DVA-C02 Practice Test 20 — 15 Questions

Question 1

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket and an AWS Lambda function. The Lambda function needs to be granted permission to read objects from the S3 bucket. Which resource should the developer define in the CloudFormation template to provide these permissions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS::IAM::Role. The Lambda function requires an IAM role (AWS::IAM::Role) with a policy that grants s3:GetObject permissions on the S3 bucket. This role is assumed by the Lambda service at runtime, allowing the function to read objects from the bucket. The role must include a trust policy that allows lambda.amazonaws.com to assume it.

Answer

AWS::Lambda::Permission

Answer

AWS::S3::BucketPolicy

Answer

AWS::IAM::ManagedPolicy

Question 2

A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The iterator age metric is increasing, and CloudWatch Logs show the function execution time is around 4 minutes (timeout is 5 minutes). The stream has 10 shards. What is the most cost-effective way to increase processing throughput?

Accepted Answer

Increase the parallelization factor per shard. Increasing the parallelization factor per shard (option D) allows each shard to be processed by multiple Lambda instances concurrently, which directly increases throughput without requiring additional shards or changes to the stream. Since the function is not hitting the 5-minute timeout but is taking ~4 minutes per batch, the bottleneck is processing concurrency per shard, not batch size or execution duration. This is the most cost-effective solution because it uses existing shards and avoids the cost of additional shards or unnecessary timeout increases.

Answer

Increase the batch size to 500

Answer

Increase the number of shards

Answer

Increase the timeout to 10 minutes

Question 3

A developer has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a batch size of 10, reserved concurrency of 5, and a timeout of 5 minutes. The SQS queue has a large backlog, and CloudWatch metrics show high throttling (Throttles) for the Lambda function. The function is idempotent and can process up to 100 messages in a single invocation. What is the MOST effective way to increase throughput without increasing the reserved concurrency?

Accepted Answer

Increase the batch size to 100.. Increasing the batch size to 100 allows each Lambda invocation to process up to 100 messages from the SQS queue instead of the current 10. Since the function is idempotent and can handle 100 messages per invocation, this change maximizes the number of messages processed per invocation without altering the reserved concurrency of 5. With a batch size of 100, each of the 5 concurrent invocations can process up to 100 messages, yielding a potential throughput of 500 messages per invocation cycle, which directly reduces the backlog and throttling by consuming messages faster.

Answer

Increase the reserved concurrency to 10.

Answer

Reduce the batch size to 1.

Answer

Enable the SQS queue to use long polling.

Question 4

A developer is building an AWS Lambda function that needs to retrieve a database password securely. The password is stored in AWS Secrets Manager and is rotated every 30 days. The function must minimize the number of API calls to Secrets Manager. Which approach should the developer use?

Accepted Answer

Retrieve the secret from Secrets Manager once outside the handler function, cache it in a global variable, and refresh the cache if the secret fails.. It retrieves the secret once during the Lambda cold start (outside the handler), caches it in a global variable, and only refreshes the cache if the secret fails (e.g., due to rotation). This minimizes API calls to Secrets Manager while still handling secret rotation gracefully, as the cached secret remains valid until a failure occurs.

Answer

Store the database password as an encrypted environment variable in the Lambda function.

Answer

Call Secrets Manager on every invocation to get the latest secret.

Answer

Use AWS Systems Manager Parameter Store SecureString instead of Secrets Manager.

Question 5

A company uses AWS Organizations with multiple accounts. A developer needs to grant an IAM user in Account A (111111111111) read-only access to an S3 bucket in Account B (222222222222). The bucket is encrypted with SSE-S3. Which combination of policies is required for cross-account access?

Accepted Answer

Bucket policy in Account B granting s3:GetObject to the IAM user ARN, and an IAM policy in Account A allowing s3:GetObject.. Cross-account S3 access requires both a bucket policy in the resource account (Account B) that explicitly grants the IAM user ARN from Account A the s3:GetObject permission, and an IAM policy in the user's account (Account A) that allows the same action. The bucket policy acts as a resource-based policy that authorizes the cross-account principal, while the IAM policy is necessary to authorize the user to make the request. SSE-S3 encryption does not require additional configuration because S3 handles decryption automatically for authorized users.

Answer

Bucket policy in Account B granting s3:GetObject to Account A's root user ARN, and an IAM policy in Account A allowing s3:GetObject.

Answer

Bucket policy in Account B granting s3:GetObject to the IAM user ARN, and no IAM policy in Account A is needed.

Answer

IAM policy in Account A allowing s3:GetObject, and an S3 Access Point in Account B configured for cross-account access.

Question 6

A developer is building a system that reads messages from an Amazon SQS queue, processes them, and stores results in an Amazon DynamoDB table. The developer wants to use a managed service to coordinate the processing steps, including error handling and retry logic, without provisioning any servers. Which AWS service should the developer use?

Accepted Answer

AWS Step Functions. AWS Step Functions is a serverless orchestration service that lets you coordinate multiple AWS services into a workflow. It directly supports error handling, retry logic, and conditional branching, making it ideal for managing the processing steps of messages from SQS through to DynamoDB without provisioning any servers.

Answer

Amazon Simple Workflow Service (SWF)

Answer

AWS Glue

Answer

Amazon MQ

Question 7

A developer is using AWS Elastic Beanstalk to deploy a web application. The application uses an in-environment Amazon RDS database instance. The developer needs to update the application code without risking data loss. The database must not be affected by environment operations such as termination or updates. What is the recommended approach?

Accepted Answer

Create a standalone Amazon RDS instance and reconfigure the application to use it instead of the in-environment database.. Decoupling the RDS database from the Elastic Beanstalk environment by creating a standalone RDS instance ensures that the database is not tied to the environment's lifecycle. In-environment databases are automatically deleted when the environment is terminated or updated, risking data loss. By reconfiguring the application to point to an external RDS instance, the database persists independently of environment operations, meeting the requirement to avoid data loss during code updates or environment changes.

Answer

Take a snapshot of the database before each deployment and restore it after the deployment completes.

Answer

Use the Elastic Beanstalk environment's 'Swap environment URLs' feature to perform a blue/green deployment.

Answer

Create a new Elastic Beanstalk environment with a new RDS instance and migrate data manually.

Question 8

A developer notices that an AWS Lambda function, which processes messages from an SQS queue, is taking longer than expected. The function has a reserved concurrency of 5 and a batch size of 10. The SQS queue has a large backlog. CloudWatch metrics show that the function's throttles are high. The function is idempotent and can process up to 100 messages per invocation. What is the most effective way to increase throughput without increasing reserved concurrency?

Accepted Answer

Increase the batch size to 100.. Increasing the batch size to 100 directly reduces the number of Lambda invocations required to process the backlog, thereby decreasing throttling without increasing reserved concurrency. The function's capacity to handle up to 100 messages per invocation makes this alignment optimal. SQS event source mappings support batch sizes up to 10,000 for standard queues, so a batch size of 100 is feasible. Short polling (option D) would not improve throughput; it causes frequent empty responses and does not reduce throttling. Increasing reserved concurrency violates the constraint, and changing timeout (option C) does not address throttling.

Answer

Increase reserved concurrency to 10.

Answer

Change the function timeout to 15 minutes.

Answer

Enable SQS short polling to reduce latency.

Question 9

A developer is creating a REST API using Amazon API Gateway and multiple AWS Lambda functions for different endpoints. The API must support CORS for a web application hosted on a different domain. The developer is using Lambda proxy integration. Which configuration is required to enable CORS?

Accepted Answer

Enable CORS in API Gateway and configure the Lambda functions to return the required CORS headers.. With Lambda proxy integration in API Gateway, the entire request and response are passed through to the Lambda function, which must return the HTTP response including status code, headers, and body. To enable CORS, the Lambda function must include the required CORS headers (e.g., Access-Control-Allow-Origin) in its response. While API Gateway can be configured to add CORS headers for non-proxy integrations, with proxy integration the Lambda function is solely responsible for returning all headers.

Answer

Configure API Gateway to return CORS headers and Lambda functions can ignore CORS.

Answer

Configure Lambda functions to return CORS headers and API Gateway will pass them through automatically.

Answer

Use a Lambda@Edge function at Amazon CloudFront to add CORS headers.

Question 10

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to retrieve an item by its primary key frequently. Which DynamoDB API call should the developer use to achieve the lowest latency?

Accepted Answer

GetItem. The GetItem API call is the most efficient way to retrieve a single item by its primary key in DynamoDB, as it directly accesses the item using the hash key (and optionally the sort key) with consistent, single-digit millisecond latency. Unlike Scan or Query, GetItem does not need to evaluate any conditions or filter through other items, making it the lowest-latency option for this specific use case.

Answer

Scan

Answer

Query

Answer

BatchGetItem

Question 11

A developer is debugging an issue where an Amazon S3 bucket policy is not allowing cross-account access for a user from another AWS account. The bucket policy grants access to the other account's root user. The IAM user in the other account has an IAM policy that allows s3:GetObject on the bucket. When the user tries to download an object, they get an Access Denied error. What is the most likely cause?

Accepted Answer

The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission. The most likely cause is that the bucket is encrypted with SSE-KMS. When an S3 bucket uses AWS KMS customer master keys (CMKs) for server-side encryption, the bucket policy granting access to the root user of the other account is not sufficient. The IAM user in the other account must also have explicit kms:Decrypt permission on the KMS key, because S3 GetObject calls require decrypting the object before returning it. Without this KMS permission, the request fails with Access Denied even though the S3 bucket policy and IAM policy appear correct.

Answer

The bucket policy does not specify the user's ARN

Answer

The object's ACL is set to private

Answer

The IAM policy does not include s3:ListBucket

Question 12

A developer is using AWS X-Ray to trace a Lambda function that calls DynamoDB and SQS. Some traces show errors. Which TWO actions should the developer take to diagnose the issue?

Accepted Answer

Examine the trace details for exception messages.. To diagnose errors in existing X-Ray traces, the developer should examine trace details (Option A) to see exception messages and stack traces for each segment, and check the service map (Option C) for error edges that indicate which service interactions failed. Option B is about enabling X-Ray permissions, which is a prerequisite for tracing but does not help diagnose errors in traces that are already captured. Option D (disabling sampling) is unnecessary because X-Ray captures errors by default regardless of sampling. Option E (CloudFront caching) is unrelated to trace diagnostics.

Answer

Verify that the Lambda function's IAM role has permissions for X-Ray.

Answer

Disable X-Ray sampling to capture all requests.

Answer

Enable CloudFront to cache responses.

Question 13

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

Accepted Answer

Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.. With Lambda proxy integration in API Gateway, the Lambda function must return a response in the exact format that API Gateway expects: a JSON object with 'statusCode' (integer), 'headers' (object), and 'body' (string). This allows the developer to set a custom HTTP status code like 404 and include a custom error message in the body. API Gateway will then map this response directly to the HTTP response sent to the client.

Answer

Return a JSON object with 'status_code' and 'message' keys.

Answer

Throw an exception with a message that includes the HTTP status code.

Answer

Return a JSON object with 'errorMessage' and 'errorType' keys.

Question 14

A developer needs to ensure that every cryptographic operation performed on an AWS KMS customer master key (CMK) used for server-side encryption in Amazon S3 is recorded in AWS CloudTrail for auditing. The developer has already enabled CloudTrail and is logging management events. However, the security team wants to see all calls to the KMS Decrypt and Encrypt APIs for this specific key. What must the developer do?

Accepted Answer

Enable CloudTrail data events for the specific KMS key ARN.. CloudTrail data events can be configured to log individual API operations (such as Decrypt and Encrypt) on specific KMS keys. By default, CloudTrail management events do not include these data-plane operations; enabling data events for the specific KMS key ARN ensures every cryptographic call is recorded for auditing.

Answer

Enable CloudTrail data events for the S3 bucket containing the encrypted objects.

Answer

Create an additional CloudTrail trail that logs all management events for the KMS key.

Answer

Enable CloudTrail Insights events on the existing trail.

Question 15

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Accepted Answer

Increase the memory allocation for the Lambda function.. Increasing the memory allocation for a Lambda function also increases CPU and network bandwidth, which can significantly speed up the processing of large files, helping the function complete within the timeout. Option E is correct because increasing the Lambda function timeout directly addresses the timeout issue, giving the function more time to complete processing large files. Option A is incorrect because S3 multipart upload is used for uploading large objects to S3, not for downloading/reading from S3; it does not improve data ingestion into a Lambda function. Option C is incorrect because sending events to SQS does not affect the processing speed of a single large file; it only decouples the event source. Option D is too generic; while a more efficient algorithm could help, it is not a guaranteed or most likely fix compared to increasing memory or timeout.

Answer

Use S3 multipart upload for large files to improve throughput.

Answer

Change the S3 event notification to send messages to an Amazon SQS queue instead.

Answer

Update the Lambda function code to use a more efficient algorithm.