DVA-C02 Practice Test 20 — 15 Questions

Question 1

A development team is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'HealthCheck' error. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). What is the MOST likely cause of this error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The ALB target group health check is misconfigured or the application is not responding to health check requests.. The 'HealthCheck' error in AWS CodeDeploy indicates that the deployment failed because the target group health checks are not passing. This typically occurs when the ALB health check path or configuration does not match the application's expected response, or the application is not running correctly on the instances, causing the ALB to mark them as unhealthy. CodeDeploy monitors the ALB target group health status during deployment and will fail if instances do not become healthy within the configured timeout.

Answer

The EC2 instances do not have the correct IAM instance profile attached.

Answer

The deployment configuration is set to 'AllAtOnce' which does not support health checks.

Answer

The deployment group is not configured with the ALB target group.

Question 2

A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?

Accepted Answer

Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.. AWS PrivateLink with a VPC Endpoint service and a Network Load Balancer (NLB) allows you to expose services running in private subnets to other VPCs or on-premises networks via VPN without traversing the public internet. The NLB handles TCP traffic at Layer 4, and the VPC Endpoint service provides secure, scalable connectivity by creating elastic network interfaces in the consumer VPC, ensuring traffic stays within the AWS network. This approach is both secure (no public exposure) and scalable (NLB handles high throughput and availability).

Answer

Place an Application Load Balancer in public subnets and point to the services' target groups.

Answer

Use a NAT Gateway to allow inbound traffic from the VPN to the services.

Answer

Use an Internet Gateway and route traffic from the VPN to the services.

Question 3

A developer notices that an AWS Lambda function, which uses Amazon RDS Proxy to connect to an Aurora MySQL database, is experiencing increased latency and occasional connection timeouts. The function is configured with a reserved concurrency of 100 and is deployed in a VPC. The RDS Proxy's maximum connections is set to 1000. CloudWatch metrics show that the DatabaseConnections metric for the proxy is consistently at 1000. What is the most likely cause of the increased latency and timeouts?

Accepted Answer

The Lambda function is not reusing database connections properly, exhausting the proxy connection pool. The RDS Proxy's DatabaseConnections metric is consistently at 1000, which equals the proxy's maximum connections setting. This indicates the proxy connection pool is fully saturated. When all connections are in use, new connection requests from Lambda invocations must wait, causing increased latency, and if the wait exceeds the timeout, connection timeouts occur. The most likely cause is that the Lambda function is not reusing database connections (e.g., not using connection pooling or keeping connections open across invocations), exhausting the pool.

Answer

The RDS Proxy target group is not configured with the correct DB instance

Answer

The Lambda function's execution role is missing the rds-db:connect permission

Answer

The VPC does not have a NAT Gateway for outbound traffic

Question 4

A developer is troubleshooting an Amazon API Gateway REST API that returns 504 Gateway Timeout errors for certain requests. The backend is a Lambda function that performs a resource-intensive operation that occasionally takes up to 30 seconds. API Gateway has a default integration timeout of 29 seconds. The developer cannot reduce the execution time. What should the developer do to resolve the timeout issue?

Accepted Answer

Refactor the Lambda function to use asynchronous invocation, return a 202 immediately, and have the client poll for results.. It decouples the client from the long-running Lambda execution. By invoking the Lambda asynchronously, the API Gateway can return a 202 Accepted response immediately, well within the 29-second integration timeout. The client then polls a separate endpoint (e.g., using a presigned S3 URL or a DynamoDB status record) to retrieve the final result, completely sidestepping the timeout limitation.

Answer

Increase the API Gateway integration timeout to 30 seconds.

Answer

Enable API Gateway caching to avoid repeated calls.

Answer

Use multiple Lambda functions to parallelize processing.

Question 5

A developer uses AWS CodePipeline to deploy a serverless application defined with AWS SAM. The pipeline consists of Source (S3), Build (CodeBuild), and Deploy (CloudFormation) stages. The developer wants to run integration tests after the stack is deployed but before the pipeline completes. Which approach should the developer use?

Accepted Answer

Add a test stage after the Deploy stage with an action that invokes a Lambda function to run tests.. AWS CodePipeline allows you to add a test stage after the Deploy stage, and you can configure an action that invokes an AWS Lambda function to run integration tests. This ensures tests run automatically after the CloudFormation stack is deployed but before the pipeline completes, meeting the requirement without manual intervention.

Answer

Use the CloudFormation stack's Outputs to trigger a Lambda function that runs tests.

Answer

Configure a post-deployment hook in the SAM template that runs tests.

Answer

Add a manual approval step after Deploy, then run tests manually.

Question 6

A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.. AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.

Answer

Create an IAM user and store the access keys in the Lambda environment variables.

Answer

Attach a resource-based policy to the Lambda function that grants DynamoDB access.

Answer

Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.

Question 7

A developer is building a serverless application using AWS SAM. The application includes an Amazon API Gateway endpoint with a Lambda function that processes user uploads. The developer wants to enable API caching in the development stage to speed up repeated requests, but disable caching in the production stage. What is the most efficient way to achieve this?

Accepted Answer

Configure caching in the SAM template using the CacheClusterEnabled property and use CloudFormation conditions to enable it only in the dev stage.. AWS SAM extends AWS CloudFormation, allowing you to use CloudFormation conditions to conditionally enable the `CacheClusterEnabled` property on the `AWS::ApiGateway::Stage` resource. By defining a condition that evaluates to true only for the dev stage (e.g., based on a parameter like `StageName`), you can enable caching in dev and disable it in prod within a single SAM template, avoiding duplication and manual steps.

Answer

Create two separate SAM templates, one for dev with caching and one for prod without.

Answer

Enable caching in the API Gateway console after each deployment for the dev stage.

Answer

Use a custom CloudFormation resource to toggle caching based on a parameter.

Question 8

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Answer

Amazon EBS

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 9

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) allows you to implement custom authentication logic using an external OAuth 2.0 provider. The Lambda function receives the OAuth 2.0 bearer token from the request, validates it against the external provider's token introspection endpoint or by verifying the JWT signature, and returns an IAM policy that grants or denies access to the API Gateway method.

Answer

IAM authorization

Answer

Resource policy

Answer

Amazon Cognito User Pools

Question 10

A developer is using AWS CodeDeploy to deploy a new version of an AWS Lambda function. The developer wants to gradually shift traffic from the old version to the new version in 10-minute increments. Which deployment configuration should the developer use?

Accepted Answer

Linear10PercentEvery10Minutes. The Linear10PercentEvery10Minutes configuration shifts traffic from the old Lambda version to the new version in 10% increments every 10 minutes, which matches the developer's requirement of gradually shifting traffic in 10-minute increments. This is a linear deployment type in AWS CodeDeploy that provides a steady, incremental traffic shift over time.

Answer

Canary10Percent10Minutes

Answer

Canary10Percent30Minutes

Answer

AllAtOnce

Question 11

A company has a requirement that all API calls to AWS must be logged and monitored for suspicious activity. They want to receive alerts when root account activity is detected. Which AWS service and configuration should they use?

Accepted Answer

Enable AWS CloudTrail and create a CloudWatch Events rule to match root account API calls and trigger a Lambda function.. AWS CloudTrail captures all API calls, including those made by the root account. By creating a CloudWatch Events (now Amazon EventBridge) rule that matches the `userIdentity.type` field set to `Root` and the `eventSource` set to `signin.amazonaws.com`, you can trigger a Lambda function to send alerts or perform remediation. This provides real-time monitoring and notification for suspicious root account activity.

Answer

Enable AWS CloudTrail and configure SNS notifications for root account events.

Answer

Use VPC Flow Logs to capture API calls and analyze with Athena.

Answer

Use AWS Config rules to detect root account usage.

Question 12

A developer is using AWS CodeDeploy with a blue/green deployment on an Amazon ECS service running on Fargate. The developer wants to ensure that the new (green) task set is fully healthy and serving traffic before the old (blue) task set is terminated. The deployment should automatically roll back to the blue task set if the green task set fails health checks. Which configuration should the developer set in the CodeDeploy deployment group?

Accepted Answer

Deployment type: blue/green, with rollback configuration enabled to trigger automatic rollback and reroute traffic to the original task set. The developer needs to configure the CodeDeploy deployment group with a blue/green deployment type and enable automatic rollback. This ensures that if the green task set fails health checks, CodeDeploy automatically terminates the green deployment and reroutes traffic back to the original blue task set, meeting the requirement for a fully healthy green task set before termination.

Answer

Deployment type: blue/green, Deployment configuration: CodeDeployDefault.ECSAllAtOnce

Answer

Deployment type: blue/green, Deployment configuration: CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Answer

Deployment type: blue/green, with an Application Load Balancer

Question 13

A developer is creating a REST API using Amazon API Gateway with Lambda proxy integration. The API needs to accept and return binary data such as images or PDF files. The developer has configured the API to use the Lambda proxy integration. What additional configuration is required to support binary data?

Accepted Answer

In API Gateway, add the binary media types to the API settings, e.g., image/png, application/pdf.. With Lambda proxy integration, API Gateway passes the client request as-is to Lambda and returns the Lambda response as-is to the client. To handle binary data, you must explicitly declare the binary media types (e.g., image/png, application/pdf) in the API Gateway REST API settings. This tells API Gateway to base64-encode the binary payload before sending it to Lambda and to decode the base64-encoded response from Lambda back to binary for the client. Without this configuration, API Gateway treats all payloads as text and will corrupt binary data.

Answer

Set the Content-Type header to application/octet-stream in the Lambda response.

Answer

Use an API Gateway custom domain with an SSL certificate.

Answer

Enable API caching with binary support.

Question 14

A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

Accepted Answer

AWS Systems Manager Parameter Store.. AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with server-side encryption.

Answer

Amazon DynamoDB with encryption at rest.

Question 15

A Lambda function connects to an RDS database and causes too many database connections during traffic spikes. Which service should be introduced?

Accepted Answer

Amazon RDS Proxy. Amazon RDS Proxy sits between your Lambda function and the RDS database, managing a pool of established database connections. During traffic spikes, Lambda can rapidly scale up concurrent executions, each potentially opening a new database connection, which can exhaust the database's maximum connections. RDS Proxy reuses connections from the pool, reducing the number of open connections and preventing database overload, while also improving connection handling efficiency for serverless applications.

Answer

AWS Glue Data Catalog

Answer

Amazon Route 53 Resolver

Answer

AWS WAF