DVA-C02 Practice Test 24 — 15 Questions

Question 1

A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Examine the ALB access logs for 503 responses.. The correct first step is to examine the ALB access logs for 503 responses. Since health checks are succeeding, the EC2 instances are considered healthy by the target group, but the ALB itself may be returning 503 errors due to issues like request rate limits, connection limits, or backend response timeouts. Access logs provide detailed HTTP response codes and timestamps, allowing you to identify the pattern and cause of the 503 errors without making assumptions about instance count or state.

Answer

Increase the number of EC2 instances in the target group.

Answer

Check the Route 53 record for the ALB.

Answer

Verify that the EC2 instances are in a running state.

Question 2

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function sometimes fails due to transient errors. The developer wants to ensure that failed messages are retried automatically and then sent to a dead-letter queue after three failed attempts. How should the developer configure this?

Accepted Answer

Configure the SQS queue with a redrive policy and a dead-letter queue. Set the maxReceiveCount to 3.. Amazon SQS supports a redrive policy that automatically moves messages to a dead-letter queue (DLQ) after a specified number of receive attempts. By setting maxReceiveCount to 3, the SQS queue will retry delivering the message to the Lambda function up to three times (including the initial attempt). After three failed processing attempts, the message is automatically sent to the configured DLQ. This approach decouples retry logic from the Lambda function itself and leverages SQS's built-in reliability features.

Answer

Enable Lambda function's DLQ and set the retry attempts to 3.

Answer

Configure the Lambda function's reserved concurrency to 0 and set the DLQ on the function.

Answer

Use an Amazon SNS topic to send failed messages to a DLQ after three Lambda invocations.

Question 3

A SAM application should gradually shift Lambda traffic and roll back on errors. Which two pieces are needed?

Accepted Answer

A Lambda alias/deployment preference. AWS SAM uses Lambda aliases with deployment preferences (e.g., Canary10Percent5Minutes or Linear10PercentEvery10Minutes) to gradually shift traffic from the old version to the new version. Option C is correct because CloudWatch alarms can be tied to the deployment preferences to automatically roll back the traffic shift if the alarm enters the ALARM state, indicating errors or degraded health.

Answer

An S3 lifecycle rule

Answer

A public S3 bucket

Question 4

A developer is using AWS AppSync to build a GraphQL API. The API needs to allow clients to receive real-time updates when data changes in a DynamoDB table. Which AppSync feature should the developer use?

Accepted Answer

Subscriptions. Subscriptions in AWS AppSync are the feature designed for real-time updates. They use WebSocket connections to push data to clients automatically when a mutation modifies the underlying data source, such as a DynamoDB table. By configuring a subscription on a specific mutation, the developer enables clients to receive live changes without polling.

Answer

Resolvers

Answer

Queries

Answer

Mutations

Question 5

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

Accepted Answer

The HMAC or digital signature over the payload using the shared/public key material. Webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Answer

The source port number

Answer

The CloudWatch log stream name

Answer

The API Gateway request ID only

Question 6

A developer is monitoring an AWS Lambda function that is triggered by an Amazon SQS queue. The function's CloudWatch metrics show a high number of throttles. The function has a reserved concurrency of 10 and the SQS queue has a large backlog of messages. The function processes each message in about 2 seconds and has a timeout of 60 seconds. Which action will most effectively reduce the throttles and increase throughput?

Accepted Answer

Increase the reserved concurrency of the Lambda function to 50. The high throttles indicate that the Lambda function's reserved concurrency of 10 is insufficient to handle the incoming messages from the SQS queue. By increasing reserved concurrency to 50, you allow more concurrent executions, which reduces throttling and increases throughput. The function's 2-second processing time and 60-second timeout are not the bottleneck; the concurrency limit is.

Answer

Increase the batch size in the SQS event source mapping to 100

Answer

Increase the function timeout to 120 seconds

Answer

Decrease the reserved concurrency to 5

Question 7

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group of Amazon EC2 instances. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer needs to identify the root cause. Which AWS service should the developer use to view detailed error logs from the failed deployment?

Accepted Answer

Amazon CloudWatch Logs (if configured) or the CodeDeploy agent log files on the EC2 instances. When a CodeDeploy deployment fails due to instance-level errors, the most direct way to investigate is to examine the CodeDeploy agent logs located on each EC2 instance at `/opt/codedeploy-agent/deployment-root/deployment-logs/codedeploy-agent.log`. If Amazon CloudWatch Logs has been configured to stream these logs, you can also view them centrally in the CloudWatch console. These logs contain detailed error messages from the `codedeploy-agent` process, including script failures, permission issues, or missing dependencies that caused the deployment to fail.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS CodeDeploy console

Question 8

A team is using AWS CodePipeline with multiple stages: Source, Build, Test, and Deploy. The Deploy stage uses AWS CodeDeploy to deploy to an EC2 Auto Scaling group. The pipeline runs successfully, but the application still serves the old version. What is the most likely cause?

Accepted Answer

The CodeDeploy deployment group is associated with a different Auto Scaling group than the one serving traffic.. The most likely cause is that the CodeDeploy deployment group is associated with a different Auto Scaling group than the one actually serving traffic. Even though the pipeline runs successfully, CodeDeploy deploys the new application revision only to instances in the Auto Scaling group linked to its deployment group. If the deployment group targets a different Auto Scaling group (e.g., a staging group) while the live traffic is served by another group (e.g., production), the old version remains on the production instances.

Answer

The load balancer's target group is not pointing to the correct instances.

Answer

The build artifact in the Source stage is corrupted.

Answer

The CodeBuild stage failed silently and did not produce a new artifact.

Question 9

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage that pulls from CodeCommit and a deploy stage that uses AWS Elastic Beanstalk. The developer wants to run unit tests automatically before deploying to Elastic Beanstalk. Which action should the developer add to the pipeline?

Accepted Answer

Add a test stage that uses an AWS CodeBuild project configured to run unit tests. AWS CodeBuild can be integrated as a test stage in CodePipeline to run unit tests automatically. By adding a CodeBuild project configured with a buildspec.yml file that executes unit tests, the pipeline will run tests after the source stage and before the deploy stage, ensuring only code that passes tests is deployed to Elastic Beanstalk.

Answer

Add a manual approval step before the deploy stage

Answer

Configure Elastic Beanstalk health checks to run tests

Answer

Replace Elastic Beanstalk with AWS CodeDeploy

Question 10

A Step Functions workflow calls three independent Lambda functions and should continue only after all results are available. Which state pattern should be used?

Accepted Answer

Parallel state. The Parallel state in AWS Step Functions is designed to execute multiple branches of work concurrently and then aggregate their outputs into a single array. This is exactly what is needed when three independent Lambda functions must all complete before the workflow continues, as the Parallel state waits for all branches to finish before proceeding to the next state.

Answer

Choice state

Answer

Wait state

Answer

Fail state

Question 11

A developer is using AWS CodeBuild to build a Java application. The build fails with the error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE'. What is the most likely cause?

Accepted Answer

The Docker image specified in the build environment does not exist or the repository is not accessible.. The error 'BUILD_CONTAINER_UNABLE_TO_PULL_IMAGE' in AWS CodeBuild indicates that the service cannot pull the specified Docker image from the repository. This occurs when the image name/tag is incorrect, the image does not exist in the specified registry (e.g., Amazon ECR or Docker Hub), or the CodeBuild service role lacks the necessary permissions (e.g., ecr:GetDownloadUrlForLayer, ecr:BatchGetImage) to access the repository. Option B correctly identifies this as the most likely cause.

Answer

The build environment does not have enough memory.

Answer

The build command has a syntax error.

Answer

The buildspec.yml file does not define artifacts.

Question 12

Drag and drop the steps to set up a custom domain for an API Gateway API in the correct order.

Accepted Answer

1. Register or have a domain, 2. Request or import a certificate in ACM, 3. Create a custom domain name in API Gateway, 4. Create an API mapping to a stage, 5. Update DNS records to point to the API Gateway domain name. First have a domain, get a certificate, create custom domain in API Gateway, map to stage, and update DNS.

Answer

1. Create a custom domain name in API Gateway, 2. Register or have a domain, 3. Request or import a certificate in ACM, 4. Create an API mapping to a stage, 5. Update DNS records

Answer

1. Update DNS records, 2. Register or have a domain, 3. Request or import a certificate in ACM, 4. Create a custom domain name in API Gateway, 5. Create an API mapping to a stage

Answer

1. Register or have a domain, 2. Create a custom domain name in API Gateway, 3. Request or import a certificate in ACM, 4. Create an API mapping to a stage, 5. Update DNS records

Question 13

A developer is using Amazon DynamoDB with provisioned throughput. The application is receiving ProvisionedThroughputExceededException errors. What is the BEST way to handle this error?

Accepted Answer

Implement exponential backoff and retry in the application code.. The ProvisionedThroughputExceededException indicates that the application has exceeded the provisioned read/write capacity units for the DynamoDB table. The best practice to handle this error is to implement exponential backoff and retry logic in the application code, which progressively increases the wait time between retries to reduce request volume and allow the throttling to subside. This approach is recommended by AWS for handling throttling errors gracefully without manual intervention.

Answer

Contact AWS Support to increase the DynamoDB service limits.

Answer

Reduce the read and write capacity units.

Answer

Switch the table to on-demand capacity mode.

Question 14

Which AWS service provides a managed, rotating secret store for database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to manage the entire lifecycle of secrets, including automatic rotation of database credentials on a configurable schedule (e.g., every 30 days). It natively integrates with Amazon RDS, Aurora, Redshift, and DocumentDB to rotate credentials without application downtime, using a built-in Lambda rotation function. This makes it the only fully managed, rotating secret store among the options.

Answer

AWS KMS

Answer

AWS IAM Roles

Answer

AWS Systems Manager Parameter Store

Question 15

A company runs a containerized application on Amazon ECS with Fargate. The application writes logs to stdout. The operations team wants to send these logs to a centralized log management tool that requires logs in JSON format. What is the BEST way to achieve this without modifying application code?

Accepted Answer

Use the FireLens log driver to route logs to Fluent Bit and then to the tool. FireLens is an ECS log driver that integrates with Fluent Bit or Fluentd to route, filter, and transform container logs without modifying application code. By using FireLens with Fluent Bit, you can configure a JSON parser to convert stdout logs into JSON format before forwarding them to the centralized log management tool, meeting the requirement exactly.

Answer

Use the awslogs log driver and configure a JSON output format

Answer

Install the CloudWatch Logs agent on the container

Answer

Modify the application to output logs in JSON format