DVA-C02 Practice Test 12 — 15 Questions

Question 1

A Lambda function processing SQS messages is failing with concurrency errors. The function is configured with reserved concurrency of 5. The SQS queue has a batch size of 10. What is the most effective way to prevent throttling?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the reserved concurrency to a higher value.. The function is throttling due to insufficient reserved concurrency. With a batch size of 10, each SQS batch triggers one invocation, but the function's reserved concurrency of 5 limits concurrent executions to 5. Increasing reserved concurrency allows more concurrent invocations to handle the SQS messages without throttling.

Answer

Reduce the batch size to 1 to spread out invocations.

Answer

Increase the Lambda function memory to get more concurrency.

Answer

Set the SQS queue's concurrency limit to match the Lambda reserved concurrency.

Question 2

A developer is trying to decrypt an S3 object using an AWS KMS key. The decryption fails with an 'AccessDenied' error. The IAM policy attached to the developer's user includes the statement in the exhibit. The KMS key policy includes the following statement:

{
  "Sid": "Enable IAM User Permissions",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:root"
  },
  "Action": "kms:*",
  "Resource": "*"
}

What is the most likely reason for the failure?

Accepted Answer

The developer's IAM policy does not include 'kms:Decrypt' permission.. To decrypt an S3 object encrypted with SSE-KMS, the principal needs kms:Decrypt permission on the KMS key. The key policy's default root statement enables IAM policies in the account, so the most likely cause of AccessDenied is that the developer's IAM policy lacks kms:Decrypt.

Answer

The KMS key policy does not grant access to the developer's IAM user.

Answer

The KMS key policy specifies 'kms:*' which is too broad and causes a conflict.

Answer

The developer's IAM policy uses 'Resource' with the full key ARN but the key policy requires a different format.

Question 3

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. Users report intermittent 503 errors. The Lambda function code appears correct. Which action is MOST likely to resolve the issue?

Accepted Answer

Request a service quota increase for Lambda concurrent executions.. Intermittent 503 errors from API Gateway often indicate that Lambda concurrent execution limits have been reached. When the number of simultaneous invocations exceeds the account-level or function-level reserved concurrency, API Gateway returns a 503 'Service Unavailable' response. Increasing the Lambda concurrent executions quota allows more invocations to be processed without throttling.

Answer

Increase the Lambda function memory allocation.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 4

A developer launches an Amazon EC2 instance that needs to read and write data to an Amazon DynamoDB table. The developer must follow the principle of least privilege and ensure that no long-term credentials are stored on the instance. Which approach should the developer use?

Accepted Answer

Create an IAM role with the necessary DynamoDB permissions, and attach the role to the EC2 instance profile. The SDK will automatically retrieve temporary credentials from the instance metadata.. It uses an IAM role attached to the EC2 instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the instance metadata service (IMDS). This follows the principle of least privilege by granting only the necessary DynamoDB permissions and eliminates the need to store any long-term credentials on the instance, as the credentials are rotated automatically by AWS STS.

Answer

Create an IAM user with programmatic access, store the access key and secret key in a configuration file on the EC2 instance.

Answer

Store the DynamoDB credentials in AWS Systems Manager Parameter Store as a SecureString, and retrieve them from the EC2 instance at runtime.

Answer

Use a Lambda function to generate temporary credentials for the EC2 instance and pass them via user data at launch.

Question 5

A developer is troubleshooting an IAM policy that is supposed to allow a Lambda function to read objects from an S3 bucket. The Lambda function role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket/*","arn:aws:s3:::example-bucket"]}]}. Despite this, the Lambda function receives an AccessDenied error when trying to read objects. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that explicitly denies the Lambda function's access.. The IAM policy attached to the Lambda function role correctly grants s3:GetObject and s3:ListBucket permissions on the bucket and its objects. However, if the S3 bucket itself has a bucket policy that explicitly denies access to the Lambda function's role, that explicit deny overrides any allow from IAM policies, resulting in an AccessDenied error. This is because AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The Lambda function is in a different AWS account than the S3 bucket.

Answer

The IAM policy uses an incorrect resource ARN format.

Question 6

A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?

Accepted Answer

Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.. AWS Secrets Manager provides a secure, auditable, and automated way to store and retrieve database credentials. The Lambda function can assume an IAM role with permissions to access the secret, and retrieve the credentials at runtime using the AWS SDK, avoiding hardcoding or insecure storage. This approach also supports automatic rotation of credentials, enhancing security.

Answer

Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.

Answer

Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.

Answer

Hardcode the credentials as environment variables in the Lambda function configuration.

Question 7

A developer is using Amazon DynamoDB for a new application. The developer wants to reduce read latency. Which design pattern should the developer use?

Accepted Answer

Use DynamoDB Accelerator (DAX) as a cache for frequently read items.. DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX offloads requests from the DynamoDB table, reducing read latency without requiring application-level caching logic. This directly addresses the developer's goal of reducing read latency.

Answer

Create a global secondary index (GSI) for the table.

Answer

Increase the provisioned read capacity units (RCUs) for the table.

Answer

Use DynamoDB Global Tables to replicate data to multiple regions.

Question 8

A company uses AWS CloudFormation to manage its infrastructure. The developer wants to update a stack but only if the update does not cause any resource replacement. Which CloudFormation stack update option should be used?

Accepted Answer

Create a change set and review the changes before executing it.. A change set allows you to preview the changes that CloudFormation will make to your stack, including whether any resources will be replaced. By reviewing the change set, you can see if any resource replacement is listed and choose not to execute it if you want to avoid replacements. This gives you full control to update the stack only when no replacements are required.

Answer

Use the direct update option with a template.

Answer

Use the 'Force rollback' option to ensure no replacement.

Answer

Use the 'Preserve stack settings' option when updating the stack.

Question 9

A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store encrypted credentials.. AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.

Answer

Store the credentials as Lambda environment variables.

Answer

Hardcode the credentials in the Lambda function code.

Answer

Store the credentials in a file in the Lambda deployment package.

Question 10

A company is running a serverless application using AWS Lambda and Amazon API Gateway. The application experiences increased latency during peak hours. CloudWatch metrics show that Lambda function duration remains stable, but API Gateway latency spikes. Which THREE actions should the developer take to reduce API Gateway latency?

Accepted Answer

Enable compression for API responses.. Options B, D, and E are correct. Enabling compression reduces payload size, decreasing response time. API Gateway caching reduces backend calls by serving cached responses, lowering latency. Switching to Regional endpoint reduces network latency by eliminating the global edge network hop. Option A is wrong because increasing Lambda timeout does not reduce API Gateway latency; it only allows functions to run longer. Option C is wrong because throttling limits cap request rates but do not reduce latency for individual requests.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 11

A developer is using Amazon DynamoDB as the data store for a web application. The application experiences frequent throttling errors. Which action can reduce throttling without changing the application code?

Accepted Answer

Enable DynamoDB Auto Scaling. DynamoDB Auto Scaling automatically adjusts the provisioned throughput capacity based on actual traffic patterns, using the AWS Application Auto Scaling service. This prevents throttling by increasing capacity during demand spikes and reduces costs by scaling down during low traffic, all without requiring any code changes.

Answer

Add a secondary index

Answer

Decrease the provisioned write capacity

Answer

Increase the provisioned read capacity only

Question 12

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 13

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

Accepted Answer

The Lambda function must send a response to an S3 pre-signed URL.. AWS CloudFormation custom resources require the Lambda function to send a response to an S3 pre-signed URL to signal completion. CloudFormation waits for this response to proceed with stack operations; without it, the stack creation or update will time out and fail.

Answer

The Lambda function must be defined in the same CloudFormation template.

Answer

The Lambda function must return a JSON object with the desired output.

Answer

The Lambda function must be written in Python.

Question 14

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment is set to use a 'OneAtATime' deployment configuration. The developer wants to ensure that the deployment does not cause downtime. Which TWO configurations are necessary?

Accepted Answer

Configure a load balancer for the Auto Scaling group.. Registering the Auto Scaling group with a load balancer allows CodeDeploy to deregister each instance before deployment and re-register it after the new application version is installed and passes health checks. This ensures traffic is shifted away from the instance being updated, preventing downtime during a 'OneAtATime' deployment.

Answer

Set the 'IgnoreApplicationStopFailures' flag to true.

Answer

Use an 'AllAtOnce' deployment configuration.

Answer

Install the CodeDeploy agent on each instance.

Question 15

A developer is building a serverless application using AWS Lambda to process events from an Amazon SQS queue. The Lambda function is CPU-bound and currently experiences timeouts. What is the MOST cost-effective way to reduce execution time?

Accepted Answer

Increase the Lambda function's memory allocation. Increasing the Lambda function's memory allocation is the most cost-effective way to reduce execution time for a CPU-bound function because Lambda allocates CPU proportionally to memory. More memory means more vCPU capacity, which directly speeds up CPU-bound processing. This reduces the function's duration, and since Lambda billing is based on compute time (GB-seconds), the total cost can decrease even if the per-GB-second rate is higher.

Answer

Increase the SQS batch window size

Answer

Switch the Lambda runtime from Python to Node.js

Answer

Enable Provisioned Concurrency for the function