DVA-C02 Practice Test 24 — 15 Questions

Question 1

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API should allow users to retrieve data from an Amazon DynamoDB table. The developer wants to minimize latency for frequently accessed data. What should the developer do?

Accepted Answer

Use DynamoDB Accelerator (DAX) as a caching layer.. The correct answer is C. Using DynamoDB Accelerator (DAX) provides an in-memory cache that reduces latency for frequently accessed data. Option A is wrong because API Gateway caching caches the entire API response, which may not be efficient for all requests. Option B is wrong because increasing Lambda memory does not directly reduce latency for DynamoDB queries. Option D is wrong because CloudFront is for content delivery, not for reducing database latency.

Answer

Deploy a CloudFront distribution in front of the API Gateway.

Answer

Increase the Lambda function memory to improve performance.

Answer

Enable API Gateway caching.

Question 2

A company is running a monolithic application on an EC2 instance. The application currently stores session state in local memory on the instance. The company plans to scale the application horizontally by adding more instances behind a load balancer. What change is required to ensure that session state is preserved across requests?

Accepted Answer

Use Amazon ElastiCache to store session state externally.. The correct answer is D. Using ElastiCache (Redis or Memcached) provides a centralized, scalable session store accessible from all instances. Option A is wrong because S3 is not designed for low-latency session storage. Option B is wrong because RDS is a relational database, which can work but is not optimized for session storage. Option C is wrong because increasing instance size does not enable session sharing across instances.

Answer

Store session data in Amazon S3 and retrieve it on each request.

Answer

Increase the EC2 instance size to handle more sessions per instance.

Answer

Use an Amazon RDS database to store session state.

Question 3

A developer is troubleshooting an issue where an IAM user is unable to upload a file to an S3 bucket that uses server-side encryption with AWS KMS (SSE-KMS). The IAM policy shown in the exhibit is attached to the user. What is the likely cause of the failure?

Accepted Answer

The user does not have kms:Encrypt permission on the KMS key.. The correct answer is B. The policy allows s3:PutObject but does not include kms:Encrypt, which is required for uploading objects with SSE-KMS. Option A is wrong because the policy allows s3:PutObject. Option C is wrong because the KMS key is specified. Option D is wrong because the user may not have KMS permissions, but the missing action is kms:Encrypt.

Answer

The KMS key ARN in the resource statement is incorrect.

Answer

The user does not have s3:PutObject permission on the bucket.

Answer

The user does not have access to the KMS key at all.

Question 4

A developer is building a serverless application and wants to invoke an AWS Lambda function every hour to perform a cleanup task. Which AWS service should the developer use to schedule the invocation?

Accepted Answer

Amazon EventBridge (CloudWatch Events). The correct answer is B. Amazon CloudWatch Events (now Amazon EventBridge) can schedule events to trigger Lambda functions at specified intervals. Option A is wrong because SQS is a message queue, not a scheduler. Option C is wrong because Step Functions orchestrates workflows but does not schedule invocations directly. Option D is wrong because SNS is a notification service.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon SQS

Question 5

A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks permissions to write to CloudWatch Logs.. The correct answer is A. The Lambda function's execution role does not have permissions to create log streams and put log events. Option B is wrong because the log group exists. Option C is wrong because the function has been invoked, so it is not failing before logging. Option D is wrong because the log group name is correct.

Answer

The CloudWatch Logs log group does not exist.

Answer

The Lambda function is failing before any logging code is executed.

Answer

The Lambda function is configured to use a different log group name.

Question 6

A developer is building a real-time chat application using WebSocket APIs in Amazon API Gateway. The backend is an AWS Lambda function that stores connection IDs in an Amazon DynamoDB table. After a few days, the application stops working for new users. The developer checks CloudWatch Logs and sees that the Lambda function is returning 'AccessDeniedException' when calling DynamoDB. What is the MOST likely cause?

Accepted Answer

The DynamoDB table was recreated and the Lambda function's IAM role still references the old table ARN.. Option A is correct because Lambda execution role must be updated when DynamoDB table is recreated. Option B is wrong because Lambda function code updates don't change IAM roles. Option C is wrong because API Gateway permissions affect invocation, not DynamoDB access. Option D is wrong because SDK version mismatch would cause different errors.

Answer

The Lambda function code was updated but the IAM role was not reattached.

Answer

The Lambda function uses an outdated AWS SDK version.

Answer

The API Gateway route was updated without redeploying the API.

Question 7

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Accepted Answer

Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.. Options A and D are correct. Option A ensures at-least-once processing because after the visibility timeout, the message becomes visible again if not deleted. Option D ensures the function deletes the message only after successful processing. Option B is wrong because long polling reduces empty responses but doesn't guarantee processing. Option C is wrong because DLQ is for failed messages. Option E is wrong because FIFO ensures exactly-once, not at-least-once.

Answer

Configure a Dead Letter Queue (DLQ) to capture failed messages.

Answer

Enable long polling on the SQS queue.

Answer

Use a FIFO queue to ensure exactly-once processing.

Question 8

A developer needs to store application configuration data that can be read by multiple EC2 instances. The data is less than 1 KB and changes frequently. Which AWS service is BEST suited for this?

Accepted Answer

AWS AppConfig. Option C is correct because AWS AppConfig is designed for application configuration and supports frequent updates. Option A is wrong because S3 is object storage, not ideal for small frequently changing configs. Option B is wrong because Parameter Store can store configs but is better for less frequent changes; AppConfig is optimized for frequent changes. Option D is wrong because DynamoDB is a database, overkill for simple config.

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Question 9

A developer wants to deploy a containerized application on AWS. The application requires persistent storage that can be accessed by multiple containers running on different EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon Elastic File System (EFS). Option B is correct because Amazon EFS provides shared file storage for multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance. Option C is wrong because S3 is object storage. Option D is wrong because DynamoDB is a NoSQL database.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon DynamoDB

Question 10

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway REST API and a Lambda function. The developer wants to enable access logging for the API Gateway. Which THREE resources or configurations are required? (Choose THREE.)

Accepted Answer

A stage with access logging enabled in the API Gateway.. Options A, B, and D are correct. Option A sets up a log group. Option B configures the IAM role for API Gateway to write logs. Option D enables access logging. Option C is not required because Lambda function logs are separate. Option E is not required because Lambda execution role is for Lambda, not API Gateway logging.

Answer

A Lambda function that processes the access logs.

Answer

An IAM role for the Lambda function with logs:PutLogEvents permission.

Question 11

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

Accepted Answer

Use AWS CloudFormation to define and deploy the API Gateway.. Option B is correct because AWS CloudFormation can deploy and update API Gateway as part of infrastructure as code. Option A is wrong because Lambda only updates function code. Option C is wrong because CodeBuild builds artifacts, doesn't deploy API Gateway directly. Option D is wrong because S3 doesn't deploy API Gateway.

Answer

Use AWS Lambda to update the API Gateway configuration.

Answer

Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.

Answer

Use AWS CodeBuild to compile and deploy the API Gateway configuration.

Question 12

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The KMS key policy does not grant the IAM user/role permissions to use the key.. Option B is correct because KMS key policies can restrict access to the key. Option A is wrong because S3 bucket policy affects S3 actions, not KMS. Option C is wrong because KMS keys are regional and cross-region access fails. Option D is wrong because object ownership doesn't affect KMS permissions.

Answer

The S3 bucket's object ownership is set to BucketOwnerPreferred.

Answer

The KMS key is in a different AWS Region than the S3 bucket.

Answer

The S3 bucket policy denies PutObject without encryption.

Question 13

A developer is using AWS X-Ray to trace requests through a microservices application. The application consists of several AWS Lambda functions that call each other and Amazon DynamoDB. The developer notices that some traces are incomplete and missing segments for downstream calls. What is the MOST likely cause?

Accepted Answer

The downstream DynamoDB table does not have X-Ray tracing enabled.. Option D is correct because X-Ray tracing must be enabled on downstream resources to record segments. Option A is wrong because sampling rate affects number of traces, not completeness. Option B is wrong because X-Ray SDK is needed on Lambda. Option C is wrong because X-Ray daemon is needed for EC2, but Lambda uses the X-Ray SDK.

Answer

The Lambda functions do not have the X-Ray SDK imported.

Answer

The X-Ray daemon is not running on the Lambda execution environment.

Answer

The X-Ray sampling rate is set too low.

Question 14

A developer is writing a script to programmatically create an Amazon EC2 instance. The script will run on an EC2 instance that already has an IAM role attached. Which AWS SDK method should the developer use to securely obtain temporary credentials for the script?

Accepted Answer

Retrieve the temporary credentials from the instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).. Option C is correct because instance metadata provides temporary credentials from the attached IAM role. Options A and B are wrong because hardcoding keys is insecure. Option D is wrong because AWS Secrets Manager is for secrets, not automatic credential retrieval for EC2.

Answer

Store the access key ID and secret access key in the script.

Answer

Use AWS Secrets Manager to store and retrieve the credentials.

Answer

Use the AWS SDK's default credential provider chain.

Question 15

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon ElastiCache for session state. Recently, users are experiencing intermittent session timeouts and slow page loads. The developer suspects the issue is related to the ElastiCache cluster. Which THREE actions should the developer take to troubleshoot and resolve the issue? (Choose THREE.)

Accepted Answer

Monitor the ElastiCache cluster's CPU utilization and cache hit ratio in CloudWatch.. Options B, C, and D are correct. Option B helps identify slow queries and cache hits. Option C helps scale for increased load. Option D helps distribute traffic evenly. Option A is wrong because multi-AZ is for high availability, not performance. Option E is wrong because Encryption in transit addresses security, not performance.

Answer

Enable Encryption in transit for the ElastiCache cluster.

Answer

Enable Multi-AZ replication for the ElastiCache cluster.