DVA-C02 Practice Test 12 — 15 Questions

Question 1

A developer created the following IAM role for a Lambda function:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "lambda.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}
```

The function needs to write logs to CloudWatch Logs. What is missing?

Accepted Answer

The role needs a permissions policy that grants logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. The role shown includes a trust policy that allows Lambda to assume the role but does not include an attached permissions policy for CloudWatch Logs. To write logs to CloudWatch Logs, the Lambda function must be granted logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents through a permissions policy attached to the role.

Answer

The trust policy is incorrect; it should allow ec2.amazonaws.com.

Answer

The role name is invalid.

Answer

The trust policy should not allow Lambda to assume the role.

Question 2

A developer is building a chat application using WebSockets. The application runs on multiple EC2 instances and needs to broadcast messages to all connected clients. Which AWS service can handle the WebSocket connections and route messages?

Accepted Answer

Amazon API Gateway WebSocket API. Amazon API Gateway WebSocket API is the correct choice because it natively manages WebSocket connections, maintains persistent bidirectional communication, and can broadcast messages to all connected clients using callback URLs. It handles connection lifecycle (connect, disconnect, default) and integrates with AWS Lambda or other backends to route messages efficiently.

Answer

Amazon SQS with long polling

Answer

Application Load Balancer with WebSocket support

Answer

Amazon CloudFront with WebSocket support

Question 3

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 4

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'ScriptMissing' during the BeforeInstall lifecycle event. What is the most likely cause?

Accepted Answer

The script file specified in the appspec.yml for the BeforeInstall hook is not present on the instance. The 'ScriptMissing' error in AWS CodeDeploy indicates that the deployment failed because a script file referenced in the appspec.yml for a lifecycle event (in this case, BeforeInstall) could not be found on the EC2 instance. CodeDeploy expects the script to be present at the specified path after the archive is extracted; if the file is missing or the path is incorrect, the agent reports this error. Option B correctly identifies that the script file is not present on the instance.

Answer

The BeforeInstall lifecycle event is not defined in the appspec.yml

Answer

The CodeDeploy agent on the instance is not running

Answer

The instance does not have the necessary permissions to execute the script

Question 5

A developer runs the following AWS CLI query against a DynamoDB table named 'Orders' and receives a ValidationException:

```
aws dynamodb query \
    --table-name Orders \
    --key-condition-expression "OrderID = :orderID" \
    --expression-attribute-values '{":orderID":{"S":"12345"}}'
```

What is the MOST likely cause?

Accepted Answer

The table's partition key is not named 'OrderID'. DynamoDB's Query operation requires that the KeyConditionExpression reference the table's actual partition key name exactly. If the Orders table's partition key is not named 'OrderID', the query fails with a ValidationException. The expression attribute values are formatted correctly, and a sort key is not required to query by partition key alone.

Answer

The expression attribute values are incorrectly formatted

Answer

The table does not exist

Answer

The query needs to use a sort key

Question 6

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an Amazon RDS MySQL database using credentials stored in AWS Secrets Manager. The ECS task role has the following IAM policy: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["secretsmanager:GetSecretValue"],"Resource":"arn:aws:secretsmanager:us-east-1:123456789012:secret:prod-db-*"}]}. The application fails to retrieve the secret with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The secret's resource-based policy denies access to the task role.. The IAM policy on the ECS task role allows access to secrets matching the pattern `prod-db-*`. However, if the secret has a resource-based policy that explicitly denies access to the task role, that denial overrides the IAM allow, causing an AccessDeniedException. AWS Secrets Manager evaluates both identity-based policies (task role) and resource-based policies, and an explicit deny in either results in denial.

Answer

The task execution role does not have permission to retrieve the secret.

Answer

The task is in a private subnet without a VPC endpoint to Secrets Manager.

Answer

The secret name does not match the pattern in the policy.

Question 7

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. The developer wants to ensure that session data is not lost if an EC2 instance is terminated. Which solution should the developer implement?

Accepted Answer

Store session data in an Amazon ElastiCache cluster.. Amazon ElastiCache provides a managed, highly available, and durable in-memory cache that can store session state externally from EC2 instances. By using ElastiCache (e.g., Redis with replication and persistence), session data survives instance termination because it is stored in a separate, resilient service, not on the local instance.

Answer

Store session data in an Amazon EBS volume.

Answer

Store session data in an Amazon S3 bucket.

Answer

Store session data in the instance store.

Question 8

A Lambda function needs temporary scratch space larger than the default while processing images. Which setting should be adjusted?

Accepted Answer

Ephemeral storage size for /tmp. Lambda functions have a default /tmp storage of 512 MB, which is insufficient for large image processing tasks. Adjusting the ephemeral storage size (up to 10,240 MB) provides the necessary scratch space for temporary files, such as intermediate image buffers or resized outputs, without requiring external storage like EFS.

Answer

Reserved concurrency

Answer

Function URL auth type

Answer

Dead-letter queue target

Question 9

An API Gateway REST API invokes Lambda synchronously. Clients receive 502 responses after a deployment, but Lambda logs show a successful business operation. What is the most likely issue?

Accepted Answer

The Lambda proxy integration response format is invalid. Lambda proxy integration requires the response to be in a specific JSON format: `{"statusCode": ..., "headers": ..., "body": ...}`. If the Lambda function returns a plain string or an object missing these keys, API Gateway cannot map it to an HTTP response, resulting in a 502 Internal Server Error. The successful business operation in logs confirms the Lambda code ran correctly, but the malformed response format causes the gateway error.

Answer

The Lambda execution role lacks dynamodb:PutItem

Answer

The API cache TTL is too short

Answer

The API stage has X-Ray tracing enabled

Question 10

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

Accepted Answer

Enable CORS in the API Gateway settings and configure the required headers.. Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.

Answer

Use Amazon CloudFront to proxy the API and add CORS headers.

Answer

Nothing; API Gateway automatically handles CORS.

Answer

Add CORS headers in the Lambda function code.

Question 11

A developer wants to debug an AWS Lambda function by viewing real-time logs. Which AWS service should the developer use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service because AWS Lambda automatically streams all execution logs, including real-time output from console.log() statements and any errors, to CloudWatch Logs. The developer can use the CloudWatch Logs console or the `aws logs tail` command to view these logs in near real-time, enabling effective debugging of function behavior as it executes.

Answer

AWS X-Ray

Answer

Amazon S3

Answer

AWS CloudTrail

Question 12

A developer is implementing an e-commerce application where a purchase operation must deduct inventory and create an order atomically. The inventory and orders are stored in separate DynamoDB tables. Which DynamoDB feature should the developer use to execute these operations as a single, all-or-nothing transaction?

Accepted Answer

DynamoDB Transactions. DynamoDB Transactions provide ACID (Atomicity, Consistency, Isolation, Durability) guarantees across one or more tables within a single AWS account and region. This allows the developer to combine the deduct-inventory and create-order operations into a single all-or-nothing transaction, ensuring that both succeed or both fail without partial updates.

Answer

DynamoDB Streams

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Global Tables

Question 13

A developer is using Amazon DynamoDB to store session data for a web application. The application reads and writes a single item per user session. The traffic pattern shows occasional spikes. The developer wants to minimize read and write costs. Which DynamoDB capacity mode should the developer choose?

Accepted Answer

On-demand capacity. On-demand capacity mode is ideal for unpredictable traffic patterns with occasional spikes because it automatically scales read and write throughput based on actual usage, charging only for consumed operations. Since the application reads and writes a single item per session and experiences spikes, on-demand eliminates the need to provision for peak capacity, minimizing costs compared to over-provisioning.

Answer

Reserved capacity

Answer

Provisioned capacity with manual scaling

Answer

Provisioned capacity with auto scaling

Question 14

A developer is deploying a microservices architecture on Amazon ECS using Fargate launch type. The services need to communicate with each other. The developer wants to use service discovery so that services can find each other by name. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a cloud resource discovery service that allows microservices to register their DNS names and health checks, enabling dynamic service discovery. With Amazon ECS and Fargate, services can use AWS Cloud Map namespaces (either API-based or DNS-based) to resolve each other by logical service names, which is essential for inter-service communication in a microservices architecture.

Answer

Amazon Route 53 private hosted zones

Answer

Amazon ECR

Answer

Application Load Balancer

Question 15

A developer is using AWS Elastic Beanstalk to deploy a Node.js application. The developer wants to run a custom script to set environment variables before the application starts. Which configuration file and location should the developer use?

Accepted Answer

Add a configuration file in the .ebextensions directory that uses container_commands.. `.ebextensions` configuration files with `container_commands` allow you to run custom commands before the application starts. `container_commands` execute after the application and web server have been set up but before the application is deployed, making them ideal for setting environment variables or running setup scripts. The files must be in YAML or JSON format and placed in the `.ebextensions` directory at the root of your source bundle.

Answer

Add a Procfile to the application root.

Answer

Place a shell script in the .ebextensions/scripts directory.

Answer

Add a cron.yaml file to the .ebextensions directory.