DVA-C02 Practice Exam 2 — 20 Questions

Question 1

A developer notices that the Lambda function 'my-function' is not generating any logs in CloudWatch, although the function is invoked successfully. The developer runs the command above. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda function's execution role is missing the 'logs:CreateLogStream' and 'logs:PutLogEvents' permissions.. The log group exists but has 0 stored bytes, meaning no log streams have been created. This typically indicates that the Lambda function's execution role does not have permissions to create log streams and put log events. The function runs but fails silently to write logs.

Answer

The log group retention policy is set to 0 days.

Answer

The Lambda function is configured to log to a custom log group.

Answer

The Lambda function has reserved concurrency set to 0.

Question 2

A company uses AWS CodePipeline with CodeBuild to deploy a Node.js application. The build fails intermittently with 'npm ERR! network' errors. What is the most likely cause and solution?

Accepted Answer

The build environment lacks outbound internet access; configure a NAT gateway or use a VPC endpoint for npm.. The 'npm ERR! network' error indicates that npm cannot reach the registry to download packages. If AWS CodeBuild is configured to run inside a VPC, it requires outbound internet access to reach the public npm registry. If CodeBuild is configured with multiple subnets and some of them lack a route to a NAT gateway, the builds will fail intermittently depending on which subnet the build container is provisioned in. To resolve this, ensure all configured subnets have a route to a NAT gateway, or host your packages in AWS CodeArtifact and use a VPC endpoint to access them privately.

Answer

A unit test is failing; fix the test code.

Answer

The npm cache is corrupted; clear the cache in CodeBuild.

Answer

The npm token has expired; regenerate the token.

Question 3

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket with a bucket policy that grants public read access. The stack creation fails with the error 'Access Denied for bucket: bucket-policy does not allow access.' The developer has full administrative permissions in AWS. The developer verifies that the bucket policy is correctly formatted. What is the most likely cause of the failure?

Accepted Answer

The S3 Block Public Access settings are enabled at the account level, preventing the bucket policy from granting public access.. AWS S3 Block Public Access settings (at the account or bucket level) prevent the creation of public bucket policies. When CloudFormation attempts to apply a public bucket policy while Block Public Access is enabled, S3 rejects the PutBucketPolicy API call with an 'Access Denied' error. Since the developer has full administrative permissions, the failure is not due to missing IAM permissions but rather S3 Block Public Access blocking the public policy.

Answer

The developer does not have permissions to create S3 buckets.

Answer

The S3 bucket name is already in use by another account.

Answer

The S3 bucket is encrypted with AWS KMS, and the bucket policy does not include kms:Decrypt permissions.

Question 4

Which TWO services can be used to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

SSE-KMS. Options A and E are correct. Option A: SSE-KMS uses AWS Key Management Service (KMS) for managing encryption keys, providing additional control and audit capabilities. Option E: SSE-S3 uses S3-managed keys for encryption at rest. Option B is incorrect because AWS IAM is an access management service, not an encryption service. Option C is incorrect because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not data encryption. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not directly integrated with S3 for encryption.

Answer

AWS IAM

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 5

Refer to the exhibit. A developer creates this CloudFormation template and tries to deploy it. The deployment fails with 'CREATE_FAILED' for the S3 bucket resource. What is the most likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. S3 bucket names must be globally unique across all AWS accounts. If the bucket name specified in the template is already in use by another account, CloudFormation will fail with CREATE_FAILED for the S3 bucket resource. This is a fundamental requirement of the S3 service, not a template syntax or configuration issue.

Answer

The template does not enable versioning on the bucket.

Answer

The bucket name must be in all lowercase letters.

Answer

The template does not specify a bucket policy.

Question 6

A developer is creating a CloudFormation template to deploy a microservices architecture. The template includes an Amazon ECS service with an Application Load Balancer. The developer wants to ensure that the load balancer is created before the ECS service. How should the developer achieve this?

Accepted Answer

Use the DependsOn attribute in the ECS service resource to reference the load balancer.. The DependsOn attribute explicitly defines resource creation order in AWS CloudFormation. By setting DependsOn on the ECS service to reference the load balancer, the template ensures the load balancer is fully created before the ECS service attempts to register with it, preventing deployment failures due to missing dependencies.

Answer

Use the Ref function in the ECS service to reference the load balancer.

Answer

Define the load balancer before the ECS service in the template.

Answer

Use the Fn::GetAtt function to reference the load balancer.

Question 7

A developer needs to store session state for a stateless web application running on EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to ensure session data is not lost if an instance fails?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database that provides fast and predictable performance with seamless scalability. It is highly recommended for storing session state in stateless applications because it is serverless, highly durable, and requires no cluster management, unlike ElastiCache. AWS SDKs even offer native session state providers for DynamoDB.

Answer

Amazon S3

Answer

Amazon ElastiCache

Answer

Amazon RDS

Question 8

A developer created a CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?

Accepted Answer

The bucket policy does not allow public access.. An 'Access Denied' (403 Forbidden) error on an Amazon S3 static website endpoint indicates that the requester does not have permission to access the resource. By default, all new S3 buckets and objects are private. To allow public access to the website's assets, you must add a bucket policy that grants public read permissions (`s3:GetObject`) to anonymous users, and ensure that S3 Block Public Access settings are disabled. If static website hosting were not enabled, the website endpoint would not return a 403 Forbidden error; it would not resolve or would return a 404 error. Therefore, the missing bucket policy is the most likely cause.

Answer

The bucket has versioning enabled, which blocks public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have static website hosting enabled.

Question 9

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Remove the Lambda function from the VPC.. When a Lambda function is configured to run inside a VPC, it loses its default internet access. If the function needs to call an external API, the connection will hang and eventually time out. Increasing the timeout (Option A) will not resolve this, as the network path is blocked. To resolve this, the developer should either configure a NAT Gateway in the VPC or, if VPC resources are not required, remove the Lambda function from the VPC (Option C) to restore default internet access.

Answer

Increase the Lambda function timeout to 10 seconds.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the Lambda function memory to 1024 MB.

Question 10

A developer is building a real-time chat application using Amazon API Gateway WebSockets and AWS Lambda. The developer notices that messages are sometimes delivered out of order. What should the developer do to ensure ordered message delivery?

Accepted Answer

Use an Amazon SQS FIFO queue to buffer messages before processing. WebSocket connections run over TCP, which guarantees in-order delivery of frames from the client to Amazon API Gateway. However, when API Gateway routes these messages to AWS Lambda, Lambda executes concurrently. This concurrent execution can lead to messages being processed, written to a database, or broadcasted to other clients out of order. To guarantee ordered processing, messages can be buffered using an Amazon SQS FIFO (First-In-First-Out) queue before being processed by Lambda, ensuring they are handled in the exact order they were received.

Answer

Increase the Lambda function's memory allocation

Answer

Use API Gateway's built-in message ordering feature

Answer

Set the 'sequenceNumber' property in the WebSocket message

Question 11

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

Accepted Answer

The bucket policy denies the upload. The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer

The user needs s3:PutObjectAcl permission

Answer

The policy does not allow s3:ListBucket

Answer

The user does not have s3:GetObject permission

Question 12

A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?

Accepted Answer

Request validation using models and request validators. API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.

Answer

Usage plans with API keys

Answer

WAF (AWS WAF) integration

Answer

Custom authorizer (Lambda authorizer)

Question 13

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 14

A developer notices that an AWS Lambda function is timing out after 15 seconds. The function makes HTTP requests to an external API. How can the developer resolve this issue without changing the function code?

Accepted Answer

Increase the timeout setting of the Lambda function. The Lambda function is timing out because its configured execution timeout (15 seconds) is too short for the HTTP requests to the external API to complete. Increasing the timeout setting (up to the maximum limit of 15 minutes) allows the function to run longer and wait for the API response, resolving the timeout without modifying the code. This is a configuration change in the Lambda function settings, not a code change.

Answer

Increase the reserved concurrency

Answer

Place the Lambda function in a VPC

Answer

Decrease the memory allocation of the Lambda function

Question 15

A developer is building a serverless application that processes images uploaded to an S3 bucket. The bucket triggers a Lambda function that creates a thumbnail and stores it in another S3 bucket. The developer notices that the Lambda function is invoked multiple times for the same object, causing duplicate thumbnails. What is the MOST likely cause?

Accepted Answer

S3 event notifications are eventually consistent and may deliver duplicates.. Amazon S3 event notifications are designed to provide at-least-once delivery. This means that while most events are delivered exactly once, duplicate event notifications can occasionally occur. To handle this, the Lambda function should be designed to be idempotent, ensuring that processing the same event multiple times does not cause unintended side effects (like duplicate thumbnails).

Answer

The Lambda function is configured with a DLQ that causes retries.

Answer

The Lambda function is idempotent and should handle duplicates.

Answer

The S3 bucket has multiple event notifications that trigger the same Lambda function.

Question 16

A developer invokes an AWS Lambda function and receives a timeout error. The function is configured with a 3-second timeout. The developer needs to process data that sometimes takes up to 10 seconds. What should the developer do?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error indicates the Lambda function is timing out because its configured timeout of 3 seconds is insufficient for processing that sometimes takes up to 10 seconds. Option B directly addresses this by increasing the timeout to 10 seconds, which is within the maximum Lambda timeout of 15 minutes (900 seconds). This ensures the function can complete its execution without being prematurely terminated.

Answer

Change the invocation type to Event (async).

Answer

Increase the memory allocation for the Lambda function.

Answer

Set reserved concurrency to 1.

Question 17

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

Accepted Answer

Noncurrent versions of objects are deleted 30 days after they become noncurrent.. The CloudFormation template defines an S3 Lifecycle rule with `NoncurrentVersionExpiration` set to 30 `NoncurrentDays`. This rule specifically targets noncurrent versions of objects, meaning that after an object version becomes noncurrent (e.g., due to a PUT or DELETE of the current version), that noncurrent version will be permanently deleted 30 days later. The `Status: Enabled` ensures the rule is active, and versioning is enabled via the `VersioningConfiguration` property.

Answer

The bucket will have versioning disabled because the rule conflicts.

Answer

Current versions are transitioned to another storage class after 30 days.

Answer

Objects are automatically deleted after 30 days.

Question 18

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. S3 can directly invoke a Lambda function via S3 event notifications. When a new object is created in the bucket, S3 publishes a notification with the event type `s3:ObjectCreated:*` and the Lambda function is triggered asynchronously. This is the simplest and most direct integration for this use case, requiring no intermediate services.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 19

A developer is deploying an application using AWS CloudFormation. The template includes an AWS::Lambda::Function resource. The developer wants to ensure that the Lambda function's code is automatically updated when the source code in S3 changes. Which approach should the developer use?

Accepted Answer

Specify the S3 object version in the template and update the version number in the template when code changes.. AWS CloudFormation detects changes to the `AWS::Lambda::Function` resource's `Code` property only when the properties defined in the template (such as `S3Key` or `S3ObjectVersion`) change. If you upload a new deployment package to S3 using the same bucket and key, CloudFormation will not detect any change and will not update the Lambda function. To resolve this, you should enable S3 Versioning on the bucket, specify the `S3ObjectVersion` in the CloudFormation template, and update this version parameter in the template whenever the code is updated.

Answer

Use the AWS::Lambda::Version resource to create a new version.

Answer

Include the S3 bucket and key as template parameters and update the stack with a new key when code changes.

Answer

Use a custom resource backed by a Lambda function that polls S3 for changes.

Question 20

A company runs an application on Amazon EC2 instances that need to read data from an Amazon DynamoDB table. The developer must grant access to DynamoDB without storing any long-term credentials on the instance. Which approach should the developer use?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the AWS access key and secret key in a configuration file.

Answer

Use an IAM user and store credentials in AWS Secrets Manager.

Answer

Use the DynamoDB table's resource-based policy to allow the EC2 instance.