DVA-C02 Practice Test 2 — 25 Questions

Question 1

A developer is troubleshooting an AWS Lambda function that processes large CSV files (up to 1 GB) uploaded to an Amazon S3 bucket. The function uses Python and the pandas library to perform data transformations. Recently, the function started timing out on large files. CloudWatch Logs show that the function's execution time is close to the 15-minute Lambda timeout, and memory utilization peaks at around 80% of the configured 3,008 MB. The function has not been modified in months. Which action will most likely resolve the timeout issue without requiring code changes?

Accepted Answer

Increase the memory allocation of the Lambda function to the maximum available (10,240 MB). Increasing the memory allocation to the maximum (10,240 MB) proportionally increases the CPU and network throughput allocated to the Lambda function, which directly reduces execution time for CPU-bound pandas operations. Since memory utilization is only at 80% of the current 3,008 MB, the bottleneck is likely CPU, not memory, and Lambda's CPU scales linearly with memory configuration. This action resolves the timeout without any code changes.

Answer

Increase the function timeout to the maximum allowed (900 seconds is already the max)

Answer

Use S3 Select to filter columns and rows before invoking the Lambda function

Answer

Increase the batch size of the S3 event notification to invoke the function with multiple files

Question 2

A developer optimized an Amazon S3 bucket for high request rates. The bucket receives over 5,000 PUT requests per second. Recently, some requests are failing with a 503 Slow Down error. What is the most likely cause and how should the developer fix it?

Accepted Answer

Add a random prefix to the object keys to distribute across partitions.. Option D is correct because S3 returns 503 when request rates exceed partition limits. Prefix randomization spreads requests across partitions. Option A is wrong because 503 is not due to permissions. Option B is wrong because 503 is not a quota limit exceeded error (that would be 400). Option C is wrong because multipart upload is for large objects, not rate limits.

Answer

Use multipart upload for all objects to improve throughput.

Answer

The request rate exceeds the account-level PUT quota; request a quota increase.

Answer

The bucket policy is too permissive; restrict access to prevent abuse.

Question 3

A company is deploying a containerized application on Amazon EKS. The developer wants to automate the deployment process using a CI/CD pipeline that builds a Docker image, pushes it to Amazon ECR, and updates the Kubernetes deployment. Which tool should the developer use to update the Kubernetes deployment?

Accepted Answer

kubectl set image command. The `kubectl set image` command is the standard Kubernetes-native method to update the image of an existing deployment. It directly modifies the deployment's pod template to reference the new Docker image tag, triggering a rolling update. This is the simplest and most direct approach for updating a deployment in a CI/CD pipeline without additional infrastructure.

Answer

AWS Systems Manager Automation

Answer

AWS CloudFormation with a custom resource

Answer

AWS CodeBuild with a buildspec that runs kubectl commands

Question 4

A developer is deploying a new version of a Lambda function using the AWS CLI. The function is part of a serverless application that processes S3 events. The developer wants to ensure that the new version is production-ready and that the old version is still available for rollback. Which CLI command should the developer use to create a new version of the Lambda function?

Accepted Answer

aws lambda publish-version --function-name my-function. Option A is correct because the `aws lambda publish-version` command creates an immutable, versioned snapshot of the Lambda function's code and configuration, which is required for production-ready deployments. This ensures the old version remains available for rollback while the new version is published with a unique version number (e.g., $LATEST, 1, 2). The command explicitly publishes the current $LATEST version as a new numbered version, making it production-ready without affecting existing versions.

Answer

aws lambda update-function-configuration --function-name my-function --handler new-handler

Answer

aws lambda update-function-code --function-name my-function --zip-file fileb://my-code.zip

Answer

aws lambda create-function --function-name my-function --zip-file fileb://my-code.zip

Question 5

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer notices that the deploy stage fails intermittently due to EC2 instances not being available. Which TWO actions should the developer take to improve the reliability of the deployment? (Choose two.)

Accepted Answer

Configure the CodeDeploy deployment group to have a minimum healthy hosts threshold.. Option B is correct because configuring a minimum healthy hosts threshold in the CodeDeploy deployment group ensures that a certain percentage or number of EC2 instances remain healthy during the deployment. This prevents the deployment from proceeding if too many instances are unavailable, reducing the risk of failure due to insufficient capacity. Option E is correct because adding a manual approval step before the deploy stage allows the developer to verify instance health (e.g., via AWS Systems Manager or custom scripts) before triggering the deployment, catching availability issues early.

Answer

Increase the number of EC2 instances in the Auto Scaling group to ensure availability.

Answer

Reduce the deployment timeout to fail faster.

Answer

Use a different deployment type, such as blue/green, instead of in-place.

Question 6

A developer is deploying a microservices architecture on Amazon ECS. The services need to communicate with each other securely. The developer wants to use service discovery and ensure that traffic between services is encrypted. Which combination of services should the developer use?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with mutual TLS. AWS Cloud Map provides service discovery by registering ECS service instances with DNS-based or API-based resolution, enabling dynamic routing between microservices. AWS App Mesh with mutual TLS (mTLS) encrypts traffic between services and enforces identity-based authentication, ensuring end-to-end encryption and secure communication. This combination directly addresses the requirements for service discovery and encrypted traffic.

Answer

Use Amazon API Gateway and AWS Lambda

Answer

Use Amazon Route 53 private hosted zones and enable DNSSEC

Answer

Use an Application Load Balancer for each service and enable TLS termination

Question 7

A web application running on EC2 instances behind an Application Load Balancer (ALB) is experiencing intermittent 503 errors. The ALB target group health checks are succeeding. Which step should the developer take FIRST to diagnose the issue?

Accepted Answer

Examine the ALB access logs for 503 responses.. The correct first step is to examine the ALB access logs for 503 responses. Since health checks are succeeding, the EC2 instances are considered healthy by the target group, but the ALB itself may be returning 503 errors due to issues like request rate limits, connection limits, or backend response timeouts. Access logs provide detailed HTTP response codes and timestamps, allowing you to identify the pattern and cause of the 503 errors without making assumptions about instance count or state.

Answer

Increase the number of EC2 instances in the target group.

Answer

Check the Route 53 record for the ALB.

Answer

Verify that the EC2 instances are in a running state.

Question 8

A development team wants to automatically deploy a web application to Amazon EC2 instances when new code is pushed to the master branch of an AWS CodeCommit repository. Which AWS service should the team use to orchestrate the build, test, and deployment phases?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire build, test, and deployment phases as a pipeline. It can be configured to automatically trigger on code pushes to the master branch of an AWS CodeCommit repository, then invoke AWS CodeBuild for building and testing, and finally deploy to EC2 instances via AWS CodeDeploy, providing end-to-end automation.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 9

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The developer wants to create a new version and update the alias to point to the new version. Which sequence of CLI commands should the developer use?

Accepted Answer

Update function code, publish version, update alias. Option D is correct because the correct sequence is to first update the function code, then publish a new version, and finally update the alias to point to that new version. The `update-function-code` command uploads the new code to the $LATEST version, `publish-version` creates an immutable numbered version from $LATEST, and `update-alias` updates the alias to reference that specific version. This ensures the alias always points to a stable, published version rather than the mutable $LATEST.

Answer

Update alias, update function code, publish version

Answer

Create alias, update function code, publish version

Answer

Publish version, update function code, update alias

Question 10

A developer is designing a CI/CD pipeline for a serverless application using AWS CodePipeline. The pipeline must automatically build and deploy the application when changes are pushed to a CodeCommit repository. The application uses AWS CloudFormation for infrastructure provisioning. Which TWO actions should the developer include in the pipeline?

Accepted Answer

Use AWS CodeBuild to run unit tests and package the application.. Option C is correct because AWS CodeBuild can compile source code, run unit tests, and produce deployment artifacts, which is a standard build phase in a CI/CD pipeline. Option E is correct because AWS CloudFormation is the native AWS service for provisioning and updating infrastructure as code, making it the appropriate deployment action for a serverless application defined in templates.

Answer

Use AWS CodeDeploy to deploy the application to EC2 instances.

Answer

Use AWS CodeCommit as a deployment action.

Answer

Use AWS Lambda to run integration tests.

Question 11

Refer to the exhibit. A developer creates this CloudFormation template and tries to deploy it. The deployment fails with 'CREATE_FAILED' for the S3 bucket resource. What is the most likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. Option C is correct because S3 bucket names must be globally unique across all AWS accounts. If the bucket name specified in the template is already in use by another account, CloudFormation will fail with CREATE_FAILED for the S3 bucket resource. This is a fundamental requirement of the S3 service, not a template syntax or configuration issue.

Answer

The template does not enable versioning on the bucket.

Answer

The bucket name must be in all lowercase letters.

Answer

The template does not specify a bucket policy.

Question 12

A company wants to deploy a serverless application using AWS Lambda and API Gateway. The deployment process must support automatic rollbacks if the new version fails CloudWatch alarms. Which AWS service should be used to orchestrate this deployment?

Accepted Answer

AWS CodeDeploy. AWS CodeDeploy is the correct choice because it natively supports deployment strategies like canary, linear, and all-at-once, and can be configured with CloudWatch alarms to automatically trigger rollbacks when a new version fails. This makes it ideal for serverless applications using Lambda and API Gateway, where you need safe, automated deployments with health-check-driven rollback capabilities.

Answer

AWS Elastic Beanstalk

Answer

AWS CloudFormation with a change set

Answer

AWS CodePipeline

Question 13

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?

Accepted Answer

Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.. Option C is correct because it automates the creation of a CloudFront invalidation as part of the CodePipeline post-deploy stage. This ensures that after new files are uploaded to S3, CloudFront's edge caches are purged of the old content, forcing it to fetch the updated files from the origin. This is the most efficient solution as it requires no manual intervention and does not compromise caching performance.

Answer

Manually create a CloudFront invalidation after each deployment.

Answer

Reduce the CloudFront distribution's default TTL to 0.

Answer

Update the S3 bucket policy to allow public read access.

Question 14

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer runs 'sam deploy' and receives an error: 'Error: Failed to create changeset for the stack.' What is a common cause of this error?

Accepted Answer

The SAM template contains a syntax error.. The 'Failed to create changeset for the stack' error typically occurs when the SAM template contains a syntax error, such as invalid YAML formatting, missing required properties, or incorrect resource definitions. AWS CloudFormation validates the template before creating a changeset, and any syntax issue will cause the changeset creation to fail immediately. This is the most common cause because SAM templates are YAML-based and prone to indentation or structural mistakes.

Answer

The S3 bucket specified for artifacts does not exist.

Answer

The IAM user does not have permission to create CloudFormation stacks.

Answer

AWS CodeDeploy is not configured for the application.

Question 15

A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the encryption condition is not met.. Option A is correct because an S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.

Answer

Configure default encryption on the bucket with SSE-KMS.

Answer

Enable S3 Object Lock.

Answer

Use a CloudTrail trail to monitor uploads.

Question 16

A developer deployed a new version of an AWS Lambda function that is part of a serverless application. The function uses an Amazon DynamoDB table as a data store. After deployment, the developer notices that the function's latency has increased significantly for some requests. CloudWatch traces show that the increase is due to DynamoDB throttle events. The function is configured with a reserved concurrency of 100 and the DynamoDB table has 5 read capacity units (RCUs) and 5 write capacity units (WCUs). What is the most effective way to reduce the throttling while maintaining application performance?

Accepted Answer

Increase the read and write capacity units on the DynamoDB table. The primary cause of the throttling is insufficient DynamoDB capacity to handle the request volume from the Lambda function. Increasing the read and write capacity units (RCUs/WCUs) directly addresses the throttle events by providing more throughput to match the function's concurrency of 100. This is the most effective solution because it resolves the bottleneck at the data store level without reducing the application's ability to process requests concurrently.

Answer

Decrease the reserved concurrency of the Lambda function to 10

Answer

Enable DynamoDB Accelerator (DAX) for caching reads

Answer

Enable auto scaling on the DynamoDB table

Question 17

A company uses AWS CodePipeline to deploy a web application. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The developer wants to add a manual approval step before the Deploy stage. Which TWO configurations are required?

Accepted Answer

An IAM role that allows CodePipeline to publish to the SNS topic.. Option D is correct because CodePipeline requires an IAM role with permissions to publish to an SNS topic in order to send notifications for manual approval actions. This role is assumed by CodePipeline to invoke the SNS Publish API, which delivers the approval request message to the configured topic. Without this role, the pipeline cannot notify the approver, and the approval step will fail. Option E is correct because an SNS topic is the mechanism used to send the approval notification to the approver. The SNS topic is configured in the approval stage of the pipeline, and it publishes a message that is sent to the subscribed approvers (e.g., via email). Both the SNS topic and the IAM role allowing CodePipeline to publish to it are required for the manual approval action to function.

Answer

An Amazon SES identity to send emails.

Answer

An AWS Lambda function to send approval emails.

Answer

An Amazon CloudWatch alarm to trigger the approval.

Question 18

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Accepted Answer

Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.. Option A is correct because AWS Systems Manager Parameter Store allows you to securely store database credentials as parameters and reference them directly in the ECS task definition using the 'secrets' field. This enables Fargate to inject the credentials as environment variables at container startup without exposing them in plaintext.

Answer

Hardcode the credentials in the container image.

Answer

Define environment variables in the task definition with the credentials.

Question 19

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon S3 bucket with a bucket policy that grants public read access. The stack creation fails with the error 'Access Denied for bucket: bucket-policy does not allow access.' The developer has full administrative permissions in AWS. The developer verifies that the bucket policy is correctly formatted. What is the most likely cause of the failure?

Accepted Answer

The S3 Block Public Access settings are enabled at the account level, preventing the bucket policy from granting public access.. Option C is correct because AWS S3 Block Public Access settings at the account level override bucket policies that grant public access, even if the bucket policy itself is correctly formatted. Since the developer has full administrative permissions, the failure is not due to a lack of IAM permissions but rather an account-level security control that explicitly denies public access. The error 'Access Denied for bucket: bucket-policy does not allow access' is a typical symptom when S3 Block Public Access is enabled, as it prevents the bucket policy from taking effect.

Answer

The developer does not have permissions to create S3 buckets.

Answer

The S3 bucket name is already in use by another account.

Answer

The S3 bucket is encrypted with AWS KMS, and the bucket policy does not include kms:Decrypt permissions.

Question 20

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The deployment group has a minimum of 2 instances and a maximum of 4. The deployment configuration is CodeDeployDefault.OneAtATime. What is the most likely cause of the failure?

Accepted Answer

The Auto Scaling group has only 2 instances, and one instance fails during deployment, leaving less than the required healthy instances.. The deployment configuration CodeDeployDefault.OneAtATime deploys to one instance at a time, and the deployment group has a minimum of 2 healthy instances. If one instance fails during deployment, only 1 healthy instance remains, which is below the minimum required threshold of 2. This causes CodeDeploy to stop the deployment and mark it as failed, as it cannot maintain the required number of healthy instances.

Answer

The deployment group's maximum instances is set to 4, which exceeds the number of instances in the Auto Scaling group.

Answer

The IAM role attached to the instances does not have sufficient permissions to download the revision from Amazon S3.

Answer

The revision is not properly zipped or the AppSpec file is missing.