DVA-C02 sample exam questions

AWS SAM extends CloudFormation with a short YAML syntax for serverless resources. CloudFormation has no serverless intrinsic functions, Elastic Beanstalk runs applications on servers, and AWS CDK defines infrastructure in programming languages.

AWS CodeCommit is a source control repository for program code, which can be a pipeline's source. CodeDeploy deploys, CodeArtifact stores packages, and CodeGuru reviews code. AWS has since limited CodeCommit for new customers, so this question reflects an older recommendation.

Rolling with additional batch adds one new instance first, so capacity stays at five during deployment. Rolling with a batch size of 2 drops capacity to 3, traffic splitting doubles instances for longer, and keeping six instances costs more all the time.

An ALB handles HTTP and HTTPS and passes the client's address in the X-Forwarded-For header. An NLB does not use HTTP headers, and registering targets by instance ID alone does not give an application the client IP in this case.

A KMS key with a role and key policy can generate a data key to encrypt data before writing to /tmp. Lambda does not use EBS volumes, a key generated with OpenSSL is not managed or protected, and on-premises HSM calls add latency and complexity.

AWS Elastic Beanstalk deploys, scales and manages Ruby applications and hides the infrastructure. CodeDeploy only deploys code, CloudFormation requires defining resources, and OpsWorks requires configuration management knowledge.

A secure string in Parameter Store with a dynamic reference keeps sensitive data out of the template. A CloudFormation parameter does not store it securely, and S3 or EFS downloads do not integrate this way and need separate protection.

An Export in the Outputs section with Fn::ImportValue in other templates is CloudFormation's built-in way to reference across stacks. There is no Exported property or ImportResource for this, a custom resource adds work, and Fn::Include would not reference the existing bucket.

Encrypt the file with the plaintext data key and a symmetric algorithm, then keep only the encrypted key for later decryption. A plaintext key must never be stored on disk, and the KMS Encrypt API handles only up to 4 KB of data.

X-Ray active tracing records calls from a function to other services with no code changes for this basic view. CloudTrail records API activity rather than timing, AWS Config tracks resource configuration, and function logs do not show traffic between services.

AWS X-Ray works with API Gateway, Lambda and DynamoDB, and its service map shows bottlenecks across the application. Logs and metrics in the other options each cover only part of the application or require more work.

AWS AppConfig deploys configuration changes gradually with no downtime, and the agent retrieves them for ECS, with a canary strategy to limit risk. CodeDeploy and CDK deploy new code, ECSCanary10Percent15Minutes is not a launch type, and a Lambda function checked by an alarm is not a configuration system.

The X-Ray SDK instruments each microservice, and the service map gives an end-to-end view of requests. CloudWatch shows logs and metrics rather than traces, CloudTrail records API calls, and AWS Health covers AWS service health.

VPC Flow Logs show traffic reaching the load balancer's network interfaces and whether it was accepted. Route 53 logs show DNS queries rather than connections, and Systems Manager and CloudWatch agent logs are about instances.

A Lambda@Edge function can perform field-level asymmetric encryption with a public key, so only parts of the application with the private key can decrypt. AWS WAF and self-managed keys do not provide this, CloudFront's own field-level encryption does not use KMS keys, and HTTPS and signed URLs do not limit decryption.