DVA-C02 Practice Exam 3 — 20 Questions

Question 1

A developer is writing a Lambda function that needs to access an Amazon RDS MySQL database. The function will be invoked frequently. What is the BEST practice for managing the database connection?

Accepted Answer

Use Amazon RDS Proxy to manage the connection pool.. For Lambda functions accessing relational databases like Amazon RDS, the best practice is to use Amazon RDS Proxy. Because Lambda functions can scale rapidly to hundreds or thousands of concurrent executions, they can quickly exhaust the database's connection pool. RDS Proxy pools and shares these connections, improving scalability and application resilience. While opening connections outside the handler (Option C) is a good general practice, it does not solve the connection exhaustion problem under high concurrency and frequent invocations.

Answer

Close the database connection at the end of each invocation.

Answer

Open a new database connection inside the handler for each invocation.

Answer

Open the database connection outside the handler function and reuse it.

Question 2

An organization has a Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has a visibility timeout of 30 seconds. The Lambda function takes an average of 45 seconds to process each message. What is the likely behavior of this setup?

Accepted Answer

Messages will be processed multiple times because they become visible again before the function completes.. The Lambda function takes 45 seconds to process a message, but the SQS queue's visibility timeout is only 30 seconds. Because the processing time exceeds the visibility timeout, the message will become visible again in the queue after 30 seconds and can be received by another Lambda invocation before the first one finishes. This leads to duplicate processing. To prevent this, the SQS visibility timeout should be configured to be at least 6 times the Lambda function's timeout.

Answer

The Lambda function will be throttled due to reserved concurrency.

Answer

The Lambda function will process messages successfully with no issues.

Answer

The Lambda function will automatically increase its processing speed.

Question 3

Refer to the exhibit. A developer attached the IAM policy to a Lambda function's execution role. The function reads items from a DynamoDB table that uses AWS KMS customer managed key (CMK) for encryption at rest. When the function tries to read an item, it receives an access denied error. What is the cause?

Accepted Answer

The policy allows kms:Decrypt on all resources but the CMK key policy may not grant access.. The IAM policy grants kms:Decrypt on all resources, but DynamoDB uses AWS KMS customer managed keys (CMKs) for encryption at rest. Even if the IAM policy allows the action, the CMK's key policy must also grant the Lambda execution role access to use the key. If the key policy does not include a statement allowing the Lambda role to perform kms:Decrypt, the request fails with an access denied error, regardless of the IAM policy.

Answer

The DynamoDB table is not encrypted with a KMS key.

Answer

The policy does not allow dynamodb:GetItem on the table.

Answer

The DynamoDB table does not exist.

Question 4

A developer is designing a system where an S3 bucket receives uploads, and each upload triggers a Lambda function to process the file. The processed output is stored in another S3 bucket. The developer notices that sometimes the same file is processed multiple times. How can this be prevented?

Accepted Answer

Make the Lambda function idempotent by checking if the object has already been processed using a DynamoDB table.. Making the Lambda function idempotent using a DynamoDB table ensures that even if the same S3 event is delivered multiple times (due to at-least-once delivery semantics) or if the same file is uploaded again, the function checks a unique identifier (such as the object key or hash) in DynamoDB before processing. If it has already been processed, the function can safely skip it. This is the standard architectural pattern for ensuring idempotency in serverless pipelines.

Answer

Use an SQS FIFO queue as the event destination and enable content-based deduplication.

Answer

Enable S3 bucket replication to another bucket and trigger Lambda from the replica.

Answer

Enable S3 bucket versioning and use 's3:ObjectCreated:Put' events.

Question 5

A developer runs the AWS CLI command shown. The Lambda function returns a 200 status code but the output file is null and the response includes FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an unhandled exception.. The presence of `FunctionError: Unhandled` in the response of an `aws lambda invoke` command indicates that the Lambda function encountered an error (such as an unhandled exception or runtime crash) that was not caught by the function's code. Even though the function failed, the Invoke API itself successfully completed the transaction of invoking the function, which is why it returns an HTTP status code of 200.

Answer

The Lambda function timed out.

Answer

The payload was too large for synchronous invocation.

Answer

The Lambda function was not found.

Question 6

A developer invokes a Lambda function using the AWS CLI. The response shows StatusCode 200 and FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an exception that was not caught by the code.. A is correct because a StatusCode 200 from an AWS Lambda invocation via the AWS CLI indicates that the invocation request itself was accepted and processed by the Lambda service, but the presence of FunctionError: Unhandled means the function code threw an exception that was not caught by any try-catch block or error handler. This results in the Lambda service returning a 200 HTTP status for the invocation request while signaling the error via the FunctionError field in the response payload.

Answer

The Lambda function timed out before completing.

Answer

The Lambda function executed successfully without errors.

Answer

The AWS CLI failed to invoke the function due to permissions.

Question 7

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The output shows StatusCode 200 and no FunctionError. However, the application that depends on this function's output is not working correctly. What should the developer check next?

Accepted Answer

Check the Lambda function's CloudWatch Logs for any errors or unexpected output.. A StatusCode 200 with no FunctionError indicates the Lambda function executed and completed without a runtime or invocation error. However, the application may still fail if the function returns incorrect data or has logical errors. Checking CloudWatch Logs is the standard next step to inspect the actual execution logs, print statements, or handled logic errors that would reveal why the output is incorrect.

Answer

Check the IAM role attached to the Lambda function for insufficient permissions.

Answer

Check the payload format against the function's expected input.

Answer

Check the Lambda function's memory and timeout configuration.

Question 8

A developer needs to access a DynamoDB table from a Lambda function. The Lambda function is in the same AWS account as the DynamoDB table. What is the most secure way to grant the Lambda function access to the DynamoDB table?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and assign it as the Lambda execution role.. The most secure and standard way to grant a Lambda function access to DynamoDB is to create an IAM role with a policy that grants the necessary DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) and assign that role as the Lambda execution role. This follows the principle of least privilege and avoids hardcoding credentials, as Lambda automatically assumes this role and manages temporary security credentials. While DynamoDB supports resource-based policies, the Lambda execution role (identity-based policy) remains the standard and recommended approach for granting a Lambda function access to resources within the same account.

Answer

Use the AWS account root user credentials.

Answer

Store the AWS access key and secret access key in the Lambda environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Question 9

An application running on Amazon EC2 instances in an Auto Scaling group processes messages from an SQS queue. The application runs in a private subnet and needs to send metrics to Amazon CloudWatch. How can the developer ensure the EC2 instances can send metrics without traversing the internet?

Accepted Answer

Create a VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring).. A VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring) allows EC2 instances in a private subnet to send metrics to CloudWatch over the AWS network without traversing the internet. This is achieved by creating an Interface Endpoint (powered by AWS PrivateLink) that provides private connectivity to CloudWatch using private IP addresses from your subnet, avoiding the need for an internet gateway, NAT gateway, or virtual private gateway.

Answer

Attach a NAT Gateway to the private subnet and update the route table.

Answer

Install the CloudWatch agent on each instance and configure it to use a proxy.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to instances.

Question 10

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support CORS to allow requests from a web application hosted on a different domain. The developer has enabled CORS on the API Gateway resource and configured the Lambda function to return the appropriate headers. However, the web application is still receiving CORS errors. What is the most likely cause?

Accepted Answer

The API Gateway stage is not redeployed after enabling CORS.. When you enable CORS in the API Gateway console, it creates or updates the OPTIONS method for the resource. However, these configuration changes do not take effect until the API is redeployed to a stage. If the developer does not redeploy the API, the preflight OPTIONS request will fail (typically returning a 403 or 404), which the browser interprets as a CORS error. Since the developer already configured the Lambda function to return the headers, the missing step is redeploying the API stage.

Answer

The API Gateway CORS configuration is incorrect; the allowed origin should be set to '*'.

Answer

The web application is not sending the preflight OPTIONS request.

Answer

The Lambda function is not returning the CORS headers in the response.

Question 11

An application running on EC2 instances needs to access an S3 bucket securely. Which of the following is the BEST practice for managing credentials?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Assigning an IAM role to an EC2 instance is the AWS-recommended best practice for securely granting permissions to AWS services. The instance automatically obtains temporary security credentials from the instance metadata service (IMDS), eliminating the need to hardcode or manage long-term access keys. This approach follows the principle of least privilege and avoids the security risks of storing credentials on disk.

Answer

Store the AWS access key and secret key in a configuration file on the EC2 instance.

Answer

Use an IAM user with programmatic access and attach a policy allowing S3 access.

Answer

Use a shared secret key stored in AWS Secrets Manager and retrieve it at runtime.

Question 12

A company is deploying a new microservice on AWS Lambda behind an API Gateway. The development team wants to ensure that new versions of the Lambda function can be rolled out gradually and automatically rolled back if error rates exceed a threshold. Which deployment strategy should the team use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment strategy that shifts 10% of traffic to the new version for 5 minutes, then shifts the remaining 90%. Configure a CloudWatch alarm to automatically roll back if error rates exceed 2%.. AWS CodeDeploy supports canary deployments for Lambda, where you specify a percentage of traffic to shift to the new version for a specified interval, then shift the rest. You can attach CloudWatch alarms to the deployment group so that if error rates exceed a threshold during the canary window, CodeDeploy automatically rolls back to the previous version. This matches the requirement for gradual rollout and automatic rollback.

Answer

Use AWS Lambda function aliases with weighted alias traffic shifting. Update the weights manually and monitor error rates using CloudWatch. Roll back by reverting the alias weights.

Answer

Use AWS CodeDeploy with a linear deployment strategy that shifts 10% of traffic every 5 minutes. Configure a CloudWatch alarm to monitor error rates and manually roll back if needed.

Answer

Use AWS CodeDeploy with a blue/green deployment and an Application Load Balancer (ALB) to shift traffic to the new version. Configure CloudWatch alarms to trigger a rollback if errors exceed 5%.

Question 13

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 14

A developer needs to store application configuration that can be accessed by multiple microservices running on Amazon ECS. The configuration must be encrypted at rest and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) and features built-in, automatic rotation of secrets using AWS Lambda. While AWS Systems Manager Parameter Store can store encrypted configuration data (using SecureString), it does not offer native automatic rotation capabilities; implementing rotation in Parameter Store requires custom integration and code.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation

Answer

Amazon S3

Question 15

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support request validation, request throttling, and API keys. Which API Gateway feature should the developer use to enforce a daily request limit for each API key?

Accepted Answer

Usage plans. Usage plans in API Gateway allow you to set throttling and quota limits per API key, enabling daily request limits for each key. This feature is specifically designed to control usage by associating API keys with a plan that defines rate limits and quotas, such as a daily request cap. Option A is correct because it directly addresses the requirement to enforce a daily request limit per API key.

Answer

API keys

Answer

Throttling settings at the method level

Answer

AWS WAF

Question 16

A developer is using Amazon API Gateway with a Lambda authorizer to control access to an API. The authorizer function needs to decode a JWT token from the request header and return an IAM policy. Which type of Lambda authorizer should be used?

Accepted Answer

TOKEN authorizer with the token passed in the Authorization header.. A TOKEN authorizer is designed to receive a JWT or OAuth token in the Authorization header and pass it directly to the Lambda function for validation. The Lambda function then decodes the token and returns an IAM policy document to allow or deny the API request. This is the correct choice because the question explicitly states the token is in the request header and needs to be decoded, which matches the TOKEN authorizer's behavior of forwarding the raw token value.

Answer

REQUEST authorizer with the token in a custom header.

Answer

Use Amazon Cognito User Pools as the authorizer.

Answer

Use a resource policy to allow or deny access based on the JWT token.

Question 17

A developer is using IAM roles for Amazon EC2 to grant permissions to an application. The application makes API calls to DynamoDB and S3. After deploying, the application fails to access DynamoDB. The developer verifies the IAM role has the correct DynamoDB permissions. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance profile.. For an EC2 instance to use an IAM role, the role must be attached to an EC2 instance profile, which is the container that passes the role's credentials to the instance via the instance metadata service. Even if the IAM role has the correct DynamoDB permissions, if it is not associated with the instance profile, the application will not receive temporary credentials and will fail to access DynamoDB.

Answer

The IAM role does not have a trust policy for EC2.

Answer

The DynamoDB table is in a different region than the EC2 instance.

Answer

The application is using the wrong AWS SDK.

Question 18

A company runs a web application on AWS Elastic Beanstalk. The application currently runs in a single environment. The developer wants to deploy a new version with zero downtime and be able to test the new version thoroughly before it receives any production traffic. Which deployment strategy should the developer use?

Accepted Answer

Create a new environment (green) with the new version, run tests against it, and then swap the environment URLs so that production points to the green environment.. It describes a blue/green deployment strategy, which creates a separate 'green' environment with the new application version, allowing thorough testing before swapping the environment URLs (CNAME records) in Elastic Beanstalk. This ensures zero downtime because the swap is instantaneous and the original 'blue' environment remains untouched until the swap occurs.

Answer

Perform a rolling deployment with a batch size of one instance at a time.

Answer

Use an immutable deployment to launch a new set of instances and then swap the Auto Scaling group.

Answer

Use a rolling deployment with additional batch to launch new instances before terminating old ones.

Question 19

A developer needs to allow users from another AWS account (account ID: 123456789012) to read objects in an S3 bucket owned by the developer's account. The developer wants to use a bucket policy and does not want to create IAM users in the other account. Which bucket policy statement achieves this securely?

Accepted Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}. It uses the AWS account root principal ARN (arn:aws:iam::123456789012:root) to grant cross-account access to the S3 bucket. This allows any IAM user or role in the external account to read objects, provided the external account's administrator delegates permissions via IAM policies. The bucket policy does not require creating IAM users in the other account, aligning with the requirement.

Answer

{"Principal": "*", "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"aws:SourceAccount": "123456789012"}}}

Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:user/cross-account-user"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}

Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:role/cross-account-role"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}

Question 20

A company runs a monolithic application on EC2 Behind an Application Load Balancer. They want to migrate to a microservices architecture using ECS Fargate. What is the most important optimization to ensure minimal downtime during the migration?

Accepted Answer

Use a blue/green deployment strategy with weighted target groups.. A blue/green deployment strategy with weighted target groups allows you to gradually shift traffic from the existing monolithic EC2 application (blue) to the new microservices on ECS Fargate (green) while monitoring for errors. This minimizes downtime by enabling instant rollback if issues arise, and it leverages Application Load Balancer (ALB) features like stickiness and health checks to ensure a seamless transition without disrupting active connections.

Answer

Increase the EC2 instance size to handle the microservices load.

Answer

Deploy all microservices in a single ECS service for simplicity.

Answer

Scale horizontally by adding more EC2 instances.