DVA-C02 Exam Questions and Answers

Increase the batch size to 100.

Increasing the batch size for an SQS event source mapping allows each AWS Lambda invocation to process a larger number of messages simultaneously. This significantly reduces the total number of Lambda invocations required to process a given volume of messages, thereby lowering the demand for concurrent executions. By processing more work per invocation, the function is less likely to hit its concurrency limit and experience throttling, effectively optimizing resource utilization without increasing reserved concurrency.

Increase the reserved concurrency of the Lambda function

Increasing reserved concurrency directly allocates a dedicated maximum number of simultaneous executions for this specific Lambda function. This prevents the function from being throttled by the account's unreserved concurrency limit or other functions consuming available capacity. By ensuring more invocations can run in parallel, the function can effectively process larger SQS batch sizes without messages backing up, significantly improving overall message consumption rate and throughput.

DynamoDB Accelerator (DAX)

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically designed to sit in front of DynamoDB tables. It provides microsecond response times for read-heavy workloads by caching frequently accessed data, significantly improving performance for serverless applications. DAX is API-compatible with DynamoDB, requiring minimal application code changes to integrate and benefit from its high-performance caching capabilities, making it ideal for reducing read latency.

Use the Amazon States Language (ASL) Retry field in the Task state definition.

The Amazon States Language (ASL) Retry field is the definitive and recommended mechanism within AWS Step Functions for handling transient failures in Task states. This declarative approach allows developers to specify which error types to retry, the maximum number of attempts, the initial delay, and an exponential backoff rate. Implementing retries directly in the state machine definition ensures robust error handling without modifying the underlying Lambda function code.

Enable API Gateway caching on the stage and configure the client ID header as a cache key parameter. Set a cache TTL of 5 minutes.

API Gateway caching uses cache key parameters to index responses. By including the client ID header in the cache key, different clients get separate cached responses. The TTL controls how long the response is cached.

Enable API caching on the stage with a TTL of 300 seconds and configure the client ID as a cache key parameter.

API Gateway's built-in caching mechanism is exclusively available for REST APIs, not HTTP APIs. While enabling caching on a stage with a specified TTL and using a client ID as a cache key parameter is a valid strategy for optimizing REST API performance and reducing backend load, this functionality is simply not supported for HTTP APIs. Therefore, this option cannot be implemented for the API type specified in the question, rendering it ineffective for the stated goal.

The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.

When an S3 bucket utilizes Server-Side Encryption with AWS KMS (SSE-KMS) for object encryption, any entity attempting to read those encrypted objects requires two distinct sets of permissions. First, it needs `s3:GetObject` permission on the S3 bucket and object. Second, and critically, the Lambda function's execution role must also have `kms:Decrypt` permission on the specific AWS KMS key used to encrypt the objects. This `kms:Decrypt` permission is granted via the KMS key policy, not the S3 bucket policy, and without it, the Lambda cannot decrypt the object data even if it successfully retrieves the encrypted bytes from S3.

Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id

This SCP will deny any PutObject request that specifies a KMS key that is not the required key. The StringNotEquals condition ensures that if the request does not use the specific key ID, the request is denied. This is the standard way to enforce encryption with a specific KMS key using SCPs.

The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN

Cross-account access requires both a bucket policy that grants the user permissions and an IAM policy in the user's account that allows the action. The IAM policy is necessary because the default is to deny all actions.

Enable CloudTrail data events for the specific KMS key ARN.

CloudTrail data events for KMS record every call to Decrypt, Encrypt, GenerateDataKey, etc. By specifying the key ARN in the data event selector, only operations on that key are logged, meeting the audit requirement without excessive logging.

The IAM role's trust policy does not allow Cognito to assume it.

The trust policy of an IAM role explicitly defines which entities are permitted to assume that role. For Amazon Cognito Identity Pools to issue temporary AWS credentials to an authenticated user, the IAM role associated with the authenticated identity must have a trust policy that grants the Cognito Identity service principal (cognito-identity.amazonaws.com) the sts:AssumeRole permission. Without this crucial trust relationship, Cognito cannot generate the necessary temporary credentials, leading to 'Access Denied' errors when the application attempts to interact with other AWS services, regardless of the permissions policy attached to the role.

Add a statement granting kms:Decrypt to the Lambda function's execution role.

When a Lambda function needs to interact with a customer-managed AWS KMS key, the key policy associated with that KMS key must explicitly grant permissions to the entity making the request. The Lambda function assumes an IAM execution role, and it is this role that makes API calls to KMS. Therefore, the KMS key policy must include a statement allowing the kms:Decrypt action for the specific ARN of the Lambda function's execution role, ensuring direct access control and adherence to the principle of least privilege.

Modify the blue/green deployment configuration to use the same database endpoint for both task sets by updating the environment variables in the task definition before deployment.

During an AWS CodeDeploy blue/green deployment, both the existing (blue) and new (green) application versions must access the same persistent data store to maintain data consistency. By updating environment variables within the ECS task definition, such as `DATABASE_ENDPOINT`, before deployment, both task sets can be configured to point to the single, shared database instance. This approach avoids data migration complexities and ensures a seamless transition without modifying the container image itself, making it the most straightforward and efficient solution for database connectivity.

Deployment type: blue/green, with rollback configuration enabled to trigger automatic rollback and reroute traffic to the original task set

This configuration leverages AWS CodeDeploy's integrated rollback capabilities for blue/green deployments. By enabling rollback, CodeDeploy actively monitors predefined CloudWatch alarms or health checks during the traffic shifting phase. If any alarm is triggered, indicating a deployment failure or performance degradation, CodeDeploy automatically initiates a rollback, rerouting all traffic back to the original, stable task set to maintain application availability and minimize impact.

Create two separate ECS services, each with its own task definition, and place the web server in a public subnet with the worker in a private subnet.

This approach correctly leverages ECS services for independent lifecycle management and scaling of distinct application components. By defining separate task definitions and services for the web server and worker, each can be scaled independently based on its specific load requirements, optimizing resource utilization. Placing the web server service in a public subnet, typically behind an Application Load Balancer, allows it to serve internet traffic, while the worker service in a private subnet ensures it remains isolated from direct public access, enhancing security and adhering to best practices for backend components.

CodeDeployDefault.OneAtATime

The CodeDeployDefault.OneAtATime configuration updates only one instance in the target deployment group at a time. This strategy ensures maximum application availability by keeping the vast majority of instances serving traffic throughout the deployment process. It minimizes the blast radius of any potential deployment failure and allows for quick rollback or termination of the deployment if issues are detected on the single updated instance, making it ideal for critical applications requiring continuous operation.

CodeDeployDefault.OneAtATime

OneAtATime deploys to a single instance at a time, minimizing the number of instances offline and best preserving availability.

Blue/green deployment with environment CNAME swap

Blue/green deployment with environment CNAME swap is the most robust strategy for zero-downtime deployments and easy rollback. It involves creating a completely new, separate Elastic Beanstalk environment (the "green" environment) running the new application version, while the existing "blue" environment continues to serve traffic. After thorough testing of the green environment, the CNAME record of the load balancer is atomically swapped, redirecting all traffic to the new environment instantly. This approach ensures the new version is fully validated before going live and allows for immediate rollback by swapping the CNAME back.

Increase the read and write capacity units on the DynamoDB table

Increasing the read and write capacity units (RCU/WCU) on the DynamoDB table directly raises its maximum sustained throughput. These units define the number of strongly consistent reads and 1KB writes the table can handle per second. By provisioning more capacity, the table can accommodate a higher volume of operations, directly mitigating throttling errors that occur when request rates exceed the current limits.

Switch the DynamoDB table to on-demand capacity mode

Switching to on-demand capacity mode allows DynamoDB to automatically scale read and write throughput based on the actual traffic patterns generated by the Lambda function. This eliminates ProvisionedThroughputExceededException errors by dynamically adjusting capacity, ensuring the table can handle unpredictable or spiky workloads without manual intervention or capacity planning. It directly resolves throttling issues stemming from insufficient provisioned capacity.

The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes

During a rapid traffic spike, an Auto Scaling group's cooldown period, typically 300 seconds by default, prevents additional scaling activities from initiating immediately after a previous one. This delay means that even if the scaling policy is triggered multiple times, new instances cannot launch quickly enough to meet the escalating demand. Consequently, existing instances become overloaded and unhealthy, leading to 503 Service Unavailable errors as the application cannot process requests.

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB)

Increasing the Lambda function's memory allocation directly scales the available CPU power, network bandwidth, and ephemeral storage. For CPU-intensive tasks like `pandas` processing of large CSV files, more CPU can significantly accelerate computations, reducing the overall execution time. This approach is highly effective in preventing timeouts by providing the necessary resources to complete the workload within the allowed duration, without requiring any changes to the existing function code.

S3 event notifications are delivered at least once, and the Lambda function is not idempotent.

S3 event notifications operate on an "at least once" delivery model, meaning that a single S3 event, such as an object creation, might trigger the associated Lambda function multiple times. If the Lambda function's logic is not designed to be idempotent, each duplicate invocation will independently process the event and perform its side effects, leading to duplicate data entries or actions. Implementing idempotency, often by using a unique identifier from the S3 event (like the object key) as a check, is crucial to prevent these redundant operations.

Increase the parallelization factor to 10

The parallelization factor determines the number of concurrent Lambda invocations per shard. Increasing it allows multiple invocations to process records from the same shard simultaneously, dramatically increasing throughput without additional shard costs.