Question 1

A company has an application that consists of different microservices that run inside an AWS account. The microservices are running in containers inside a single VPC. The number of microservices is constantly increasing. A developer must create a central logging solution for application logs.

ACreate a different Amazon CloudWatch Logs stream for each microservice.

BCreate an AWS CloudTrail trail to log all the API calls.

CConfigure VPC Flow Logs to track the communications between the microservices.

DUse AWS Cloud Map to map the interactions of the microservices.

Answer : A

To create a central logging solution for microservices, using Amazon CloudWatch Logs is a recommended and effective approach. Here's why:

Amazon CloudWatch Logs Streams allow you to centralize logs from different services, which is crucial as the number of microservices increases.

Each microservice can have its own dedicated log stream within Amazon CloudWatch Logs, providing clear segregation of logs while still allowing centralized management.

This setup enables developers to monitor, search, and analyze logs efficiently using tools like CloudWatch Insights.

Other options like CloudTrail (B) are designed for API activity monitoring, not application logs. VPC Flow Logs (C) focus on network traffic rather than application behavior. AWS Cloud Map (D) is for service discovery and routing, not logging.

Reference: AWS CloudWatch Logs documentation

Question 2

A company has a website that is developed in PHP and is launched using AWS Elastic Beanstalk. There is a new version of the website that needs to be deployed in the Elastic Beanstalk environment. The company cannot tolerate having the website offline if an update fails. Deployments must have minimal impact and rollback as soon as possible.

AAll at once

BRolling

CSnapshots

DImmutable

Answer : D

The Immutable deployment method is the best choice when a company requires minimal downtime and automatic rollback in case of a failure. Here's why:

In Immutable deployments, a new set of instances is launched with the updated version. These instances are tested and validated before they replace the old instances. This ensures zero downtime and immediate rollback if the deployment fails.

All at once (A) causes downtime because the update replaces all instances simultaneously.

Rolling deployments (B) update a few instances at a time, but if a failure occurs midway, downtime or partial unavailability can happen.

Snapshots (C) are not a deployment strategy in Elastic Beanstalk.

Reference: Elastic Beanstalk Deployment Policies

Question 3

A gaming application stores scores for players in an Amazon DynamoDB table that has four attributes: user_id, user_name, user_score, and user_rank. The users are allowed to update their names only. A user is authenticated by web identity federation.

Which set of conditions should be added in the policy attached to the role for the dynamodb:PutItem API call?

A'Condition': {
'ForAllValues:StringEquals': {
'dynamodb:LeadingKeys': ['${www.amazon.com:user_id}'],
'dynamodb:Attributes': ['user_name']
}
}

B'Condition': {
'ForAllValues:StringEquals': {
'dynamodb:LeadingKeys': ['${www.amazon.com:user_name}'],
'dynamodb:Attributes': ['user_id']
}
}

C'Condition': {
'ForAllValues:StringEquals': {
'dynamodb:LeadingKeys': ['${www.amazon.com:user_id}'],
'dynamodb:Attributes': ['user_name', 'user_id']
}
}

D'Condition': {
'ForAllValues:StringEquals': {
'dynamodb:LeadingKeys': ['${www.amazon.com:user_name}'],
'dynamodb:Attributes': ['username', 'userid']
}
}

Answer : A

The correct policy condition ensures that:

The LeadingKeys condition restricts operations to the authenticated user's user_id.

The Attributes condition limits the updatable attributes to user_name.

Explanation of Choices:

Option A: Correctly enforces both the key restriction (dynamodb:LeadingKeys) and ensures only the user_name attribute can be updated.

Option B, C, D: Use incorrect conditions, such as referencing user_name in the LeadingKeys or including other attributes like user_id in updatable fields.

Reference: AWS DynamoDB Condition Keys Documentation

Question 4

A developer is migrating a containerized application from an on-premises environment to the AWS Cloud. The developer is using the AWS CDK to provision a container in Amazon ECS on AWS Fargate. The container is behind an Application Load Balancer (ALB).

When the developer deploys the stack, the deployment fails because the ALB fails health checks. The developer needs to resolve the failed health checks.

Which solutions will meet this requirement? (Select TWO.)

AConfirm that the capacity providers for the container have been provisioned and are properly sized.

BConfirm that the target group port matches the port mappings in the ECS task definition.

CConfirm that a hosted zone associated with the ALB matches a hosted zone that is referenced in the ECS task definition.

DConfirm that the ALB listener on the mapped port has a default action that redirects to the application's health check path endpoint.

EConfirm that the ALB listener on the mapped port has a default action that forwards to the correct target group.

Answer : B, E

Option B: The target group port in the ALB must match the port specified in the ECS task definition. If there is a mismatch, the ALB health check will fail since it cannot correctly route traffic to the container.

Option E: The ALB listener must have a default action that forwards requests to the correct target group associated with the ECS service. If this configuration is missing, the health check will fail as no traffic is routed to the service.

Option A is irrelevant to resolving health check issues since capacity providers relate to provisioning compute capacity.

Option C (hosted zone) is not directly related to ALB health checks.

Option D (redirecting traffic) is not related to ECS health check configurations.

Reference: AWS ECS Health Check Documentation

Question 5

A developer is managing an application that uploads user files to an Amazon S3 bucket named companybucket. The company wants to maintain copies of all the files uploaded by users for compliance purposes, while ensuring users still have access to the data through the application.

Which IAM permissions should be applied to users to ensure they can create but not remove files from the bucket?

Ajson
Copy code
{
'Version': '2012-10-17',
'Statement': [
{
'Sid': 'statement1',
'Effect': 'Allow',
'Action': ['s3:GetObject', 's3:PutObject', 's3:DeleteObject'],
'Resource': ['arn:aws:s3:::companybucket']
}
]
}

Bjson
Copy code
{
'Version': '2012-10-17',
'Statement': [
{
'Sid': 'statement1',
'Effect': 'Allow',
'Action': ['s3:CreateBucket', 's3:GetBucketLocation'],
'Resource': 'arn:aws:s3:::companybucket'
}
]
}

Cjson
Copy code
{
'Version': '2012-10-17',
'Statement': [
{
'Sid': 'statement1',
'Effect': 'Allow',
'Action': ['s3:GetObject', 's3:PutObject', 's3:DeleteObject', 's3:PutObjectRetention'],
'Resource': 'arn:aws:s3:::companybucket'
}
]
}

Djson
Copy code
{
'Version': '2012-10-17',
'Statement': [
{
'Sid': 'statement1',
'Effect': 'Allow',
'Action': ['s3:GetObject', 's3:PutObject'],
'Resource': ['arn:aws:s3:::companybucket']
}
]
}

Answer : D

To meet the requirement:

Users must be able to upload (PutObject) and read (GetObject) files but not delete them.

Option D ensures users cannot delete files by omitting the s3:DeleteObject action while allowing s3:GetObject and s3:PutObject.

Option A: Includes s3:DeleteObject, which allows users to delete files and does not meet the requirement.

Option B: Contains unrelated actions like CreateBucket, which is not relevant here.

Option C: Adds s3:PutObjectRetention, which is unnecessary and does not restrict DeleteObject.

Reference: AWS S3 Permissions Documentation

Free Practice Questions for Amazon DVA-C02 Exam

Question 1

Question 2

Question 3

Question 4

Question 5