Question 1

A company is using Amazon API Gateway to manage its public-facing API. The CISO requires that the APIs be used by test account users only. What is the MOST secure way to restrict API access to users of this particular AWS account?

Accepted Answer

API Gateway resource policies can be used to restrict access to specific AWS accounts, ensuring that only users from the test account can access the API.

Question 2

An application needs to encrypt data that is written to Amazon S3 where the keys are managed in an on-premises data center, and the encryption is handled by S3. Which type of encryption should be used?

Accepted Answer

The answer of An application needs to encrypt data that...

Question 3

A Developer is trying to monitor an application's status by running a cron job that returns 1 if the service is up and 0 if the service is down. The Developer created code that uses an AWS CLI put-metric-alarm command to publish the custom metrics to Amazon CloudWatch and create an alarm. However, the Developer is unable to create an alarm as the custom metrics do not appear in the CloudWatch console. What is causing this issue?

Accepted Answer

The Developer needs to use the put-metric-data command to publish custom metrics to CloudWatch. The put-metric-alarm command is used to create alarms based on existing metrics.

Question 4

A Developer needs to create an application that supports Security Assertion Markup Language (SAML) and Facebook authentication. It must also allow access to AWS services, such as Amazon DynamoDB. Which AWS service or feature will meet these requirements with the LEAST amount of additional coding?

Accepted Answer

The answer of A Developer needs to create an application...

Question 5

An application has the following requirements: Performance efficiency of seconds with up to a minute of latency. The data storage size may grow up to thousands of terabytes. Per-message sizes may vary between 100 KB and 100 MB. Data can be stored as key/value stores supporting eventual consistency. What is the MOST cost-effective AWS service to meet these requirements?

Accepted Answer

Amazon DynamoDB is a key-value store that provides fast and consistent performance, with eventual consistency for large data sets. It can handle data sizes up to thousands of terabytes and supports per-message sizes between 100 KB and 100 MB.

Question 6

A development team uses AWS Elastic Beanstalk for application deployment. The team has configured the application version lifecycle policy to limit the number of application versions to 25. However, even with the lifecycle policy, the source bundle is deleted from the Amazon S3 source bucket. What should a developer do in the Elastic Beanstalk application version lifecycle settings to retain the source code in the S3 bucket?

Accepted Answer

Setting Retention to "Retain source bundle in S3" ensures that the source code is not deleted from the S3 bucket even when the application version lifecycle policy deletes old versions.

Question 7

A developer must ensure that the IAM credentials used by an application in Amazon EC2 are not misused or compromised. What should the developer use to keep user credentials secure?

Accepted Answer

The answer of A developer must ensure that the IAM...

Question 8

A Developer has written code for an application and wants to share it with other Developers on the team to receive feedback. The shared application code needs to be stored long-term with multiple versions and batch change tracking. Which AWS service should the Developer use?

Accepted Answer

AWS CodeCommit is a fully managed source control service that makes it easy for teams to host secure and scalable Git repositories. It is ideal for storing application code long-term with version control and change tracking.

Question 9

A development team is building a new application that will run on Amazon EC2 and use Amazon DynamoDB as a storage layer. The developers all have assigned IAM user accounts in the same IAM group. The developers currently can launch EC2 instances, and they need to be able to launch EC2 instances with an instance role allowing access to Amazon DynamoDB. Which AWS IAM changes are needed when creating an instance role to provide this functionality?

Accepted Answer

The correct setup involves creating a permissions policy for the role that allows access to DynamoDB, a trust policy that allows EC2 to assume the role, and a permissions policy for the developers to use the iam:PassRole permission.

Question 10

A Developer registered an AWS Lambda function as a target for an Application Load Balancer (ALB) using a CLI command. However, the Lambda function is not being invoked when the client sends requests through the ALB. Why is the Lambda function not being invoked?

Accepted Answer

The Lambda function needs to have the correct permissions set to allow the ALB to invoke it. This is typically done by adding a resource-based policy to the Lambda function that grants the ALB permission to invoke it.

Question 11

A company's fleet of Amazon EC2 instances receives data from millions of users through an API. The servers batch the data, add an object for each user, and upload the objects to an S3 bucket to ensure high access rates. The object attributes are Customer ID, Server ID, TS-Server (TimeStamp and Server ID), the size of the object, and a timestamp. A Developer wants to find all the objects for a given user collected during a specified time range. After creating an S3 object created event, how can the Developer achieve this requirement?

Accepted Answer

Using Amazon DynamoDB with Customer ID as the partition key and TS-Server as the sort key allows efficient querying of objects for a specific user within a specified time range.

Question 12

A Developer is preparing a deployment package using AWS CloudFormation. The package consists of two separate templates: one for the infrastructure and one for the application. The application has to be inside the VPC that is created from the infrastructure template. How can the application stack refer to the VPC created from the infrastructure template?

Accepted Answer

The Ref function can be used to import resources from other stacks into the current stack. In this case, the application stack can use the Ref function to import the VPC created in the infrastructure stack.

Question 13

Given the following AWS CloudFormation template:  What is the MOST efficient way to reference the new Amazon S3 bucket from another AWS CloudFormation template?

Accepted Answer

The answer of Given the following AWS CloudFormation template: ...

Question 14

A development team is designing a mobile app that requires multi-factor authentication. Which steps should be taken to achieve this? (Choose two.)

Accepted Answer

The answer of A development team is designing a mobile...

Question 15

A Developer needs to deploy an application running on AWS Fargate using Amazon ECS. The application has environment variables that must be passed to a container for the application to initialize. How should the environment variables be passed to the container?

Accepted Answer

Environment variables for containers in Amazon ECS are specified in the task definition under the environment parameter.

Question 16

A company requires that AWS Lambda functions written by Developers log errors so System Administrators can more effectively troubleshoot issues. What should the Developers implement to meet this need?

Accepted Answer

The answer of A company requires that AWS Lambda functions...

Question 17

A development team is working on a mobile app that allows users to upload pictures to Amazon S3. The team expects the app will be used by hundreds of thousands of users during a single event simultaneously. Once the pictures are uploaded, the backend service will scan and parse the pictures for inappropriate content. Which approach is the MOST resilient way to achieve this goal, which also smooths out temporary volume spikes for the backend service?

Accepted Answer

Using Amazon SQS allows for decoupling and buffering of requests, which helps handle temporary volume spikes by queuing the events and processing them asynchronously with AWS Lambda.

Question 18

What is required to trace Lambda-based applications with AWS X-Ray?

Accepted Answer

The answer of What is required to trace Lambda-based applications...

Question 19

A developer converted an existing program to an AWS Lambda function in the console. The program runs properly on a local laptop, but shows an "Unable to import module" error when tested in the Lambda console. Which of the following can fix the error?

Accepted Answer

The answer of A developer converted an existing program to...

Question 20

A developer is provided with an HTTPS clone URL for an AWS CodeCommit repository. What needs to be configured before cloning this repository?

Accepted Answer

The Git credential helper needs to be configured to use an AWS credential profile to authenticate with AWS CodeCommit when using an HTTPS clone URL.

Exam 6: AWS Certified Developer Associate (DVA-C01)