Medium — DVA-C02 Practice Quiz

Question 1

A developer is deploying a customer-facing web application behind an Application Load Balancer (ALB). The security team requires that all traffic between clients and the application be encrypted in transit using TLS, and that the TLS certificate be automatically renewed before expiration to avoid outages. The developer wants the least amount of operational overhead. What should the developer do?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) and associate it with an HTTPS listener on the ALB.

Answer

Purchase a certificate from a third-party CA, store the private key in AWS Secrets Manager, and manually attach it to the ALB each year.

Answer

Enable server-side encryption with SSE-KMS on the ALB target group to encrypt traffic to the backend instances.

Answer

Generate a self-signed certificate on each EC2 instance and configure the ALB to forward TLS traffic without termination.

Question 2

A developer maintains a REST API on Amazon API Gateway that serves a product catalog. The GET /products endpoint receives thousands of identical requests per minute, and each request invokes a Lambda function that reads from a database. The catalog data changes only a few times per day. The team wants to reduce Lambda invocations, lower latency, and cut cost with minimal code changes. What is the MOST appropriate solution?

Accepted Answer

Enable API Gateway caching on the stage for the GET /products method with an appropriate TTL and cache key settings.

Answer

Configure Lambda provisioned concurrency to keep instances warm for the GET /products integration.

Answer

Add an ElastiCache for Redis cluster inside the Lambda function and implement a cache-aside pattern in the function code.

Answer

Increase the Lambda function's memory allocation to speed up each database read.

Question 3

A developer exposes a REST API through Amazon API Gateway that forwards requests to a Lambda function. The Lambda code is being invoked with malformed JSON bodies and missing required query parameters, wasting compute and generating errors. The team wants to reject these bad requests before they reach Lambda, without adding custom validation code. What is the MOST appropriate approach?

Accepted Answer

Enable API Gateway request validation using a JSON Schema model and mark required query string parameters as required in the method request.

Answer

Add a Lambda authorizer that inspects the request body and returns a Deny policy for malformed payloads.

Answer

Configure a mapping template in the integration request to silently drop requests that fail validation.

Answer

Enable AWS WAF on the API stage with a rule that blocks requests containing invalid JSON.

Question 4

A developer maintains a monolithic web application backed by an Amazon Aurora MySQL cluster with a single writer instance. Product teams now run heavy read-only reporting queries during business hours, and these queries are causing latency spikes for the transactional traffic on the primary. The reporting queries can tolerate data that is a few seconds stale. What is the MOST cost-effective way to offload the reporting workload while keeping application code changes minimal?

Accepted Answer

Add one or more Aurora Replicas to the cluster and configure the reporting queries to use the cluster reader endpoint.

Answer

Migrate the reporting queries to a separate DynamoDB table populated by a nightly export job.

Answer

Increase the instance size of the Aurora writer to the largest available class to absorb both workloads.

Answer

Enable Multi-AZ on the Aurora cluster and point the reporting queries at the standby instance.

Question 5

A developer maintains a production CloudFormation stack that runs a public-facing API. Before applying a modified template that alters an RDS instance and several IAM policies, the team wants to review exactly which resources will be added, modified, or replaced — and specifically whether any resource will require replacement — WITHOUT actually making any changes to the running stack. What should the developer do?

Accepted Answer

Create a CloudFormation change set from the updated template and inspect it before executing it.

Answer

Run drift detection on the stack to preview the impact of the new template.

Answer

Deploy the updated template to the stack and monitor the Events tab, rolling back if a replacement occurs.

Answer

Enable termination protection on the stack and then run stack update to see the differences.

Question 6

A team manages its production infrastructure with an AWS CloudFormation stack. An engineer reports that a security group rule was manually modified in the AWS Management Console outside of CloudFormation, and the team wants to identify which stack resources no longer match their template definitions before the next deployment. Which CloudFormation capability should they use?

Accepted Answer

Run drift detection on the stack to compare the actual resource configurations against the expected template values.

Answer

Enable a stack policy to prevent any future manual changes to the security group resource.

Answer

Create a change set to preview the differences between the current template and the deployed resources.

Answer

Use the continue-update-rollback command to restore the stack to its last known good state.

Question 7

A developer is preparing to deploy a serverless application defined in an AWS CloudFormation template. The template references a Lambda function whose code lives in a local directory. When the developer tries to deploy with 'aws cloudformation deploy', the function's local code path is not accepted by CloudFormation. What is the correct step to prepare the deployment artifacts so the template can be deployed?

Accepted Answer

Run 'aws cloudformation package' to upload the local code to an S3 bucket and produce a processed template that references the S3 object, then deploy the output template.

Answer

Manually zip the code and paste the base64-encoded contents directly into the CloudFormation template's ZipFile property for the deployment.

Answer

Configure CodeDeploy to read the local directory at deploy time and inject the code into the Lambda function automatically.

Answer

Enable versioning on the target Lambda function so CloudFormation resolves the local path to the latest published version.

Question 8

A developer is authoring a CloudFormation template that provisions an RDS database. The template accepts the master database password as an input parameter. During code review, a colleague notes that the password value appears in plaintext in the CloudFormation console's Parameters tab and in the stack events. The developer wants to prevent the parameter value from being displayed or logged while still allowing it to be passed at stack creation time. Which change should the developer make to the template?

Accepted Answer

Set the NoEcho property to true on the password parameter.

Answer

Add a Metadata section to the parameter marking it as sensitive.

Answer

Change the parameter Type to AWS::EC2::KeyPair::KeyName.

Answer

Wrap the parameter value in an Fn::Base64 intrinsic function.

Question 9

A developer runs a media website on an Application Load Balancer backed by EC2 instances. Product images and CSS/JS files rarely change but are requested millions of times daily by users across many countries. Origin CPU is saturated serving these static files, and users far from the region report slow page loads. Which change most effectively reduces origin load and improves global latency for these assets?

Accepted Answer

Place an Amazon CloudFront distribution in front of the ALB and set appropriate cache behaviors and TTLs for the static assets

Answer

Add an Amazon ElastiCache for Redis cluster and have the EC2 instances read the images from the cache before serving them

Answer

Enable API Gateway caching in front of the ALB to cache the static file responses

Answer

Provision Amazon DynamoDB Accelerator (DAX) to cache the image metadata and reduce database round trips

Question 10

A developer supports a Lambda function that processes uploaded orders. During flash sales, customers report failed order submissions. In CloudWatch, the developer observes that the function's Throttles metric spikes to hundreds per minute while the Errors metric remains near zero, and the ConcurrentExecutions metric flatlines at a fixed value during the spikes. What is the most likely root cause of the failed submissions?

Accepted Answer

The function is hitting its concurrency limit and being throttled, so invocations are rejected before the handler runs.

Answer

The function code is throwing unhandled exceptions that cause each invocation to fail after processing begins.

Answer

The function is experiencing cold starts that cause each invocation to time out during initialization.

Answer

The function's IAM execution role is missing permissions, causing every invocation to be denied.

Question 11

A developer maintains a REST API backed by Lambda and DynamoDB. Support tickets report that the API feels slow for some users, but the CloudWatch alarm monitoring the Average of the API Gateway Latency metric never triggers because the mean stays low. The team wants an alarm that reliably catches the intermittent slowness affecting a minority of requests. What is the most effective change?

Accepted Answer

Create the alarm on the p99 percentile statistic of the Latency metric instead of the Average.

Answer

Increase the alarm's evaluation period so the Average is calculated over a longer window.

Answer

Switch the alarm to use the Sum statistic of the Latency metric.

Answer

Lower the alarm threshold on the Average statistic to a smaller millisecond value.

Question 12

A developer needs to publish custom application metrics (such as order value and items-per-order) from a high-throughput Lambda function. The function already writes structured JSON logs to CloudWatch Logs. Calling the PutMetricData API on every invocation has caused throttling and added latency to the function. What is the MOST efficient way to emit these custom metrics while avoiding the API throttling and extra latency?

Accepted Answer

Write log entries in the CloudWatch embedded metric format (EMF) so CloudWatch automatically extracts the values as custom metrics from the logs.

Answer

Batch the metrics in memory and call PutMetricData once per minute using a background thread inside the Lambda function.

Answer

Enable Lambda enhanced monitoring so the order value and items-per-order are captured as built-in metrics.

Answer

Create a CloudWatch metric filter on the log group that increments a metric each time the function logs an order event.

Question 13

A developer runs a Lambda function triggered by API Gateway. Users intermittently receive 502 errors during traffic peaks. The developer suspects the function is failing to keep up with demand. Which CloudWatch metric should the developer examine first to confirm whether requests are being rejected before they can execute?

Accepted Answer

The Throttles metric for the Lambda function

Answer

The Duration metric for the Lambda function

Answer

The IntegrationLatency metric for the API Gateway stage

Answer

The Errors metric for the Lambda function

Question 14

A developer is investigating an increase in HTTP 500 errors reported by an application running on AWS Lambda behind API Gateway. The Lambda function writes structured JSON logs (including a 'level' field and 'errorType' field) to Amazon CloudWatch Logs. The developer needs to quickly identify which specific error type is most frequently associated with the failures over the last hour, without exporting logs to another service. What is the FASTEST way to do this?

Accepted Answer

Run a CloudWatch Logs Insights query against the function's log group that filters where level = 'ERROR', then uses stats count(*) by errorType and sorts by the count in descending order

Answer

Create a CloudWatch metric filter on the log group and wait for a new custom metric to accumulate data points before graphing it

Answer

Enable AWS X-Ray active tracing and inspect the service map to count error types across recent traces

Answer

Stream the log group to Amazon S3 with a subscription filter and query the objects using Amazon Athena

Question 15

A developer runs a Java application on Amazon EC2 that writes plain-text logs to a CloudWatch Logs log group. Operations wants to be paged whenever the phrase "OutOfMemoryError" appears more than 3 times within a 5-minute window. There is currently no numeric metric that tracks these occurrences. What is the most appropriate way to enable this alerting with the least custom code?

Accepted Answer

Create a CloudWatch Logs metric filter that matches "OutOfMemoryError" and increments a custom metric, then create a CloudWatch alarm on that metric with a threshold of 3 over a 5-minute period.

Answer

Enable CloudWatch Logs Insights scheduled queries to count occurrences and configure the query to publish an SNS notification directly when the count exceeds 3.

Answer

Add the CloudWatch agent to the instance and configure it to emit an alarm whenever it detects the "OutOfMemoryError" string in the log stream.

Answer

Create an EventBridge rule that pattern-matches the "OutOfMemoryError" log events delivered from CloudWatch Logs and triggers an SNS topic after 3 matches.

Question 16

A developer's Lambda function currently writes plain-text log lines such as 'Processed order 12345 in 240ms'. The operations team wants to build CloudWatch Logs Insights queries and metric filters that can reliably extract the order ID, duration, and status without brittle string parsing. What is the MOST effective change the developer should make to the logging approach?

Accepted Answer

Emit each log entry as a single-line JSON object with named fields (e.g. orderId, durationMs, status) so downstream tools can parse and query discrete attributes.

Answer

Increase the Lambda memory allocation so logs are flushed to CloudWatch more quickly and become easier to parse.

Answer

Write logs across multiple lines per event with one attribute per line to make each value visually distinct.

Answer

Enable X-Ray active tracing so the log lines are automatically converted into structured segments.

Question 17

A developer manages a Lambda-based order processing service whose traffic varies predictably across the day, with higher volume during business hours and much lower volume overnight. The team wants a CloudWatch alarm on the function's error count that adapts to these normal traffic patterns and only alerts when errors deviate meaningfully from expected behavior, without constant false alarms from a fixed threshold. What should the developer configure?

Accepted Answer

Create a CloudWatch alarm using anomaly detection on the Errors metric with a band based on the model, alarming when values fall outside the band.

Answer

Create a static-threshold CloudWatch alarm on the Errors metric set to a high fixed value to avoid daytime noise.

Answer

Create a CloudWatch composite alarm combining the Invocations and Duration metrics with fixed thresholds.

Answer

Enable Lambda enhanced monitoring and rely on the default dashboard graphs for manual review each morning.

Question 18

A development team builds Node.js microservices and installs npm packages during their AWS CodeBuild stage. They want a private repository to store their own internal packages while also being able to pull public packages from the npm public registry, so that all dependencies are resolved through a single endpoint that can be cached and controlled. Which AWS service and configuration meets this requirement with the least operational overhead?

Accepted Answer

Create an AWS CodeArtifact repository with an upstream connection to the public npm registry, and configure npm in CodeBuild to authenticate against the CodeArtifact repository endpoint.

Answer

Store all internal packages as objects in an Amazon S3 bucket and use a lifecycle policy to periodically sync public npm packages into the bucket.

Answer

Push internal packages as container images to Amazon ECR and pull public npm packages directly from the npm registry during each build.

Answer

Run a self-managed private npm registry on an Amazon EC2 instance and manually mirror public packages using a scheduled cron job.

Question 19

A development team uses AWS CodePipeline with AWS CodeBuild to build a containerized microservice. The buildspec.yml must authenticate to Amazon ECR, build the Docker image, tag it, and push it so a later CodeDeploy stage can reference the image. During builds, the push step fails with an authentication error even though the CodeBuild service role has ECR permissions. What should the team add to the buildspec.yml to correctly authenticate Docker to the private ECR registry before pushing?

Accepted Answer

Run 'aws ecr get-login-password' and pipe the output to 'docker login --username AWS --password-stdin' against the registry URI in the pre_build phase

Answer

Store long-lived ECR access keys in the buildspec environment variables and pass them to 'docker login'

Answer

Add the ECR registry credentials to a Docker Hub secret in Secrets Manager and reference it in the build phase

Answer

Enable privileged mode in the CodeBuild project and rely on it to automatically authenticate Docker to ECR

Question 20

A development team uses AWS CodeBuild to build a Java application. Their buildspec.yml runs unit tests during the build phase, but they notice that when a unit test command returns a non-zero exit code, CodeBuild still continues to the post_build phase and produces artifacts, resulting in broken builds being deployed. They want the build to stop immediately and be marked as FAILED if any command in the build phase fails. What is the correct explanation of CodeBuild behavior and how to fix this?

Accepted Answer

By default, if a command in a phase fails, CodeBuild stops that phase and the build fails; the team must have set on-failure to CONTINUE for the build phase, which they should change to ABORT.

Answer

CodeBuild always ignores command exit codes; the team must add a manual 'exit 1' after their test command to force failure.

Answer

The team must move the unit tests into a separate CodePipeline test stage because CodeBuild cannot fail on test results.

Answer

CodeBuild runs all commands in a phase regardless of exit codes by default; the only fix is to enable the 'batch build' feature to enforce ordering.

Question 21

A development team uses AWS CodeBuild to build a containerized application. The build process needs a database password that is stored in AWS Systems Manager Parameter Store as a SecureString parameter named /myapp/db/password. The team wants the value injected as an environment variable during the build without hardcoding the secret anywhere in the repository or buildspec. What is the recommended way to accomplish this?

Accepted Answer

In the buildspec env section, define the variable under 'parameter-store' with the Parameter Store name as its value, and grant the CodeBuild service role ssm:GetParameters permission.

Answer

Store the plaintext password directly in the buildspec env 'variables' block and encrypt the entire buildspec file with KMS.

Answer

Add the password as a plaintext CodeBuild project environment variable of type PLAINTEXT so it is available at build time.

Answer

Hardcode the password in a Dockerfile ARG and pass it during the docker build command in the build phase.

Question 22

A developer is configuring an AWS CodeBuild project to build a Docker container image from a Dockerfile and push it to Amazon ECR. The buildspec runs 'docker build' and 'docker push' commands, but every build fails during the 'docker build' step with an error indicating that it cannot connect to the Docker daemon. The developer has confirmed the build role has ECR permissions. What is the most likely cause and correct fix?

Accepted Answer

The CodeBuild project must have privileged mode enabled so the build container can run the Docker daemon.

Answer

The build must run on a Windows environment image because Docker builds are not supported on Linux CodeBuild images.

Answer

The buildspec must include an 'aws ecr get-login-password' command in the pre_build phase to start the Docker daemon.

Answer

The service role needs the AdministratorAccess policy attached to allow Docker daemon access.

Question 23

A development team uses AWS CodeDeploy to deploy a Node.js application to an Amazon EC2/On-Premises deployment group. Their revision bundle is stored in Amazon S3 as a .zip file. During deployment, every attempt fails immediately with the error 'The deployment failed because no instances were found for your deployment group' does not appear, but instead the agent reports that the AppSpec file could not be located. Where must the AppSpec file be placed within the application revision so that the CodeDeploy agent can process it?

Accepted Answer

In the root directory of the application revision, named appspec.yml

Answer

In a /scripts subdirectory of the revision, named appspec.json

Answer

In the S3 bucket root, separate from the .zip revision, named deploy-config.yml

Answer

Anywhere in the revision as long as it is referenced by name in the CodeDeploy console

Question 24

A team runs a web application on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. They want to use AWS CodeDeploy to deploy new versions to a brand-new set of instances, run smoke tests against them, and only then shift live traffic. If validation fails, the old instances must still be available for an instant rollback with zero downtime. Which CodeDeploy deployment approach meets these requirements?

Accepted Answer

Use a blue/green deployment where CodeDeploy provisions a replacement Auto Scaling group, registers it with the load balancer after validation hooks pass, and keeps the original instances for rollback.

Answer

Use an in-place deployment with the CodeDeployDefault.AllAtOnce configuration so all instances are updated simultaneously.

Answer

Use an in-place deployment with a OneAtATime configuration and rely on Auto Scaling to launch new instances if a health check fails.

Answer

Use a blue/green deployment but terminate the original instances immediately after the new environment is provisioned to reduce cost.

Question 25

A development team deploys a monolithic Java application to a fleet of EC2 instances behind an Application Load Balancer using AWS CodeDeploy with an in-place deployment configuration. They need to run a validation script that checks the application is responding correctly AFTER the new revision is installed and started, but BEFORE the instance is placed back into the load balancer's rotation to serve production traffic. In which AppSpec lifecycle event hook should they place this validation script?

Accepted Answer

ValidateService

Answer

AfterInstall

Answer

ApplicationStart

Answer

BeforeAllowTraffic