DVA-C01 Online Practice Questions and Answers

A Developer is creating an Auto Scaling group whose instances need to publish a custom metric to Amazon CloudWatch. Which method would be the MOST secure way to authenticate a CloudWatch PUT request?

A. Create an IAM user with PutMetricData permission and put the user credentials in a private repository; have applications pull the credentials as needed.

B. Create an IAM user with PutMetricData permission, and modify the Auto Scaling launch configuration to inject the user credentials into the instance user data.

C. Modify the CloudWatch metric policies to allow the PutMetricData permission to instances from the Auto Scaling group.

D. Create an IAM role with PutMetricData permission and modify the Auto Scaling launching configuration to launch instances using that role.

An application stops working with the following error: The specified bucket does not exist. Where is the BEST place to start the root cause analysis?

A. Check the Elastic Load Balancer logs for DeleteBucket requests.

B. Check the application logs in Amazon CloudWatch Logs for Amazon S3 DeleteBucket errors.

C. Check AWS X-Ray for Amazon S3 DeleteBucket alarms.

D. Check AWS CloudTrail for a DeleteBucket event.

A company is developing an application that will run on several Amazon EC2 instances in an Auto Scaling group and can access a database running on Amazon EC2. The application needs to store secrets required to connect to the database. The application must allow for periodic secret rotation, and there should be no changes to the application when a secret changes.

What is the SAFEST way to meet these requirements?

A. Associate an IAM role to the EC2 instance where the application is running with permission to access the database.

B. Use AWS Systems Manager Parameter Store with the SecureString data type to store secrets.

C. Configure the application to store secrets in Amazon S3 object metadata.

D. Hard code the database secrets in the application code itself.

A Development team would like to migrate their existing application code from a GitHub repository to AWS CodeCommit. What needs to be created before they can migrate a cloned repository to CodeCommit over HTTPS?

A. A GitHub secure authentication token

B. A public and private SSH key file

C. A set of Git credentials generated from IAM

D. An Amazon EC2 IAM role with CodeCommit permissions

A Developer has written a serverless application using multiple AWS services. The business logic is written as a Lambda function which has dependencies on third-party libraries. The Lambda function endpoints will be exposed using Amazon API Gateway. The Lambda function will write the information to Amazon DynamoDB.

The Developer is ready to deploy the application but must have the ability to rollback. How can this deployment be automated, based on these requirements?

A. Deploy using Amazon Lambda API operations to create the Lambda function by providing a deployment package.

B. Use an AWS CloudFormation template and use CloudFormation syntax to define the Lambda function resource in the template.

C. Use syntax conforming to the Serverless Application Model in the AWS CloudFormation template to define the Lambda function resource.

D. Create a bash script which uses AWS CLI to package and deploy the application.

A Developer has an application that must accept a large amount of incoming data streams and process the data before sending it to many downstream users. Which serverless solution should the Developer use to meet these requirements?

A. Amazon RDS MySQL stored procedure with AWS Lambda

B. AWS Direct Connect with AWS Lambda

C. Amazon Kinesis Data Streams with AWS Lambda

D. Amazon EC2 bash script with AWS Lambda

Two containerized microservices are hosted on Amazon EC2 ECS. The first microservice reads an Amazon RDS Aurora database instance, and the second microservice reads an Amazon DynamoDB table. How can each microservice be granted the minimum privileges?

A. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.

B. Set ECS_ENABLE_TASK_IAM_ROLE to false on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.

C. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Run the first microservice with an IAM role for ECS tasks with read-only access for the Aurora database. Run the second microservice with an IAM role for ECS tasks with read-only access to DynamoDB.

D. Set ECS_ENABLE_TASK_IAM_ROLE to true on EC2 instance boot in the ECS agent configuration file. Grant the instance profile role read-only access to the Aurora database and DynamoDB.

A development team uses AWS Elastic Beanstalk to deploy a Java-based web application. The team wants to ensure that the changes to the source code and the configuration are always deployed on new instances. The team updates. However, an error occurs the first time a change is deployed with the new update policy.

What is the MOST likely cause of this issue?

A. Immutable updates are not supported for Java-based applications.

B. The account has reached its on-demand instance limit.

C. Immutable updates are only supported for m4.large and larger instance types.

D. The developer must also modify the .ebextensions/immutable-updates.config file to enable immutable updates.

A developer is debugging an AWS Lambda function behind an Amazon API Gateway. Whenever the API Gateway endpoint is called, HTTP status code 200 is returned even though AWS Lambda is recording a 4xx error. What change needs to be made to return a proper error code through the API Gateway?

A. Enable CORS in the API Gateway method settings

B. Use a Lambda proxy integration to return HTTP codes and headers

C. Enable API Gateway error pass-through.

D. Return the value in the header x-Amzn-ErrorType.

A developer is running an application on an Amazon EC2 instance. When the application tries to read an Amazon S3 bucket the application fails. The developer notices that the associated IAM role is missing the S3 read permission. The developer needs to give the application the ability to read the S3 bucket.

Which solution will meet this requirement with the LEAST application disruption?

A. Add the permission to the role. Terminate the existing EC2 instance. Launch a new EC2 instance

B. Add the permission to the role so that the change will take effect automatically

C. Add the permission to the role. Hibernate and restart the existing EC2 instance.

D. Add the permission to the S3 bucket. Restart the EC2 instance.