Amazon Web Services Updated DVA-C02 Exam Questions and Answers by francisco

CloudFormation and Lambda Environment Variables:

CloudFormation is an excellent tool to manage infrastructure as code, including the log group resource.

Lambda functions can access environment variables at runtime, making them a suitable way to pass configuration information like the log group ARN.

CloudFormation Template Modification:

In your CloudFormation template, define the log group resource.

In the Lambda function resource, add an Environment section:

YAML

Environment:

Variables:

LOG_GROUP_ARN: !Ref LogGroupResourceName

Use code with caution.

content_copy

The !Ref intrinsic function retrieves the log group ' s ARN, which CloudFormation generates during stack creation.

Using the ARN in Your Lambda Function:

Within your Lambda code, access the LOG_GROUP_ARN environment variable.

Configure your logging library (e.g., Python ' s logging module) to send logs to the specified log group.

Amazon DynamoDB is a fully managed NoSQL database service that provides fast and consistent performance with seamless scalability. The developer can store each employee’s contact information in a DynamoDB table along with the object keys for the photos stored in Amazon S3. Amazon S3 is an object storage service that offers industry-leading scalability, data availability, security, and performance. The developer can use AWS APIs to search and retrieve the employee details and photos from DynamoDB and S3.

IAM Roles for EC2 (A): The most secure way to provide AWS permissions from EC2.

Create a role with a policy allowing s3:GetObject on the specific bucket.

Attach the role to an instance profile and associate that profile with your instances.

Pre-signed URLs (C): Temporary, authenticated URLs for specific S3 actions.

Modify the app to use the AWS SDK to call GeneratePresignedUrl.

Embed these URLs when a user is properly logged in, allowing download access.

The requirement is for a single secret value to be available in multiple AWS Regions while remaining consistent across those Regions, with the least operational overhead . AWS Secrets Manager provides a managed capability for this use case: secret replication (also referred to as multi-Region secrets). When replication is enabled from a primary Region, Secrets Manager automatically creates and maintains synchronized replicas of the secret in the selected secondary Regions. Updates to the primary secret are propagated to the replicas so the secret value remains consistent across Regions.

This approach (option C) minimizes operational effort because AWS manages the replication workflow, consistency, and the lifecycle of replicas. The application in each Region can retrieve the secret from the local Region endpoint of Secrets Manager by referencing the Region-appropriate secret ARN, improving latency and reducing cross-Region dependency. It also improves resilience: if a Region has issues, workloads in another Region can still read the replicated secret locally.

Option A recreates managed replication with custom glue (Lambda + EventBridge), which adds code, scheduling, error handling, permissions, retries, and monitoring—higher operational overhead and more failure modes. Option B introduces a cross-Region runtime dependency on the primary Region and increases latency; local caching also risks stale secret values during rotations/updates unless carefully managed, and it reduces resilience if the primary Region is impaired. Option D (independent secrets per Region) increases operational overhead and directly risks inconsistency, because keeping values synchronized becomes a manual or custom automated process.

Therefore, C is the best solution: enable Secrets Manager replication in the primary Region and have applications in each Region read from their local replicated secret ARN to achieve consistent, multi-Region availability with minimal operational work.