Amazon Web Services Updated DVA-C02 Exam Questions and Answers by ishaaq

The requirement is to test a new Lambda version without impacting the production API, and to do so with the least operational overhead. In API Gateway (REST API), the simplest pattern is to create a separate stage (for example, test) and use a stage variable to control which Lambda function version (or alias) the integration invokes.

With option B, the developer creates a new stage and defines a stage variable (commonly something like lambdaAlias or lambdaVersion). The API method integration URI can reference this stage variable so that each stage points to a different Lambda alias/version. The production stage (for example, prod) continues to call the stable version, while the test stage calls the new version. This cleanly isolates testing traffic and prevents any effect on the production REST API because stages have distinct invoke URLs and deployments.

This approach is operationally efficient because it avoids duplicating the API definition (new REST API) and avoids creating extra resources/methods that must be maintained. It also provides a repeatable process: future versions can be tested by updating only stage variables or alias routing rather than restructuring the API.

Why not the others:

A adds additional resources/methods and increases API surface area and maintenance.

C duplicates the entire API, increasing overhead and configuration drift risk.

D would impact production because it changes the integration used by the existing method.

Therefore, using a new stage + stage variables to route to the updated Lambda version meets the requirements with minimal overhead.

To provide login functionality with branded sign-in pages and minimal custom code, the best solution is Amazon Cognito Hosted UI. Cognito User Pools include a managed authentication service that can handle sign-up/sign-in, MFA options, password resets, and OAuth/OpenID Connect flows. The Hosted UI provides ready-to-use authentication pages and endpoints, which removes the need to build and maintain custom authentication pages and backend logic.

AWS allows customization of the Hosted UI to match company branding (for example, logo, colors, and CSS styling). This directly meets the requirement that “all pages must match branding” while minimizing development effort. The application can integrate with Cognito using standard authorization flows and tokens, which works well with Lambda-based architectures (for example, API Gateway authorizers with Cognito user pools).

Option A (S3 static pages) would still require implementing authentication flows, session handling, token management, and secure integration with the backend—significantly more custom code.

Option B requires writing and maintaining custom sign-in page serving logic plus authentication handlers, which increases code and operational overhead.

Option C (Lambda@Edge) is even more complex, introducing edge execution and additional deployment/versioning considerations, and still requires custom auth logic.

Therefore, using Amazon Cognito User Pools with the Hosted UI and branding customization is the lowest-code, most maintainable solution.

This solution will meet the requirements by ensuring that all traffic between users and CloudFront, and all traffic between CloudFront and the web application, are encrypted using HTTPS protocol. The Origin Protocol Policy determines how CloudFront communicates with the origin server (the web application), and setting it to “HTTPS Only” will force CloudFront to use HTTPS for every request to the origin server. The Viewer Protocol Policy determines how CloudFront responds to HTTP or HTTPS requests from users, and setting it to “HTTPS Only” or “Redirect HTTP to HTTPS” will force CloudFront to use HTTPS for every response to users. Option A is not optimal because it will use AWS KMS to encrypt traffic between CloudFront and the web application, which is not necessary or supported by CloudFront. Option C is not optimal because it will set the origin’s HTTP port to 443, which is incorrect as port 443 is used for HTTPS protocol, not HTTP protocol. Option E is not optimal because it will enable the CloudFront option Restrict Viewer Access, which is used for controlling access to private content using signed URLs or signed cookies, not for encrypting traffic.