Amazon Web Services DVA-C02 Exam With Confidence Using Practice Dumps

The correct answer is C because Amazon SNS FIFO topics are designed for applications that require both message ordering and deduplication , and high throughput mode extends the throughput capability to support large-scale workloads such as sending thousands of notifications per second . This directly matches the requirement for ordered notification delivery at very high scale.

The requirement to filter out some notifications before sending them to the HTTP endpoint is also handled natively by SNS subscription filter policies . With a filter policy, only messages with matching message attributes are delivered to the subscribed endpoint. This means the application can publish all notification events to the SNS topic, while SNS ensures that only relevant notifications are forwarded to the HTTP subscriber. This avoids unnecessary downstream traffic and reduces custom logic.

Option A is incorrect because Amazon Data Firehose is intended primarily for streaming data delivery to analytics and storage destinations, not for ordered notification delivery to HTTP endpoints with filtering requirements. Option B is incorrect because Amazon SQS standard queues do not preserve strict ordering . Also, this design adds Lambda processing complexity and does not align as cleanly with native FIFO and filtering capabilities. Option D is not the best choice because EventBridge supports filtering and API destinations, but it does not provide the same straightforward FIFO ordered delivery guarantee required here.

Therefore, Amazon SNS FIFO in high throughput mode with an HTTP subscription and subscription filter policy is the AWS service combination that best satisfies all the stated requirements.

The requirement is to keep profile pictures private in S3 while allowing the browser to display them each time an employee logs in. The standard AWS pattern is to store objects in a private bucket and provide time-limited access through S3 presigned URLs . A presigned URL grants temporary permission to perform a specific operation (such as GET) on a specific object, and it expires automatically after a configured duration. This prevents public access while still allowing simple browser retrieval.

Option D is the viable long-term solution because it stores only the S3 object key (a stable identifier) in DynamoDB and generates a fresh presigned URL at login time . This is important because presigned URLs expire; storing a presigned URL (option A) would eventually store an expired URL and force extra complexity to refresh records. Generating a new presigned URL when needed ensures the link is always valid and keeps the expiration window tight, which improves security.

Option B is not appropriate for employee browsers in general: a VPC endpoint is for traffic from resources inside a VPC (EC2, Lambda in VPC, etc.). Employee browsers on the public internet cannot use a private VPC endpoint to reach S3. Option C is not viable for “no size limit” images: DynamoDB has strict item size limits, base64 inflates data size, and storing large binary blobs in DynamoDB is inefficient and expensive compared to S3.

Therefore, D best meets the requirement: keep images private in S3, store the S3 key in DynamoDB, and generate a presigned URL on each login to provide secure, temporary access for display.

CloudWatch for Log Analysis: CloudWatch is the best fit here because logs are already centralized. Here ' s the process:

Metric Filter: Create a metric filter on the CloudWatch Logs log group. Design a pattern to specifically identify application error messages.

Custom Metric: This filter generates a new custom CloudWatch metric (e.g., ApplicationErrors). This metric tracks the error count.

CloudWatch Alarm: Create an alarm on the ApplicationErrors metric. Configure the alarm with your desired threshold and a 5-minute evaluation period.

SNS Action: Set the alarm to trigger an SNS notification when it enters the alarm state.