DVA-C02 Practice Test 14 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda. The function needs to access a DynamoDB table and write logs to Amazon CloudWatch. What is the minimum set of IAM permissions the Lambda execution role must have?

Accepted Answer

dynamodb:PutItem, logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents. Option C is correct because the Lambda execution role must allow logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents for CloudWatch, and dynamodb:PutItem for DynamoDB. Option A is wrong because it includes unnecessary DynamoDB read permissions. Option B is wrong because it includes dynamodb:* which is too broad. Option D is wrong because it lacks DynamoDB write permission.

Answer

logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents

Answer

dynamodb:*, logs:PutLogEvents

Answer

dynamodb:GetItem, dynamodb:PutItem, logs:PutLogEvents

Question 2

A company uses AWS CodePipeline to deploy a Node.js application to AWS Elastic Beanstalk. The build stage runs successfully, but the deploy stage fails with an error: 'The deployment failed because no instances were found for the environment.' What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment has no running instances due to a failed health check.. Option C is correct because if the Elastic Beanstalk environment does not have any running EC2 instances (e.g., due to a failed health check or scaling issue), the deployment cannot find any instances to update. Option A is wrong because the IAM role permissions would cause a different error (e.g., access denied). Option B is wrong because CodeDeploy is not used with Elastic Beanstalk. Option D is wrong because incorrect artifact name would cause a different error (e.g., artifact not found).

Answer

The CodeDeploy application is not configured correctly.

Answer

The IAM role for CodePipeline lacks permissions to describe EC2 instances.

Answer

The build artifact is not named correctly for Elastic Beanstalk.

Question 3

A developer is using Amazon S3 to store application logs. The logs are generated every hour and must be retained for 90 days. After 90 days, the logs should be deleted automatically. Which S3 lifecycle policy should the developer configure?

Accepted Answer

Expire objects after 90 days.. Option B is correct because an expiration action after 90 days will delete the objects. Option A (transition to Glacier after 90 days) does not delete. Option C (expire after 30 days) deletes too early. Option D (transition to S3 Standard-IA and expire after 90 days) is valid but unnecessary; a single expiration action is simpler.

Answer

Expire objects after 30 days.

Answer

Transition objects to Amazon S3 Glacier after 90 days.

Answer

Transition objects to S3 Standard-IA after 30 days and expire after 90 days.

Question 4

A developer is debugging an AWS Lambda function that processes messages from an Amazon SQS queue. The function is failing with an error when processing certain messages. The developer wants to isolate the failed messages for later analysis without losing them. What should the developer do?

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Option C is correct because a dead-letter queue (DLQ) on the SQS queue will capture messages that cannot be processed, allowing the function to continue processing other messages. Option A (increase visibility timeout) does not isolate failed messages. Option B (log and ignore) loses the messages. Option D (use SNS) is not a standard pattern for this issue.

Answer

Publish the failed messages to an SNS topic for later processing.

Answer

Log the error and delete the message from the queue.

Answer

Increase the visibility timeout of the SQS queue.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to enable caching for API responses to reduce latency and cost. Which step is REQUIRED to enable caching?

Accepted Answer

Create a cache cluster in API Gateway for the stage. To enable API Gateway caching, you must create a cache cluster on the stage level, which incurs additional cost. Option B is correct.

Answer

Enable caching in the Lambda function code

Answer

Set the TTL in the API Gateway method request integration

Answer

Use Amazon ElastiCache and modify the Lambda function to check cache

Question 6

An IAM policy attached to an IAM user. What is the effect of this policy on the user's ability to delete objects in the bucket my-bucket?

Accepted Answer

The user is denied the ability to delete objects regardless of source IP.. Option B is correct because the Deny statement has a condition that only denies the action when the source IP is NOT in the specified range. So if the user's IP is in 192.0.2.0/24, the Deny does not apply, and since there is no explicit Allow for DeleteObject, the default implicit Deny applies, so deletion is denied regardless. Actually, need to analyze: The Deny applies when source IP is not in the range. If the source IP is in the range, the Deny condition is not met, so the Deny statement does not apply. However, there is no Allow for DeleteObject, so the action is implicitly denied. Therefore, deletion is always denied. If there were an Allow, then the Allow would take effect when the Deny doesn't apply. But here there is no Allow, so it's denied always. So answer B is correct: the user is denied because there is no Allow statement for DeleteObject.

Answer

The user can delete objects from any IP address.

Answer

The user can delete objects only if the source IP is not 192.0.2.0/24.

Answer

The user can delete objects only if the source IP is 192.0.2.0/24.

Question 7

A developer runs the AWS CLI command to invoke a Lambda function synchronously. What does the output indicate?

Accepted Answer

The Lambda function executed successfully and returned a response.. Option A is correct. The StatusCode 200 indicates the invocation was successful, and the response contains the Lambda function's output. Option B (validation error) would return a different status code. Option C (timeout) would return a timeout error. Option D (function not found) would return 404.

Answer

The Lambda function failed validation.

Answer

The Lambda function was not found.

Answer

The Lambda function timed out.

Question 8

A developer wants to store application logs in Amazon S3 with automatic transition to Glacier after 30 days and deletion after 365 days. Which S3 feature should be used?

Accepted Answer

S3 Lifecycle configuration. S3 Lifecycle policies automate transitioning objects between storage classes and expiring them. Option A is correct.

Answer

S3 Object Lock

Answer

S3 Replication

Answer

S3 Event Notifications

Question 9

A developer is deploying a microservice using Amazon ECS with Fargate. The service needs to scale based on CPU utilization. Which combination of actions is required? (Select TWO)

Accepted Answer

Create a CloudWatch alarm on the ECS service's CPUUtilization metric. To scale ECS services, you create a CloudWatch alarm on CPU utilization and associate it with an Application Auto Scaling target tracking policy. Options B and D are correct.

Answer

Configure an ELB target group health check

Answer

Enable auto scaling on the ECS cluster

Answer

Create an Application Auto Scaling step scaling policy

Question 10

A developer is using AWS Lambda with an Amazon RDS MySQL database. The Lambda function frequently times out when connecting to the database. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance. Lambda functions in a VPC require a VPC endpoint for internet access or NAT gateway; without it, they cannot reach RDS if the RDS is in a private subnet. Option C is correct.

Answer

The Lambda function is not configured with enough memory

Answer

The Lambda function is not using a reserved concurrency limit

Answer

The Lambda function's execution role lacks RDS permissions

Question 11

Which TWO actions should a developer take to improve the security of an AWS Lambda function that processes sensitive data?

Accepted Answer

Encrypt environment variables using AWS KMS. Encrypt environment variables with KMS and use a VPC to isolate the function. Options A and C are correct.

Answer

Use a dead-letter queue (DLQ) for failed invocations

Answer

Grant the Lambda function full access to all S3 buckets

Answer

Store secrets in the Lambda function code

Question 12

A developer is running a Lambda function that uses the 'requests' library. The error shown in the exhibit occurs when invoking the function. Which step should the developer take to fix this?

Accepted Answer

Package the 'requests' library with the Lambda deployment package. The requests library is not included in the Lambda runtime; it must be packaged with the deployment package. Option C is correct.

Answer

Change the Lambda runtime to Python 3.9 which includes requests

Answer

Use the 'urllib' library instead of 'requests'

Answer

Install the 'requests' library using pip in the Lambda console

Question 13

A developer is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. The build fails with a 'no basic auth credentials' error when trying to push the image. Which TWO actions should the developer take to resolve this issue? (Choose two.)

Accepted Answer

Add a pre-build command to run 'aws ecr get-login-password --region | docker login --username AWS --password-stdin .dkr.ecr..amazonaws.com'.. Options B and D are correct because the build project needs to have an IAM role with permissions to push to ECR, and the pre-build phase should include the 'aws ecr get-login-password' command to authenticate. Option A is wrong because AWS CLI is already installed in CodeBuild. Option C is wrong because Docker is already available. Option E is wrong because ECR access is via IAM, not SSH keys.

Answer

Install the AWS CLI in the buildspec.yml file.

Answer

Install Docker in the buildspec.yml file.

Answer

Configure SSH key-based authentication for ECR.

Question 14

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. Options A, C, and D are correct. Option A is correct because an approval action is added to the pipeline. Option B is wrong because CodeBuild is for build, not deployment. Option C is correct because approval requires an SNS topic to send notifications. Option D is correct because an IAM role is needed for the approval action to publish to SNS. Option E is wrong because the approval action is added to the pipeline, not a separate stage.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.

Question 15

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. Option B is correct because API Gateway can validate requests using a model schema, reducing Lambda invocations. Option A is wrong because validation in Lambda still incurs cost and latency. Option C is wrong because request parameters alone don't validate payload. Option D is wrong because CloudFront is a CDN, not for API validation.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.