Free AWS DVA-C02 Actual Exam Questions

It’s C because using S3 directly with the AWS SDK gives you built-in durability and availability without the complexity of mounting or managing file systems. Mounting S3 (D) can cause performance issues and isn’t fully native.

Maybe D works best since mounting the S3 bucket keeps the shared folder approach and S3 offers built-in high availability, unlike EBS or instance store which are tied to single instances.

It’s A because Step Functions can handle complex workflows and built-in wait states without extra infrastructure. Waiting inside Step Functions feels more straightforward than managing queue polling with SQS. Also, Step Functions can handle retries based on API failure responses dynamically, which fits this use case better than SQS or relying on CloudWatch alarms (C) which don’t directly control invocation pacing. Kinesis Data Firehose (D) doesn’t really apply here since you’re not batching for storage or analytics but need to control call rates in real time.

Maybe B works best here since SQS can naturally queue the API requests and Lambda can control the pace of processing to keep within rate limits. Step Functions might add complexity for simple rate throttling.

Maybe D because provisioned concurrency keeps Lambdas warm, cutting down cold start delays. Increasing memory (C) helps speed but doesn’t fully fix cold start issues like provisioned concurrency does.

B. Step Functions sounds right because it handles sequential workflows and error retries easily.

I think C could be a solid pick here. Doing real-time optimization via Lambda@Edge means no need to store tons of variants upfront, which saves on storage costs. If you max out the CloudFront cache TTL, most requests hit the cache after the first, reducing repeated Lambda invocations and keeping latency down. It’s cost-effective since you avoid both large S3 storage and batch processing costs. Plus, it handles unpredictable device dimensions well without pre-generating variants. So I’d go with C for balancing flexibility and cost.

Maybe B makes sense too since it pre-generates variants with batch jobs, so processing isn’t done on-demand. Lambda@Edge routing based on headers can keep costs lower than real-time resizing every request.

A/B? Since we want to filter by Product ID and sort by rating, having Product Rating as the sort key (A) makes more sense than Review ID (B) for fast retrieval of top ratings.

A This will let you quickly find all reviews for a product and sort them by rating, which matches exactly what the query needs. LSIs can’t change the partition key, so they won’t help here.

Not A, since SSE-S3 uses symmetric keys managed by AWS, which doesn’t guarantee only the company can decrypt. They need control over the keys, so server-side with AWS-managed keys won’t meet that requirement.

Maybe D fits best since client-side encryption with a customer-managed key means the company controls the decryption keys, matching the asymmetric requirement better than server-side options.

D imo, server-side encryption with AWS owned keys is the default for DynamoDB tables.

It’s D for sure. AWS owned keys are the default encryption method for DynamoDB, so you don’t have to specify any KMS key ARN or create keys manually when creating the table. Options A, B, and C all mention specifying a key, which is only necessary if you want customer managed or AWS managed keys. Since the question explicitly says AWS owned key, just creating the table with default settings meets the requirement. No extra parameters needed.

It’s A for sure. You can’t just flip encryption on an existing AMI or snapshot, so creating a new encrypted AMI and then copying is the only way to meet the encryption rule across regions.

Maybe D is out since you can’t just copy unencrypted AMIs and then magically turn on encryption by default in the new region. I think B and C are off too because KMS manages keys but doesn’t directly enable encryption on existing AMIs, and ACM is for certificates, not AMI encryption. So yeah, A feels right—you create new AMIs with encryption enabled first, then copy them over. That way all AMIs are encrypted before they’re used anywhere.

Makes sense to exclude B since Lambda can’t just route through a VPN like an EC2 instance. I’d also rule out C because VPC endpoints are mainly for AWS service access, not general private resource connectivity, and routing through a NAT gateway is for outbound internet traffic, not private network access. D seems specific to PrivateLink, which is more for service-to-service communication rather than general Lambda access to VPC resources. So A fits best — placing the Lambda inside the VPC subnets with a security group for access sounds like the straightforward way.

Option A is solid because Lambda functions need to be in the VPC’s subnets to access private resources directly. B is off since Lambda doesn’t natively route through VPNs; that’s more for EC2 or on-prem setups.

This is definitely a light workload, so spinning up containers with EKS or ECS seems overkill. Lambda plus API Gateway caching (B) keeps things simple and cheap without extra management overhead. B

I think A, C, and D all involve more infrastructure than needed for just a small POC with low traffic. Lambda plus API Gateway caching in B seems the simplest and cheapest way to go here. B

Maybe A, since it blocks any non-HTTPS requests explicitly.

A imo makes the most sense since it directly enforces encryption in transit by denying requests without secure transport. The other options don’t address encryption in transit explicitly.

B/D? Rolling could work by updating instances in batches to avoid downtime, but it risks partial failures. Immutable is safer because the whole environment is replaced atomically, ensuring immediate rollback.

This sounds like a classic case for immutable deployments (D) because they create a new set of instances and only switch traffic once those pass health checks. That way, if the update fails, the old environment is still up and running—no downtime. Rolling updates (B) could cause partial outages if something goes wrong mid-deploy, and all at once (A) definitely risks downtime. Snapshots (C) don’t really fit here since they’re about backups, not deployment strategies. Does anyone think rolling updates could still be safe enough with health checks, or is immutable definitely the safest bet?

A vs B but A is simpler without SQS in the middle for email notifications.

SNS can send emails directly, so option A fits best here.

Option A makes the most sense since Redis supports built-in sorted sets that let you rank or sort data easily, which Memcached (Option B) doesn’t handle well. Also, ElastiCache for Redis supports encryption both in transit and at rest, which is essential for PHI. The read replica in Option C won’t really help with caching or ranking, just read scalability. DynamoDB with DAX (Option D) is good for caching but doesn’t have native sorting/ranking features like Redis, so it’s less ideal given the requirements.

A, Redis supports sorting and ranking with encryption options.

It’s D because AssumeRole lets you pass MFA tokens directly for cross-account access without needing web identity or SAML setup. The others are more for federated users, so they don’t fit here.

Maybe D here too, since AssumeRole lets you pass MFA tokens when switching roles across accounts. The others seem more tied to web identity or SAML federation, which the question doesn’t mention.