View Full Amazon AWS Certified Developer – Associate DVA-C02 Exam Dumps and Practice Test Dumps.

Question 241

A developer wants to ensure that a Lambda function can access a private resource in a VPC. Which configuration is required?

1. Attach an Elastic IP directly to the Lambda function
2. Configure the Lambda function with appropriate VPC subnets and security groups
3. Make the private resource publicly accessible
4. Disable IAM authentication

Correct Answer: 2

Explanation

A Lambda function can be configured to access resources inside a VPC by attaching the function to appropriate VPC subnets and security groups. The selected subnets determine where the Lambda execution environment connects, while security groups control network traffic. Additional networking configuration may be required depending on whether the function needs access to resources outside the VPC. Lambda does not receive a public IP address simply because it is connected to a VPC. Developers should also ensure that routing and security rules allow the required traffic. Proper VPC configuration therefore enables Lambda to communicate with private AWS resources.

Question 242

A developer needs to securely pass database credentials to an application running on Amazon ECS. Which service is designed to store and manage these credentials?

1. Amazon CloudFront
2. AWS Secrets Manager
3. Amazon Route 53
4. Amazon ECR

Correct Answer: 2

Explanation

AWS Secrets Manager is designed to securely store sensitive information such as database credentials, API keys, and passwords. ECS applications can retrieve secrets at runtime through supported task configuration and IAM permissions, avoiding the need to place credentials directly inside container images. Secrets Manager also supports rotation for supported secrets and can integrate with other AWS services. CloudFront provides content delivery, Route 53 provides DNS services, and ECR stores container images. Secrets Manager is therefore appropriate when sensitive credentials must be securely managed and supplied to an ECS application.

Question 243

A developer wants to prevent an SQS consumer from receiving a message immediately after another consumer has received it. Which setting controls this behavior?

1. Visibility timeout
2. Message retention period
3. Maximum message size
4. Queue encryption

Correct Answer: 1

Explanation

The SQS visibility timeout determines how long a message remains hidden after a consumer receives it. During this period, other consumers normally cannot receive the same message. The consumer should process the message and delete it before the visibility timeout expires. If processing fails or the message is not deleted, it can become visible again for another attempt. Message retention controls how long messages remain in the queue, maximum message size controls payload size, and encryption protects message data. Visibility timeout is therefore the setting that controls temporary message invisibility after receipt.

Question 244

A developer wants to allow users to download private S3 objects for a limited period without giving them AWS credentials. Which solution should be implemented?

1. Public-read bucket policy
2. S3 presigned URL
3. Root user access key
4. Disable S3 Block Public Access

Correct Answer: 2

Explanation

An S3 presigned URL provides temporary access to a specific S3 object without requiring the recipient to have AWS credentials. The URL is generated using credentials with appropriate permissions and includes an expiration time. This allows applications to securely share private objects for a limited period. Making the bucket public or disabling Block Public Access can expose more data than intended. Root credentials should never be distributed to application users. Presigned URLs therefore provide a controlled mechanism for temporary access to private S3 objects while keeping the underlying bucket private.

Question 245

A developer wants to invoke a Lambda function whenever a new record is available in a DynamoDB table’s change stream. Which service integration should be configured?

1. Lambda event source mapping
2. CloudFront distribution
3. S3 lifecycle configuration
4. API Gateway cache

Correct Answer: 1

Explanation

Lambda event source mappings allow Lambda functions to consume records from supported event sources, including DynamoDB Streams. Lambda polls the stream and invokes the function with batches of records according to the configured settings. This supports event-driven processing whenever DynamoDB items are created, updated, or deleted. CloudFront provides content delivery, S3 lifecycle rules manage object storage, and API Gateway caching stores API responses. Event source mapping is therefore the appropriate integration for connecting a Lambda function to a DynamoDB Stream and processing table changes automatically.

Question 246

A developer needs to ensure that an API request is authenticated using a JWT token before API Gateway invokes the backend. Which API Gateway feature can provide this capability for supported APIs?

1. API caching
2. API authorizer
3. API throttling only
4. API mapping only

Correct Answer: 2

Explanation

API Gateway authorization mechanisms can validate client authentication before requests reach the backend integration. Depending on the API type and architecture, developers can use supported authorizers and JWT-based authorization mechanisms to validate tokens and control access. This keeps authentication enforcement at the API layer instead of requiring every backend function to implement the same validation logic. API caching improves response performance, throttling controls request rates, and API mappings help associate custom domains with APIs. An appropriate API authorizer is therefore the correct feature for enforcing authenticated access before backend execution.

Question 247

A developer wants to store an application setting that contains multiple comma-separated values in Systems Manager Parameter Store. Which parameter type is intended for multiple string values?

1. SecureString
2. StringList
3. Binary
4. SecretBinary

Correct Answer: 2

Explanation

Systems Manager Parameter Store provides the StringList parameter type for storing a collection of strings in a single parameter. Applications can retrieve the parameter and parse the values according to their requirements. String parameters are suitable for single text values, while SecureString is intended for encrypted sensitive values. Parameter Store does not use SecretBinary as a standard parameter type for this purpose. StringList is therefore appropriate when developers need to maintain several related string values within one parameter while keeping configuration centralized and accessible through controlled IAM permissions.

Question 248

A developer wants to execute a Lambda function with a maximum execution time of five minutes. Which configuration should be changed?

1. Lambda timeout
2. Lambda alias
3. Lambda layer
4. Lambda destination

Correct Answer: 1

Explanation

The Lambda timeout setting determines the maximum amount of time a function can run before AWS terminates the invocation. Developers should configure the timeout based on the expected processing duration of the workload while avoiding unnecessarily long limits. A timeout that is too short can cause legitimate operations to fail, while an excessively long timeout can delay failure detection. Lambda aliases manage version references, layers package reusable dependencies, and destinations route asynchronous invocation results. The Lambda timeout is therefore the setting that should be changed when controlling the maximum execution duration of a function.

Question 249

A developer needs to process a high volume of application events and retain the events for later consumption by multiple consumers. Which service is designed for this use case?

1. Amazon Kinesis Data Streams
2. Amazon Route 53
3. Amazon ECR
4. Amazon CloudFront

Correct Answer: 1

Explanation

Amazon Kinesis Data Streams is designed for collecting and processing streaming data at scale. Records can remain available for a configured retention period, allowing multiple consumers to process the stream independently according to their application requirements. This makes Kinesis useful for telemetry, clickstreams, application events, and other continuously generated data. Route 53 provides DNS functionality, ECR stores container images, and CloudFront distributes content. Kinesis Data Streams is therefore suitable when an application needs scalable event ingestion with stream retention and multiple independent consumers.

Question 250

A developer wants to avoid storing AWS credentials in an application running on an EC2 instance. Which security mechanism should be used?

1. IAM role attached to the EC2 instance
2. Hardcoded access keys
3. Root account credentials
4. Public IAM policy

Correct Answer: 1

Explanation

An IAM role attached to an EC2 instance provides temporary credentials that applications can retrieve through the instance metadata service. AWS SDKs can automatically discover these credentials through the standard credential provider chain. This removes the need to store long-term access keys in application code or configuration files. Hardcoded credentials can be exposed through source repositories or logs, while root credentials should never be used by application workloads. Public IAM policies also create unnecessary security exposure. An EC2 IAM role is therefore the recommended approach for securely granting applications AWS permissions.

Question 251

A developer wants to retry failed Step Functions tasks automatically before marking the workflow execution as failed. Which feature should be configured?

1. Retry configuration in the state machine
2. S3 lifecycle policy
3. CloudFront cache policy
4. DynamoDB TTL

Correct Answer: 1

Explanation

AWS Step Functions supports retry behavior within state machine definitions. Developers can configure retry rules for supported states, including the errors that should trigger retries, the number of attempts, and delay behavior between attempts. This allows workflows to recover automatically from transient failures without requiring custom retry logic inside every application component. S3 lifecycle policies manage object retention, CloudFront cache policies control caching behavior, and DynamoDB TTL expires items. Step Functions retry configuration is therefore the appropriate mechanism for automatically retrying failed workflow tasks.

Question 252

A developer wants to execute code whenever a specific EventBridge event pattern matches an incoming event. Which target can be configured?

1. AWS Lambda function
2. S3 storage class
3. DynamoDB partition key
4. IAM password policy

Correct Answer: 1

Explanation

Amazon EventBridge rules can evaluate incoming events against defined event patterns. When an event matches a rule, EventBridge can send it to a configured target such as a Lambda function. This enables loosely coupled event-driven architectures where event producers do not need direct knowledge of consumers. An S3 storage class controls object storage characteristics, a DynamoDB partition key determines data distribution, and IAM password policies manage user password requirements. A Lambda function is therefore an appropriate EventBridge target when application code should execute in response to matching events.

Question 253

A developer wants to limit access to an S3 bucket so that only a specific IAM role can perform operations on it. Which mechanism can be used?

1. S3 bucket policy
2. CloudWatch alarm
3. Lambda layer
4. SQS visibility timeout

Correct Answer: 1

Explanation

An S3 bucket policy is a resource-based policy that can specify which principals are allowed or denied access to a bucket and its objects. A developer can create a policy that grants required S3 actions to a particular IAM role while restricting other access. IAM policies attached to identities can also be used as part of the overall access-control model. CloudWatch alarms monitor metrics, Lambda layers package dependencies, and SQS visibility timeout controls message visibility. An S3 bucket policy is therefore an appropriate mechanism for enforcing resource-level access restrictions on a bucket.

Question 254

A developer wants to reduce the number of requests sent to a backend database when an API receives repeated identical requests. Which technique can help?

1. API response caching
2. Increasing database latency
3. Disabling API monitoring
4. Increasing message retention

Correct Answer: 1

Explanation

API response caching can store responses for frequently repeated requests and return the cached response without contacting the backend for every request. API Gateway provides caching capabilities that can reduce backend workload and improve response latency for suitable read-oriented APIs. Developers should consider cache expiration and whether the underlying data changes frequently before enabling caching. Increasing database latency, disabling monitoring, or increasing message retention does not reduce repeated database queries. API response caching is therefore a suitable technique when repeated requests can safely use previously generated responses.

Question 255

A developer needs to upload objects from a geographically distant client to Amazon S3 and wants to improve transfer performance. Which S3 feature may help accelerate uploads?

1. S3 Transfer Acceleration
2. S3 Object Lock
3. S3 Inventory
4. S3 Select

Correct Answer: 1

Explanation

S3 Transfer Acceleration can improve data transfer performance by using Amazon CloudFront edge locations as optimized network entry points for transfers to S3. It can be useful when clients are geographically distant from the S3 bucket’s Region and network paths have high latency. Object Lock provides retention protection, Inventory generates reports about objects, and S3 Select allows applications to retrieve selected data from supported objects. Transfer Acceleration is therefore the S3 feature to consider when improving upload or download performance for geographically distributed clients.

Question 256

A developer wants to ensure that only one successful update is applied when multiple clients attempt to modify the same DynamoDB item simultaneously. Which technique should be considered?

1. Conditional write
2. S3 multipart upload
3. CloudFront caching
4. SNS fanout

Correct Answer: 1

Explanation

DynamoDB conditional writes allow an application to specify a condition that must be true before a write succeeds. Developers can use conditions based on an item’s current attribute values, such as a version number, to implement optimistic concurrency control. If another client has already changed the item, the condition can fail and the application can handle the conflict appropriately. Multipart upload is an S3 transfer feature, CloudFront caching handles content delivery, and SNS fanout distributes messages. Conditional writes are therefore appropriate when multiple clients may attempt concurrent updates to the same DynamoDB item.

Question 257

A developer wants to monitor an application metric and automatically invoke an action when the metric remains above a threshold for several evaluation periods. Which CloudWatch feature should be used?

1. CloudWatch Logs Insights
2. CloudWatch alarm
3. CloudTrail trail
4. CloudFormation stack

Correct Answer: 2

Explanation

CloudWatch alarms monitor metrics and can evaluate them against configured thresholds over specified evaluation periods. Developers can configure an alarm to enter the ALARM state when a metric remains above or below a defined condition. The alarm can then trigger supported actions such as sending a notification through SNS. Logs Insights is used to query log data, CloudTrail records API activity, and CloudFormation manages infrastructure. A CloudWatch alarm is therefore the appropriate feature when an application metric must be continuously evaluated and an action should occur when a threshold condition is met.

Question 258

A developer wants a containerized application to run without managing EC2 instances. Which AWS compute option is appropriate for ECS?

1. AWS Fargate
2. Amazon EBS
3. Amazon Route 53
4. Amazon S3 Glacier

Correct Answer: 1

Explanation

AWS Fargate provides serverless compute for container workloads running on services such as Amazon ECS. Developers define task requirements and container configurations without needing to provision or manage the underlying EC2 instances. AWS handles the infrastructure required to run the containers. EBS provides block storage, Route 53 provides DNS services, and S3 Glacier is intended for archival storage. Fargate is therefore appropriate when developers want to deploy ECS containers while avoiding direct management of the underlying compute instances.

Question 259

A developer wants to send a notification to an SQS queue when a CloudWatch alarm changes state. Which service can be used between the alarm and the queue?

1. Amazon SNS
2. Amazon ECR
3. Amazon RDS
4. Amazon ElastiCache

Correct Answer: 1

Explanation

Amazon CloudWatch alarms can publish notifications to an SNS topic when their state changes. An SQS queue can subscribe to that SNS topic, allowing the notification to be delivered to the queue for asynchronous processing. This creates a useful decoupled architecture in which monitoring events can be processed by application consumers without requiring them to directly poll CloudWatch. ECR manages container images, RDS provides relational databases, and ElastiCache provides in-memory caching. SNS is therefore an appropriate intermediary for delivering CloudWatch alarm notifications to an SQS queue.

Question 260

A developer wants to configure an application to automatically retry a failed network request while preventing all clients from retrying at exactly the same time. Which approach should be used?

1. Immediate retries without delay
2. Exponential backoff with jitter
3. Infinite retries at a fixed interval
4. Disable all retries

Correct Answer: 2

Explanation

Exponential backoff with jitter is a common strategy for handling transient failures in distributed applications. Exponential backoff increases the delay between retry attempts, while jitter adds a random component to the delay. This prevents large numbers of clients from retrying at exactly the same time and potentially creating another traffic spike. Immediate or fixed-interval retries can cause synchronized retry storms, while infinite retries can consume resources indefinitely. Disabling retries may cause applications to fail unnecessarily when errors are temporary. Exponential backoff combined with jitter therefore provides a resilient retry strategy.