Amazon AWS Certified Developer Associate Exam Prep
AWS Certified Developer - Associate DVA-C02 (Page 25 )

• Correct answer: B: Use a function alias with different versions.

• AWS Lambda versions are immutable. You publish a version for each code change.
• An alias is a movable pointer to a specific version (e.g., prod ? version 5).
• Deploying a new version is just publishing another version; directing production traffic to the new version is as simple as updating the alias.
• If you need to roll back, you re-point the alias to the previous version. This is minimal operational effort and avoids rebuilding pipelines or managing multiple deployment artifacts at runtime.

• A (blue/green with OpsWorks) adds complexity and tooling overhead.
• C (saving old deployment packages in S3) doesn’t provide runtime switching or instant rollback.
• D (CodePipeline) adds orchestration overhead; while useful, it’s more setup than the alias approach for simple rollback needs.

• Correct answers: IntegrationLatency and Latency.

• Why:

• Why not CacheHitCount/CacheMissCount: those relate to API Gateway caching. If you’re not using caching (or the problem isn’t caching-related), they won’t help diagnose a timeout.

• Practical tip: in CloudWatch, compare Latency and IntegrationLatency for the failing method/resource. If Latency is high but IntegrationLatency is low, the delay is outside the Lambda integration (gateway/network). If IntegrationLatency is high, the Lambda/backend is the bottleneck. Also review CloudWatch Logs for API Gateway and Lambda for additional clues.

• Use a field on Account to show the aggregated yearly shipments (a Roll-Up Summary).
• A Master-Detail relationship between Shipment and Account is required for Roll-Up Summary to work (and to ensure access is governed by the parent Account).
• OWD and the relationship type determine what users can see. If you want to restrict shipment-level access while still showing a summary on Account, Private OWD on Shipment plus Master-Detail helps, because access to shipments is controlled by the Account record.

• A (Public OWD on Shipment with Process Builder and a Lookup to Account): Not ideal. Public access would expose shipments broadly, and a lookup cannot support a built-in roll-up summary.
• B (Private OWD on Shipment, Roll-Up Summary, Master-Detail to Account): Best answer. Private shipments, but because of Master-Detail, access and the roll-up are tied to the Account. The Account can show the yearly total via a Roll-Up Summary field.
• C (Controlled by Parent on Shipment, Trigger, Master-Detail): Master-Detail is correct, but using a trigger is unnecessary for a straightforward roll-up; roll-ups are the standard, maintainable solution.
• D (Private OWD on Shipment, Trigger, Lookup to Account): More complex and not as efficient; no automatic roll-up, and lookup breaks the ease of summarizing by Account.

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• AWS Audit Manager continuously collects evidence from AWS services and helps assess whether workloads comply with regulatory frameworks and internal policies. It can produce audit-ready reports.
• AWS Config records resource configurations and evaluates them against compliance rules. For example, it can check whether encryption, logging, or access settings meet company requirements.

• Amazon Inspector identifies software vulnerabilities and unintended network exposure, not general policy or regulatory compliance.
• Amazon CloudWatch monitors metrics, logs, and operational events, but is not primarily a compliance assessment service.
• AWS CloudTrail records API activity for auditing and investigation. It supports compliance, but does not itself provide the structured compliance assessment capabilities of Audit Manager and Config.

• A Layer 2 switch checks the destination MAC address in its MAC address table (CAM table).
• If the destination MAC is unknown, the switch cannot select a specific outgoing port.
• It therefore performs unknown-unicast flooding, sending the frame out every other port in that VLAN.
• The frame is not sent back through the port where it arrived.

• Basic: billing/subscription support only; no technical support requests can be opened.
• Developer, Standard, Professional Direct, and Premier: include technical support and allow opening new support requests.

• If option A corresponds to “Developer, Standard, Professional Direct, Premier,” that is the correct choice.
• If the option text is really “Premier only,” that would be incorrect per current Azure docs.

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• A assigned without var becomes a global variable (in non-strict mode). So after myFunction(), a = 5 is accessible.
• b is declared with var inside the function, so it’s local to that function (function-scoped). It’s not defined in the outer (global) scope.

• console.log(a) prints 5.
• console.log(b) throws a ReferenceError: b is not defined.

• This is a lookup relationship. Salesforce does not cascade access from a child (Opportunity) to its parent (Account) via implicit sharing.
• To view the Account, the user must have explicit access to the Account (via its OWD/sharing, or object permissions).

• The user has Read/View (or higher) on Account via profile/permission set.
• Manual sharing or a sharing rule grants that Account to the user.
• The Account is exposed by a broader permission like View All/Modify All on Account.
• Role hierarchy with Grant Access Using Hierarchies could grant access to Accounts owned by others, if applicable.

• Correct choices: A and D.

• Why not B, C, or E?

• Pull: Downloads changes from the central repository and updates the local repository.
• Push: Sends local commits to the central repository.
• Commit: Records local changes in the repository’s history.
• Merge: Combines changes from different branches.
• Clone: Creates a new local copy of a repository.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• L2TP uses UDP port 1701 for the L2TP control channel.
• The destination port is 1701; the source port is a dynamically chosen ephemeral port on the client (not 1701).
• Therefore the statement that both source and destination ports are 1710 is incorrect (and 1710 is not the standard L2TP port).

• The destination port should be 1701, not 1710.
• The source port should be an ephemeral port chosen by the client, not 1701.

• Permanent table (E): Correct. A dropped permanent table can be restored with UNDROP TABLE during its Time Travel retention period. Permanent tables also have Fail-safe protection.
• Transient table: It can also generally be restored during its shorter Time Travel period, although it has no Fail-safe. Therefore, excluding it makes the question questionable.
• Temporary table: Usually cannot be recovered after it is dropped; its lifecycle is limited to the session.
• Materialized view (D): The answer key treats it as recoverable, but recovery behavior depends on the specific Snowflake object/version capabilities. It should not be confused with an ordinary view.

• Why: If an application on EC2 needs to call other AWS services, using an IAM role (attached to the EC2 instance as an instance profile) provides temporary, automatically rotated credentials. This avoids embedding access keys in the application.
• How it works: Create a role with the minimum required permissions, attach it to the EC2 instance, and let the AWS SDK used by the application retrieve credentials from the instance metadata service. The credentials rotate automatically and are scoped to the policy you define.
• Why not other options:

• Modelo de embeddings multimodal: transforma texto e imagens em vetores no mesmo espaço semântico. Isso permite comparar uma consulta textual com imagens, ou uma imagem com textos relacionados.
• Modelo generativo multimodal: interpreta diferentes modalidades e gera conteúdo, mas não é a escolha específica para indexação e busca vetorial.
• Modelo de geração de imagens: cria imagens, portanto é inadequado.
• Modelo de embeddings de texto: não atende consultas com imagens.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

• Import — Loads data into Power BI. It requires a refresh, so it may not reflect changes within two minutes unless refresh is configured appropriately.
• Live connection — Connects to an existing Power BI semantic model or Analysis Services model; it is not the normal choice for connecting directly to an Azure SQL database.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• Correct answer: D) Amazon Aurora Serverless

• Aurora Serverless is serverless, so compute capacity scales automatically and can pause during idle periods. This minimizes ongoing administration and you pay only for actual usage, which is ideal for infrequent workloads.
• PostgreSQL on EC2 requires full OS and DB administration.
• RDS for PostgreSQL is managed but still involves provisioning capacity and some maintenance tasks.
• Aurora PostgreSQL (non-Serverless) is managed but requires you to manage capacity, though with some automation; it’s not as hands-off as Serverless for intermittent usage.

• Wiping securely overwrites the drive so the original data cannot reasonably be recovered. It is generally less expensive than physically destroying the device.
• Recycling could expose the data if the drive is not securely erased first.
• Shredding physically destroys the drive and is effective, but usually more costly and prevents reuse.
• Deletion only removes file references; it is not a secure sanitization method.

• Idioma: “Responda em português.”
• Tamanho: “Responda em até três frases.”
• Formato: “Use uma lista com três recomendações.”
• Objetivo: “Recomende produtos com base nas necessidades do cliente.”

• Mudar o tamanho do LLM: pode alterar capacidade e custo, mas não garante idioma ou respostas curtas.
• Aumentar a temperatura: aumenta a criatividade e a aleatoriedade; não controla diretamente o tamanho ou idioma.
• Aumentar o Top K: permite considerar mais tokens prováveis, aumentando a variedade; também não é o mecanismo principal para controlar idioma ou comprimento.

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• Correct answer: A
• What this is saying: You need to write a Transact-SQL query that uses REGEXP_SUBSTR to extract the ID from MessageText, and you should apply STRING_ESCAPE(MessageText, 'json') before calling REGEXP_SUBSTR.

• MessageText may contain JSON characters (quotes, backslashes, etc.). Escaping the JSON content first ensures the string you pass to the regex is safe and won’t confuse the regex engine.
• The pattern you apply with REGEXP_SUBSTR would then extract the first substring that matches your ID pattern from the (escaped) text.

• Example (conceptual):

• The question implies REGEXP_SUBSTR is available in this environment; some SQL Server and Fabric contexts don’t expose it natively in all versions. If REGEXP_SUBSTR isn’t available, you’d need an alternative approach (e.g., using built-in regex-like capabilities or CLR/UDFs).
• If you need the ID specifically from the first paragraph, you might first isolate the first paragraph and then apply REGEXP_SUBSTR, or compose a single pattern that anchors to the first paragraph.

• The policy is confidential, and the requester is no longer authorized merely because they used to work for the organization.
• The security professional should not disclose it by email or display it on a device without authorization.
• Using official channels allows the organization’s owner or information custodian to verify:

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• Correct answer: B (No, it does not).

• A purchase agreement in Dynamics 365 SCM is a vendor-side price arrangement. It sets prices/discounts for what your company buys from suppliers, not for what you sell to customers.
• The objective in Question 2 is to give clients a quantity-based discount on items they purchase from you. To accomplish this, you should configure a sales price / trade agreement (on the customer/sales side), not a purchase agreement.
• In a sales price trade agreement, you can define quantity breaks such as:

• Create a Sales price trade agreement for the item and relevant customer (or customer group).
• Add quantity breaks: 51–100 with 10% discount, 101+ with 15% discount.
• Ensure the agreement is active for the desired date range.

• Multi-pass wipe: Overwrites the drive’s existing data multiple times, making recovery much more difficult while preserving the drive’s functionality.
• Single-pass wipe: May be sufficient in some modern sanitization standards, but is presented here as less secure than multiple overwrites.
• Degaussing: Uses a strong magnetic field to disrupt data. It can render the drive unusable or unreliable, reducing its resale value.
• Pinning: Is not an appropriate data-sanitization method.

• Date: 2018-12-31
• Time: 08:59

• B: The original value contains the text at, so it cannot be converted directly to a date.
• A: The last characters contain the time, not the date.
• D: Extracting the first 11 characters can leave an unwanted space and does not properly separate the time component.

• Control plane: Managed by Databricks and contains the Databricks web application, workspace services, cluster management, and job orchestration.
• Data plane: Runs in your cloud account and contains compute resources such as:

• Worker node: Data plane compute.
• Driver node: Data plane compute.
• JDBC data source: Usually an external data system.
• Databricks Filesystem (DBFS): Provides storage access and is backed by cloud object storage rather than being entirely part of the control plane.

• The problem: Guest users can’t create posts in the Monthly Reports channel.
• The recommended fix (answer B): Modify the Guest access settings in the Teams admin center.

• Guest access settings control what guests are allowed to do across Teams (for example, posting, chat, and channel participation). If guests are restricted from posting, enabling the appropriate guest permissions will let them post in channels like Monthly Reports.
• The other options don’t directly change guest permissions in the way that affects posting:

• Regional leads — Customer Community Plus

• Capacity planners — External Identity

• Customer Community does not provide the enhanced reporting/dashboard access required by regional leads.
• An Identity license is generally for internal Salesforce identity use and does not fit the external capacity-planning users as well as External Identity.

• Sustainability is not a CAF perspective (it's not one of the CAF perspectives).
• Performance efficiency and Reliability are pillars of the AWS Well-Architected Framework, not CAF.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the tools needed to build, test, and deploy predictive analytics models.
• Azure Machine Learning—including the historical Azure Machine Learning Studio—is designed for the machine-learning lifecycle:

• The correct option is B: AWS Storage Gateway.

• Why: The scenario requires backing up on-prem data to AWS without changing existing backup workflows. AWS Storage Gateway provides a hybrid storage solution; specifically, the Tape Gateway emulates a physical tape library, allowing your existing backup software to write to virtual tapes that are stored in AWS (in S3 or S3 Glacier). This lets you back up 10 TB to the cloud while preserving current backup workflows and on-prem infrastructure.

• How it would work: Deploy a gateway appliance or VM on-site, connect your tape-based backup software to the virtual tape library, and start writing to virtual tapes. The data is then archived in AWS, freeing up local storage.

• Why the others aren’t suitable:

• Quick tip: If you weren’t using tape, File Gateway could be another option for file-based backups; Tape Gateway is the right pick for tape-based workflows.

• The Balanced Scorecard translates an organization’s vision and strategy into a set of concrete objectives and metrics across four perspectives (financial, customer, internal processes, learning & growth). This framework explicitly links IT goals to business goals and provides a way to measure and monitor alignment over time.

• Enterprise architecture (EA): Great for governance, standards, and roadmaps to ensure IT assets support business needs, but it’s more about structure and alignment at design time rather than directly measuring ongoing alignment of goals.
• KPIs: Useful metrics, but they don’t by themselves provide a full framework to ensure IT goals are aligned with organizational strategy.
• Enterprise dashboard: A visualization tool for metrics; it helps report status but doesn’t inherently establish or assess alignment.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• What wipe does: A factory reset that erases all data, apps, and settings and returns the device to the OOBE. It removes the device from management and resets identity.
• Why not for this scenario: The goal is to repurpose the same device to a new user with Autopilot. Autopilot Reset keeps the device’s Azure AD/Intune identity and re-provisions the device for the next user without a full wipe.
• What Autopilot Reset does: Removes user data and apps but preserves device identity and management connection, then reapplies the Autopilot provisioning for the next user.
• When you’d use wipe instead: If you’re selling or permanently discarding the device, or you truly want to scrub all traces and start fresh without re-enrolling.

• In Microsoft Entra (Azure AD), admin roles can be scoped to either the entire directory (tenant) or to an Administrative Unit (AU). To assign a role at an AU scope, the user must be a member of that AU.

• Roles in question: Security Administrator and User Administrator can be scoped either to the Directory or to a specific AU.

• User1 is a member of AU1. Therefore, User1 can be assigned either at the AU scope (AU1) or at the Directory scope (global).

• User2 is not a member of AU1. Therefore, User2 cannot be assigned at the AU scope; the valid scope for User2 is only the Directory scope.

• User1: can be assigned at AU1 and at Directory scopes.
• User2: can be assigned only at the Directory scope.

• SAMLRequest: the SAML authentication request
• RelayState: the original destination or application state

• RedirectURL: not the standard SAML parameter for preserving the original request.
• DisplayState: not a standard SAML SSO parameter.
• StartURL: Salesforce-related terminology, but not the standard parameter used in this SAML exchange.

• Detect risky sign-ins from unfamiliar or unidentified IP addresses
• Evaluate user or sign-in risk
• Automatically require a password change because of a risky sign-in

• User risk policy: Can require a user to securely change their password when the account may be compromised.
• Sign-in risk policy: Can require MFA or block access based on the risk of a particular sign-in.

• Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.
• Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.
• Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

• Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

• Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

• Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

• Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

• View/inspect configuration: Possible.
• Modify the installed application or its S-Controls: Typically restricted in a test-drive org.

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically:

• Review iteration length: Changing duration does not resolve unclear requirements.
• Limit work in progress: Useful when excessive multitasking is the problem, but it does not directly clarify requirements.
• Review individual performance: The issue is a process and backlog-quality problem, not necessarily an individual performance problem.