DVA-C02 Practice Test 13 — 15 Questions

Question 1

A developer is writing a Lambda function that processes records from a Kinesis stream. The function must handle duplicate records and ensure exactly-once processing. Which approach should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a unique identifier for each record and store processed IDs in a DynamoDB table to skip duplicates.. Exactly-once processing in a Kinesis-triggered Lambda function requires idempotency. By using a unique identifier (e.g., Kinesis sequence number or a business key) and storing processed IDs in a DynamoDB table, the function can check for duplicates before processing each record. This pattern ensures that even if Kinesis delivers the same record multiple times (due to retries or shard rebalancing), the record is only processed once.

Answer

Disable retries in the Lambda function to avoid processing duplicates.

Answer

Enable record ordering in the Kinesis stream.

Answer

Send the records to an SQS FIFO queue for deduplication.

Question 2

A developer is designing a REST API using Amazon API Gateway that experiences high traffic with many repeated requests for the same data. The developer wants to reduce backend load and improve response times. Which feature should the developer enable on the API Gateway method?

Accepted Answer

Enable API Gateway caching. API Gateway caching stores responses from backend endpoints for a configurable Time-to-Live (TTL). When a request for the same data arrives, API Gateway serves the cached response directly without invoking the backend, reducing load and improving latency. This is the most straightforward and managed solution for repeated requests at the API layer.

Answer

Implement caching in the Lambda function using a local cache

Answer

Use an Amazon ElastiCache Redis cluster and modify the Lambda function to check the cache first

Answer

Place an Amazon CloudFront distribution in front of API Gateway

Question 3

A developer is deploying a serverless application using AWS SAM. The application consists of multiple Lambda functions and an Amazon API Gateway. The developer wants to enable canary deployments for the API Gateway stage to gradually shift traffic. Which SAM resource attribute should the developer use?

Accepted Answer

DeploymentPreference. The `DeploymentPreference` attribute in AWS SAM's `AWS::Serverless::Api` resource enables canary deployments for API Gateway stages. This attribute allows you to configure traffic shifting patterns, such as linear or canary, by specifying settings like `Type` (e.g., `Canary10Percent5Minutes`) and `Alarms` to automatically roll back on failures. It directly integrates with AWS CodeDeploy to manage the gradual traffic shift without manual intervention.

Answer

CanarySetting

Answer

StageName

Answer

MethodSettings

Question 4

A developer is building an application that uses Amazon DynamoDB as a data store. The application reads the same item frequently but writes rarely. The developer wants to reduce read costs. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency from single-digit milliseconds to microseconds. Since the application reads the same item frequently but writes rarely, DAX can serve repeated read requests from its cache, significantly reducing the number of read capacity units consumed against the DynamoDB table and thus lowering read costs.

Answer

DynamoDB Global Tables

Answer

DynamoDB Auto Scaling

Answer

Time to Live (TTL)

Question 5

A developer needs to store session state data for a web application running on multiple EC2 instances. The data must be highly available and durable. Which AWS service should be used?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that is ideal for storing session state data with high availability and durability. By using ElastiCache for Redis or Memcached, session data is stored outside of individual EC2 instances, ensuring that if an instance fails, the session state is preserved and can be accessed by other instances in the application tier. ElastiCache supports replication and automatic failover, meeting the requirements for high availability and durability.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon CloudFront

Question 6

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Accepted Answer

An SCP at the organization level denies s3:GetObject.. The correct answers are A, C, and E. An organization-level SCP can deny s3:GetObject, overriding IAM allows. An explicit deny in the user's role policy also overrides any allow. A bucket policy with an explicit Deny statement will cause access denied even if IAM allows. Option B is incorrect because using a wrong region endpoint results in a different error (e.g., NoSuchBucket or redirect), not an access denied. Option D is incorrect because cross-account access is possible with proper permissions; the bucket being in another account does not inherently deny access.

Answer

The user is using an incorrect region endpoint.

Answer

The S3 bucket is in a different AWS account.

Question 7

A developer needs to securely expose an API running on an EC2 instance behind an Application Load Balancer. The API should only be accessible to authenticated users via a custom authorization header. Which steps should be taken? (Choose TWO.)

Accepted Answer

Create a Lambda authorizer that validates the custom header. It creates a Lambda authorizer that can validate a custom authorization header. Option D is correct because API Gateway natively supports Lambda authorizers, allowing the custom header validation to secure the API. Options B and C are incorrect because AWS WAF cannot perform custom authorization logic, and Cognito User Pools require OIDC flows, not custom headers. Option E is incorrect because ALB does not natively support Lambda authorizers as a feature.

Answer

Enable AWS WAF on the ALB to inspect the header

Answer

Use Amazon Cognito User Pools to validate the header

Answer

Configure the ALB to use the Lambda authorizer

Question 8

Refer to the exhibit. A developer ran this CLI command and received the output shown. The application is retrieving the secret but getting an authentication error from the database. What is the MOST likely issue?

Accepted Answer

The application is not correctly parsing the JSON SecretString.. The CLI command successfully retrieved the secret, as shown by the output containing the secret value. The application, however, is failing with an authentication error from the database. This indicates that the secret was retrieved but the application is likely misinterpreting the JSON structure of the SecretString. If the secret is stored as a JSON object (e.g., containing username and password fields), the application must parse the JSON and extract the correct field (e.g., 'password'). If it treats the entire JSON string as the password, it will pass an invalid credential to the database, causing an authentication error.

Answer

The secret is not marked as AWSCURRENT.

Answer

The CLI command should have used the --secret-string parameter.

Answer

The secret ID is incorrect.

Question 9

Which TWO are best practices for securing an AWS account? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users. The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture. Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Answer

Disable AWS CloudTrail to reduce costs

Answer

Disable password rotation to avoid user inconvenience

Answer

Use the root user for daily administrative tasks

Question 10

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. AWS Lambda uses an IAM role (execution role) to obtain temporary credentials via the AWS Security Token Service (STS). Attaching a policy that grants DynamoDB access to this role follows the principle of least privilege and avoids long-term credentials. This is the standard, secure pattern for granting Lambda functions access to other AWS services.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.

Question 11

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Amazon RDS read replicas are designed to offload read traffic from the primary DB instance. A read replica is an asynchronous copy of the primary that can serve SELECT queries, improving read performance without impacting write operations on the primary. Option C is correct because the application must explicitly use the read replica's endpoint for read queries; the replica does not automatically balance traffic. Together, creating a read replica and modifying the application to direct SELECT queries to its endpoint achieves the goal of improving read performance and offloading the primary.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 12

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and a Lambda function. The developer wants to set up a custom domain name for the API in the production stage. Which resource should the developer define in the SAM template to achieve this with minimal effort?

Accepted Answer

AWS::Serverless::Api. The AWS::Serverless::Api resource in an AWS SAM template provides a high-level abstraction that simplifies the configuration of API Gateway REST APIs, including the ability to set up a custom domain name via the Domain property. This approach requires minimal effort because SAM automatically creates the underlying AWS::ApiGateway::DomainName and AWS::ApiGateway::BasePathMapping resources, handles the TLS certificate association, and manages the stage deployment. Defining a raw AWS::ApiGateway::DomainName would require additional manual configuration for base path mapping and stage integration, making the Serverless::Api the most efficient choice.

Answer

AWS::ApiGateway::DomainName

Answer

AWS::ApiGateway::BasePathMapping

Answer

AWS::Route53::RecordSet

Question 13

A Lambda function using a Kinesis event source repeatedly retries one bad record and blocks progress in the shard. Which feature helps isolate failed records after retry limits?

Accepted Answer

Configure failure handling with bisect batch on error and an on-failure destination where supported. Lambda's Kinesis event source mapping supports a 'bisect batch on error' feature that splits a failed batch into two smaller batches, allowing the bad record to be isolated and retried separately. Additionally, configuring an on-failure destination (e.g., an SQS queue or SNS topic) sends the record to a dead-letter destination after the retry limit is exhausted, preventing the shard from blocking progress.

Answer

Increase memory to 10 GB only

Answer

Disable batch processing

Answer

Convert the stream to an S3 bucket

Question 14

A developer notices that an AWS Lambda function is timing out after 3 seconds. The function processes messages from an SQS queue. What is the MOST likely cause of the timeout?

Accepted Answer

The Lambda function timeout is set too low.. The Lambda function is timing out after 3 seconds, which matches the default Lambda timeout. The most likely cause is that the function timeout is set too low (3 seconds) and needs to be increased to accommodate processing time. Option B (SQS visibility timeout) affects message redelivery but not the Lambda execution timeout. Option D (reserved concurrency set to zero) would prevent any invocations, not cause a timeout after 3 seconds. Option A (dead-letter queue not configured) does not cause timeouts; it only affects where failed messages go.

Answer

The SQS dead-letter queue is not configured.

Answer

The SQS queue visibility timeout is too short.

Answer

The Lambda function's reserved concurrency is set to zero.

Question 15

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?

Accepted Answer

Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.. It automates the creation of a CloudFront invalidation as part of the CodePipeline post-deploy stage. This ensures that after new files are uploaded to S3, CloudFront's edge caches are purged of the old content, forcing it to fetch the updated files from the origin. This is the most efficient solution as it requires no manual intervention and does not compromise caching performance.

Answer

Manually create a CloudFront invalidation after each deployment.

Answer

Reduce the CloudFront distribution's default TTL to 0.

Answer

Update the S3 bucket policy to allow public read access.