Free DVA-C02 practice test: 30 questions with answers

A Lambda execution role provides temporary credentials scoped to the permitted DynamoDB actions, without stored keys. Environment-variable keys are long-lived secrets, and bucket policies and gateway policies do not grant table access.

Fan-out from SNS to multiple SQS queues gives each consumer its own copy and independent processing. Direct HTTP calls couple the producer to each consumer, shared files do not notify consumers, and a single consumer does not give independent copies.

A global secondary index with the order date as key supports efficient queries on that attribute. Capacity changes do not add access paths, scans read the whole table, and duplicating the table creates synchronization work.

S3 event notifications can invoke Lambda for object creation events, which starts the function as each file arrives. Polling adds delay and cost, VPC endpoints do not trigger functions, and layers hold code or libraries.

Initialization outside the handler is reused across warm invocations, and provisioned concurrency keeps environments ready. Adding work to the handler, longer timeouts and disabled logs do not reduce cold-start latency.

Authorizers on API Gateway methods validate tokens before the request reaches the function, which enforces the requirement. A secret in the URL, cache settings and bucket policies do not validate caller identity.

AWS AppConfig manages configuration and feature flags with validation and controlled rollout, and applications can pick up changes without redeployment. The other services archive data, host code repositories and provide DNS.

A synchronous invocation waits for the callee to finish and returns its response, which fits a wait-for-result pattern. Asynchronous invocation returns immediately, while polling a bucket or sending email are indirect and fragile.

Returning CORS headers for the app's origin and answering pre-flight OPTIONS requests with the allowed methods and headers lets the browser make the call safely. Allowing every origin with credentials, disabling HTTPS and bucket policies do not provide that safe, scoped access.

The user pool issues ID and access tokens after authentication, and the API can validate them with a Cognito authorizer. Random strings, passwords sent per request and embedded API keys do not prove the authenticated user's identity.

Specifying the KMS key on upload, or setting it as the bucket default, applies SSE-KMS with the customer managed key. Unencrypted uploads, passwords in object names and root keys do not meet the requirement.

A customer managed key requires the role to have kms:Decrypt permission through the key policy or IAM, in addition to permission to read the secret. Timeouts, endpoints and aliases do not address decryption permission.

CloudTrail records API activity across the account and can deliver logs to S3 for central retention. CloudFront logs cover content requests, Budgets tracks cost, and Polly is a speech service.

Parameterized queries keep user input separate from the query structure, which prevents injection. Removing validation, adding memory and publishing logs do not address injection.

ECS task definitions can reference secrets from Secrets Manager or Parameter Store so the value is injected at runtime and not stored in plain text. Plain environment variables, images and logs expose the password.

Retrieving secrets at runtime from a managed store keeps them out of code and configuration, and scanning catches accidental commits. Plain environment variables, committed env files and logged secrets all expose values.

X-Ray traces show the timing of each segment and subsegment within a request, including external calls. Pricing, dashboards and advisory checks do not show per-call timing.

Logs Insights can filter log events by a field such as request ID over a time window quickly. Manual scrolling is slow, deleting logs destroys evidence, and CPU metrics do not locate a specific request.

Throttling on a single partition can happen even when total capacity looks sufficient, because each partition has its own throughput limit. A key design with better distribution fixes this. Attribute counts, regions and memory are not the usual cause.

DAX is an in-memory cache for DynamoDB that reduces read latency and load for frequently read items. The other services serve email, backup and ad hoc analytics.

Exponential backoff with jitter spreads retries over time and reduces the chance of repeated throttling. Immediate retries and unlimited parallel bursts make throttling worse, and disabling retries pushes failures to users.

Larger batch sizes and batching windows let one invocation process many messages, which lowers invocation count and cost. Disabling the mapping stops processing, longer timeouts do not reduce invocations, and separate functions multiply them.

CloudFront metrics and real-time logs show request and latency data from edge locations for a distribution. The other services are unrelated to API latency.

Aliases with weighted routing shift a percentage of invocations to a new version and allow gradual promotion. Deleting old versions, live editing and disabling logs remove safeguards.

The CodeBuild service role supplies temporary credentials scoped to the ECR push permission, which avoids stored keys. Keys in buildspec, root passwords and public repositories all create security problems.

CodeDeploy can roll back automatically when a deployment fails, including when health checks fail, which limits the impact. Deleting the appspec file, disabling health checks and running all at once remove the safeguard.

CodePipeline orchestrates source, build, test and deploy stages, which can include CodeBuild and CloudFormation. The other services provide identity, data integration and simple hosting.

Parameters and per-environment overrides keep one template for both environments and avoid drift between two hand-edited versions. Hard-coded production values and spreadsheets are error-prone.

SAM extends CloudFormation and transforms its templates into standard CloudFormation during deployment, and change sets preview updates before they run. SAM supports the CLI, stacks can be updated, and SAM creates functions automatically from the template.

A failed rollback usually needs the underlying cause fixed, after which the rollback can continue or specific resources can be skipped. Deleting without checking, duplicating the name and ignoring the state can leave resources orphaned or the stack inconsistent.