Amazon AWS Certified Developer - Associate DVA-C02 Exam Questions

Page: 1 / 14
Total 600 questions

Want more questions? Get Premium Access.
()

Question 1

A company has an application that receives batches of orders from partners every day. The application uses an AWS Lambda function to process the batches.

If a batch contains no orders, the Lambda function must publish to an Amazon SNS topic as soon as possible.

Which combination of steps will meet this requirement with the LEAST implementation effort? (Select TWO.)

AUpdate the existing Lambda function's code to send an Amazon CloudWatch custom metric for the number of orders in a batch for each partner.

BCreate a new Lambda function as an Amazon Kinesis data stream consumer. Configure the new Lambda function to track orders and to publish to the SNS topic when a batch contains no orders.

CSet up an Amazon CloudWatch alarm that will send a notification to the SNS topic when the value of the custom metric is 0.

DSchedule a new Lambda function to analyze Amazon CloudWatch metrics every 24 hours to identify batches that contain no orders. Configure the Lambda function to publish to the SNS topic.

EModify the existing Lambda function to log orders to an Amazon Kinesis data stream.

Answer : A, C

The least implementation effort is to publish a custom CloudWatch metric from the existing Lambda function that records the number of orders in each batch, then create a CloudWatch alarm that sends a notification to the SNS topic when the metric value is 0. This avoids building a separate stream-processing pipeline or scheduled analytics job. A new Kinesis consumer and Lambda function would add unnecessary services and operational complexity. A 24-hour scheduled function is also slower than required because the notification must happen as soon as possible. Logging to Kinesis only creates more data movement and still requires separate analysis logic. CloudWatch supports custom metrics, and CloudWatch alarms can send notifications through Amazon SNS when metric thresholds are breached. (AWS Documentation)

===============

Question 2

A developer is testing an AWS Lambda function by using the AWS SAM local CLI. The application that is implemented by the Lambda function makes several AWS API calls by using the AWS SDK. The developer wants to allow the function to make AWS API calls in a test AWS account from the developer's laptop.

What should the developer do to meet these requirements?

AEdit the template.yml file. Add the AWS_ACCESS_KEY_ID property and the AWS_SECRET_ACCESS_KEY property in the Globals section.

BAdd a test profile by using the aws configure command with the --profile option. Run AWS SAM by using sam local invoke with the --profile option.

CEdit the template.yml file. For the AWS::Serverless::Function resource, set the role to an IAM role in the AWS account.

DRun the function by using sam local invoke. Override the AWS_ACCESS_KEY_ID parameter and the AWS_SECRET_ACCESS_KEY parameter by specifying the --parameter-overrides option.

Answer : B

When using AWS SAM local (sam local invoke, sam local start-api), the Lambda code runs in a local container on the developer's machine. If that code uses the AWS SDK to call AWS services, it needs AWS credentials available in the local environment. The recommended way is to rely on the AWS SDK's standard credential provider chain, which includes credentials stored by the AWS CLI in ~/.aws/credentials and selected via a named profile.

By running aws configure --profile , the developer creates a dedicated set of access keys (and optionally a session token/region) for the test account. Then, running SAM with sam local invoke --profile causes SAM to supply those credentials to the local container so the function can authenticate to AWS and make real API calls in the intended test account. This approach is clean, repeatable, and avoids hardcoding secrets into templates or source code.

Option A is insecure and not the intended use of SAM templates; templates are infrastructure definitions, not secret stores. Option C sets the Lambda execution role for deployed functions in AWS, but it does not automatically grant credentials to code running locally on a laptop. Option D misuses --parameter-overrides, which is meant for overriding template parameters at deployment/build time, not for securely injecting AWS access keys into local execution.

Therefore, the correct approach is B: configure an AWS CLI profile and run SAM local with the --profile option so the Lambda code can call AWS APIs in the test account using standard credential handling.

Question 3

A developer is configuring an applications deployment environment in AWS CodePipeine. The application code is stored in a GitHub repository. The developer wants to ensure that the repository package's unit tests run in the new deployment environment. The deployment has already set the pipeline's source provider to GitHub and has specified the repository and branch to use in the deployment.

When combination of steps should the developer take next to meet these requirements with the least the LEAST overhead' (Select TWO).

ACreate an AWS CodeCommt project. Add the repository package's build and test commands to the protects buildspec

BCreate an AWS CodeBuid project. Add the repository package's build and test commands to the projects buildspec

CCreate an AWS CodeDeploy protect. Add the repository package's build and test commands to the project's buildspec

DAdd an action to the source stage. Specify the newly created project as the action provider. Specify the build attract as the actions input artifact.

EAdd a new stage to the pipeline alter the source stage. Add an action to the new stage. Speedy the newly created protect as the action provider. Specify the source artifact as the action's input artifact.

Answer : B, E

This solution will ensure that the repository package's unit tests run in the new deployment environment with the least overhead because it uses AWS CodeBuild to build and test the code in a fully managed service, and AWS CodePipeline to orchestrate the deployment stages and actions. Option A is not optimal because it will use AWS CodeCommit instead of AWS CodeBuild, which is a source control service, not a build and test service. Option C is not optimal because it will use AWS CodeDeploy instead of AWS CodeBuild, which is a deployment service, not a build and test service. Option D is not optimal because it will add an action to the source stage instead of creating a new stage, which will not follow the best practice of separating different deployment phases.

Question 4

A developer built an application that calls an external API to obtain data, processes the data, and saves the result to Amazon S3. The developer built a container image with all of the necessary dependencies to run the application as a container.

The application runs locally and requires minimal CPU and RAM resources. The developer has created an Amazon ECS cluster. The developer needs to run the application hourly in Amazon ECS.

Which solution will meet these requirements with the LEAST amount of infrastructure management overhead?

AAdd a capacity provider to manage instances.

BAdd an Amazon EC2 instance that runs the application.

CDefine a task definition with an AWS Fargate launch type.

DCreate an Amazon ECS cluster and add the managed node groups feature to run the application.

Answer : C

To run a containerized job hourly in ECS with minimal infrastructure management, the best choice is AWS Fargate. Fargate is a serverless compute engine for containers that runs ECS tasks without the developer needing to provision, patch, or scale EC2 instances.

With option C, the developer defines an ECS task definition using the Fargate launch type and schedules it (commonly via Amazon EventBridge Scheduler / EventBridge rule triggering RunTask). ECS handles the placement, networking, and execution of the task on managed infrastructure. This is the least operational overhead approach because there are no instances to manage and no capacity planning required, which fits an hourly job with small CPU/RAM needs.

Option A (capacity providers) is primarily for managing EC2 capacity for ECS and still requires underlying instances, which increases operational burden.

Option B runs the app on an EC2 instance, which requires instance lifecycle management, OS patching, scaling considerations, and failure handling.

Option D refers to managed node groups (an EKS concept) and does not apply cleanly to ECS. Even in a Kubernetes context, nodes still need management compared to Fargate.

Therefore, defining a Fargate task is the simplest and lowest-management solution.

Question 5

A developer is writing an application that will provide data files to an external company. The external company needs to verify that the data is not modified in transit.

How can the developer use AWS KMS to prove the integrity of the transferred data?

AEncrypt the data by using a symmetric key. Provide the key to the external company.

BSign the data by using a symmetric key. Provide the key to the external company.

CSign the data by using the private key of an asymmetric key pair. Provide the public key to the external company.

DSign the data by using the public key of an asymmetric key pair. Provide the private key to the external company.

Answer : C

To prove integrity (and authenticity) of data in transit, the correct cryptographic primitive is a digital signature. AWS KMS supports signing and verification operations using asymmetric KMS keys designed for signing (for example, RSA_SIGN_PSS, RSA_SIGN_PKCS1, or ECC_NIST_P256 key specs). The developer signs the data (or more commonly, a hash of the data) using the private key, and the external recipient verifies the signature using the corresponding public key. If the data is modified in transit, signature verification fails, proving the content was changed.

Option C exactly describes this model: sign with the private key, share the public key. The private key remains protected (ideally never leaving KMS). The public key can be distributed safely because it cannot be used to forge signatures.

Option A (encryption) provides confidentiality, not integrity proof to a third party, and sharing a symmetric encryption key is insecure and breaks key management principles.

Option B is incorrect because symmetric keys do not provide non-repudiation and generally require the verifier to possess the same secret key, which would allow the verifier to forge signatures too. While HMAC can validate integrity between trusted parties, it does not meet the typical ''prove integrity'' requirement to an external party without sharing a secret.

Option D is backward and insecure: you never share a private key.

Therefore, use an asymmetric KMS signing key to sign with the private key and provide the public key for verification.

Question 6

A developer is preparing to begin development of a new version of an application. The previous version of the application is deployed in a production environment. The developer needs to deploy fixes and updates to the current version during the development of the new version of the application. The code for the new version of the application is stored in AWS CodeCommit.

Which solution will meet these requirements?

AFrom the main branch, create a feature branch for production bug fixes. Create a second feature branch from the main branch for development of the new version.

BCreate a Git tag of the code that is currently deployed in production. Create a Git tag for the development of the new version. Push the two tags to the CodeCommit repository.

CFrom the main branch, create a branch of the code that is currently deployed in production. Apply an IAM policy that ensures no other other users can push or merge to the branch.

DCreate a new CodeCommit repository for development of the new version of the application. Create a Git tag for the development of the new version.

Answer : A

A feature branch is a branch that is created from the main branch to work on a specific feature or task1.Feature branches allow developers to isolate their work from the main branch and avoid conflicts with other changes1.Feature branches can be merged back to the main branch when the feature or task is completed and tested1.

In this scenario, the developer needs to maintain two parallel streams of work: one for fixing and updating the current version of the application that is deployed in production, and another for developing the new version of the application. The developer can use feature branches to achieve this goal.

The developer can create a feature branch from the main branch for production bug fixes. This branch will contain the code that is currently deployed in production, and any fixes or updates that need to be applied to it. The developer can push this branch to the CodeCommit repository and use it to deploy changes to the production environment.

The developer can also create a second feature branch from the main branch for development of the new version of the application. This branch will contain the code that is under development for the new version, and any changes or enhancements that are part of it. The developer can push this branch to the CodeCommit repository and use it to test and deploy the new version of the application in a separate environment.

By using feature branches, the developer can keep the main branch stable and clean, and avoid mixing code from different versions of the application. The developer can also easily switch between branches and merge them when needed.

Question 7

A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS KMS key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to retrieve the data from the S3 bucket.

How can the developer enforce that all requests to retrieve the data provide encryption in transit?

ADefine a resource-based policy on the S3 bucket to deny access when a request meets the condition 'aws:SecureTransport': 'false'.

BDefine a resource-based policy on the S3 bucket to allow access when a request meets the condition 'aws:SecureTransport': 'false'.

CDefine a role-based policy on the other accounts' roles to deny access when a request meets the condition 'aws:SecureTransport': 'false'.

DDefine a resource-based policy on the KMS key to deny access when a request meets the condition 'aws:SecureTransport': 'false'.

Answer : A

''Encryption in transit'' for S3 means requiring requests to use HTTPS (TLS) rather than HTTP. AWS provides a standard policy condition key, aws:SecureTransport, that evaluates to true when the request is made over SSL/TLS and false when it is not. To enforce TLS for all cross-account GetObject requests, the most reliable control point is the S3 bucket resource-based policy, because the bucket is the resource being accessed and the bucket owner can enforce conditions regardless of which external account is calling.

Option A is the established pattern: add an explicit Deny statement in the bucket policy that denies all S3 actions (or at least s3:GetObject) when aws:SecureTransport is false. An explicit deny overrides any allows, ensuring that even if another account's IAM policy allows access, the request will still be blocked if it is not using HTTPS.

Option B is backwards because it would allow insecure transport rather than deny it.

Option C is weaker because you cannot reliably enforce policies in other accounts (and principals could change roles or permissions). The bucket owner should enforce transport security at the bucket level.

Option D is not the right layer: the KMS key policy controls key usage, but the S3 GetObject transport requirement is best enforced by the S3 bucket policy. Also, S3 access can be denied before KMS is even involved.

Therefore, enforce HTTPS by adding a bucket policy Deny when aws:SecureTransport is false.