DVA-C02 Practice Test 4 — 25 Questions

Question 1

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function needs to read and write items to a DynamoDB table. What is the BEST way to securely provide the Lambda function with the necessary AWS credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with DynamoDB permissions and attach it to the Lambda function.. The best practice for granting AWS Lambda functions access to DynamoDB is to create an IAM role with the necessary DynamoDB permissions (e.g., dynamodb:GetItem, dynamodb:PutItem) and attach that role to the Lambda function. This follows the principle of least privilege and leverages AWS Identity and Access Management (IAM) roles, which provide temporary, automatically rotated credentials via the AWS Security Token Service (STS). This approach eliminates the need to manage long-term access keys and ensures secure, auditable access.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Create an IAM user with programmatic access and store the credentials in the Lambda code.

Answer

Use the Lambda function's default full admin access provided by AWS.

Question 2

A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails with a timeout error. CloudWatch logs show that the timeout occurs during the processing of large files. The function has a memory setting of 128 MB and a timeout of 3 seconds. The developer wants to process large files without modifying the code. Which parameter should the developer adjust first?

Accepted Answer

Increase the function's memory. Increasing the function's memory is the correct first step because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like decompressing or parsing large files. This directly addresses the timeout by making the function complete faster, without requiring code changes. The current 128 MB setting is the minimum, which provides the least CPU, so even a modest increase can significantly reduce execution time.

Answer

Increase the function's timeout

Answer

Increase the function's reserved concurrency

Answer

Increase the S3 event notification batch size

Question 3

A company wants to enforce multi-factor authentication (MFA) for all users accessing the AWS Management Console. The company has an existing IAM setup with users and groups. Which approach should the developer recommend to enforce MFA?

Accepted Answer

Attach an IAM policy to each user that denies all actions unless the user has MFA present.. It uses an IAM policy with a condition key (`aws:MultiFactorAuthPresent`) to deny all actions when MFA is not present. This is the standard AWS-recommended approach to enforce MFA for IAM users accessing the Management Console, as it applies a deny-all-except-MFA effect at the user level without requiring account-level changes.

Answer

Enable MFA at the account level using the AWS Account settings.

Answer

Enable MFA on the root user and require all users to use the root user credentials with MFA.

Answer

Create a new IAM group for MFA users and add users to that group.

Question 4

A developer is writing a Lambda function that processes events from an Amazon S3 bucket. The function needs to access a DynamoDB table to store metadata about the S3 objects. Which of the following is the MOST efficient way to initialize the DynamoDB client in the Lambda function?

Accepted Answer

Create the DynamoDB client outside the Lambda handler function, in the global scope.. Initializing the DynamoDB client outside the Lambda handler (in global scope) allows the client to be reused across multiple invocations within the same execution environment. This avoids the overhead of creating a new client on every invocation, which reduces latency and conserves resources. AWS Lambda reuses the global scope for subsequent invocations after the first, making this the most efficient approach.

Answer

Store the DynamoDB table name as a global variable and create the client inside the handler.

Answer

Use a static variable inside the handler to cache the DynamoDB client.

Answer

Create the DynamoDB client inside the Lambda handler function every invocation.

Question 5

A developer is using the AWS CLI to deploy a new version of a Lambda function. The developer runs the following command:

aws lambda update-function-code --function-name my-function --zip-file fileb://my-code.zip

After the command completes, the developer checks the function and sees that the code has been updated but the version number is still $LATEST. The developer wants to create a new version so that the previous version is preserved. What should the developer do next?

Accepted Answer

Run the publish-version command to create a new version from the updated $LATEST.. The `update-function-code` command without the `--publish` flag only updates the `$LATEST` version of the Lambda function. To create an immutable, numbered version that preserves the previous code, the developer must explicitly run the `publish-version` command, which takes the current `$LATEST` code and publishes it as a new version (e.g., version 2). This ensures the previous version (version 1) remains unchanged and can be referenced via its version ARN.

Answer

Run the update-function-code command again with the --publish flag.

Answer

Run the delete-function command and then create-function with the updated code.

Answer

Run the update-function-configuration command to set the version number.

Question 6

A company hosts a web application on EC2 instances behind an ALB. The application uses cookies to track user sessions. The security team is concerned about session hijacking. Which action should be taken to protect the cookies?

Accepted Answer

Set the Secure and HttpOnly flags on the session cookie.. Setting the Secure and HttpOnly flags on the session cookie is the correct action because the Secure flag ensures the cookie is only sent over HTTPS, preventing interception via man-in-the-middle attacks, while the HttpOnly flag prevents client-side scripts (e.g., JavaScript) from accessing the cookie, mitigating cross-site scripting (XSS)-based session hijacking. This directly addresses the security team's concern by hardening the cookie against common attack vectors without requiring architectural changes.

Answer

Enable encryption on the ALB using a custom SSL certificate.

Answer

Store session data in ElastiCache instead of cookies.

Answer

Use AWS WAF to block requests without a valid session cookie.

Question 7

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. AWS Lambda uses an IAM execution role to securely obtain temporary credentials via the AWS Security Token Service (STS). By attaching a policy that grants only the required DynamoDB actions (e.g., GetItem, PutItem) on specific tables, you follow the principle of least privilege. This avoids hardcoding long-term credentials and eliminates the risk of credential exposure.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 8

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment must be as fast as possible while ensuring that at least 50% of instances remain healthy throughout. Which deployment configuration should be used?

Accepted Answer

CodeDeployDefault.HalfAtATime. CodeDeployDefault.HalfAtATime is the correct choice because it deploys to half of the instances in the Auto Scaling group at a time, ensuring that at least 50% of instances remain healthy throughout the deployment. This configuration balances speed (by deploying to multiple instances concurrently) with the required availability constraint, making it the fastest option that satisfies the 'at least 50% healthy' requirement.

Answer

CodeDeployDefault.OneAtATime

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.MinHealthyPercent

Question 9

A developer is building a microservices application composed of multiple AWS Lambda functions and an Amazon API Gateway. The developer needs to trace requests as they travel through different services to identify performance bottlenecks. Which AWS service should the developer integrate?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through distributed applications, including AWS Lambda functions and API Gateway. It generates a service map that shows the flow of requests, latency breakdowns, and identifies performance bottlenecks across microservices. X-Ray integrates directly with Lambda and API Gateway via the X-Ray SDK and tracing headers, enabling trace propagation without code changes.

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Answer

Amazon Inspector

Question 10

A developer needs to grant temporary access to an Amazon S3 bucket for a user from a different AWS account. The developer wants to use the most secure method that does not require sharing long-term credentials. Which approach should the developer take?

Accepted Answer

Use cross-account IAM roles with STS AssumeRole. Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole allows the external user to obtain temporary, limited-privilege credentials without sharing any long-term access keys. This approach follows the principle of least privilege and eliminates the risk of exposed static credentials, as the temporary credentials automatically expire after a configurable duration (default 1 hour, max 12 hours).

Answer

Create an IAM user in the developer's account and share the access keys

Answer

Use S3 bucket policy with a condition for the external account's IAM user

Answer

Use S3 access control lists (ACLs) with the external user's canonical user ID

Question 11

A team wants CloudFormation to prevent accidental deletion of a production DynamoDB table during stack updates. What should they configure?

Accepted Answer

DeletionPolicy or UpdateReplacePolicy Retain as appropriate. The DeletionPolicy attribute with a value of Retain instructs AWS CloudFormation to preserve the DynamoDB table when its stack resource is deleted during a stack update or stack deletion. Similarly, UpdateReplacePolicy Retain ensures that if a resource replacement is required during an update, the existing table is kept rather than deleted. This directly prevents accidental data loss by overriding CloudFormation's default behavior of deleting resources that are removed from the template or replaced.

Answer

A larger write capacity setting

Answer

A Lambda layer

Answer

An API Gateway usage plan

Question 12

A company runs a batch processing job on Amazon ECS using Fargate. The job processes files from an S3 bucket and writes results to another S3 bucket. The job runs once per day and takes about 30 minutes. The company wants to reduce costs by stopping the ECS service when not in use. Which solution should the developer implement?

Accepted Answer

Use AWS Batch with a Fargate launch type and schedule the job with Amazon EventBridge.. AWS Batch with a Fargate launch type is the ideal solution because it is purpose-built for batch processing jobs that run to completion. By scheduling the job with Amazon EventBridge, you can trigger the job once per day, and AWS Batch automatically provisions the Fargate compute environment only when the job runs, then scales down to zero after completion—eliminating costs during idle periods. This approach directly addresses the requirement to reduce costs by stopping the ECS service when not in use, without manual intervention.

Answer

Use an AWS Lambda function to run the job and configure a scheduled event in Amazon EventBridge.

Answer

Use Amazon ECS Service Auto Scaling to scale the service down to zero tasks when not in use.

Answer

Use an Amazon EC2 Auto Scaling group to launch an instance, run the job, and then terminate.

Question 13

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

Accepted Answer

Use the ephemeral storage provided by Fargate.. Fargate provides ephemeral storage (up to 20 GB by default) that persists data across container restarts within the same task but is automatically deleted when the task stops. This matches the requirement for temporary data that does not need to be shared across tasks and is cleaned up upon task termination.

Answer

Attach an Amazon EBS volume to the task.

Answer

Mount an Amazon EFS file system to the container.

Answer

Create a Docker volume using the 'tmpfs' driver.

Question 14

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB health checks are failing for a few instances, but the instances themselves are running and have healthy application processes. What is the MOST likely cause?

Accepted Answer

The security group for the EC2 instances is not allowing traffic from the ALB.. The ALB health checks are failing despite the instances and application processes being healthy, which indicates a network-level issue. The most likely cause is that the EC2 instances' security group is not allowing inbound traffic from the ALB's security group on the health check port (e.g., HTTP/HTTPS). Without this rule, the ALB cannot reach the health check endpoint, marking the instances as unhealthy and causing intermittent 503 errors when traffic is routed to those instances.

Answer

The ALB is not scaled to handle the traffic.

Answer

The DNS resolution via Route53 is misconfigured.

Answer

Sticky sessions are not enabled on the ALB.

Question 15

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function needs to read and write items to a DynamoDB table. What is the BEST way to securely provide the Lambda function with the necessary AWS credentials?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.. It adheres to the principle of least privilege by granting only the specific DynamoDB actions (e.g., GetItem, PutItem) required by the Lambda function, scoped to the exact table. The Lambda execution role is an IAM role that the Lambda service assumes, and attaching a custom policy with fine-grained permissions ensures minimal access. This approach avoids over-permissioning and follows AWS security best practices for serverless applications.

Answer

Configure a resource-based policy on the Lambda function to allow DynamoDB access.

Answer

Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

Answer

Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

Question 16

A developer is using AWS SAM to deploy a serverless application. The template includes a Lambda function that connects to an RDS MySQL database. The function works correctly in the developer's account but fails with a timeout when deployed to a production account. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance.. The most likely cause is that the Lambda function is not attached to the same VPC as the RDS instance. Lambda functions run in a VPC by default only if explicitly configured; without VPC attachment, the function cannot reach the RDS database's private IP address, leading to a connection timeout. The developer's account may have had the RDS instance publicly accessible or the Lambda function was inadvertently in the same VPC, but the production account likely uses a private RDS instance in a VPC that the Lambda function is not connected to.

Answer

The Lambda function timeout is set too low for the database query.

Answer

The SAM template does not support RDS as an event source.

Answer

The Lambda function uses a runtime that is not compatible with the MySQL client.

Question 17

A company uses AWS Elastic Beanstalk to deploy a web application. The deployment is successful, but the application health checks fail. The application runs on a single EC2 instance. What should a developer do to troubleshoot this issue?

Accepted Answer

View the application logs in the Elastic Beanstalk console.. Viewing the application logs in the Elastic Beanstalk console helps identify why the application is not responding to health checks. Logs can reveal application errors, missing dependencies, or configuration issues. Option D is wrong because SSH may not be configured for the instance, and restarting the web server without understanding the root cause may not resolve the issue. Option B is incorrect because modifying the CloudFormation template to increase instance size does not address health check failures. Option C is incorrect because adding an Application Load Balancer does not fix underlying application problems.

Answer

Modify the CloudFormation template to increase instance size.

Answer

Add an Application Load Balancer to the environment.

Answer

SSH into the EC2 instance and restart the web server.

Question 18

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 19

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?

Accepted Answer

Attach an IAM execution role with CloudWatch Logs permissions.. AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.

Answer

Use AWS KMS to encrypt the log data and grant permissions.

Answer

Create a resource-based policy on the Lambda function.

Answer

Store AWS access keys in environment variables.

Question 20

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses sessions stored in an ElastiCache Redis cluster. Recently, users have been experiencing session timeouts and errors. The developer notices that the Redis cluster is running out of memory. What should the developer do to resolve this issue?

Accepted Answer

Enable the 'allkeys-lru' eviction policy in the Redis parameter group.. Enabling the 'allkeys-lru' eviction policy in the Redis parameter group allows Redis to automatically evict the least recently used keys when memory is full, preventing session timeouts and errors caused by out-of-memory conditions. This policy is specifically designed for use cases like session storage where losing old sessions is acceptable to free memory for new ones.

Answer

Increase the session timeout in the application configuration.

Answer

Reduce the number of EC2 instances behind the load balancer.

Answer

Migrate from Redis to a Memcached cluster.