DVA-C02 Practice Test 4 — 25 Questions

Question 1

A developer is designing a serverless application that uses Amazon DynamoDB as the data store. The application must handle sudden spikes in read traffic without throttling. Which THREE actions should the developer take?

Accepted Answer

Configure DynamoDB auto scaling for the table. DynamoDB auto scaling (option A) dynamically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This ensures the table can handle sudden spikes in read traffic without manual intervention, preventing throttling exceptions.

Answer

Use a global secondary index with a different partition key

Answer

Use strongly consistent reads for all queries

Question 2

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

Accepted Answer

The SQS visibility timeout is too short for the Lambda function's execution time.. When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Answer

The Lambda function's reserved concurrency is set too high.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The Lambda function's batch size is set to more than 1.

Question 3

A developer is writing an AWS Lambda function in Python that needs to download a file from Amazon S3, process it, and upload the result to a different S3 bucket. The function currently runs within the default 3-second timeout, but the developer expects the file size to increase. What is the MOST cost-effective way to handle the increase in processing time?

Accepted Answer

Increase the Lambda function's timeout to a value higher than the expected processing time.. Increasing the Lambda function's timeout is the most cost-effective solution because it directly addresses the expected increase in processing time without incurring additional costs. Lambda pricing is based on the number of invocations and duration (in GB-seconds), so extending the timeout only charges for the actual time the function runs, not for idle time or additional services. This approach avoids the complexity and cost of Step Functions or provisioned concurrency, which would add unnecessary overhead for a simple sequential task.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use Lambda provisioned concurrency to keep the function warm.

Answer

Refactor the code to use AWS Step Functions to orchestrate the processing.

Question 4

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to connected clients. The developer notices that the 'connectionId' changes every time a client reconnects. How should the developer store the mapping between user identity and connectionId?

Accepted Answer

Use Amazon DynamoDB to store the mapping, with user identity as the partition key and connectionId as an attribute.. Option B is correct because DynamoDB provides a fully managed, serverless key-value store that can persist the mapping between user identity and connectionId with low latency. Since connectionId changes on each reconnect, a durable database like DynamoDB ensures the mapping survives Lambda cold starts and scales automatically with the number of connected users, which is essential for a real-time chat application.

Answer

Use Amazon ElastiCache to store the mapping in memory.

Answer

Use Amazon RDS to store the mapping in a relational database.

Answer

Use Amazon S3 to store the mapping as a JSON file.

Question 5

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The API should only be accessible from a specific VPC. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for API Gateway.. Option A is correct because creating a VPC endpoint for API Gateway (of type `execute-api`) allows API Gateway to be accessed privately from within a specific VPC without traversing the public internet. This endpoint uses AWS PrivateLink to provide a private IP address within the VPC, ensuring traffic stays within the AWS network.

Answer

Use an API key that is only known within the VPC.

Answer

Configure the Lambda function to be VPC-enabled.

Answer

Create a VPC endpoint for Lambda.

Question 6

A company uses AWS CodeBuild to run unit tests. The buildspec.yml file is stored in the source repository. The build fails intermittently with 'command not found' for a tool that is installed in the build environment. What should the developer do to ensure the tool is available?

Accepted Answer

Add a pre_build phase to install the tool.. Option D is correct because the `pre_build` phase in a CodeBuild buildspec runs before the `build` phase, allowing you to install dependencies or tools that are required for the build commands. By placing the installation command in the `pre_build` phase, you ensure the tool is available before the unit tests execute, addressing the intermittent 'command not found' error caused by the tool not being present in the default build environment.

Answer

Use a custom Docker image that includes the tool.

Answer

Configure the build environment to include the tool via the AWS Management Console.

Answer

Add a post_build phase to install the tool.

Question 7

A developer needs to deploy a containerized application on AWS. The application requires persistent storage for stateful data. Which AWS compute service should the developer choose?

Accepted Answer

Amazon ECS with Fargate. Amazon ECS with Fargate is the best choice for deploying a containerized application with persistent storage. Fargate supports persistent storage by integrating with Amazon EFS or by using bind mounts from the underlying infrastructure. While Amazon EKS with Fargate also supports persistent storage, ECS with Fargate offers simpler management and is often preferred for stateful containers. AWS Elastic Beanstalk can run containers but is more opinionated and less flexible for stateful configurations. AWS Lambda is stateless and ephemeral, not suitable for persistent storage.

Answer

AWS Elastic Beanstalk

Answer

Amazon EKS with Fargate

Answer

AWS Lambda

Question 8

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function is configured to access a VPC without a NAT gateway.. Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts. Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Answer

The function's reserved concurrency is set to 0.

Answer

The function has a dead-letter queue configured.

Question 9

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. Option B is correct because the `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 10

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The Lambda function is timing out because the default timeout is 3 seconds, and the external API call via the 'axios' library is taking longer than that, even though the API normally responds within 500 ms. The most direct fix is to increase the Lambda function timeout to 10 seconds to accommodate any transient delays or cold-start overhead that may cause the API call to exceed 3 seconds. This ensures the function has enough time to wait for the HTTP response without failing.

Answer

Increase the Lambda function reserved concurrency.

Answer

Remove the Lambda function from the VPC.

Answer

Increase the Lambda function memory to 1024 MB.

Question 11

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

Accepted Answer

The Error document field in the static website hosting configuration is not set to error.html.. When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Answer

The bucket policy denies access to the error.html object.

Answer

The index.html is missing from the bucket.

Answer

The error.html object has incorrect permissions.

Question 12

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The deployment fails with a 'ResourceConflictException' error. What is the MOST likely cause?

Accepted Answer

Another deployment is currently in progress for the same Lambda function.. The 'ResourceConflictException' error in AWS Lambda occurs when you attempt to update a Lambda function while another update operation is already in progress. Lambda enforces a single in-flight update per function to prevent race conditions and ensure state consistency. The AWS CLI command (e.g., update-function-code) will fail immediately if a previous deployment has not completed, even if the previous deployment was triggered by the same or a different client.

Answer

The Lambda function code exceeds the maximum allowed size.

Answer

The Lambda function has an alias that conflicts with the version number.

Answer

The IAM role associated with the Lambda function does not have sufficient permissions.

Question 13

A developer attaches this IAM policy to a user. The user tries to upload an object to example-bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an access denied error.. The IAM policy denies any s3:PutObject request that does not include the x-amz-server-side-encryption header with a value of 'AES256'. Since the user attempts to upload without specifying encryption, the request lacks the required header, triggering the Deny effect in the policy. The explicit Deny overrides any Allow, resulting in an access denied error.

Answer

The upload succeeds only if the object is smaller than 5 GB.

Answer

The upload succeeds but the object is not encrypted.

Answer

The upload succeeds because S3 default encryption is applied.

Question 14

A developer is using AWS CodePipeline to automate a build and deploy process. The pipeline has a build stage that uses AWS CodeBuild and a deploy stage that uses AWS CodeDeploy. The build stage produces a build artifact that is stored in Amazon S3. The deploy stage fails with 'NoSuchKey' error. What is the MOST likely cause?

Accepted Answer

The pipeline does not have an OutputArtifact configured for the build stage, so the artifact is not passed to the deploy stage.. The 'NoSuchKey' error indicates that the deploy stage cannot find the expected artifact in Amazon S3. This most commonly occurs when the build stage does not have an OutputArtifact configured in the pipeline definition, so the artifact is not passed to the deploy stage. Without the OutputArtifact, CodePipeline does not store the build output in the pipeline's artifact store, and CodeDeploy receives no artifact reference to download.

Answer

The CodeDeploy application does not have the correct service role.

Answer

The CodeBuild project does not have permissions to upload to the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to access the artifact.

Question 15

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. Option C is correct because AWS Systems Manager Parameter Store (or Secrets Manager) is designed for secure storage of secrets and can be accessed via IAM roles. Option A is wrong because environment variables can be exposed. Option B is wrong because S3 is not designed for secrets and requires encryption management. Option D is wrong because Lambda is a compute service, not a secret store.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 16

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. Option B is correct because Amazon SNS is used to send notifications to approvers when a manual approval action is pending in the pipeline. The approval action in CodePipeline can be configured with an SNS topic ARN, and when the pipeline reaches that stage, it publishes a notification to the topic, alerting approvers to review and approve or reject the deployment.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 17

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. Option C is correct because AWS Lambda uses an IAM execution role to securely obtain temporary credentials via the AWS Security Token Service (STS). By attaching a policy that grants only the required DynamoDB actions (e.g., GetItem, PutItem) on specific tables, you follow the principle of least privilege. This avoids hardcoding long-term credentials and eliminates the risk of credential exposure.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 18

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. Option A is correct because it uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 19

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. Option D is correct because AWS Secrets Manager provides a secure, auditable service for rotating and managing database credentials. By retrieving secrets at runtime via the AWS SDK, the application avoids embedding sensitive data in code or configuration, which is a key security best practice for Elastic Beanstalk deployments.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.

Question 20

Refer to the exhibit. An IAM policy statement is attached to an AWS Lambda function's execution role. The function needs to invoke another Lambda function named 'my-function'. However, the invocation fails with an access denied error. What is the most likely cause?

Accepted Answer

The policy is attached to the wrong IAM role.. Option D is correct because the IAM policy statement is attached to the Lambda function's execution role, but the error indicates that the role does not have the necessary permissions to invoke 'my-function'. The most likely cause is that the policy is attached to the wrong IAM role—perhaps the role intended for the invoking function is not the one actually being used, or the policy is attached to a different role entirely. Without the correct role association, the Lambda service cannot assume the required permissions, resulting in an access denied error.

Answer

The action should be 'lambda:*' to allow all Lambda actions.

Answer

The Lambda function has a timeout set too low.

Answer

The resource ARN is missing the function name.