DVA-C02 Practice Test 16 — 15 Questions

Question 1

A developer is troubleshooting a slow Amazon DynamoDB table. The table has a read capacity of 1000 RCU and a write capacity of 500 WCU. The application frequently reads the same item. Which TWO actions can improve read performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement DynamoDB Accelerator (DAX) for caching.. DynamoDB Accelerator (DAX) is an in-memory cache that can reduce read latency for frequently accessed items from milliseconds to microseconds, offloading read traffic from the table and improving performance without requiring a capacity increase. Option E is correct because eventually consistent reads consume half the RCU of strongly consistent reads (0.5 RCU vs 1 RCU per 4 KB item) and return data faster, which is suitable when the application can tolerate slightly stale data for the same item.

Answer

Increase the read capacity units (RCU) to 2000.

Answer

Add a Global Secondary Index (GSI) on the frequently read attribute.

Answer

Decrease the write capacity units (WCU) to 250.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AES-256 (SSE-S3) and that no public access is allowed. Which TWO methods can be used to enforce these requirements across all accounts? (Choose TWO.)

Accepted Answer

Use AWS Config rules with automatic remediation to detect and fix non-compliant buckets.. AWS Config rules can evaluate S3 bucket configurations against desired settings (e.g., encryption enabled, public access blocked) and trigger automatic remediation via AWS Systems Manager Automation documents to fix non-compliant buckets. This provides continuous enforcement across all accounts in the organization without manual intervention.

Answer

Attach an IAM policy to all IAM users in each account that denies unencrypted operations.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets.

Question 3

A developer is using AWS CodeDeploy to deploy a revision to an Amazon EC2 instance. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' Which TWO actions should the developer take to troubleshoot the issue? (Choose TWO.)

Accepted Answer

Check the CodeDeploy agent logs on the EC2 instance for errors.. The CodeDeploy agent logs on the EC2 instance contain detailed error messages about why the deployment script failed, such as script exit codes, missing dependencies, or permission issues. Checking these logs is the first step in diagnosing individual instance failures, as the agent writes events to `/var/log/aws/codedeploy-agent/codedeploy-agent.log`.

Answer

Change the deployment configuration to AllAtOnce.

Answer

Verify that the EC2 instance has an IAM role that allows CodeDeploy to access it.

Answer

Increase the health check grace period on the Auto Scaling group.

Question 4

Refer to the exhibit. A developer runs an AWS CLI command on an EC2 instance and receives the error shown. The instance has an IAM role attached with the necessary permissions. What is the most likely cause of this error?

Accepted Answer

The CLI is not configured to use the instance profile credentials; environment variables or config file might be overriding.. The error indicates that the AWS CLI cannot find credentials. Even though the EC2 instance has an IAM role attached, the CLI will not automatically use instance profile credentials if environment variables (e.g., AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) or a config file (e.g., ~/.aws/credentials) are present with different or invalid values. The CLI's credential provider chain checks environment variables first, then the config file, and only falls back to the instance metadata service (IMDS) if no other credentials are found. Therefore, overriding settings are the most likely cause.

Answer

The CLI command is not supported on EC2 instances.

Answer

The IAM role does not have the required permissions for the CLI command.

Answer

The instance does not have an IAM role attached.

Question 5

The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The policy does not include the 'dynamodb:Scan' action.. The IAM policy shown in the question does not include the 'dynamodb:Scan' action. Without this action explicitly allowed, the Lambda function's role lacks permission to perform a Scan operation on the DynamoDB table, resulting in an AccessDenied error. The policy must grant the specific action required by the API call.

Answer

The DynamoDB table does not exist.

Answer

The IAM role is not attached to the Lambda function.

Answer

The resource ARN is incorrect.

Question 6

Refer to the exhibit. A developer is troubleshooting a failed CodeDeploy deployment to an EC2 Auto Scaling group. The instance logs show that the 'BeforeInstall' script failed with exit code 1. What should the developer do to resolve the issue?

Accepted Answer

Review the BeforeInstall script for errors and fix them.. The 'BeforeInstall' script failed with exit code 1, which is a generic error indicating the script itself encountered an issue during execution. The developer should review the script for errors, such as syntax mistakes, missing dependencies, or incorrect commands, and fix them. This is the most direct and appropriate action because the failure is explicitly tied to the script's execution, not to infrastructure or permissions.

Answer

Ensure the CodeDeploy agent is installed and running on the instance.

Answer

Verify that the scripts location in the AppSpec file is correct.

Answer

Check that the instance's IAM role has permissions to download the revision.

Question 7

A developer is designing a mobile application that needs to upload files to Amazon S3. The developer wants to use temporary credentials to avoid storing long-term AWS credentials on the device. Which TWO services should the developer use together?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is used to generate temporary, limited-privilege credentials for accessing AWS resources, such as S3 buckets. Amazon Cognito provides identity pools that can automatically obtain and refresh STS tokens for authenticated users, eliminating the need to store long-term AWS credentials on the mobile device. Together, they enable secure, temporary credential management for file uploads.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Question 8

A developer is designing a microservice that processes orders. The service must ensure that each order is processed exactly once. The developer uses an SQS queue to decouple the order submission from processing. Which SQS feature should be used to prevent duplicate processing?

Accepted Answer

FIFO queue with content-based deduplication. A FIFO queue with content-based deduplication ensures that each unique order is processed exactly once. FIFO queues guarantee first-in-first-out delivery and exactly-once processing, while content-based deduplication uses the message body to generate a deduplication ID, preventing duplicate messages from being added to the queue within a 5-minute deduplication interval.

Answer

Standard queue with visibility timeout

Answer

FIFO queue with a dead-letter queue

Answer

Standard queue with message retention period

Question 9

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. Which TWO additional checks should the developer perform to resolve the issue?

Accepted Answer

Check if the S3 bucket policy has an explicit deny statement that affects the EC2 instance.. S3 bucket policies can explicitly deny access even if the IAM role attached to the EC2 instance grants s3:GetObject. An explicit deny in a bucket policy overrides any allow, so checking for such a deny statement is essential. Option E is correct because if the S3 bucket uses SSE-KMS encryption, the EC2 instance's IAM role must have kms:Decrypt permissions to decrypt the object; without it, GetObject requests will fail.

Answer

Check the network ACLs for the subnet.

Answer

Check if the EC2 instance is in a VPC with an S3 VPC endpoint configured.

Answer

Check the security group rules attached to the EC2 instance.

Question 10

A developer is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The application performs many read operations. The developer wants to reduce the load on the database. What is the MOST effective solution?

Accepted Answer

Create a read replica and direct read queries to it.. Creating a read replica allows read queries to be directed to the replica, offloading the read workload from the primary instance and reducing its CPU utilization. Option A is incorrect because upgrading to a larger instance class increases capacity but does not specifically address read-heavy workloads efficiently and is less cost-effective than scaling reads with replicas. Option C is incorrect because Multi-AZ provides high availability and automatic failover, not performance improvement or load reduction. Option D is incorrect because purchasing reserved instances reduces costs but does not affect CPU utilization.

Answer

Upgrade the DB instance to a larger instance class.

Answer

Enable Multi-AZ for automatic failover.

Answer

Purchase reserved instances to reduce costs.

Question 11

A developer is building a REST API using API Gateway and Lambda. The API must be secured using a Lambda authorizer. Which THREE steps are necessary to implement the Lambda authorizer? (Choose THREE.)

Accepted Answer

Configure the API Gateway method to use the Lambda authorizer.. The API Gateway method must be explicitly configured to use the Lambda authorizer as the authorization mechanism. This is done by setting the method's Authorization type to the Lambda authorizer's logical name in the API Gateway console or via the REST API's `authorizationType` property set to `CUSTOM` and referencing the authorizer's ID. Without this configuration, API Gateway will not invoke the authorizer function for incoming requests.

Answer

Return a JSON Web Token (JWT) from the authorizer function.

Answer

Generate an API key and distribute it to clients.

Question 12

A company runs a serverless application on AWS using API Gateway, AWS Lambda, and DynamoDB. The application processes user uploads and stores metadata in DynamoDB. Recently, users have reported that some uploads fail with a 500 Internal Server Error. The CloudWatch Logs for the Lambda function show 'ProvisionedThroughputExceededException' errors for DynamoDB, followed by 'Task timed out after 3.00 seconds' errors. The Lambda function has a 3-second timeout and 128 MB of memory. The DynamoDB table has 5 read capacity units and 5 write capacity units. The application uses a single Lambda function that processes each upload synchronously. The company expects a steady increase in uploads. Which combination of actions should a developer take to resolve the errors and prepare for future growth? (Choose TWO.)

Accepted Answer

Increase the DynamoDB table's write capacity units to a higher value.. The errors are caused by DynamoDB throttling due to insufficient write capacity. Option A increases write capacity to handle the load. Option C implements retries with exponential backoff to handle occasional throttling without failing. Option B would not help because the errors are from DynamoDB, not Lambda concurrency. Option D would increase latency but not solve throttling. Option E might cause duplicate processing.

Answer

Switch the Lambda function to asynchronous invocation with a DLQ.

Answer

Increase the Lambda function's timeout to 30 seconds.

Answer

Increase the Lambda function's reserved concurrency to 100.

Question 13

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must authenticate users using a third-party OIDC identity provider and authorize each request. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Create an Amazon Cognito user pool with the OIDC identity provider configured.. Amazon Cognito user pools can be configured to federate with third-party OIDC identity providers. This allows the user pool to act as an intermediary that handles the OIDC token exchange, issuing its own JWT tokens after successful authentication. This is the standard approach for integrating external OIDC providers with AWS serverless applications.

Answer

Generate an API key and distribute it to users for authentication.

Answer

Create an IAM authorizer in API Gateway to validate the JWT token.

Question 14

Which THREE actions are required to set up a blue/green deployment for an Amazon ECS service using AWS CodeDeploy? (Choose three.)

Accepted Answer

Create an ECS application and deployment group in CodeDeploy.. CodeDeploy requires an ECS application and deployment group to manage the deployment lifecycle, including traffic shifting and rollback. The deployment group defines the ECS service, target groups, and load balancer listener for routing traffic between blue and green environments.

Answer

Create a second ECS service for the green environment.

Answer

Create a new Application Load Balancer for the green environment.

Question 15

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. Which permissions are required for the CodeBuild service role? (Choose THREE.)

Accepted Answer

ecr:PutImage. `ecr:PutImage` is the permission required to push a Docker image to an Amazon ECR repository. When CodeBuild completes a build and runs `docker push`, it calls the ECR API `PutImage` to upload the image manifest. Without this permission, the push operation will fail with an access denied error.

Answer

ecr:CreateImage

Answer

ecr:BatchGetImage