe IAM user needs an associated policy with read access to demoman-table.

   Show answer

   Answer: D

   Explanation

   The correct answer is (D). The command is correct and the demoman table exists. The most likely issue is that the IAM user does not have a policy associated with read access to the demoman table. To resolve the issue, the developer must add a policy to the IAM user that grants read access to the demoman table.

   Source: Adapted from community discussion — Digo30sp

   Next question

5. Question 55 · 548 in bank

   Select 2

   An organization is using Amazon CloudFront to ensure that its users experience low-latency access to its web application. The organization has identified a need to encrypt all traffic between users and CloudFront, and all traffic between CloudFront and the web application. How can these requirements be met? (Choose two.)

   • AUse AWS KMS to encrypt traffic between CloudFront and the web application.
   • BSet the Origin Protocol Policy to “HTTPS Only”.
   • CSet the Origin’s HTTP Port to 443.
   • DSet the Viewer Protocol Policy to “HTTPS Only” or “Redirect HTTP to HTTPS”.
   • EEnable the CloudFront option Restrict Viewer Access.

   Show answer

   Answer: BD

   Explanation

   B. Set the Origin Protocol Policy to “HTTPS Only”: This setting ensures that all traffic between CloudFront and the web application (origin) is encrypted. By setting the Origin Protocol Policy to "HTTPS Only," CloudFront will only connect to the origin over HTTPS, ensuring encryption of data in transit. D. Set the Viewer Protocol Policy to “HTTPS Only” or “Redirect HTTP to HTTPS”: This setting is crucial for ensuring that all traffic between the users (viewers) and CloudFront is encrypted. By setting the Viewer Protocol Policy to "HTTPS Only" or "Redirect HTTP to HTTPS," CloudFront ensures that user requests are either only served over HTTPS or automatically redirected from HTTP to HTTPS.

   Source: Adapted from community discussion — SerialiDr

   References

   • AWS documentation

   Next question

6. Question 56 · 548 in bank

   A developer is deploying an AWS Lambda function The developer wants the ability to return to older versions of the function quickly and seamlessly. How can the developer achieve this goal with the LEAST operational overhead?

   • AUse AWS OpsWorks to perform blue/green deployments.
   • BUse a function alias with different versions.
   • CMaintain deployment packages for older versions in Amazon S3.
   • DUse AWS CodePipeline for deployments and rollbacks.

   Show answer

   Answer: B

   Explanation

   A) Eliminated - OpsWorks is unnecessary for Lambda function deployments.Blue/green deployments are more suited for EC2 or ECS applications, not for a simple Lambda rollback. B) Correct - Quickly switch the alias to an older version C) Eliminated - Requires manual work to download and redeploy older versions. D) Eliminated - CodePipeline introduces unnecessary complexity

   Source: Adapted from community discussion — sumanshu

   References

   • AWS documentation

   Next question

7. Question 57 · 548 in bank

   A developer is planning to migrate on-premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS Key Management Service (AWS KMS) to encrypt the data. Which type of keys should the developer use to meet these requirements?

   • AAmazon S3 managed keys
   • BSymmetric customer managed keys with key material that is generated by AWS
   • CAsymmetric customer managed keys with key material that is generated by AWS
   • DSymmetric customer managed keys with imported key material

   Show answer

   Answer: B

   Explanation

   Asymmetric keys (option C) are typically used for different use cases, such as digital signatures and key pairs, and may not be as suitable for automatic rotation in the described scenario. Imported key material (option D) means that you bring your own key material, and AWS KMS doesn't support automatic rotation for such keys. Amazon S3 managed keys (option A) are used specifically for Amazon S3 and don't support automatic rotation. so, option B is correct

   Source: Adapted from community discussion — PrakashM14

   References

   • AWS documentation

   Next question

8. Question 58 · 548 in bank

   A team of developers is using an AWS CodePipeline pipeline as a continuous integration and continuous delivery (CI/CD) mechanism for a web application. A developer has written unit tests to programmatically test the functionality of the application code. The unit tests produce a test report that shows the results of each individual check. The developer now wants to run these tests automatically during the CI/CD process. Which solution will meet this requirement with the LEAST operational effort?

   • AWrite a Git pre-commit hook that runs the tests before every commit. Ensure that each developer who is working on the project has the pre-commit hook installed locally. Review the test report and resolve any issues before pushing changes to AWS CodeCommit.
   • BAdd a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage after the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues.
   • CAdd a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues.
   • DAdd a new stage to the pipeline. Use Jenkins as the provider. Configure CodePipeline to use Jenkins to run the unit tests. Write a Jenkinsfile that fails the stage if any test does not pass. Use the test report plugin for Jenkins to integrate the report with the Jenkins dashboard. View the test results in Jenkins. Resolve any issues.

   Show answer

   Answer: C

   Explanation

   This is the most efficient and integrated approach. AWS CodeBuild is fully integrated with AWS CodePipeline and can be used to run unit tests as part of the CI/CD process. Placing the testing stage before deployment ensures that only tested code is deployed. The buildspec can be configured to fail the build if tests do not pass, and CodeBuild's test reports feature allows for easy viewing and analysis of test results.

   Source: Adapted from community discussion — SerialiDr

   Next question

9. Question 59 · 548 in bank

   A company has multiple Amazon VPC endpoints in the same VPC. A developer needs to configure an Amazon S3 bucket policy so users can access an S3 bucket only by using these VPC endpoints. Which solution will meet these requirements?

   • ACreate multiple S3 bucket polices by using each VPC endpoint ID that have the aws:SourceVpce value in the StringNotEquals condition.
   • BCreate a single S3 bucket policy that has the aws:SourceVpc value and in the StringNotEquals condition to use VPC ID.
   • CCreate a single S3 bucket policy that has the aws:SourceVpce value and in the StringNotEquals condition to use vpce*.
   • DCreate a single S3 bucket policy that has multiple aws:sourceVpce value in the StringNotEquals condition. Repeat for all the VPC endpoint IDs.

   Show answer

   Answer: D

   Explanation

   C works as well but It is a broad solution I think it's better practice to use D and specify the exact endpoints that the user can access from. "aws:sourceVpce": ["vpce-id1", "vpce-id2", "..."]

   Source: Adapted from community discussion — dilleman

   References

   • AWS documentation

   Next question

10. Question 60 · 548 in bank

    Select 2

    A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle. After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account. Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)

    • AStore the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret.
    • BStore the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy.
    • CStore the Root CA Cert in an Amazon S3 bucket. Create a resource-based policy to allow access to the bucket.
    • DRefactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store inside the Lambda function handler.
    • ERefactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler.

    Show answer

    Answer: AE

    Explanation

    Secrets Manager is not cost-effective compared to option C - S3 bucket. Question clearly asks "MOST cost-effective" https://www.examtopics.com/discussions/amazon/view/96242-exam-aws-certified-developer-associate-topic-1-question-429/ So answer is CE

    Source: Adapted from community discussion — not_a_bot_definitely

    References

    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

DVA-C02 practice, question 51. 548 questions available.