AWS DVA-C02 Free Practice Questions — Page 1

Correct Answer: C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.

AWS Secrets Manager is the ideal solution for storing sensitive credentials like API access tokens. It provides automatic encryption at rest and in transit, supports resource-based policies for cross-account access, and handles decryption automatically when retrieving secrets. While Parameter Store SecureString can also store encrypted values, Secrets Manager is specifically designed for credential management and offers built-in rotation capabilities. The other options (DynamoDB and S3) require more manual setup for encryption and decryption, resulting in higher management overhead.

Correct Answer: D. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.

Option D is correct because it follows the proper cross-account EventBridge pattern. First, you configure the main account's event bus to accept events from other accounts. Then, each source account creates a rule to forward EC2 lifecycle events to the main account's event bus. Finally, a rule in the main account routes these events to the SQS queue. Option B is incorrect because EventBridge rules cannot directly target cross-account SQS queues. Option A is incorrect because EC2 cannot be configured to directly deliver events to another account's event bus. Option C is inefficient and not event-driven.

Correct Answer: D. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.

Amazon Cognito identity pools provide a powerful feature that allows you to use IAM policy variables to restrict users to their own S3 prefixes. By using the ${cognito-identity.amazonaws.com:sub} variable in an IAM policy, each authenticated user can only access objects under their unique identity prefix in S3. This provides the highest level of security as it enforces access control at the IAM level. Options A and B rely on application-level filtering which can be bypassed. Option C adds operational overhead with Lambda validation.

Correct Answer: B. AWS Step Functions

AWS Step Functions is the ideal service for orchestrating workflows that require sequential execution and error handling. Step Functions provides built-in support for running tasks in sequence, handling retries and errors, and managing state between steps. It integrates seamlessly with other AWS services and scales automatically. AWS Batch is for batch computing jobs. AWS Glue is for ETL jobs but lacks the workflow orchestration capabilities. Lambda alone cannot manage sequential workflows with error handling efficiently.

Correct Answer: C. The Lambda function does not have IAM permissions to write to DynamoDB.

The most likely cause is that the Lambda function's execution role does not have the necessary IAM permissions to write to the DynamoDB table. Lambda functions require explicit IAM permissions to interact with other AWS services. Since the function successfully reads from S3 (triggered by S3 event) but fails writing to DynamoDB, the execution role is missing DynamoDB write permissions like dynamodb:PutItem or dynamodb:UpdateItem. Option A would cause throttling errors, not write failures. Option B is incorrect as GSIs are for queries, not writes. Option D is incorrect as DynamoDB is a regional service and doesn't require AZ alignment.