DVA-C02 Practice Test 15 — 15 Questions

Question 1

A developer is building a RESTful API using Amazon API Gateway. The API experiences high traffic spikes, and many requests are for the same data (e.g., a product catalog). The developer wants to reduce the load on the backend Lambda functions and improve response times for repeated requests. Which feature should the developer enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable API Gateway caching and set a TTL.. API Gateway caching stores responses from backend Lambda functions for a configurable time-to-live (TTL). When a request for the same data (e.g., a product catalog) arrives within the TTL period, API Gateway serves the cached response directly, reducing the number of invocations to the Lambda function and improving response latency. This directly addresses the need to reduce load on the backend and improve response times for repeated requests.

Answer

Use CloudFront with the API Gateway as an origin.

Answer

Enable throttling on the API Gateway usage plan.

Answer

Use a DynamoDB Accelerator (DAX) cluster for the backend database.

Question 2

A company requires that all API calls to create an Amazon S3 bucket must include a specific tag (e.g., 'CostCenter'). Which IAM policy condition key should a developer use to enforce this requirement?

Accepted Answer

aws:RequestTag. The `aws:RequestTag` condition key evaluates the tags that are included in the API request itself. When a developer attempts to create an S3 bucket, the IAM policy can use `aws:RequestTag` to require that a specific tag key (e.g., 'CostCenter') is present in the `CreateBucket` request. This ensures that the tag is applied at creation time, enforcing the company's tagging requirement.

Answer

aws:ResourceTag

Answer

s3:ExistingObjectTag

Answer

aws:TagKeys

Question 3

A developer is building a mobile application that uses Amazon Cognito for user authentication. After a user signs in, the application needs to access an Amazon DynamoDB table. The developer has set up an identity pool with an authenticated role. The IAM role attached to the authenticated identity has a policy allowing the required DynamoDB actions. However, users report that they cannot perform DynamoDB operations. What is the MOST likely cause of this issue?

Accepted Answer

The IAM role's trust policy does not allow Cognito to assume it.. The most likely cause is that the IAM role's trust policy does not include a statement allowing Amazon Cognito (specifically the `cognito-identity.amazonaws.com` service principal) to assume the role. Even if the identity pool is configured to use the authenticated role and the role's permissions policy grants DynamoDB actions, Cognito must be able to assume the role via AWS Security Token Service (STS) `AssumeRoleWithWebIdentity`. Without the correct trust relationship, Cognito cannot obtain temporary credentials for the user, so all DynamoDB operations fail.

Answer

The identity pool is not configured to use the authenticated role.

Answer

The app is not passing the correct identity ID.

Answer

The DynamoDB table is encrypted with a different KMS key.

Question 4

An AWS Lambda function processes messages from an Amazon SQS queue and writes results to an Amazon DynamoDB table. The function is configured with a reserved concurrency of 5 and a batch size of 10. CloudWatch metrics show high throttling and a growing queue backlog. The function's execution time averages 1 second per message. What is the MOST effective action to reduce throttling while improving throughput?

Accepted Answer

Increase the reserved concurrency to 20.. The Lambda function is throttling because its reserved concurrency of 5 limits it to 5 concurrent executions. With a batch size of 10 and 1-second execution time, the function can process at most 5 * 10 = 50 messages per second. Increasing reserved concurrency to 20 allows 20 concurrent executions, raising throughput to 200 messages per second, which directly reduces throttling and clears the backlog.

Answer

Increase the batch size to 100.

Answer

Decrease the reserved concurrency to 2.

Answer

Increase the provisioned write capacity of the DynamoDB table.

Question 5

A developer needs to grant a user in another AWS account (Account B) read-only access to objects in an Amazon S3 bucket owned by Account A. The developer has already added a bucket policy that grants s3:GetObject access to the IAM user in Account B. However, the user in Account B still gets Access Denied when trying to read objects. What additional configuration is required?

Accepted Answer

The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN. The bucket policy in Account A grants s3:GetObject access to the IAM user in Account B, but this alone is insufficient. For cross-account access, the IAM user in Account B must also have an IAM policy attached that explicitly allows s3:GetObject on the bucket ARN. Without this, the user’s own account denies the request before it reaches Account A’s bucket policy, resulting in Access Denied.

Answer

The bucket must be made public by unchecking 'Block all public access'

Answer

The developer must create a new IAM role in Account A and have the user in Account B assume that role

Answer

The user in Account B must use the S3 console instead of the AWS CLI

Question 6

A developer is using Amazon S3 to host a static website. The website uses JavaScript to fetch data from an API Gateway endpoint. Users report that the website loads but API calls fail with HTTP 403 errors. The developer checks the S3 bucket policy and finds it allows public read access. What is the most likely cause?

Accepted Answer

The API Gateway API key is not included in the JavaScript code.. The website loads from S3, but the API calls to API Gateway fail with 403. This is often due to missing API key. If the API Gateway endpoint requires an API key and the JavaScript code does not include it in the request headers, API Gateway returns a 403 Forbidden error. Option C is correct because the most likely cause is that the API key is not included in the JavaScript code, leading to the 403 response.

Answer

The S3 bucket policy blocks access from the API Gateway domain.

Answer

The S3 bucket is not configured for static website hosting.

Answer

The S3 bucket does not have CORS configuration to allow cross-origin requests from the API Gateway domain.

Question 7

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API receives a large number of requests with duplicate payloads from the same client within a short time window. To reduce Lambda invocations and improve performance, the developer wants to return the previously computed response for identical requests based on a unique client ID in the header. How can the developer achieve this using API Gateway features?

Accepted Answer

Enable API Gateway caching on the stage and configure the client ID header as a cache key parameter. Set a cache TTL of 5 minutes.. API Gateway caching allows you to store responses for a configurable TTL and use the client ID header as a cache key parameter. This means that when a request with the same client ID arrives within the TTL window, API Gateway returns the cached response directly without invoking the Lambda function, reducing invocations and improving performance.

Answer

Configure a usage plan with a quota and throttle settings to limit requests per client ID.

Answer

Use request validation to reject requests that have the same client ID within 5 minutes.

Answer

Reduce the Lambda function's batch size to 1 and implement caching logic inside the function using an external cache like ElastiCache.

Question 8

A Lambda function processes a batch of SQS messages. Which two configurations reduce duplicate or failed-message impact?

Accepted Answer

Use a visibility timeout longer than expected processing time. A visibility timeout longer than the expected processing time prevents other consumers from reprocessing a message while it is still being handled, reducing duplicates. Option D is correct because a dead-letter queue captures messages that repeatedly fail processing, allowing analysis and preventing them from blocking the queue, while partial batch response enables the function to return a list of failed message IDs so that only those messages become visible again, reducing reprocessing of successful ones.

Answer

Set visibility timeout to zero

Answer

Disable the dead-letter queue

Question 9

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API must support different HTTP methods (GET, POST, PUT, DELETE) for the same resource path. The developer wants to define the API in a single Lambda function that can handle all methods without additional mapping configuration. Which Lambda integration type should the developer use?

Accepted Answer

Lambda proxy integration. Lambda proxy integration (option A) is correct because it allows a single Lambda function to handle all HTTP methods (GET, POST, PUT, DELETE) for the same resource path without additional mapping configuration. In this integration type, API Gateway passes the entire client request (method, headers, query parameters, body) as a JSON event to the Lambda function, and the function must return a response in a specific format that includes status code, headers, and body. This eliminates the need for manual mapping templates or method-specific configurations.

Answer

Lambda custom integration

Answer

AWS service integration

Answer

HTTP integration

Question 10

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API should return JSON responses to client requests. The developer is using the Lambda proxy integration. What is the simplest way to return a JSON response from the Lambda function?

Accepted Answer

Return a dictionary containing 'statusCode', 'headers', and 'body' with 'body' as a JSON string.. With Lambda proxy integration, API Gateway passes the entire request to the Lambda function and expects the function to return a specific response format. The simplest way to return a JSON response is to return a dictionary (or object) containing 'statusCode', 'headers', and 'body', where 'body' is a JSON string. This format is required by API Gateway to correctly interpret the Lambda output and forward it to the client.

Answer

Return a string from the Lambda handler.

Answer

Use API Gateway integration response and mapping templates to transform the Lambda output.

Answer

Return a JSON object from Lambda and set a Content-Type header in the API Gateway method response.

Question 11

A developer is building a serverless REST API using Amazon API Gateway and AWS Lambda. The API will be consumed by a web application hosted on a different domain. The developer needs to enable Cross-Origin Resource Sharing (CORS) for all HTTP methods. What is the most efficient way to achieve this?

Accepted Answer

Enable CORS on the API Gateway resource using the 'Enable CORS' feature in the API Gateway console, which adds the OPTIONS method and appropriate headers.. API Gateway's 'Enable CORS' feature automatically creates an OPTIONS method for the selected resource and configures the necessary response headers (e.g., Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to handle preflight requests. This is the most efficient approach as it centralizes CORS configuration at the API Gateway layer, eliminating the need for manual header management in Lambda or additional infrastructure.

Answer

In the Lambda function code, add the 'Access-Control-Allow-Origin' header to every response.

Answer

Configure Amazon CloudFront in front of API Gateway to handle CORS.

Answer

Set a bucket policy on the S3 bucket that hosts the web application to allow cross-origin requests.

Question 12

A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?

Accepted Answer

The bucket policy in Account A grants s3:GetObject to the role, the KMS key policy grants kms:Decrypt to the role, and the role in Account B has an IAM policy allowing s3:GetObject and kms:Decrypt. Cross-account access to an SSE-KMS encrypted S3 bucket requires three layers of permissions: the bucket policy in Account A must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to the same role, and the role's IAM policy in Account B must allow both s3:GetObject and kms:Decrypt. Without any one of these, the request will fail due to either an S3 authorization error or a KMS decryption failure.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the role in Account B has an IAM policy allowing s3:GetObject. No KMS permissions are needed because SSE-KMS uses AWS managed keys by default.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the KMS key policy grants kms:Decrypt to the role. The role in Account B does not need additional IAM policies because the bucket and key policies provide sufficient permissions.

Answer

Only the bucket policy in Account A needs to grant s3:GetObject to the role. KMS is not involved because the bucket is encrypted with SSE-KMS but the role can decrypt using the default KMS key.

Question 13

A developer is using AWS X-Ray to trace a serverless application. The application uses an AWS Lambda function to query a DynamoDB table. The trace shows that the DynamoDB subsegment takes a significant portion of the total response time. The developer wants to reduce the DynamoDB query latency. Which service should the developer integrate with the Lambda function to achieve the lowest latency for repeated read queries?

Accepted Answer

DynamoDB Accelerator (DAX). DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds for repeated read queries. By integrating DAX with the Lambda function, the developer can cache the results of frequent DynamoDB queries directly in memory, bypassing the read capacity units and the underlying storage engine, which directly addresses the latency bottleneck shown in the X-Ray trace.

Answer

Amazon ElastiCache for Redis

Answer

DynamoDB Global Tables

Answer

DynamoDB Streams

Question 14

A developer needs to grant an IAM user in the same AWS account access to a specific object in an S3 bucket. The bucket policy currently grants access only to the bucket owner (the root account). Which identity-based policy statement should the developer add to the IAM user's permissions?

Accepted Answer

An IAM policy that allows s3:GetObject for the specific object ARN.. An IAM policy attached directly to the user can grant s3:GetObject permission for a specific object ARN (e.g., arn:aws:s3:::bucket-name/object-key). This identity-based policy overrides the bucket policy's default deny for the root-only access, as long as there is no explicit deny in the bucket policy. The bucket policy restricts access to the root account, but an explicit allow in an IAM policy can still grant access to the user since IAM policies and bucket policies are evaluated together, and an explicit allow in either can permit the action unless an explicit deny exists.

Answer

A bucket policy that allows s3:GetObject for the user.

Answer

An S3 access point policy.

Answer

An IAM policy that allows s3:ListBucket for the bucket.

Question 15

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket and an AWS Lambda function. The Lambda function needs to be granted permission to read objects from the S3 bucket. Which resource should the developer define in the CloudFormation template to provide these permissions?

Accepted Answer

AWS::IAM::Role. The Lambda function requires an IAM role (AWS::IAM::Role) with a policy that grants s3:GetObject permissions on the S3 bucket. This role is assumed by the Lambda service at runtime, allowing the function to read objects from the bucket. The role must include a trust policy that allows lambda.amazonaws.com to assume it.

Answer

AWS::Lambda::Permission

Answer

AWS::S3::BucketPolicy

Answer

AWS::IAM::ManagedPolicy