Amazon DVA-C02 Online Practice Questions and Exam Preparation

Amazon DVA-C02 Online Questions & Answers

• Question 381:

  A company hosts its application in the us-west-1 Region. The company wants to add redundancy in the us-east-1 Region.

  The application secrets are stored in AWS Secrets Manager in us-west-1. A developer needs to replicate the secrets to us-east-1. Which solution will meet this requirement?

  A. Configure secret replication for each secret. Add us-east-1 as a replication Region. Choose an AWS Key Management Service (AWS KMS) key in us-east-1 to encrypt the replicated secrets.
  B. Create a new secret in us-east-1 for each secret. Configure secret replication in us-east-1. Set the source to be the corresponding secret in us-west-1. Choose an AWS Key Management Service (AWS KMS) key in us-west-1 to encrypt the replicated secrets.
  C. Create a replication rule for each secret. Set us-east-1 as the destination Region. Configure the rule to run during secret rotation. Choose an AWS Key Management Service (AWS KMS) key in us-east-1 to encrypt the replicated secrets.
  D. Create a Secrets Manager lifecycle rule to replicate each secret to a new Amazon S3 bucket in us-west-1. Configure an S3 replication rule to replicate the secrets to us-east-1.
  A. Configure secret replication for each secret. Add us-east-1 as a replication Region. Choose an AWS Key Management Service (AWS KMS) key in us-east-1 to encrypt the replicated secrets.

  ---

  Explanation

  AWS Secrets Manager provides a built-in feature for cross-region replication of secrets. By configuring secret replication, you can add the us-east-1 Region as a replication destination. This ensures that the secrets are automatically and securely replicated from us-west-1 to us-east-1. You also have the option to specify an AWS KMS key in the destination region (us-east-1) to encrypt the replicated secrets, ensuring they are protected by encryption keys in the appropriate region.

• Question 382:

  A developer is creating an AWS Lambda function that is invoked by messages to an Amazon Simple Notification Service (Amazon SNS) topic. The messages represent customer data updates from a customer relationship management (CRM) system The developer wants the Lambda function to process only the messages that pertain to email address changes. Additional subscribers to the SNS topic will process any other messages.

  Which solution will meet these requirements in the LEAST development effort?

  A. Use Lambda event filtering to allow only messages that are related to email address changes to invoke the Lambda function.
  B. Use an SNS filter policy on the Lambda function subscription to allow only messages that are related to email address changes to invoke the Lambda function.
  C. Subscribe an Amazon Simple Queue Service (Amazon SQS) queue to the SNS topic. Configure the SQS queue with a filter policy to allow only messages that are related to email address changes. Connect the SQS queue to the Lambda function.
  D. Configure the Lambda code to check the received message. If the message is not related to an email address change, configure the Lambda function to publish the message back to the SNS topic for the other subscribers to process.
  B. Use an SNS filter policy on the Lambda function subscription to allow only messages that are related to email address changes to invoke the Lambda function.

  ---

  Explanation

  SNS filter policies allow you to specify criteria that messages must meet to be delivered to a particular subscriber.

• Question 383:

  A company is using Amazon API Gateway to develop an API for its application on AWS. A developer needs to test and generate API responses. Other teams are required to test the API immediately.

  What should the developer do to meet these requirements?

  A. Set up a mock integration request in API Gateway. Configure the method's integration request and integration response to associate a response with a given status code.
  B. Set up the request validators in the API's OpenAPI definition file. Import the OpenAPI definitions into API Gateway to test the API.
  C. Set up a gateway response for the API in API Gateway. Configure response headers with hardcoded HTTP status codes and responses.
  D. Set up a request parameter-based Lambda authorizer to control access to the API. Configure the Lambda function with the necessary mapping template.
  A. Set up a mock integration request in API Gateway. Configure the method's integration request and integration response to associate a response with a given status code.

  ---

  Explanation

• Question 384:

  A developer is creating a script to automate the deployment process for a serverless application. The developer wants to use an existing AWS Serverless Application Model (AWS SAM) template for the application.

  What should the developer use for the project? (Choose two.)

  A. Call aws cloudformation package to create the deployment package. Call aws cloudformation deploy to deploy the package afterward.
  B. Call sam package to create the deployment package. Call sam deploy to deploy the package afterward.
  C. Call aws s3 cp to upload the AWS SAM template to Amazon S3. Call aws lambda update-function-code to create the application.
  D. Create a ZIP package locally and call aws serverlessrepo create-applicatiion to create the application.
  E. Create a ZIP package and upload it to Amazon S3. Call aws cloudformation create-stack to create the application.
  A. Call aws cloudformation package to create the deployment package. Call aws cloudformation deploy to deploy the package afterward.
  B. Call sam package to create the deployment package. Call sam deploy to deploy the package afterward.

  ---

  Explanation

• Question 385:

  A developer needs temporary access to resources in a second account. What is the MOST secure way to achieve this?

  A. Use the Amazon Cognito user pools to get short-lived credentials for the second account.
  B. Create a dedicated IAM access key for the second account, and send it by mail.
  C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.
  D. Establish trust, and add an SSH key for the second account to the IAM user.
  C. Create a cross-account access role, and use sts:AssumeRole API to get short-lived credentials.

  ---

  Explanation

• Question 386:

  A developer needs to store files in an Amazon S3 bucket for a company's application. Each S3 object can have multiple versions. The objects must be permanently removed 1 year after object creation.

  The developer creates an S3 bucket that has versioning enabled.

  What should the developer do next to meet the data retention requirements?

  A. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.
  B. Create an event notification for all object creation events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
  C. Create an event notification for all object removal events in the S3 bucket. Configure the event notification to invoke an AWS Lambda function. Program the Lambda function to check the object creation date and to delete the object if the object is older than 1 year.
  D. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to delete expired object delete markers and permanently delete noncurrent versions 1 year after object creation.
  A. Create an S3 Lifecycle rule on the S3 bucket. Configure the rule to expire current versions of objects and permanently delete noncurrent versions 1 year after object creation.

  ---

  Explanation

• Question 387:

  While developing an application that runs on Amazon EC2 in an Amazon VPC, a Developer identifies the need for centralized storage of application-level logs.

  Which AWS service can be used to securely store these logs?

  A. Amazon EC2 VPC Flow Logs
  B. Amazon CloudWatch Logs
  C. Amazon CloudSearch
  D. AWS CloudTrail
  B. Amazon CloudWatch Logs

  ---

  Explanation

• Question 388:

  A developer is modifying an existing AWS Lambda function. While checking the code, the developer notices hardcoded parameter values for an Amazon RDS for SQL Server user name, password, database, host, and port. There are also hardcoded parameter values for an Amazon DynamoDB table, an Amazon S3 bucket, and an Amazon Simple Notification Service (Amazon SNS) topic.

  The developer wants to securely store the parameter values outside the code in an encrypted format and wants to turn on rotation for the credentials. The developer also wants to be able to reuse the parameter values from other applications and to update the parameter values without modifying code.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create an RDS database secret in AWS Secrets Manager. Set the user name, password, database, host, and port. Turn on secret rotation. Create encrypted Lambda environment variables for the DynamoDB table, S3 bucket, and SNS topic.
  B. Create an RDS database secret in AWS Secrets Manager. Set the user name, password, database, host, and port. Turn on secret rotation. Create SecureString parameters in AWS Systems Manager Parameter Store for the DynamoDB table, S3 bucket, and SNS topic.
  C. Create RDS database parameters in AWS Systems Manager Parameter Store for the user name, password, database, host, and port. Create encrypted Lambda environment variables for the DynamoDB table, S3 bucket, and SNS topic. Create a Lambda function and set the logic for the credentials rotation task. Schedule the credentials rotation task in Amazon EventBridge.
  D. Create RDS database parameters in AWS Systems Manager Parameter Store for the user name, password, database, host, and port. Store the DynamoDB table, S3 bucket, and SNS topic in Amazon S3. Create a Lambda function and set the logic for the credentials rotation. Invoke the Lambda function on a schedule.
  B. Create an RDS database secret in AWS Secrets Manager. Set the user name, password, database, host, and port. Turn on secret rotation. Create SecureString parameters in AWS Systems Manager Parameter Store for the DynamoDB table, S3 bucket, and SNS topic.

  ---

  Explanation

• Question 389:

  In a move toward using microservices, a company's management team has asked all development teams to build their services so that API requests depend only on that service's data store. One team is building a Payments service which has its own database; the service needs data that originates in the Accounts database. Both are using Amazon DynamoDB.

  What approach will result in the simplest, decoupled, and reliable method to get near-real time updates from the Accounts database?

  A. Use Amazon Glue to perform frequent ETL updates from the Accounts database to the Payments database.
  B. Use Amazon ElastiCache in Payments, with the cache updated by triggers in the Accounts database.
  C. Use Amazon Kinesis Data Firehose to deliver all changes from the Accounts database to the Payments database.
  D. Use Amazon DynamoDB Streams to deliver all changes from the Accounts database to the Payments database.
  D. Use Amazon DynamoDB Streams to deliver all changes from the Accounts database to the Payments database.

  ---

  Explanation

• Question 390:

  A development team is creating a serverless application that uses AWS Lambda functions. The team wants to streamline a testing workflow by sharing test events across multiple developers within the same AWS account. The team wants to ensure all developers can use consistent test events without compromising security.

  Which solution meets the requirement?

  A. Export test events as JSON files. Store the files in an Amazon S3 bucket. Configure granular IAM permissions to allow the developers to access the S3 bucket.
  B. Store test events in an Amazon DynamoDB table. Create an AWS Lambda function to retrieve shared test events for the developers.
  C. Configure test events to be shareable. Configure granular IAM permissions to allow the developers to access shared test events.
  D. Set up a Git repository to store test events. Provide the developers with access to the repository.
  A. Export test events as JSON files. Store the files in an Amazon S3 bucket. Configure granular IAM permissions to allow the developers to access the S3 bucket.

  ---

  Explanation

  Comprehensive and Detailed Step-by-Step Explanation:

  Option A: Use Amazon S3 for Shared Test Events:

  Storing JSON test event files in an S3 bucket provides a centralized, cost-effective, and highly available solution.

  Granular IAM policies can restrict access to specific developers or roles, ensuring security while maintaining consistency for shared test events.

  This solution has minimal operational overhead and integrates easily with existing workflows.

  Why Other Options Are Incorrect:

  Option B: Using DynamoDB and a Lambda function introduces unnecessary complexity for a relatively simple requirement. S3 provides a simpler and more cost-efficient solution.

  Option C: AWS Lambda test events are not inherently shareable across developers, making this option invalid.

  Option D: Using a Git repository adds operational overhead and requires developers to clone /update repositories for access, which is more cumbersome compared to S3.

  References:

  Amazon S3 for Centralized Storage