Amazon DVA-C01 Online Practice Questions and Exam Preparation

Amazon DVA-C01 Online Questions & Answers

• Question 411:

  You have an environment that consists of a public subnet using Amazon VPC and 3 instances that are running in this subnet. These three instances can successfully communicate with other hosts on the Internet. You launch a fourth instance in the same subnet, using the same AMI and security group configuration you used for the others, but find that this instance cannot be accessed from the Internet.

  What should you do to enable internet access?

  A. Deploy a NAT instance into the public subnet.

  B. Modify the routing table for the public subnet

  C. Configure a publically routable IP Address In the host OS of the fourth instance.

  D. Assign an Elastic IP address to the fourth instance.

  Correct Answer: D

• Question 412:

  A company is using Amazon API Gateway to manage access to a set of microservices implemented as AWS

  Lambda functions. Following a bug report, the company makes a minor breaking change to one of the APIs.

  In order to avoid impacting existing clients when the new API is deployed, the company wants to allow clients six months to migrate from v1 to v2.

  Which approach should the Developer use to handle this change?

  A. Update the underlying Lambda function and provide clients with the new Lambda invocation URL.

  B. Use API Gateway to automatically propagate the change to clients, specifying 180 days in the phased deployment parameter.

  C. Use API Gateway to deploy a new stage named v2 to the API and provide users with its URL.

  D. Update the underlying Lambda function, create an Amazon CloudFront distribution with the updated Lambda function as its origin.

  Correct Answer: C

• Question 413:

  A nightly batch job loads 1 million new records into a DynamoDB table. The records are only needed for one hour, and the table needs to be empty by the next night's batch job. Which is the MOST efficient and cost-effective method to provide an empty table?

  A. Use DeleteItem using a ConditionExpression.

  B. Use BatchWriteItem to empty all of the rows.

  C. With a recursive function that scans and calls out DeleteItem.

  D. Create and then delete the table after the task has completed.

  Correct Answer: D

  "Deleting an entire table is significantly more efficient than removing items one-by-one, which essentially doubles the write throughput as you do as many delete operations as put operations"

• Question 414:

  A Developer is migrating existing applications to AWS. These applications use MongoDB as their primary data store, and they will be deployed to Amazon EC2 instances. Management requires that the Developer minimize changes to applications while using AWS services

  Which solution should the Developer use to host MongoDB in AWS?

  A. Install MongoDB on the same instance where the application is running

  B. Deploy Amazon DocumentDB in MongoDB compatibility mode

  C. Use Amazon API Gateway to translate API calls from MongoDB to Amazon DynamoDB.

  D. Replicate the existing MongoDB workload to Amazon DynamoDB

  Correct Answer: D

• Question 415:

  An application is being developed to audit several AWS accounts. The application will run in Account A and must access AWS services in Accounts B and C. What is the MOST secure way to allow the application to call AWS services in each audited account?

  A. Configure cross-account roles in each audited account. Write code in Account A that assumes those roles

  B. Use S3 cross-region replication to communicate among accounts, with Amazon S3 event notifications to trigger Lambda functions

  C. Deploy an application in each audited account with its own role. Have Account A authenticate with the application

  D. Create an IAM user with an access key in each audited account. Write code in Account A that uses those access keys

  Correct Answer: A

  https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html

• Question 416:

  A company developed a set of APIs that are being served through the Amazon API Gateway. The API calls need to be authenticated based on OpenID identity providers such as Amazon or Facebook. The APIs should allow access based on a custom authorization model.

  Which is the simplest and MOST secure design to use to build an authentication and authorization model for the APIs?

  A. Use Amazon Cognito user pools and a custom authorizer to authenticate and authorize users based on JSON Web Tokens.

  B. Build a OpenID token broker with Amazon and Facebook. Users will authenticate with these identify providers and pass the JSON Web Token to the API to authenticate each API call.

  C. Store user credentials in Amazon DynamoDB and have the application retrieve temporary credentials

  D. from AWS STS. Make API calls by passing user credentials to the APIs for authentication and authorization.

  E. Use Amazon RDS to store user credentials and pass them to the APIs for authentications and authorization.

  Correct Answer: A

• Question 417:

  While developing an application that runs on Amazon EC2 in an Amazon VPC, a Developer identifies the need for centralized storage of application-level logs. Which AWS service can be used to securely store these logs?

  A. Amazon EC2 VPC Flow Logs

  B. Amazon CloudWatch Logs

  C. Amazon CloudSearch

  D. AWS CloudTrail

  Correct Answer: B

• Question 418:

  A Developer is storing sensitive documents in Amazon S3 that will require encryption at rest. The encryption keys must be rotated annually, at least. What is the easiest way to achieve this?

  A. Encrypt the data before sending it to Amazon S3

  B. Import a custom key into AWS KMS with annual rotation enabled

  C. Use AWS KMS with automatic key rotation

  D. Export a key from AWS KMS to encrypt the data

  Correct Answer: C

  https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html https://docs.aws.amazon.com/kms/latest/developerguide/custom-key-store-overview.html

  You can use the same techniques to view and manage the CMKs in your custom key store that you use for CMKs in the AWS KMS key store. You can control access with IAM and key policies, create tags and aliases, enable and disable the CMKs, and schedule key deletion. You can use the CMKs for cryptographic operations and use them with AWS services that integrate with AWS KMS. However, you cannot enable automatic key rotation and you cannot import key material into a CMK in a custom key store.

  Q: Can I rotate my keys? Yes. You can choose to have AWS KMS automatically rotate CMKs every year, provided that those keys were generated within AWS KMS HSMs. Automatic key rotation is not supported for imported keys, asymmetric keys, or keys generated in an AWS CloudHSM cluster using the AWS KMS custom key store feature. If you choose to import keys to AWS KMS or asymmetric keys or use a custom key store, you can manually rotate them by creating a new CMK and mapping an existing key alias from the old CMK to the new CMK. https://aws.amazon.com/kms/faqs/

• Question 419:

  An application uses Lambda functions to extract metadata from files uploaded to an S3 bucket; the metadata is stored in Amazon DynamoDB. The application starts behaving unexpectedly, and the Developer wants to examine the logs of the Lambda function code for errors.

  Based on this system configuration, where would the Developer find the logs?

  A. Amazon S3

  B. AWS CloudTrail

  C. Amazon CloudWatch

  D. Amazon DynamoDB

  Correct Answer: C

• Question 420:

  What happens, by default, when one of the resources in a CloudFormation stack cannot be created?

  A. Previously-created resources are kept but the stack creation terminates.

  B. Previously-created resources are deleted and the stack creation terminates.

  C. The stack creation continues, and the final results indicate which steps failed.

  D. CloudFormation templates are parsed in advance so stack creation is guaranteed to succeed.

  Correct Answer: B

  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacks.html AWS CloudFormation ensures all stack resources are created or deleted as appropriate. Because AWS CloudFormation treats the stack resources as a single unit, they must all be created or deleted successfully for the stack to be created or deleted. If a resource cannot be created, AWS CloudFormation rolls the stack back and automatically deletes any resources that were created. If a resource cannot be deleted, any remaining resources are retained until the stack can be successfully deleted.