DVA-C01 : AWS Certified Developer Associate : Part 16

DVA-C01 : AWS Certified Developer Associate : Part 16

1. A developer receives the following error message when trying to launch or terminate an Amazon EC2 instance using a boto3 script.

   

   What should the developer do to correct this error message?

   • Assign an IAM role to the EC2 instance to allow ne
   • Implement an exponential backoff algorithm for optimizing the number of API requests made to Amazon EC2.
   • Increase the overall network bandwidth to handle higher API request rates.
   • Upgrade to the latest AWS CLI version so that boto3 can handle higher request rates.

2. A developer is updating an application deployed on AWS Elastic Beanstalk. The new version is incompatible with the old version. To successfully deploy the update, a full cutover to the new, updated version must be performed on all instances at one time, with the ability to roll back changes in case of a deployment failure in the new version.

   How can this be performed with the LEAST amount of downtime?

   • Use the Elastic Beanstalk All at once deployment policy to update all instances simultaneously.
   • Perform an Elastic Beanstalk Rolling with additional batch deployment.
   • Deploy the new version in a new Elastic Beanstalk environment and swap environment URLs.
   • Perform an Elastic Beanstalk Rolling deployment.
   Explanation:

   Elastic Beanstalk has rolled out a couple of features over the last year that make zero-downtime deployment.

3. A developer is writing a web application that must share secure documents with end users. The documents are stored in a private Amazon S3 bucket. The application must allow only authenticated users to download specific documents when requested, and only for a duration of 15 minutes.

   How can the developer meet these requirements?

   • Copy the documents to a separate S3 bucket that has a lifecycle policy for deletion after 15 minutes.
   • Create a presigned S3 URL using the AWS SDK with an expiration time of 15 minutes.
   • Use server-side encryption with AWS KMS managed keys (SSE-KMS) and download the documents using HTTPS.
   • Modify the S3 bucket policy to only allow specific users to download the documents. Revert the change after 15 minutes.

4. A developer wants to send multi-value headers to an AWS Lambda function that is registered as a target with an Application Load Balancer (ALB).

   What should the developer do to achieve this?

   • Place the Lambda function and target group in the same account.
   • Send the request body to the Lambda function with a size less than 1 MB.
   • Include the Base64 encoding status, status code, status description, and headers in the Lambda function.
   • Enable the multi-value headers on the ALB.

5. An ecommerce startup is preparing for an annual sales event. As the traffic to the company’s application increases, the development team wants to be notified when the Amazon EC2 instance’s CPU utilization exceeds 80%.

   Which solution will meet this requirement?

   • Create a custom Amazon CloudWatch alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
   • Create a custom AWS Cloud Trail alarm that sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.
   • Create a cron job on the EC2 instance that executes the –describe-instance-information command on the host instance every 15 minutes and sends the results to an Amazon SNS topic.
   • Create an AWS Lambda function that queries the AWS CloudTrail logs for the CPUUtilization metric every 15 minutes and sends a notification to an Amazon SNS topic when the CPU utilization exceeds 80%.

6. An application running on Amazon EC2 opens connections to an Amazon RDS SQL Server database. The developer does not want to store the user name and password for the database in the code. The developer would also like to automatically rotate the credentials.

   What is the MOST secure way to store and access the database credentials?

   • Create an IAM role that has permissions to access the database. Attach the role to the EC2 instance.
   • Use AWS Secrets Manager to store the credentials. Retrieve the credentials from Secrets Manager as needed.
   • Store the credentials in an encrypted text file in an Amazon S3 bucket. Configure the EC2 instance’s user data to download the credentials from Amazon S3 as the instance boots.
   • Store the user name and password credentials directly in the source code. No further action is needed because the source code is stored in a private repository.

7. A global company has an application running on Amazon EC2 instances that serves image files from Amazon S3. User requests from the browser are causing high traffic, which results in degraded performance.

   Which optimization solution should a developer implement to increase application performance?

   • Create multiple prefixes in the S3 bucket to increase the request rate.
   • Create an Amazon ElastiCache cluster to cache and serve frequently accessed items.
   • Use Amazon CloudFront to serve the content of images stored in Amazon S3.
   • Submit a ticket to AWS Support to request a rate limit increase for the S3 bucket.

8. An application needs to encrypt data that is written to Amazon S3 where the keys are managed in an on-premises data center, and the encryption is handled by S3.

   Which type of encryption should be used?

   • Use server-side encryption with Amazon S3-managed keys
   • Use server-side encryption with AWS KMS-managed keys
   • Use client-side encryption with customer master keys
   • Use server-side encryption with customer-provided keys

9. A development team is working on a mobile app that allows users to upload pictures to Amazon S3. The team expects the app will be used by hundreds of thousands of users during a single event simultaneously. Once the pictures are uploaded, the backend service will scan and parse the pictures for inappropriate content.

   Which approach is the MOST resilient way to achieve this goal, which also smooths out temporary volume spikes for the backend service?

   • Develop an AWS Lambda function to check the upload folder in the S3 bucket. If new uploaded pictures are detected, the Lambda function will scan and parse them.
   • Once a picture is uploaded to Amazon S3, publish the event to an Amazon SQS queue. Use the queue as an event source to trigger an AWS Lambda function. In the Lambda function, scan and parse the picture.
   • When the user uploads a picture, invoke an API hosted in Amazon API Gateway. The API will invoke an AWS Lambda function to scan and parse the picture.
   • Create a state machine in AWS Step Functions to check the upload folder in the S3 bucket. If a new picture is detected, invoke an AWS Lambda function to scan and parse it.

10. A development team wants to run their container workloads on Amazon ECS. Each application container needs to share data with another container to collect logs and metrics.

    What should the development team do to meet these requirements?

    • Create two pod specifications. Make one to include the application container and the other to include the other container. Link the two pods together.
    • Create two task definitions. Make one to include the application container and the other to include the other container. Mount a shared volume between the two tasks.
    • Create one task definition. Specify both containers in the definition. Mount a shared volume between those two containers.
    • Create a single pod specification. Include both containers in the specification. Mount a persistent volume to both containers.

11. A company has 25,000 employees and is growing. The company is creating an application that will be accessible to its employees only. A developer is using Amazon S3 to store images and Amazon RDS to store application data. The company requires that all employee information remain in the legacy Security Assertion Markup Language (SAML) employee directory only and is not interested in mirroring any employee information on AWS.

    How can the developer provide authorized access for the employees who will be using this application so each employee can access their own application data only?

    • Use Amazon VPC and keep all resources inside the VPC, and use a VPC link for the S3 bucket with the bucket policy.
    • Use Amazon Cognito user pools, federate with the SAML provider, and use user pool groups with an IAM policy.
    • Use an Amazon Cognito identity pool, federate with the SAML provider, and use an IAM condition key with a value for the cognito-identity.amazonaws.com:sub variable to grant access to the employees.
    • Create a unique IAM role for each employee and have each employee assume the role to access the application so they can access their personal data only.

12. A company has developed a new serverless application using AWS Lambda functions that will be deployed using the AWS Serverless Application Model (AWS SAM) CLI.

    Which step should the developer complete prior to deploying the application?

    • Compress the application to a .zip file and upload it into AWS Lambda
    • Test the new AWS Lambda function by first tracing it in AWS X-Ray
    • Bundle the serverless application using a SAM package
    • Create the application environment using the eb create my-env command

13. A company stores all personally identifiable information (PII) in an Amazon DynamoDB table named PII in Account A. An application running on Amazon EC2 instances in Account B requires access to the PII table. An administrator in Account A created an IAM role named AccessPII with privileges to access the PII table, and made Account B a trusted entity.

    Which combination of additional steps should developers take to access the table? (Choose two.)

    • Ask an administrator in Account B to allow the EC2 IAM role permission to assume the AccessPII role.
    • Ask an administrator in Account B to allow the EC2 IAM role permission to assume the AccessPII role with predefined service control policies.
    • Ask an administrator in Account A to allow the EC2 IAM role permission to assume the AccessPII role with predefined service control policies.
    • Include the AssumeRole API in the application code logic to obtain credentials to access the PII table.
    • Include the GetSessionToken API in the application code logic to obtain credentials to access the PII table.

14. A developer is creating an AWS Lambda function that generates a new file each time it runs. Each new file must be checked into an AWS CodeCommit repository hosted in the same AWS account.

    How should the developer accomplish this?

    • When the Lambda function starts, use the Git CLI to clone the repository. Check the new file into the cloned repository and push the change.
    • After the new file is created in Lambda, use cURL to invoke the CodeCommit API. Send the file to the repository.
    • Use an AWS SDK to instantiate a CodeCommit client. Invoke the put_file method to add the file to the repository.
    • Upload the new to an Amazon S3 bucket. Create an AWS Step Function to accept S3 events. In the Step Function, add the new file to the repository.

15. A developer must ensure that the IAM credentials used by an application in Amazon EC2 are not misused or compromised.

    What should the developer use to keep user credentials secure?

    • Environment variables
    • AWS credentials file
    • Instance profile credentials
    • Command line options

16. A company has an application where reading objects from Amazon S3 is based on the type of user. The user types are registered user and guest user. The company has 25,000 users and is growing. Information is pulled from an S3 bucket depending on the user type.

    Which approaches are recommended to provide access to both user types? (Choose two.)

    • Provide a different access key and secret access key in the application code for registered users and guest users to provide read access to the objects.
    • Use S3 bucket policies to restrict read access to specific IAM users.
    • Use Amazon Cognito to provide access using authenticated and unauthenticated roles.
    • Create a new IAM user for each user and grant read access.
    • Use the AWS IAM service and let the application assume the different roles using the AWS Security Token Service (AWS STS) AssumeRole action depending on the type of user and provide read access to Amazon S3 using the assumed role.

17. A developer is testing an application that invokes an AWS Lambda function asynchronously. During the testing phase, the Lambda function fails to process after two retries.

    How can the developer troubleshoot the failure?

    • Configure AWS CloudTrail logging to investigate the invocation failures
    • Configure Dead Letter Queues by sending events to Amazon SQS for investigation
    • Configure Amazon Simple Workflow Service to process any direct unprocessed events
    • Configure AWS Config to process any direct unprocessed events

18. A developer is setting up Amazon API Gateway for their company’s products. The API will be used by registered developers to query and update their environments. The company wants to limit the amount of requests end users can send for both cost and security reasons. Management wants to offer registered developers the option of buying larger packages that allow for more requests.

    How can the developer accomplish this with the LEAST amount of overhead management?

    • Enable throttling for the API Gateway stage. Set a value for both the rate and burst capacity. If a registered user chooses a larger package, create a stage for them, adjust the values, and share the new URL with them.
    • Set up Amazon CloudWatch API logging in API Gateway. Create a filter based on the user and requestTime fields and create an alarm on this filter. Write an AWS Lambda function to analyze the values and requester information, and respond accordingly. Set up the function as the target for the alarm. If a registered user chooses a larger package, update the Lambda code with the values.
    • Enable Amazon CloudWatch metrics for the API Gateway stage. Set up CloudWatch alarms based off the Count metric and the ApiName, Method, Resource, and Stage dimensions to alerts when request rates pass the threshold. Set the alarm action to Deny. If a registered user chooses a larger package, create a user-specific alarm and adjust the values.
    • Set up a default usage plan, specify values for the rate and burst capacity, and associate it with a stage. If a registered user chooses a larger package, create a custom plan with the appropriate values and associate the plan with the user.

19. A developer is refactoring a monolithic application. The application takes a POST request and performs several operations. Some of the operations are in parallel while others run sequentially. These operations have been refactored into individual AWS Lambda functions. The POST request will be processed by Amazon API Gateway.

    How should the developer invoke the Lambda functions in the same sequence using API Gateway?

    • Use Amazon SQS to invoke the Lambda functions
    • Use an AWS Step Functions activity to run the Lambda functions
    • Use Amazon SNS to trigger the Lambda functions
    • Use an AWS Step Functions state machine to orchestrate the Lambda functions

20. A company is adding stored value (or gift card) capability to its highly popular casual gaming website. Users need to be able to trade this value for other users’ items on the platform. This would require both users’ records be updated as a single transaction, or both users’ records to be completely rolled back.

    Which AWS database options can provide the transactional capability required for this new feature? (Choose two.)

    • Amazon DynamoDB with operations made with the ConsistentRead parameter set to true
    • Amazon ElastiCache for Memcached with operations made within a transaction block
    • Amazon Aurora MySQL with operations made within a transaction block
    • Amazon DynamoDB with reads and writes made using Transact* operations
    • Amazon Redshift with operations made within a transaction block.