DVA-C02 Practice Test 22 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function needs to read and write items to a DynamoDB table. What is the BEST way to securely provide the Lambda function with the necessary AWS credentials?

Accepted Answer

Create an IAM role with DynamoDB permissions and attach it to the Lambda function.. Option C is correct because the best practice is to attach an IAM role to the Lambda function with the required permissions. This avoids hardcoding credentials. Option A is incorrect because storing credentials in environment variables is not secure. Option B is incorrect because Lambda does not use access keys in IAM users; it uses roles. Option D is incorrect because the Lambda function should have least privilege, not full admin access.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Create an IAM user with programmatic access and store the credentials in the Lambda code.

Answer

Use the Lambda function's default full admin access provided by AWS.

Question 2

A company has a web application running on Amazon ECS with Fargate launch type. The application needs to store and retrieve user session data. The sessions are small and require very low latency access. The development team wants a fully managed solution. Which storage options meet these requirements? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. The correct answers are C and D. Amazon ElastiCache for Redis provides in-memory caching with low latency, and Amazon DynamoDB provides fast NoSQL storage. Option A is wrong because EFS is a file system, not optimized for key-value session data. Option B is wrong because RDS is relational and adds latency. Option E is wrong because S3 is object storage with higher latency.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for PostgreSQL

Question 3

An IAM policy is attached to an IAM user. The user attempts to upload an object to s3://my-bucket/confidential/report.pdf from an IP address 192.168.1.100. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks the request.. Option A is correct because the Deny statement explicitly denies s3:* actions on the confidential prefix when the source IP is not in 10.0.0.0/8. Since the user's IP (192.168.1.100) is not in that range, the Deny applies. Even though the Allow statement grants s3:PutObject, the explicit Deny overrides. Option B is wrong because the Deny applies. Option C is wrong because the Deny is explicit. Option D is wrong because the IP condition is checked.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on all objects in the bucket.

Answer

The upload succeeds because the IP address 192.168.1.100 matches the condition.

Answer

The upload fails because the Deny statement does not have a condition.

Question 4

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to s3://my-bucket/confidential/report.pdf. What is the outcome?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the confidential prefix.. Option B is correct because the Deny statement explicitly denies all s3 actions on the confidential prefix, and explicit Deny overrides any Allow. Option A is wrong because the Deny overrides the Allow. Option C is wrong because there is no explicit Allow for that prefix. Option D is wrong because the policy applies.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Answer

The upload fails because there is no Allow statement for the confidential prefix.

Answer

The upload fails because the policy is malformed.

Question 5

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero status.. Option A is correct because a non-zero exit code from a lifecycle event script causes the deployment to fail on that instance. Option B is incorrect because if the agent were not running, the deployment would not even start. Option C is incorrect because a missing application revision would cause a different error. Option D is incorrect because IAM permissions issues would prevent the agent from downloading the revision, not cause a script to fail.

Answer

The application revision is missing from the S3 bucket.

Answer

The IAM instance profile does not have permissions to call CodeDeploy APIs.

Answer

The CodeDeploy agent is not running on the instances.

Question 6

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway, Lambda functions, and a DynamoDB table. The developer wants to define and deploy this infrastructure as code. Which files and tools are required? (Choose THREE.)

Accepted Answer

aws cloudformation deploy command. The correct answers are B, C, and D. SAM uses a template.yaml file, and the aws cloudformation package and deploy commands are used to deploy. Option A is wrong because Terraform is a separate tool. Option E is wrong because the AWS CLI alone cannot handle SAM packaging and deployment.

Answer

Terraform configuration files

Answer

AWS CLI with aws lambda update-function-code command

Question 7

A developer is deploying a serverless application that includes an AWS Lambda function with a dependency on a native library (e.g., a compiled C library). The developer uses AWS SAM. The Lambda function runs correctly in the local development environment but fails with an 'Unable to import module' error when deployed. What is the most likely cause?

Accepted Answer

The native library is compiled for a different operating system than Lambda (Amazon Linux).. Option C is correct because Lambda runs on Amazon Linux, and native libraries must be compiled for that platform. The local development environment may be a different OS. Option A is wrong because the IAM role does not affect module imports. Option B is wrong because a timeout would cause a different error. Option D is wrong because the handler name is correct locally.

Answer

The Lambda function's IAM role does not have permission to access the library.

Answer

The Lambda function's handler configuration is incorrect.

Answer

The Lambda function's timeout is too short.

Question 8

Refer to the exhibit. A developer ran the AWS CLI command to invoke a Lambda function. The response indicates an error. What should the developer do to see the error details?

Accepted Answer

Decode the LogResult value from base64 to see the logs.. Option A is correct because the LogResult contains base64-encoded logs. Option B is wrong because the logs are not automatically in CloudWatch. Option C is wrong because the LogResult is base64, not plain text. Option D is wrong because the error is Unhandled, not a timeout.

Answer

Check CloudWatch Logs for the function's log group.

Answer

Increase the Lambda function timeout to avoid the error.

Answer

Read the output.txt file for the error message.

Question 9

A developer is writing a Lambda function that processes events from an Amazon S3 bucket. The function needs to access a DynamoDB table to store metadata about the S3 objects. Which of the following is the MOST efficient way to initialize the DynamoDB client in the Lambda function?

Accepted Answer

Create the DynamoDB client outside the Lambda handler function, in the global scope.. Option B is correct because initializing the DynamoDB client outside the handler allows it to be reused across invocations, improving performance. Option A is incorrect because creating a new client for each invocation adds overhead. Option C is incorrect because using a global variable for the table name is fine, but the client should be initialized outside. Option D is incorrect because using a static variable in Java achieves the same effect as initializing outside the handler.

Answer

Store the DynamoDB table name as a global variable and create the client inside the handler.

Answer

Use a static variable inside the handler to cache the DynamoDB client.

Answer

Create the DynamoDB client inside the Lambda handler function every invocation.

Question 10

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

Accepted Answer

Noncurrent versions of objects are deleted 30 days after they become noncurrent.. Option B is correct because the lifecycle rule will delete noncurrent versions after 30 days. Option A is wrong because versioning is enabled, so old versions are kept. Option C is wrong because the rule only applies to noncurrent versions. Option D is wrong because the action is expiration, not transition.

Answer

The bucket will have versioning disabled because the rule conflicts.

Answer

Current versions are transitioned to another storage class after 30 days.

Answer

Objects are automatically deleted after 30 days.

Question 11

A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

Accepted Answer

AWS Systems Manager Parameter Store.. Option C is correct because AWS Systems Manager Parameter Store can store configuration data securely, with encryption using KMS, and provides audit trails via CloudTrail. Option A is incorrect because S3 is not designed for parameter storage and would require additional setup for encryption and access control. Option B is incorrect because DynamoDB is a database, not a configuration store; it would require more overhead. Option D is incorrect because Secrets Manager is more expensive and is specifically for secrets, not general application configuration.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with server-side encryption.

Answer

Amazon DynamoDB with encryption at rest.

Question 12

A developer is deploying an application using AWS CodeDeploy with an in-place deployment configuration. The application runs on an EC2 instance behind an Application Load Balancer. The deployment fails because the health check fails after the new version is installed. What should the developer do to prevent the deployment from failing due to health checks?

Accepted Answer

Configure a longer health check grace period in the CodeDeploy application specification.. The correct answer is D. Configuring a longer health check grace period allows the application to start and stabilize before the load balancer checks its health. Option A is wrong because deregistering the instance during deployment is not a standard practice and may cause traffic loss. Option B is wrong because a blue/green deployment is a different strategy, not a fix for in-place deployment. Option C is wrong because increasing the interval alone does not provide a grace period.

Answer

Deregister the instance from the target group before deployment and register it after.

Answer

Switch to a blue/green deployment strategy.

Answer

Increase the health check interval on the load balancer.

Question 13

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 10. The SQS queue receives a burst of 1000 messages. The Lambda function processes each message in about 5 seconds. What is the most likely behavior of the system?

Accepted Answer

Lambda processes up to 10 messages concurrently, and the rest remain in the queue until processing capacity is available.. The correct answer is D. Lambda will poll the SQS queue, but with reserved concurrency of 10, only 10 Lambda functions can run concurrently. The remaining messages will remain in the queue until the running functions finish. Option A is wrong because Lambda does not block the queue. Option B is wrong because Lambda does not scale beyond reserved concurrency. Option C is wrong because Lambda does not automatically increase concurrency beyond the limit.

Answer

Lambda rejects the messages and sends them to the dead-letter queue.

Answer

Lambda automatically scales up to 1000 concurrent executions to process all messages quickly.

Answer

Lambda increases the reserved concurrency to accommodate the burst.

Question 14

A developer is building a CI/CD pipeline using AWS CodePipeline. The source stage is an Amazon S3 bucket. The developer wants to automatically start the pipeline when a new file is uploaded to the S3 bucket. What should the developer do?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers on S3 object creation events and targets the pipeline.. Option B is correct because CodePipeline can be configured to use Amazon CloudWatch Events (now Amazon EventBridge) to detect S3 events and start the pipeline. Option A is incorrect because SQS does not trigger CodePipeline. Option C is incorrect because SNS can be used but is not a direct trigger; EventBridge is the recommended approach. Option D is incorrect because polling is not efficient; EventBridge provides real-time events.

Answer

Configure the S3 bucket to send events to an SQS queue, and poll the queue from CodePipeline.

Answer

Set up a periodic Lambda function that checks the S3 bucket for new files and starts the pipeline.

Answer

Configure the S3 bucket to send events to an SNS topic, and subscribe CodePipeline to the topic.

Question 15

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API has a REST endpoint that triggers a Lambda function to write data to an Amazon DynamoDB table. Under high traffic, some requests are failing with 5xx errors. The developer notices that the Lambda function's duration is spiking. Which combination of actions should the developer take to improve performance and reduce errors?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table and set a Lambda reserved concurrency.. Option B is correct because enabling DynamoDB acceleration and Lambda concurrency limits address both performance and throttling. Option A is wrong because increasing memory reduces duration but not concurrency issues. Option C is wrong because DAX is not for API Gateway. Option D is wrong because SQS adds latency for real-time APIs.

Answer

Use an Amazon SQS queue as a buffer between API Gateway and Lambda.

Answer

Increase the Lambda function's memory and enable DynamoDB auto-scaling.

Answer

Switch the API endpoint to HTTP API and enable API Gateway caching.