Instant Access Amazon.DVA-C02.v2026-02-16.q395 Actual Practice Test Engine for Free (Page 76)

Question 371

A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data needs to be encrypted at rest with AWS KMS keys, which can be rotated on demand.
Which combination of steps will meet these requirements? (Select TWO.)

A.Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary.
B.Configure an S3 bucket policy to enable client-side encryption for the objects containing personal data by using an AWS KMS customer managed key
C.Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects containing personal data to Amazon S3.
D.Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:
SecureTransport condition.
E.Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS.

Correct Answer: C,D

Step-by-Step Breakdown:
Requirement Summary:
* In-transit encryption (when data is moving between client and S3)
* Encryptionat rest using AWS KMS keys(which arerotatableon-demand)
Option A: Write an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions boundary
* #Incorrect: Permissions boundaries are for IAM policy control, not S3 bucket policies.
* Also, encryption enforcement in-transit is not achieved through permissions boundaries.
Option B: Configure an S3 bucket policy to enable client-side encryption
* #Incorrect: AWS doesnotenforce client-side encryption via S3 bucket policies.
* Client-side encryption must be handled entirely by the application.
* Also, KMS is forserver-side encryption, not client-side.
Option C: Configure the application to encrypt the objects by using an AWS KMS customer managed key before uploading the objects
* #Correct: This fulfills the requirement of encrypting objectsat restusing aKMS CMK, which can be rotated.
* You can specify the KMS key using the SSE-KMS option when putting an object.
Option D: Write an S3 bucket policy to allow only encrypted connections over HTTPS by using the aws:
SecureTransport condition
* #Correct: This enforcesin-transit encryption, which ensures that only HTTPS connections are allowed.
* This is the AWS-recommended way to enforce encryption in transit via bucket policy.
Option E: Configure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections over HTTPS
* #Incorrect: Block Public Access is used to prevent public exposure of the bucket.
* It hasnothing to do with encryption enforcement, whether in transit or at rest.
* Using SSE-KMS:https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html
* aws:SecureTransport condition in bucket policies:https://docs.aws.amazon.com/AmazonS3/latest
/userguide/amazon-s3-policy-keys.html
* Server-side encryption with AWS KMS:https://docs.aws.amazon.com/AmazonS3/latest/userguide/serv- side-encryption.html

Question 372

A developer is migrating an application to Amazon Elastic Kubernetes Service (Amazon EKS). The developer migrates the application to Amazon Elastic Container Registry (Amazon ECR) with an EKS cluster.
As part of the application migration to a new backend, the developer creates a new AWS account. The developer makes configuration changes to the application to point the application to the new AWS account and to use new backend resources. The developer successfully tests the changes within the application by deploying the pipeline.
The Docker image build and the pipeline deployment are successful, but the application is still connecting to the old backend. The developer finds that the application's configuration is still referencing the original EKS cluster and not referencing the new backend resources.
Which reason can explain why the application is not connecting to the new resources?

A.The developer did not successfully create the new AWS account.
B.The developer added a new tag to the Docker image.
C.The developer did not update the Docker image tag to a new version.
D.The developer pushed the changes to a new Docker image tag.

Correct Answer: C

The correct answer is C. The developer did not update the Docker image tag to a new version.
C: The developer did not update the Docker image tag to a new version. This is correct. When deploying an application to Amazon EKS, the developer needs to specify the Docker image tag that contains the application code and configuration. If the developer does not update the Docker image tag to a new version after making changes to the application, the EKS cluster will continue to use the old Docker image tag that references the original backend resources. To fix this issue, the developer should update the Docker image tag to a new version and redeploy the application to the EKS cluster.
A: The developer did not successfully create the new AWS account. This is incorrect. The creation of a new AWS account is not related to the application's connection to the backend resources. The developer can use any AWS account to host the EKS cluster and the backend resources, as long as they have the proper permissions and configurations.
B: The developer added a new tag to the Docker image. This is incorrect. Adding a new tag to the Docker image is not enough to deploy the changes to the application. The developer also needs to update the Docker image tag in the EKS cluster configuration, so that the EKS cluster can pull and run the new Docker image.
D: The developer pushed the changes to a new Docker image tag. This is incorrect. Pushing the changes to a new Docker image tag is not enough to deploy the changes to the application. The developer also needs to update the Docker image tag in the EKS cluster configuration, so that the EKS cluster can pull and run the new Docker image.
References:
* 1: Amazon EKS User Guide, "Deploying applications to your Amazon EKS cluster", https://docs.aws.
amazon.com/eks/latest/userguide/deploying-applications.html
* 2: Amazon ECR User Guide, "Pushing an image", https://docs.aws.amazon.com/AmazonECR/latest
/userguide/docker-push-ecr-image.html
* 3: Amazon EKS User Guide, "Updating an Amazon EKS cluster", https://docs.aws.amazon.com/eks
/latest/userguide/update-cluster.html

Question 373

A developer is building an application on AWS. The application has an Amazon API Gateway API that sends requests to an AWS Lambda function. The API is experiencing increased latency because the Lambda function has limited available CPU to fulfill the requests.
Before the developer deploys the API into production, the developer must configure the Lambda function to have more CPU.
Which solution will meet this requirement?

A.Increase the virtual CPU (vCPU) cores quota of the Lambda function.
B.Increase the amount of memory that is allocated to the Lambda function.
C.Increase the ephemeral storage size of the Lambda function.
D.Increase the timeout value of the Lambda function.

Question 374

A developer is creating an AWS Lambda function that searches for items from an Amazon DynamoDB table that contains customer contact information- The DynamoDB table items have the customer's email_address as the partition key and additional properties such as customer_type, name, and job_tltle.
The Lambda function runs whenever a user types a new character into the customer_type text input The developer wants the search to return partial matches of all the email_address property of a particular customer_type The developer does not want to recreate the DynamoDB table.
What should the developer do to meet these requirements?

A.Add a global secondary index (GSI) to the DynamoDB table with customer_type as the partition key and email_address as the sort key Perform a query operation on the GSI by using the begvns_wth key condition expression With the emad_address property
B.Add a global secondary index (GSI) to the DynamoDB table With ernail_address as the partition key and customer_type as the sort key Perform a query operation on the GSI by using the begins_wtth key condition expression With the emal_address property.
C.Add a local secondary index (LSI) to the DynamoDB table With customer_type as the partition key and email_address as the sort key Perform a query operation on the LSI by using the begins_wlth key condition expression With the email_address property
D.Add a local secondary Index (LSI) to the DynamoDB table With job_tltle as the partition key and emad_address as the sort key Perform a query operation on the LSI by using the begins_wrth key condition expression With the email_address property

Question 375

A company is expanding the compatibility of its photo-snaring mobile app to hundreds of additional devices with unique screen dimensions and resolutions. Photos are stored in Amazon S3 in their original format and resolution. The company uses an Amazon CloudFront distribution to serve the photos The app includes the dimension and resolution of the display as GET parameters with every request.
A developer needs to implement a solution that optimizes the photos that are served to each device to reduce load time and increase photo quality.
Which solution will meet these requirements MOST cost-effective?

A.Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a dynamic CloudFront origin that automatically maps the request of each device to the corresponding photo variant.
B.Use S3 Batch Operations to invoke an AWS Lambda function to create new variants of the photos with the required dimensions and resolutions. Create a Lambda@Edge function to route requests to the corresponding photo vacant by using request headers.
C.Create a Lambda@Edge function that optimizes the photos upon request and returns the photos as a response. Change the CloudFront TTL cache policy to the maximum value possible.
D.Create a Lambda@Edge function that optimizes the photos upon request and returns the photos as a response. In the same function store a copy of the processed photos on Amazon S3 for subsequent requests.

DVA-C02 Premium Dumps

Question 371

Question 372

Question 373

Question 374

Question 375

Download PDF File