DVA-C03 practice questions with answers

Answer: A) Enable DynamoDB auto scaling with a target tracking policy whose target utilization is set to 70 percent, plus minimum and maximum capacity bounds

DynamoDB auto scaling uses an Application Auto Scaling target tracking policy to adjust provisioned capacity so that consumed capacity stays near a chosen target utilization. On-demand mode, burst or adaptive capacity, and scheduled actions do not meet that requirement.

• ADynamoDB auto scaling uses Application Auto Scaling. Its target tracking algorithm raises or lowers provisioned read and write capacity so that the ratio of consumed to provisioned capacity stays at or near the target utilization. Allowed targets are 20–90%, and the table stays in provisioned mode.
• BOn-demand mode does handle variable traffic, but it removes provisioned capacity altogether, so there is no utilization target to track. The requirement to stay in provisioned mode rules it out.
• CBurst capacity covers short spikes, and adaptive capacity rebalances throughput across partitions. Neither one changes the table's provisioned capacity to keep utilization near a target.
• DScheduled scaling changes capacity at fixed times whatever the actual load is. It cannot follow unpredictable traffic or hold utilization near a target percentage.

Answer: A) Integrate API Gateway directly with Amazon SQS to enqueue each order, and have a Lambda function process the queue

When clients only need an acknowledgment, decouple with an API Gateway to SQS integration and process orders asynchronously.

• ACorrect. An AWS service integration lets API Gateway write to SQS and respond as soon as the message is stored. The queue absorbs the spike, and the consumer processes orders at a controlled rate.
• BIncorrect. Throttled synchronous invocations are rejected, not queued, and longer waits make clients hold connections during the spike.
• CIncorrect. Each order is unique and must be processed, so caching POST responses would lose orders.
• DIncorrect. Provisioned concurrency reduces cold starts but doesn't raise the concurrency limit. The spike still exceeds it.

Answer: B) Set MessageGroupId to the customer ID so that different customers' messages are processed in parallel

FIFO consumers scale by message group. Use a group ID that matches the ordering requirement (here, the customer) to get parallelism without losing order.

• AIncorrect. Larger batches help a little, but one message group can still be processed by only one invocation at a time, so concurrency stays at 1.
• BCorrect. Lambda scales a FIFO consumer up to the number of active message groups. Per-customer groups keep each customer's order while letting customers run in parallel.
• CIncorrect. A standard queue doesn't preserve order, so a customer's payments could be processed out of sequence.
• DIncorrect. More instances don't help. Messages in a single group are delivered in order to one invocation at a time.

Answer: A) An OpenAPI 2.0 or 3.0 definition file imported through the API Gateway import feature

API Gateway imports and exports REST API definitions in OpenAPI v2.0/v3.0 format. OpenAPI is a portable standard that also drives documentation and SDK generation. Mapping templates, models, and WSDL can't do this.

• AAPI Gateway can create or update a REST API by importing OpenAPI v2.0 or v3.0 definition files, and it can export APIs in this format too. OpenAPI is a vendor-neutral standard, so the same file works for documentation tooling and SDK generation.
• BWSDL describes SOAP web services. API Gateway's REST API import feature supports OpenAPI definition files, not WSDL.
• CMapping templates transform request and response payloads for integrations. They don't describe the API's paths and methods, and they can't be imported to create an API.
• DAPI Gateway models use JSON Schema to define the shape of a payload, but they don't describe resources, paths, or methods. A model on its own can't define or import a whole API.

Answer: D) Turn on Amazon EventBridge for the bucket and create one EventBridge rule per consumer with its own key filter

S3 event notification rules can't have overlapping prefix and suffix filters for the same event types; send events to EventBridge to fan out overlapping matches to several consumers.

• AIncorrect. s3:ObjectCreated:Put is part of s3:ObjectCreated:*, so the event types still overlap and the configuration is still rejected.
• BIncorrect. IDs don't resolve overlap. Rules with overlapping prefixes and suffixes for the same event types are invalid whatever their IDs and destinations.
• CIncorrect. This could work, but it doubles storage, adds replication delay and cost, and doesn't scale to more consumers.
• DCorrect. S3 notification rules can't overlap for the same event types. EventBridge receives every bucket event, and any number of rules can match the same events with prefix and suffix patterns.

Answer: A) Request or import a certificate in ACM in us-east-1 that includes shop.example.com, and attach it to the distribution

For viewer-facing HTTPS on a CloudFront alternate domain name, an ACM certificate must be requested or imported in us-east-1 and must cover the domain name. A certificate in the application's Region won't appear in the list.

• ACorrect. To use an ACM certificate for HTTPS between viewers and CloudFront, you must request or import it in US East (N. Virginia), us-east-1, no matter where the rest of the application runs. The certificate's SAN field must also cover the alternate domain name.
• BIncorrect. CloudFront can't use an ACM certificate from another Region through a resource share. For viewer HTTPS, the certificate must be in ACM in us-east-1.
• CIncorrect. A certificate on an ELB origin (which can be in any Region) secures only the connection between CloudFront and the origin. Viewers connecting to the alternate domain name need a certificate attached to the distribution, issued in us-east-1.
• DIncorrect. The price class only controls which edge locations serve content. It has no effect on which Region CloudFront reads ACM certificates from, which is always us-east-1.

Answer: A) The rule allows traffic from whatever instances are associated with the referenced group, so it stays valid when their private IP addresses change.

When a rule names a security group as the source, it allows traffic from the private IPs of whatever instances belong to that group right now. The rule keeps working as instances scale in, scale out, or get replaced.

• ACorrect. When a security group is the source, the rule applies to all instances associated with that group and allows traffic from their private IP addresses. You don't need to edit the rule when instances are replaced or get new IPs.
• BIncorrect. AWS docs state that no rules from the referenced security group are added to the security group that references it.
• CIncorrect. Security group referencing works with the private IP addresses of the associated instances' network interfaces, not their public or Elastic IP addresses.
• DIncorrect. Security groups support only allow rules, whatever the source type. You can't write deny rules in a security group.

Answer: C) Allow bedrock:InvokeModel on the foundation model ARN in every Region that the inference profile can route to

A role that invokes a cross-Region inference profile needs permission on the profile ARN and on the foundation model ARN in every destination Region of the profile.

• AIncorrect. Private DNS controls how the endpoint hostname resolves inside the VPC. It doesn't stop the inference profile from routing a request to another Region, and it isn't related to an IAM AccessDeniedException.
• BIncorrect. That action is needed only for streaming calls (InvokeModelWithResponseStream or ConverseStream). The failing requests are ordinary invocations, and streaming permissions don't cover other Regions.
• CCorrect. The Bedrock documentation says that when you allow an inference profile in a policy, you must also allow the foundation model in each Region associated with it. Requests routed to us-east-2 or us-west-2 are denied because only the us-east-1 model ARN is allowed.
• DIncorrect. System-defined inference profiles work with IAM roles; the documentation gives example policies for them. An application inference profile is used for cost tracking and still needs the same per-Region model permissions.

Answer: A) HttpOnly

• AThe HttpOnly attribute prevents client-side scripts from accessing the cookie via document.cookie, reducing the risk that an XSS vulnerability could be used to steal the session token.
• BSameSite controls whether a cookie is sent on cross-site requests, related to CSRF risk, not whether JavaScript can read the cookie's contents.
• CA longer expiration increases exposure time if the token is stolen; it doesn't prevent JavaScript from reading it.
• DlocalStorage is fully accessible to JavaScript, making it more vulnerable to theft via XSS than an HttpOnly cookie, not less.

Answer: B) Web previews (pull request previews) for the branch that the pull requests target

Amplify Hosting web previews deploy each pull request to its own temporary environment and remove it when the pull request closes.

• AIncorrect. Apps per developer all deploy main. They don't create an environment per pull request or clean up when it closes.
• BCorrect. Amplify web previews deploy each pull request to a unique preview URL and delete the preview when the pull request is merged or closed.
• CIncorrect. A custom domain names an existing branch deployment. It doesn't create per-pull-request environments.
• DIncorrect. This limits who sees production but still makes reviewers test unmerged changes in production, which is what previews avoid.

Answer: A) Create an RDS blue/green deployment, upgrade the engine in the green environment, test it and then switch over

RDS Blue/Green Deployments keep a green copy in sync with production, so you can upgrade and test the new engine version there. You then switch over, typically in under a minute, with no data loss and no endpoint change.

• AA blue/green deployment creates a staging (green) environment that RDS keeps in sync with production through replication. You can upgrade the major engine version in green and test it without affecting production. The switchover typically takes under a minute with no data loss, and the green instances take over the production names and endpoints, so the application doesn't need to change.
• BThis is still an in-place upgrade of the production instance. It gives no separate environment for testing before the change, and RDS documents that engine upgrades require downtime. AWS points to blue/green deployments as the way to minimize that downtime.
• CThe restored copy stops receiving production writes once the snapshot is taken, so data written afterward would be missing at cutover. The application would also need to change to the new instance's endpoint.
• DAuto minor version upgrade applies only minor versions. RDS doesn't apply major version upgrades automatically; you must modify the instance yourself, and this option provides no testing environment.

Answer: A) A GitHub (via GitHub App) source action that uses an AWS CodeConnections connection to the repository

For GitHub sources, CodePipeline recommends the GitHub (via GitHub App) action backed by an AWS CodeConnections connection. It avoids personal access tokens and starts the pipeline on pushes by default. The older OAuth app action is no longer recommended.

• ACorrect. AWS recommends the GitHub (via GitHub App) action, which is the CodeStarSourceConnection provider backed by a CodeConnections connection. It authenticates through an installed GitHub App, so no personal access token is needed. It starts the pipeline on new commits by default, and the connection manages change detection.
• BIncorrect. AWS still supports the OAuth app action but no longer recommends it. It depends on OAuth or personal access tokens, which the team wants to avoid, and it uses a separate webhook to detect changes.
• CIncorrect. This is an indirect workaround, not the recommended GitHub integration. A scheduled upload also does not start the pipeline on each push to main.
• DIncorrect. A CodeCommit source action can only use CodeCommit repositories. It cannot reference a repository hosted on GitHub.

Answer: A) Create an Amazon CloudWatch RUM app monitor and add its web client code snippet to the application

CloudWatch RUM collects page load times, client-side errors, and device and browser breakdowns from actual user sessions in production. Synthetics, X-Ray, and Route 53 health checks rely on simulated traffic or server-side data.

• ACloudWatch RUM collects client-side data from actual user sessions, including page load times, client-side errors, and breakdowns by device type and browser. Its web client snippet is added to the application and samples a configurable percentage of sessions.
• BSynthetics canaries run scripted, simulated traffic. They do not show what actual customers experience on their own devices and browsers.
• CX-Ray traces requests through backend services. On its own, it does not capture browser page load times or JavaScript errors.
• DRoute 53 health checks probe endpoints from AWS checker locations. They measure endpoint availability and latency, not the browser experience of actual users.

Answer: A) A required dependency wasn't included in the deployment package, or the handler path/module name is misconfigured

• AThis error typically means Lambda can't locate a module the handler code tries to import — either because a dependency was left out of the deployment package/layer, or the configured handler string doesn't correctly point to the actual file/module structure that was deployed.
• BA permissions issue typically surfaces as an AccessDenied-style error at the point a specific AWS API call is attempted, not as a module-import failure at function startup.
• CA low concurrency setting would cause throttling errors under load, not a module-import failure that happens on every single invocation regardless of concurrency.
• DA missing DynamoDB table would cause an error when the function actually tries to query it, not an import error that occurs before the handler code even starts running.

Answer: A) A CloudWatch dashboard containing metric graph widgets and alarm status widgets

A CloudWatch dashboard is the persistent, shareable single view for graphing several metrics alongside alarm states. Composite alarms combine alarm states, while Logs Insights and Contributor Insights analyze log data.

• ACloudWatch dashboards give a single, customizable view of selected metrics and alarms, even across Regions. Team members can share them as a common view during operational events, which meets every requirement.
• BA composite alarm combines the states of other alarms with a rule expression (AND/OR/NOT) and can trigger actions. It produces one alarm state and does not show metric graphs.
• CLogs Insights queries run against log data in log groups. They do not give a persistent combined view of custom metrics published to CloudWatch Metrics together with their alarm states.
• DContributor Insights analyzes log data to find top-N contributors, such as the noisiest hosts or IP addresses. It is not a way to arrange several metric graphs and alarm states in one view.