DVA-C02 Practice Test 2 — 25 Questions

Question 1

A developer is creating a CloudFormation template to deploy a microservices architecture. The template includes an Amazon ECS service with an Application Load Balancer. The developer wants to ensure that the load balancer is created before the ECS service. How should the developer achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the DependsOn attribute in the ECS service resource to reference the load balancer.. The DependsOn attribute explicitly defines resource creation order in AWS CloudFormation. By setting DependsOn on the ECS service to reference the load balancer, the template ensures the load balancer is fully created before the ECS service attempts to register with it, preventing deployment failures due to missing dependencies.

Answer

Use the Ref function in the ECS service to reference the load balancer.

Answer

Define the load balancer before the ECS service in the template.

Answer

Use the Fn::GetAtt function to reference the load balancer.

Question 2

A developer needs to store session state for a stateless web application running on EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to ensure session data is not lost if an instance fails?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database that provides fast and predictable performance with seamless scalability. It is highly recommended for storing session state in stateless applications because it is serverless, highly durable, and requires no cluster management, unlike ElastiCache. AWS SDKs even offer native session state providers for DynamoDB.

Answer

Amazon S3

Answer

Amazon ElastiCache

Answer

Amazon RDS

Question 3

A developer created a CloudFormation template to host a static website. After deployment, the website returns 403 Forbidden errors. What is the most likely cause?

Accepted Answer

The bucket policy does not allow public access.. An 'Access Denied' (403 Forbidden) error on an Amazon S3 static website endpoint indicates that the requester does not have permission to access the resource. By default, all new S3 buckets and objects are private. To allow public access to the website's assets, you must add a bucket policy that grants public read permissions (`s3:GetObject`) to anonymous users, and ensure that S3 Block Public Access settings are disabled. If static website hosting were not enabled, the website endpoint would not return a 403 Forbidden error; it would not resolve or would return a 404 error. Therefore, the missing bucket policy is the most likely cause.

Answer

The bucket has versioning enabled, which blocks public access.

Answer

The bucket name is not unique.

Answer

The bucket does not have static website hosting enabled.

Question 4

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Remove the Lambda function from the VPC.. When a Lambda function is configured to run inside a VPC, it loses its default internet access. If the function needs to call an external API, the connection will hang and eventually time out. Increasing the timeout (Option A) will not resolve this, as the network path is blocked. To resolve this, the developer should either configure a NAT Gateway in the VPC or, if VPC resources are not required, remove the Lambda function from the VPC (Option C) to restore default internet access.

Answer

Increase the Lambda function timeout to 10 seconds.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the Lambda function memory to 1024 MB.

Question 5

A developer is building a real-time chat application using Amazon API Gateway WebSockets and AWS Lambda. The developer notices that messages are sometimes delivered out of order. What should the developer do to ensure ordered message delivery?

Accepted Answer

Use an Amazon SQS FIFO queue to buffer messages before processing. WebSocket connections run over TCP, which guarantees in-order delivery of frames from the client to Amazon API Gateway. However, when API Gateway routes these messages to AWS Lambda, Lambda executes concurrently. This concurrent execution can lead to messages being processed, written to a database, or broadcasted to other clients out of order. To guarantee ordered processing, messages can be buffered using an Amazon SQS FIFO (First-In-First-Out) queue before being processed by Lambda, ensuring they are handled in the exact order they were received.

Answer

Increase the Lambda function's memory allocation

Answer

Use API Gateway's built-in message ordering feature

Answer

Set the 'sequenceNumber' property in the WebSocket message

Question 6

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

Accepted Answer

The bucket policy denies the upload. The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer

The user needs s3:PutObjectAcl permission

Answer

The policy does not allow s3:ListBucket

Answer

The user does not have s3:GetObject permission

Question 7

A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?

Accepted Answer

Request validation using models and request validators. API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.

Answer

Usage plans with API keys

Answer

WAF (AWS WAF) integration

Answer

Custom authorizer (Lambda authorizer)

Question 8

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 9

A developer notices that an AWS Lambda function is timing out after 15 seconds. The function makes HTTP requests to an external API. How can the developer resolve this issue without changing the function code?

Accepted Answer

Increase the timeout setting of the Lambda function. The Lambda function is timing out because its configured execution timeout (15 seconds) is too short for the HTTP requests to the external API to complete. Increasing the timeout setting (up to the maximum limit of 15 minutes) allows the function to run longer and wait for the API response, resolving the timeout without modifying the code. This is a configuration change in the Lambda function settings, not a code change.

Answer

Increase the reserved concurrency

Answer

Place the Lambda function in a VPC

Answer

Decrease the memory allocation of the Lambda function

Question 10

A developer is building a serverless application that processes images uploaded to an S3 bucket. The bucket triggers a Lambda function that creates a thumbnail and stores it in another S3 bucket. The developer notices that the Lambda function is invoked multiple times for the same object, causing duplicate thumbnails. What is the MOST likely cause?

Accepted Answer

S3 event notifications are eventually consistent and may deliver duplicates.. Amazon S3 event notifications are designed to provide at-least-once delivery. This means that while most events are delivered exactly once, duplicate event notifications can occasionally occur. To handle this, the Lambda function should be designed to be idempotent, ensuring that processing the same event multiple times does not cause unintended side effects (like duplicate thumbnails).

Answer

The Lambda function is configured with a DLQ that causes retries.

Answer

The Lambda function is idempotent and should handle duplicates.

Answer

The S3 bucket has multiple event notifications that trigger the same Lambda function.

Question 11

A developer invokes an AWS Lambda function and receives a timeout error. The function is configured with a 3-second timeout. The developer needs to process data that sometimes takes up to 10 seconds. What should the developer do?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error indicates the Lambda function is timing out because its configured timeout of 3 seconds is insufficient for processing that sometimes takes up to 10 seconds. Option B directly addresses this by increasing the timeout to 10 seconds, which is within the maximum Lambda timeout of 15 minutes (900 seconds). This ensures the function can complete its execution without being prematurely terminated.

Answer

Change the invocation type to Event (async).

Answer

Increase the memory allocation for the Lambda function.

Answer

Set reserved concurrency to 1.

Question 12

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

Accepted Answer

Noncurrent versions of objects are deleted 30 days after they become noncurrent.. The CloudFormation template defines an S3 Lifecycle rule with `NoncurrentVersionExpiration` set to 30 `NoncurrentDays`. This rule specifically targets noncurrent versions of objects, meaning that after an object version becomes noncurrent (e.g., due to a PUT or DELETE of the current version), that noncurrent version will be permanently deleted 30 days later. The `Status: Enabled` ensures the rule is active, and versioning is enabled via the `VersioningConfiguration` property.

Answer

The bucket will have versioning disabled because the rule conflicts.

Answer

Current versions are transitioned to another storage class after 30 days.

Answer

Objects are automatically deleted after 30 days.

Question 13

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. S3 can directly invoke a Lambda function via S3 event notifications. When a new object is created in the bucket, S3 publishes a notification with the event type `s3:ObjectCreated:*` and the Lambda function is triggered asynchronously. This is the simplest and most direct integration for this use case, requiring no intermediate services.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 14

A developer is deploying an application using AWS CloudFormation. The template includes an AWS::Lambda::Function resource. The developer wants to ensure that the Lambda function's code is automatically updated when the source code in S3 changes. Which approach should the developer use?

Accepted Answer

Specify the S3 object version in the template and update the version number in the template when code changes.. AWS CloudFormation detects changes to the `AWS::Lambda::Function` resource's `Code` property only when the properties defined in the template (such as `S3Key` or `S3ObjectVersion`) change. If you upload a new deployment package to S3 using the same bucket and key, CloudFormation will not detect any change and will not update the Lambda function. To resolve this, you should enable S3 Versioning on the bucket, specify the `S3ObjectVersion` in the CloudFormation template, and update this version parameter in the template whenever the code is updated.

Answer

Use the AWS::Lambda::Version resource to create a new version.

Answer

Include the S3 bucket and key as template parameters and update the stack with a new key when code changes.

Answer

Use a custom resource backed by a Lambda function that polls S3 for changes.

Question 15

A company runs an application on Amazon EC2 instances that need to read data from an Amazon DynamoDB table. The developer must grant access to DynamoDB without storing any long-term credentials on the instance. Which approach should the developer use?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the AWS access key and secret key in a configuration file.

Answer

Use an IAM user and store credentials in AWS Secrets Manager.

Answer

Use the DynamoDB table's resource-based policy to allow the EC2 instance.

Question 16

A developer is writing a Lambda function that needs to access an Amazon RDS MySQL database. The function will be invoked frequently. What is the BEST practice for managing the database connection?

Accepted Answer

Use Amazon RDS Proxy to manage the connection pool.. For Lambda functions accessing relational databases like Amazon RDS, the best practice is to use Amazon RDS Proxy. Because Lambda functions can scale rapidly to hundreds or thousands of concurrent executions, they can quickly exhaust the database's connection pool. RDS Proxy pools and shares these connections, improving scalability and application resilience. While opening connections outside the handler (Option C) is a good general practice, it does not solve the connection exhaustion problem under high concurrency and frequent invocations.

Answer

Close the database connection at the end of each invocation.

Answer

Open a new database connection inside the handler for each invocation.

Answer

Open the database connection outside the handler function and reuse it.

Question 17

An organization has a Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has a visibility timeout of 30 seconds. The Lambda function takes an average of 45 seconds to process each message. What is the likely behavior of this setup?

Accepted Answer

Messages will be processed multiple times because they become visible again before the function completes.. The Lambda function takes 45 seconds to process a message, but the SQS queue's visibility timeout is only 30 seconds. Because the processing time exceeds the visibility timeout, the message will become visible again in the queue after 30 seconds and can be received by another Lambda invocation before the first one finishes. This leads to duplicate processing. To prevent this, the SQS visibility timeout should be configured to be at least 6 times the Lambda function's timeout.

Answer

The Lambda function will be throttled due to reserved concurrency.

Answer

The Lambda function will process messages successfully with no issues.

Answer

The Lambda function will automatically increase its processing speed.

Question 18

Refer to the exhibit. A developer attached the IAM policy to a Lambda function's execution role. The function reads items from a DynamoDB table that uses AWS KMS customer managed key (CMK) for encryption at rest. When the function tries to read an item, it receives an access denied error. What is the cause?

Accepted Answer

The policy allows kms:Decrypt on all resources but the CMK key policy may not grant access.. The IAM policy grants kms:Decrypt on all resources, but DynamoDB uses AWS KMS customer managed keys (CMKs) for encryption at rest. Even if the IAM policy allows the action, the CMK's key policy must also grant the Lambda execution role access to use the key. If the key policy does not include a statement allowing the Lambda role to perform kms:Decrypt, the request fails with an access denied error, regardless of the IAM policy.

Answer

The DynamoDB table is not encrypted with a KMS key.

Answer

The policy does not allow dynamodb:GetItem on the table.

Answer

The DynamoDB table does not exist.

Question 19

A developer is designing a system where an S3 bucket receives uploads, and each upload triggers a Lambda function to process the file. The processed output is stored in another S3 bucket. The developer notices that sometimes the same file is processed multiple times. How can this be prevented?

Accepted Answer

Make the Lambda function idempotent by checking if the object has already been processed using a DynamoDB table.. Making the Lambda function idempotent using a DynamoDB table ensures that even if the same S3 event is delivered multiple times (due to at-least-once delivery semantics) or if the same file is uploaded again, the function checks a unique identifier (such as the object key or hash) in DynamoDB before processing. If it has already been processed, the function can safely skip it. This is the standard architectural pattern for ensuring idempotency in serverless pipelines.

Answer

Use an SQS FIFO queue as the event destination and enable content-based deduplication.

Answer

Enable S3 bucket replication to another bucket and trigger Lambda from the replica.

Answer

Enable S3 bucket versioning and use 's3:ObjectCreated:Put' events.

Question 20

A developer runs the AWS CLI command shown. The Lambda function returns a 200 status code but the output file is null and the response includes FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an unhandled exception.. The presence of `FunctionError: Unhandled` in the response of an `aws lambda invoke` command indicates that the Lambda function encountered an error (such as an unhandled exception or runtime crash) that was not caught by the function's code. Even though the function failed, the Invoke API itself successfully completed the transaction of invoking the function, which is why it returns an HTTP status code of 200.

Answer

The Lambda function timed out.

Answer

The payload was too large for synchronous invocation.

Answer

The Lambda function was not found.