DVA-C02 Practice Test 24 — 15 Questions

Question 1

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 instances and a maximum of 4. The deployment configuration is CodeDeployDefault.OneAtATime. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Auto Scaling group has only 2 instances, and one instance fails during deployment, leaving less than the required healthy instances.. The deployment configuration CodeDeployDefault.OneAtATime deploys to one instance at a time, and the deployment group has a minimum of 2 healthy instances. If one instance fails during deployment, only 1 healthy instance remains, which is below the minimum required threshold of 2. This causes CodeDeploy to stop the deployment and mark it as failed, as it cannot maintain the required number of healthy instances.

Answer

The deployment group's maximum instances is set to 4, which exceeds the number of instances in the Auto Scaling group.

Answer

The IAM role attached to the instances does not have sufficient permissions to download the revision from Amazon S3.

Answer

The revision is not properly zipped or the AppSpec file is missing.

Question 2

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?

Accepted Answer

Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.. CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.

Answer

Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.

Answer

Set up a VPC peering connection between the CodeBuild VPC and the database VPC.

Answer

Create a VPC endpoint for the database service and attach it to the CodeBuild project.

Question 3

A developer is deploying a containerized application to Amazon ECS with the Fargate launch type using AWS CodeDeploy for blue/green deployments. The application is behind an Application Load Balancer (ALB). What is the minimum number of ALB target groups required for a blue/green deployment?

Accepted Answer

2. In a blue/green deployment with Amazon ECS (Fargate) and AWS CodeDeploy, the deployment process requires two distinct target groups: one for the 'blue' (current) environment and one for the 'green' (new) environment. CodeDeploy shifts traffic from the blue target group to the green target group during the deployment, allowing for instant rollback by switching back. A single target group cannot differentiate between the two environments, and three or more are unnecessary because the blue/green model only needs two active target groups at any time.

Answer

1

Answer

3

Answer

4

Question 4

A company uses AWS Elastic Beanstalk to deploy a web application. The environment is currently running a previous version. The developer uploads a new application version and deploys it to the environment. After the deployment, the environment health status turns 'Severe' and the new version is not accessible. The developer needs to quickly revert to the previous working version. What should the developer do?

Accepted Answer

Use the Elastic Beanstalk console to deploy the previous application version.. Elastic Beanstalk allows you to deploy a previous application version directly from the console or CLI without creating a new environment. This action replaces the current application version in the existing environment, restoring the previously working code and resolving the health status. It is the fastest and most straightforward way to revert while preserving the environment's configuration and resources.

Answer

Create a new environment with the previous version and swap CNAMEs.

Answer

Roll back the environment configuration to a previous saved configuration.

Answer

Terminate the environment and launch a new one with the previous version.

Question 5

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to read configuration data from an Amazon S3 bucket. How should the developer securely provide the S3 bucket name to the container at runtime?

Accepted Answer

Define an environment variable in the ECS task definition with the bucket name.. Defining an environment variable in the ECS task definition is the simplest and most secure way to inject the S3 bucket name into the container at runtime. Environment variables are passed to the container when it starts, and they can be stored in the task definition itself or referenced from AWS Secrets Manager or Systems Manager Parameter Store for sensitive values. This approach avoids hardcoding and keeps the configuration decoupled from the application code.

Answer

Hardcode the bucket name in the application code.

Answer

Use AWS Systems Manager Parameter Store and retrieve the bucket name at startup.

Answer

Store the bucket name in the container image's environment file.

Question 6

A developer is using AWS Elastic Beanstalk to deploy a web application. The application needs to store session state. Which configuration is MOST cost-effective and scalable?

Accepted Answer

Use an ElastiCache Memcached cluster. ElastiCache Memcached is the most cost-effective and scalable solution for storing session state because it is an in-memory cache designed for low-latency access, which is ideal for session data that must be frequently read and written. It scales horizontally by adding nodes, and its distributed nature ensures that session data persists across EC2 instance replacements, unlike local storage. This avoids the higher cost and overhead of RDS or the latency and eventual consistency issues of S3 for session management.

Answer

Use S3 to store session state

Answer

Use an RDS database to store session state

Answer

Store session state in the local file system of each EC2 instance

Question 7

A developer is deploying an application using AWS CloudFormation. The stack includes an Amazon RDS DB instance. To ensure secure credential management, which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter for the password.. AWS Systems Manager Parameter Store with a SecureString parameter is correct because it allows you to securely store the RDS master password as an encrypted parameter and reference it in the CloudFormation template using the `resolve:ssm` or `resolve:ssm-secure` dynamic reference. This avoids hardcoding the password in the template or exposing it in plaintext, while still enabling automated deployment.

Answer

Hardcode the master password in the CloudFormation template.

Answer

Use IAM database authentication to manage credentials.

Answer

Leave the master password empty so that CloudFormation generates a random password.

Question 8

A developer is troubleshooting an AWS Lambda function that processes large CSV files (up to 1 GB) uploaded to an Amazon S3 bucket. The function uses Python and the pandas library to perform data transformations. Recently, the function started timing out on large files. CloudWatch Logs show that the function's execution time is close to the 15-minute Lambda timeout, and memory utilization peaks at around 80% of the configured 3,008 MB. The function has not been modified in months. Which action will most likely resolve the timeout issue without requiring code changes?

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files

Question 9

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function processes user uploads from Amazon S3 and stores metadata in DynamoDB. The function is experiencing high latency during peak hours. Which action would MOST improve the performance without increasing the function timeout?

Accepted Answer

Increase the DynamoDB table's provisioned read and write capacity.. Increasing the DynamoDB table's provisioned read and write capacity directly addresses the root cause of high latency during peak hours: throttling due to insufficient throughput. When the Lambda function's write requests exceed the table's capacity, DynamoDB throttles them, causing retries and increased latency. Raising the capacity allows DynamoDB to handle the burst of metadata writes without throttling, reducing response times without requiring a longer function timeout.

Answer

Increase the Lambda reserved concurrency.

Answer

Move the Lambda function into a VPC with a DynamoDB VPC endpoint.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Question 10

A development team is using AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with a 'HealthCheck' error. The application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). What is the MOST likely cause of this error?

Accepted Answer

The ALB target group health check is misconfigured or the application is not responding to health check requests.. The 'HealthCheck' error in AWS CodeDeploy indicates that the deployment failed because the target group health checks are not passing. This typically occurs when the ALB health check path or configuration does not match the application's expected response, or the application is not running correctly on the instances, causing the ALB to mark them as unhealthy. CodeDeploy monitors the ALB target group health status during deployment and will fail if instances do not become healthy within the configured timeout.

Answer

The EC2 instances do not have the correct IAM instance profile attached.

Answer

The deployment configuration is set to 'AllAtOnce' which does not support health checks.

Answer

The deployment group is not configured with the ALB target group.

Question 11

A company runs a microservices architecture on Amazon ECS with Fargate. Each service exposes an HTTP API and needs to be accessible only from the company's internal network via a VPN. The services are deployed in private subnets. What is the MOST secure and scalable way to expose these services?

Accepted Answer

Create a VPC Endpoint service powered by PrivateLink and a Network Load Balancer in front of the services.. AWS PrivateLink with a VPC Endpoint service and a Network Load Balancer (NLB) allows you to expose services running in private subnets to other VPCs or on-premises networks via VPN without traversing the public internet. The NLB handles TCP traffic at Layer 4, and the VPC Endpoint service provides secure, scalable connectivity by creating elastic network interfaces in the consumer VPC, ensuring traffic stays within the AWS network. This approach is both secure (no public exposure) and scalable (NLB handles high throughput and availability).

Answer

Place an Application Load Balancer in public subnets and point to the services' target groups.

Answer

Use a NAT Gateway to allow inbound traffic from the VPN to the services.

Answer

Use an Internet Gateway and route traffic from the VPN to the services.

Question 12

A developer notices that an AWS Lambda function, which uses Amazon RDS Proxy to connect to an Aurora MySQL database, is experiencing increased latency and occasional connection timeouts. The function is configured with a reserved concurrency of 100 and is deployed in a VPC. The RDS Proxy's maximum connections is set to 1000. CloudWatch metrics show that the DatabaseConnections metric for the proxy is consistently at 1000. What is the most likely cause of the increased latency and timeouts?

Accepted Answer

The Lambda function is not reusing database connections properly, exhausting the proxy connection pool. The RDS Proxy's DatabaseConnections metric is consistently at 1000, which equals the proxy's maximum connections setting. This indicates the proxy connection pool is fully saturated. When all connections are in use, new connection requests from Lambda invocations must wait, causing increased latency, and if the wait exceeds the timeout, connection timeouts occur. The most likely cause is that the Lambda function is not reusing database connections (e.g., not using connection pooling or keeping connections open across invocations), exhausting the pool.

Answer

The RDS Proxy target group is not configured with the correct DB instance

Answer

The Lambda function's execution role is missing the rds-db:connect permission

Answer

The VPC does not have a NAT Gateway for outbound traffic

Question 13

A developer is troubleshooting an Amazon API Gateway REST API that returns 504 Gateway Timeout errors for certain requests. The backend is a Lambda function that performs a resource-intensive operation that occasionally takes up to 30 seconds. API Gateway has a default integration timeout of 29 seconds. The developer cannot reduce the execution time. What should the developer do to resolve the timeout issue?

Accepted Answer

Refactor the Lambda function to use asynchronous invocation, return a 202 immediately, and have the client poll for results.. It decouples the client from the long-running Lambda execution. By invoking the Lambda asynchronously, the API Gateway can return a 202 Accepted response immediately, well within the 29-second integration timeout. The client then polls a separate endpoint (e.g., using a presigned S3 URL or a DynamoDB status record) to retrieve the final result, completely sidestepping the timeout limitation.

Answer

Increase the API Gateway integration timeout to 30 seconds.

Answer

Enable API Gateway caching to avoid repeated calls.

Answer

Use multiple Lambda functions to parallelize processing.

Question 14

A developer uses AWS CodePipeline to deploy a serverless application defined with AWS SAM. The pipeline consists of Source (S3), Build (CodeBuild), and Deploy (CloudFormation) stages. The developer wants to run integration tests after the stack is deployed but before the pipeline completes. Which approach should the developer use?

Accepted Answer

Add a test stage after the Deploy stage with an action that invokes a Lambda function to run tests.. AWS CodePipeline allows you to add a test stage after the Deploy stage, and you can configure an action that invokes an AWS Lambda function to run integration tests. This ensures tests run automatically after the CloudFormation stack is deployed but before the pipeline completes, meeting the requirement without manual intervention.

Answer

Use the CloudFormation stack's Outputs to trigger a Lambda function that runs tests.

Answer

Configure a post-deployment hook in the SAM template that runs tests.

Answer

Add a manual approval step after Deploy, then run tests manually.

Question 15

A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.. AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.

Answer

Create an IAM user and store the access keys in the Lambda environment variables.

Answer

Attach a resource-based policy to the Lambda function that grants DynamoDB access.

Answer

Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.