DVA-C02 Exam Dumps : AWS Certified Developer - Associate

AWS Secrets Manager: Built for managing secrets, providing encryption, automatic rotation, and access control.

Customer Master Key (CMK): Provides an extra layer of control over encryption through AWS KMS.

Automatic Rotation: Enhances security by regularly changing the secret.

User Data Script: Allows secrets retrieval at instance startup and sets them as environment variables for seamless use within the application.

The requirement is to keep profile pictures private in S3 while allowing the browser to display them each time an employee logs in. The standard AWS pattern is to store objects in a private bucket and provide time-limited access through S3 presigned URLs . A presigned URL grants temporary permission to perform a specific operation (such as GET) on a specific object, and it expires automatically after a configured duration. This prevents public access while still allowing simple browser retrieval.

Option D is the viable long-term solution because it stores only the S3 object key (a stable identifier) in DynamoDB and generates a fresh presigned URL at login time . This is important because presigned URLs expire; storing a presigned URL (option A) would eventually store an expired URL and force extra complexity to refresh records. Generating a new presigned URL when needed ensures the link is always valid and keeps the expiration window tight, which improves security.

Option B is not appropriate for employee browsers in general: a VPC endpoint is for traffic from resources inside a VPC (EC2, Lambda in VPC, etc.). Employee browsers on the public internet cannot use a private VPC endpoint to reach S3. Option C is not viable for “no size limit” images: DynamoDB has strict item size limits, base64 inflates data size, and storing large binary blobs in DynamoDB is inefficient and expensive compared to S3.

Therefore, D best meets the requirement: keep images private in S3, store the S3 key in DynamoDB, and generate a presigned URL on each login to provide secure, temporary access for display.

Amazon CloudFront is a global content delivery network (CDN) designed to deliver static and streaming content with low latency and high throughput . AWS documentation explicitly recommends CloudFront for media streaming and high-request-rate workloads.

By placing CloudFront in front of Amazon S3, video content is cached at edge locations close to end users. This dramatically reduces latency, minimizes buffering, and offloads request volume from the S3 bucket. CloudFront is built to handle sudden traffic spikes and supports tens of thousands of requests per second per edge location.

Route 53 routing policies (Option A) control DNS resolution but do not cache content. Cross-Region Replication (Option B) improves regional availability but does not provide edge caching or streaming optimization. S3 Intelligent-Tiering (Option C) optimizes storage cost, not performance.

Therefore, using CloudFront with S3 as the origin provides the largest and most immediate performance improvement.