DVA-C02 Practice Test 14 — 15 Questions

Question 1

A developer is using AWS CodePipeline to deploy a web application to an Auto Scaling group. The pipeline includes a deploy action that uses CodeDeploy. The deployment fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' Which of the following is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment configuration has a minimum healthy instances setting that is too restrictive.. The error message indicates that the deployment failed because too many instances were unhealthy or failed. The most likely cause is that the deployment configuration's minimum healthy hosts setting is too restrictive, meaning it requires a higher percentage of healthy instances during deployment than the environment can sustain, causing CodeDeploy to stop the deployment when the threshold is breached.

Answer

The CodeDeploy agent is not sending logs to CloudWatch.

Answer

The application's lifecycle hooks are failing during the ApplicationStop event.

Answer

The instances were launched from an AMI that does not have the CodeDeploy agent installed.

Question 2

Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?

Accepted Answer

The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.. The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Therefore, the user is denied access to objects under the 'secret/' prefix, including s3://my-bucket/secret/config.txt. Option D is correct. Option A is incorrect because the explicit Deny overrides any bucket policy allow. Option B is incorrect because the Deny applies to all s3 actions, including s3:GetObject, and is scoped to the 'secret/' prefix. Option C is incorrect because the Allow statement does not grant access to the 'secret/' prefix; the Deny overrides it.

Answer

The user is denied access only if the bucket policy also denies access.

Answer

The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.

Answer

The user can download the object because the Allow statement grants s3:GetObject on the bucket.

Question 3

An application uses Amazon Cognito user pools for authentication. A developer wants to restrict access to an API Gateway endpoint to only authenticated users from a specific user pool. What is the best approach?

Accepted Answer

Use a Cognito User Pool authorizer in API Gateway.. A Cognito User Pool authorizer in API Gateway is the native, fully managed way to restrict access to an API endpoint to authenticated users from a specific user pool. It automatically validates the JWT token issued by the user pool and caches the result, requiring no custom code. This approach integrates directly with API Gateway's authorization flow, ensuring only tokens from the specified user pool are accepted.

Answer

Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

Answer

Use an API Gateway resource policy that allows access only from the Cognito user pool.

Answer

Use a Lambda authorizer that validates the JWT token against the user pool.

Question 4

A Lambda function processing SQS messages is failing with concurrency errors. The function is configured with reserved concurrency of 5. The SQS queue has a batch size of 10. What is the most effective way to prevent throttling?

Accepted Answer

Increase the reserved concurrency to a higher value.. The function is throttling due to insufficient reserved concurrency. With a batch size of 10, each SQS batch triggers one invocation, but the function's reserved concurrency of 5 limits concurrent executions to 5. Increasing reserved concurrency allows more concurrent invocations to handle the SQS messages without throttling.

Answer

Reduce the batch size to 1 to spread out invocations.

Answer

Increase the Lambda function memory to get more concurrency.

Answer

Set the SQS queue's concurrency limit to match the Lambda reserved concurrency.

Question 5

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. Users report intermittent 503 errors. The Lambda function code appears correct. Which action is MOST likely to resolve the issue?

Accepted Answer

Request a service quota increase for Lambda concurrent executions.. Intermittent 503 errors from API Gateway often indicate that Lambda concurrent execution limits have been reached. When the number of simultaneous invocations exceeds the account-level or function-level reserved concurrency, API Gateway returns a 503 'Service Unavailable' response. Increasing the Lambda concurrent executions quota allows more invocations to be processed without throttling.

Answer

Increase the Lambda function memory allocation.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 6

A developer launches an Amazon EC2 instance that needs to read and write data to an Amazon DynamoDB table. The developer must follow the principle of least privilege and ensure that no long-term credentials are stored on the instance. Which approach should the developer use?

Accepted Answer

Create an IAM role with the necessary DynamoDB permissions, and attach the role to the EC2 instance profile. The SDK will automatically retrieve temporary credentials from the instance metadata.. It uses an IAM role attached to the EC2 instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the instance metadata service (IMDS). This follows the principle of least privilege by granting only the necessary DynamoDB permissions and eliminates the need to store any long-term credentials on the instance, as the credentials are rotated automatically by AWS STS.

Answer

Create an IAM user with programmatic access, store the access key and secret key in a configuration file on the EC2 instance.

Answer

Store the DynamoDB credentials in AWS Systems Manager Parameter Store as a SecureString, and retrieve them from the EC2 instance at runtime.

Answer

Use a Lambda function to generate temporary credentials for the EC2 instance and pass them via user data at launch.

Question 7

A developer is deploying a serverless application using AWS SAM. The application consists of an API Gateway endpoint that triggers an AWS Lambda function. The developer wants to enable canary deployments to gradually shift traffic to a new Lambda version. Which SAM resource attribute should the developer configure?

Accepted Answer

AutoPublishAlias and DeploymentPreference. `AutoPublishAlias` automatically creates and updates a Lambda alias (e.g., `live`) that points to the latest version of your function, while `DeploymentPreference` enables canary, linear, or all-at-once traffic shifting between the old and new alias versions. Together, they allow gradual traffic migration to a new Lambda version without manual alias management.

Answer

ReservedConcurrentExecutions

Answer

Timeout

Answer

ProvisionedConcurrency

Question 8

A developer is troubleshooting an IAM policy that is supposed to allow a Lambda function to read objects from an S3 bucket. The Lambda function role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket/*","arn:aws:s3:::example-bucket"]}]}. Despite this, the Lambda function receives an AccessDenied error when trying to read objects. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that explicitly denies the Lambda function's access.. The IAM policy attached to the Lambda function role correctly grants s3:GetObject and s3:ListBucket permissions on the bucket and its objects. However, if the S3 bucket itself has a bucket policy that explicitly denies access to the Lambda function's role, that explicit deny overrides any allow from IAM policies, resulting in an AccessDenied error. This is because AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The Lambda function is in a different AWS account than the S3 bucket.

Answer

The IAM policy uses an incorrect resource ARN format.

Question 9

A developer is using AWS Elastic Beanstalk to deploy a Python web application. The application requires a specific version of a Python package that is not pre-installed on the Elastic Beanstalk platform. How should the developer ensure the package is installed on all environment instances?

Accepted Answer

Add the package to a requirements.txt file and deploy it with the application source bundle.. AWS Elastic Beanstalk natively supports Python package management. If you include a `requirements.txt` file in the root directory of your source bundle, Elastic Beanstalk automatically installs the specified packages (and their specific versions, e.g., `package==1.2.3`) using `pip` during the deployment process. While `.ebextensions` can run custom commands, using it to install Python packages is non-standard, complex (due to virtual environment paths on Amazon Linux 2/2023), and unnecessary.

Answer

Use the AWS CLI to run a script on each instance after deployment.

Answer

Include a .ebextensions configuration file that runs a command to install the package.

Answer

Create a custom Dockerfile and use the Docker platform in Elastic Beanstalk.

Question 10

A company is using AWS CodeDeploy to deploy a web application to an Auto Scaling group of EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment.' What is the most likely cause?

Accepted Answer

The number of instances that failed deployment exceeded the configured failure threshold.. The error message explicitly states that too many individual instances failed deployment, which means the number of failed instances exceeded the configured failure threshold (either the default or a custom value in the deployment configuration). CodeDeploy stops the deployment when this threshold is breached to prevent a full outage. The most likely cause is that the failure count crossed that limit, often due to a bad revision or environment issue.

Answer

The application specification file (appspec) is missing required hooks.

Answer

The IAM role for CodeDeploy does not have sufficient permissions to call EC2 APIs.

Answer

The Auto Scaling group does not have enough instances to meet the minimum healthy count.

Question 11

A developer is using Amazon DynamoDB for a new application. The developer wants to reduce read latency. Which design pattern should the developer use?

Accepted Answer

Use DynamoDB Accelerator (DAX) as a cache for frequently read items.. DynamoDB Accelerator (DAX) is an in-memory cache designed specifically for DynamoDB, providing microsecond read latency for frequently accessed items. By caching read-heavy workloads, DAX offloads requests from the DynamoDB table, reducing read latency without requiring application-level caching logic. This directly addresses the developer's goal of reducing read latency.

Answer

Create a global secondary index (GSI) for the table.

Answer

Increase the provisioned read capacity units (RCUs) for the table.

Answer

Use DynamoDB Global Tables to replicate data to multiple regions.

Question 12

A company uses AWS CloudFormation to manage its infrastructure. The developer wants to update a stack but only if the update does not cause any resource replacement. Which CloudFormation stack update option should be used?

Accepted Answer

Create a change set and review the changes before executing it.. A change set allows you to preview the changes that CloudFormation will make to your stack, including whether any resources will be replaced. By reviewing the change set, you can see if any resource replacement is listed and choose not to execute it if you want to avoid replacements. This gives you full control to update the stack only when no replacements are required.

Answer

Use the direct update option with a template.

Answer

Use the 'Force rollback' option to ensure no replacement.

Answer

Use the 'Preserve stack settings' option when updating the stack.

Question 13

A developer is using Amazon DynamoDB as the data store for a web application. The application experiences frequent throttling errors. Which action can reduce throttling without changing the application code?

Accepted Answer

Enable DynamoDB Auto Scaling. DynamoDB Auto Scaling automatically adjusts the provisioned throughput capacity based on actual traffic patterns, using the AWS Application Auto Scaling service. This prevents throttling by increasing capacity during demand spikes and reduces costs by scaling down during low traffic, all without requiring any code changes.

Answer

Add a secondary index

Answer

Decrease the provisioned write capacity

Answer

Increase the provisioned read capacity only

Question 14

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. The application uses read-heavy workloads. Which action would MOST effectively reduce CPU load without major architectural changes?

Accepted Answer

Implement an in-memory cache layer with Amazon ElastiCache.. For a read-heavy workload causing sustained high CPU on RDS MySQL, offloading repeated read queries to an in-memory cache like ElastiCache (Redis or Memcached) removes the majority of read traffic from the database engine, directly reducing CPU utilization without re-architecting the application. This is the least invasive and most effective fix for read-dominated load.

Answer

Migrate the database to Amazon Aurora with auto-scaling.

Answer

Increase the DB instance size to a larger instance type.

Answer

Create a Multi-AZ deployment and use the standby for read queries.

Question 15

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to s3://my-bucket/confidential/report.pdf. What is the outcome?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the confidential prefix.. The IAM policy includes an explicit Deny statement for s3:PutObject on the `confidential` prefix, which overrides any Allow statements. AWS IAM evaluates policies with explicit Denies taking precedence over Allows, so the upload to `s3://my-bucket/confidential/report.pdf` is blocked regardless of the Allow statement on the bucket.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Answer

The upload fails because there is no Allow statement for the confidential prefix.

Answer

The upload fails because the policy is malformed.