🔍

DVA-C02 — questions

Page 8 of 28 · 557 total questions.

Topic 1 · Question 141

A developer wants to add request validation to a production environment Amazon API Gateway API. The developer needs to test the changes before the API is deployed to the production environment. For the test, the developer will send test requests to the API through a testing tool. Which solution will meet these requirements with the LEAST operational overhead?

  • AExport the existing API to an OpenAPI file. Create a new API. Import the OpenAPI file. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
  • BModify the existing API to add request validation. Deploy the updated API to a new API Gateway stage. Perform the tests. Deploy the updated API to the API Gateway production stage. (correct answer)
  • CCreate a new API. Add the necessary resources and methods, including new request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production
  • DClone the existing API. Modify the new API to add request validation. Perform the tests. Modify the existing API to add request validation. Deploy the existing API to production.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Modify the existing API to add request validation. Deploy the updated API to a new API Gateway stage. Perform the tests. Deploy the updated API to the API Gateway production stage.

Explanation

Amazon API Gateway is a fully managed front door for creating and securing APIs at scale.

Topic 1 · Question 142

An online food company provides an Amazon API Gateway HTTP API to receive orders for partners. The API is integrated with an AWS Lambda function. The Lambda function stores the orders in an Amazon DynamoDB table. The company expects to onboard additional partners. Some of the partners require additional Lambda functions to receive orders. The company has created an Amazon S3 bucket. The company needs to store all orders and updates in the S3 bucket for future analysis. How can the developer ensure that all orders and updates are stored to Amazon S3 with the LEAST development effort?

  • ACreate a new Lambda function and a new API Gateway API endpoint. Configure the new Lambda function to write to the S3 bucket. Modify the original Lambda function to post updates to the new API endpoint.
  • BUse Amazon Kinesis Data Streams to create a new data stream. Modify the Lambda function to publish orders to the data stream. Configure the data stream to write to the S3 bucket.
  • CEnable DynamoDB Streams on the DynamoDB table. Create a new Lambda function. Associate the stream’s Amazon Resource Name (ARN) with the Lambda function. Configure the Lambda function to write to the S3 bucket as records appear in the table's stream. (correct answer)
  • DModify the Lambda function to publish to a new Amazon Simple Notification Service (Amazon SNS) topic as the Lambda function receives orders. Subscribe a new Lambda function to the topic. Configure the new Lambda function to write to the S3 bucket as updates come through the topic.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Enable DynamoDB Streams on the DynamoDB table. Create a new Lambda function. Associate the stream’s Amazon Resource Name (ARN) with the Lambda function. Configure the Lambda function to write to the S3 bucket as recor...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling. This option needs the least custom development effort.

Topic 1 · Question 143 · Select all that apply

A company’s website runs on an Amazon EC2 instance and uses Auto Scaling to scale the environment during peak times. Website users across the world are experiencing high latency due to static content on the EC2 instance, even during non-peak hours. Which combination of steps will resolve the latency issue? (Choose two.)

  • ADouble the Auto Scaling group’s maximum number of servers.
  • BHost the application code on AWS Lambda.
  • CScale vertically by resizing the EC2 instances.
  • DCreate an Amazon CloudFront distribution to cache the static content. (correct answer)
  • EStore the application’s static content in Amazon S3. (correct answer)
Reveal answer & explanation
Correct answer: D, E

The correct answer is D, E. Option D: Create an Amazon CloudFront distribution to cache the static content. Option E: Store the application’s static content in Amazon S3.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

Topic 1 · Question 144

A company has an Amazon S3 bucket containing premier content that it intends to make available to only paid subscribers of its website. The S3 bucket currently has default permissions of all objects being private to prevent inadvertent exposure of the premier content to non-paying website visitors. How can the company limit the ability to download a premier content file in the S3 bucket to paid subscribers only?

  • AApply a bucket policy that allows anonymous users to download the content from the S3 bucket.
  • BGenerate a pre-signed object URL for the premier content file when a paid subscriber requests a download. (correct answer)
  • CAdd a bucket policy that requires multi-factor authentication for requests to access the S3 bucket objects.
  • DEnable server-side encryption on the S3 bucket for data protection against the non-paying website visitors.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Generate a pre-signed object URL for the premier content file when a paid subscriber requests a download.

Topic 1 · Question 145

A developer is creating an AWS Lambda function that searches for items from an Amazon DynamoDB table that contains customer contact information. The DynamoDB table items have the customer’s email_address as the partition key and additional properties such as customer_type, name and job_title. The Lambda function runs whenever a user types a new character into the customer_type text input. The developer wants the search to return partial matches of all the email_address property of a particular customer_type. The developer does not want to recreate the DynamoDB table. What should the developer do to meet these requirements?

  • AAdd a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the GSI by using the begins_with key condition expression with the email_address property. (correct answer)
  • BAdd a global secondary index (GSI) to the DynamoDB table with email_address as the partition key and customer_type as the sort key. Perform a query operation on the GSI by using the begins_with key condition expression with the email_address property.
  • CAdd a local secondary index (LSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the LSI by using the begins_with key condition expression with the email_address property.
  • DAdd a local secondary index (LSI) to the DynamoDB table with job_title as the partition key and email_address as the sort key. Perform a query operation on the LSI by using the begins_with key condition expression with the email_address property.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key. Perform a query operation on the GSI by using the begins_with key condition expressio...

Explanation

Amazon DynamoDB is a fully managed, serverless NoSQL database with single-digit millisecond latency and automatic scaling.

Topic 1 · Question 146

A developer is building an application that uses AWS API Gateway APIs, AWS Lambda functions, and AWS DynamoDB tables. The developer uses the AWS Serverless Application Model (AWS SAM) to build and run serverless applications on AWS. Each time the developer pushes changes for only to the Lambda functions, all the artifacts in the application are rebuilt. The developer wants to implement AWS SAM Accelerate by running a command to only redeploy the Lambda functions that have changed. Which command will meet these requirements?

  • Asam deploy --force-upload
  • Bsam deploy --no-execute-changeset
  • Csam package
  • Dsam sync --watch (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: sam sync --watch.

Topic 1 · Question 147

A developer is building an application that gives users the ability to view bank accounts from multiple sources in a single dashboard. The developer has automated the process to retrieve API credentials for these sources. The process invokes an AWS Lambda function that is associated with an AWS CloudFormation custom resource. The developer wants a solution that will store the API credentials with minimal operational overhead. Which solution will meet these requirements in the MOST secure way?

  • AAdd an AWS Secrets Manager GenerateSecretString resource to the CloudFormation template. Set the value to reference new credentials for the CloudFormation resource.
  • BUse the AWS SDK ssm:PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter type to SecureString. (correct answer)
  • CAdd an AWS Systems Manager Parameter Store resource to the CloudFormation template. Set the CloudFormation resource value to reference the new credentials. Set the resource NoEcho attribute to true.
  • DUse the AWS SDK ssm:PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter NoEcho attribute to true.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Use the AWS SDK ssm:PutParameter operation in the Lambda function from the existing custom resource to store the credentials as a parameter. Set the parameter value to reference the new credentials. Set the parameter...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead.

Topic 1 · Question 148

A developer is trying to get data from an Amazon DynamoDB table called demoman-table. The developer configured the AWS CLI to use a specific IAM user’s credentials and ran the following command: aws dynamodb get-item --table-name demoman-table --key '{"id": {"N":"1993"}}' The command returned errors and no rows were returned. What is the MOST likely cause of these issues?

  • AThe command is incorrect; it should be rewritten to use put-item with a string argument.
  • BThe developer needs to log a ticket with AWS Support to enable access to the demoman-table.
  • CAmazon DynamoDB cannot be accessed from the AWS CLI and needs to be called via the REST API.
  • DThe IAM user needs an associated policy with read access to demoman-table. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: The IAM user needs an associated policy with read access to demoman-table.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies.

Topic 1 · Question 149 · Select all that apply

An organization is using Amazon CloudFront to ensure that its users experience low-latency access to its web application. The organization has identified a need to encrypt all traffic between users and CloudFront, and all traffic between CloudFront and the web application. How can these requirements be met? (Choose two.)

  • AUse AWS KMS to encrypt traffic between CloudFront and the web application.
  • BSet the Origin Protocol Policy to “HTTPS Only”. (correct answer)
  • CSet the Origin’s HTTP Port to 443.
  • DSet the Viewer Protocol Policy to “HTTPS Only” or “Redirect HTTP to HTTPS”. (correct answer)
  • EEnable the CloudFront option Restrict Viewer Access.
Reveal answer & explanation
Correct answer: B, D

The correct answer is B, D. Option B: Set the Origin Protocol Policy to “HTTPS Only”. Option D: Set the Viewer Protocol Policy to “HTTPS Only” or “Redirect HTTP to HTTPS”. This option meets the real-time / low-latency performance requirement.

Topic 1 · Question 150

A developer is planning to migrate on-premises company data to Amazon S3. The data must be encrypted, and the encryption keys must support automatic annual rotation. The company must use AWS Key Management Service (AWS KMS) to encrypt the data. Which type of keys should the developer use to meet these requirements?

  • AAmazon S3 managed keys
  • BSymmetric customer managed keys with key material that is generated by AWS (correct answer)
  • CAsymmetric customer managed keys with key material that is generated by AWS
  • DSymmetric customer managed keys with imported key material
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Symmetric customer managed keys with key material that is generated by AWS.

Topic 1 · Question 151

A team of developers is using an AWS CodePipeline pipeline as a continuous integration and continuous delivery (CI/CD) mechanism for a web application. A developer has written unit tests to programmatically test the functionality of the application code. The unit tests produce a test report that shows the results of each individual check. The developer now wants to run these tests automatically during the CI/CD process. Which solution will meet this requirement with the LEAST operational effort?

  • AWrite a Git pre-commit hook that runs the tests before every commit. Ensure that each developer who is working on the project has the pre-commit hook installed locally. Review the test report and resolve any issues before pushing changes to AWS CodeCommit.
  • BAdd a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage after the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues.
  • CAdd a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test does not pass. Use the test reports feature of CodeBuild to integrate the report with the CodeBuild console. View the test results in CodeBuild. Resolve any issues. (correct answer)
  • DAdd a new stage to the pipeline. Use Jenkins as the provider. Configure CodePipeline to use Jenkins to run the unit tests. Write a Jenkinsfile that fails the stage if any test does not pass. Use the test report plugin for Jenkins to integrate the report with the Jenkins dashboard. View the test results in Jenkins. Resolve any issues.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Add a new stage to the pipeline. Use AWS CodeBuild as the provider. Add the new stage before the stage that deploys code revisions to the test environment. Write a buildspec that fails the CodeBuild stage if any test...

Explanation

AWS CodeBuild compiles, tests and packages code in a managed build service.

Topic 1 · Question 152

A company has multiple Amazon VPC endpoints in the same VPC. A developer needs to configure an Amazon S3 bucket policy so users can access an S3 bucket only by using these VPC endpoints. Which solution will meet these requirements?

  • ACreate multiple S3 bucket polices by using each VPC endpoint ID that have the aws:SourceVpce value in the StringNotEquals condition.
  • BCreate a single S3 bucket policy that has the aws:SourceVpc value and in the StringNotEquals condition to use VPC ID.
  • CCreate a single S3 bucket policy that has the aws:SourceVpce value and in the StringNotEquals condition to use vpce*.
  • DCreate a single S3 bucket policy that has multiple aws:sourceVpce value in the StringNotEquals condition. Repeat for all the VPC endpoint IDs. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a single S3 bucket policy that has multiple aws:sourceVpce value in the StringNotEquals condition. Repeat for all the VPC endpoint IDs.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. A VPC endpoint provides private connectivity to AWS services without traversing the public internet.

Topic 1 · Question 153 · Select all that apply

A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle. After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account. Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)

  • AStore the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret. (correct answer)
  • BStore the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy.
  • CStore the Root CA Cert in an Amazon S3 bucket. Create a resource-based policy to allow access to the bucket.
  • DRefactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store inside the Lambda function handler.
  • ERefactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler. (correct answer)
Reveal answer & explanation
Correct answer: A, E

The correct answer is A, E. Option A: Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret. Option E: Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Secrets Manager stores and automatically rotates secrets such as database credentials. This option delivers the requirement at the lowest cost.

Topic 1 · Question 154

A developer maintains applications that store several secrets in AWS Secrets Manager. The applications use secrets that have changed over time. The developer needs to identify required secrets that are still in use. The developer does not want to cause any application downtime. What should the developer do to meet these requirements?

  • AConfigure an AWS CloudTrail log file delivery to an Amazon S3 bucket. Create an Amazon CloudWatch alarm for the GetSecretValue Secrets Manager API operation requests.
  • BCreate a secretsmanager-secret-unused AWS Config managed rule. Create an Amazon EventBridge rule to initiate notifications when the AWS Config managed rule is met. (correct answer)
  • CDeactivate the applications secrets and monitor the applications error logs temporarily.
  • DConfigure AWS X-Ray for the applications. Create a sampling rule to match the GetSecretValue Secrets Manager API operation requests.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create a secretsmanager-secret-unused AWS Config managed rule. Create an Amazon EventBridge rule to initiate notifications when the AWS Config managed rule is met.

Explanation

Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. AWS Config tracks resource configuration changes and evaluates compliance.

Topic 1 · Question 155

A developer is writing a serverless application that requires an AWS Lambda function to be invoked every 10 minutes. What is an automated and serverless way to invoke the function?

  • ADeploy an Amazon EC2 instance based on Linux, and edit its /etc/crontab file by adding a command to periodically invoke the Lambda function.
  • BConfigure an environment variable named PERIOD for the Lambda function. Set the value to 600.
  • CCreate an Amazon EventBridge rule that runs on a regular schedule to invoke the Lambda function. (correct answer)
  • DCreate an Amazon Simple Notification Service (Amazon SNS) topic that has a subscription to the Lambda function with a 600-second timer.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon EventBridge rule that runs on a regular schedule to invoke the Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures.

Topic 1 · Question 156

A company is using Amazon OpenSearch Service to implement an audit monitoring system. A developer needs to create an AWS CloudFormation custom resource that is associated with an AWS Lambda function to configure the OpenSearch Service domain. The Lambda function must access the OpenSearch Service domain by using OpenSearch Service internal master user credentials. What is the MOST secure way to pass these credentials to the Lambda function?

  • AUse a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and the Lambda function’s environment variable. Set the NoEcho attribute to true.
  • BUse a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and to create a parameter in AWS Systems Manager Parameter Store. Set the NoEcho attribute to true. Create an IAM role that has the ssm:GetParameter permission. Assign the role to the Lambda function. Store the parameter name as the Lambda function’s environment variable. Resolve the parameter’s value at runtime.
  • CUse a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and the Lambda function’s environment variable. Encrypt the parameter’s value by using the AWS Key Management Service (AWS KMS) encrypt command.
  • DUse CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the secretsmanager:GetSecretValue permission. Assign the role to the Lambda function. Store the secret’s name as the Lambda function’s environment variable. Resolve the secret’s value at runtime. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon OpenSearch Service provides managed search and log analytics. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials.

Topic 1 · Question 157

An application runs on multiple EC2 instances behind an ELB. Where is the session data best written so that it can be served reliably across multiple requests?

  • AWrite data to Amazon ElastiCache. (correct answer)
  • BWrite data to Amazon Elastic Block Store.
  • CWrite data to Amazon EC2 Instance Store.
  • DWrite data to the root filesystem.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Write data to Amazon ElastiCache.

Explanation

Amazon ElastiCache provides in-memory caching (Redis/Memcached) to reduce latency and offload the database.

Topic 1 · Question 158

An ecommerce application is running behind an Application Load Balancer. A developer observes some unexpected load on the application during non-peak hours. The developer wants to analyze patterns for the client IP addresses that use the application. Which HTTP header should the developer use for this analysis?

  • AThe X-Forwarded-Proto header
  • BThe X-Forwarded-Host header
  • CThe X-Forwarded-For header (correct answer)
  • DThe X-Forwarded-Port header
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: The X-Forwarded-For header.

Topic 1 · Question 159

A developer migrated a legacy application to an AWS Lambda function. The function uses a third-party service to pull data with a series of API calls at the end of each month. The function then processes the data to generate the monthly reports. The function has been working with no issues so far. The third-party service recently issued a restriction to allow a fixed number of API calls each minute and each day. If the API calls exceed the limit for each minute or each day, then the service will produce errors. The API also provides the minute limit and daily limit in the response header. This restriction might extend the overall process to multiple days because the process is consuming more API calls than the available limit. What is the MOST operationally efficient way to refactor the serverless application to accommodate this change?

  • AUse an AWS Step Functions state machine to monitor API failures. Use the Wait state to delay calling the Lambda function. (correct answer)
  • BUse an Amazon Simple Queue Service (Amazon SQS) queue to hold the API calls. Configure the Lambda function to poll the queue within the API threshold limits.
  • CUse an Amazon CloudWatch Logs metric to count the number of API calls. Configure an Amazon CloudWatch alarm that stops the currently running instance of the Lambda function when the metric exceeds the API threshold limits.
  • DUse Amazon Kinesis Data Firehose to batch the API calls and deliver them to an Amazon S3 bucket with an event notification to invoke the Lambda function.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use an AWS Step Functions state machine to monitor API failures. Use the Wait state to delay calling the Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. AWS Step Functions coordinates multi-step workflows as a managed state machine.

Topic 1 · Question 160

A developer must analyze performance issues with production-distributed applications written as AWS Lambda functions. These distributed Lambda applications invoke other components that make up the applications. How should the developer identify and troubleshoot the root cause of the performance issues in production?

  • AAdd logging statements to the Lambda functions, then use Amazon CloudWatch to view the logs.
  • BUse AWS CloudTrail and then examine the logs.
  • CUse AWS X-Ray, then examine the segments and errors. (correct answer)
  • DRun Amazon Inspector agents and then analyze performance.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use AWS X-Ray, then examine the segments and errors.

Explanation

AWS X-Ray traces requests to analyze and debug distributed applications.

Showing questions 141160 of 557 · Page 8 of 28