DVA-C02 Practice Test 26 — 15 Questions

Question 1

A company is running a containerized application on Amazon ECS with Fargate. The application needs to process messages from an Amazon SQS queue. The developer must ensure that the application can scale out based on the queue depth. Which THREE steps should the developer take to implement this? (Choose THREE.)

Accepted Answer

Configure an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric.. Options B, D, and E are correct. Option B: The task role needs permission to poll SQS. Option D: ECS Service Auto Scaling with a target tracking policy using SQS queue depth as a metric. Option E: The application should delete messages after processing to avoid reprocessing. Option A is wrong because read capacity is for DynamoDB, not SQS. Option C is wrong because Fargate tasks are not registered with an ALB target group; they are launched by ECS service.

Answer

Configure DynamoDB auto scaling for the application's table to handle increased load.

Answer

Register the ECS tasks with an Application Load Balancer target group to distribute messages.

Question 2

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. A developer needs to improve performance. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure Auto Scaling to add more instances during peak hours.. Options A and C are correct. Auto Scaling adds instances during peak hours, spreading the load. ElastiCache caches database results, reducing latency. Option B is wrong because increasing instance size helps but is less elastic. Option D is wrong because increasing ALB idle timeout does not affect latency. Option E is wrong because EBS optimization is about network throughput, not application latency.

Answer

Increase the ALB idle timeout.

Answer

Use larger EC2 instance types.

Answer

Enable EBS optimization on the instances.

Question 3

A developer needs to implement a serverless API using Amazon API Gateway and AWS Lambda. The API should support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable CORS on the API Gateway resource and methods.. Options A and B are correct. Option A: API Gateway must return CORS headers. Option B: The Lambda function must handle the OPTIONS method. Option C is wrong because CORS is not disabled by default; it must be explicitly enabled. Option D is wrong because the Lambda function does not need to return CORS headers; API Gateway adds them. Option E is wrong because custom domain is not related to CORS.

Answer

Create a custom domain name for the API Gateway and configure the web application to use it.

Answer

Disable CORS on the API Gateway and set the Access-Control-Allow-Origin header in the Lambda function.

Answer

Modify the Lambda function to include the Access-Control-Allow-Origin header in all responses.

Question 4

A developer is using Amazon DynamoDB as the data store for a serverless application. The application experiences high read traffic, and the developer wants to reduce latency. The data is not frequently updated. Which DynamoDB feature should the developer use?

Accepted Answer

DynamoDB Accelerator (DAX). Option A is correct because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency. Option B is wrong because Global Tables are for multi-region replication, not caching. Option C is wrong because TTL is for data expiration. Option D is wrong because auto scaling adjusts throughput, not latency.

Answer

DynamoDB Auto Scaling

Answer

DynamoDB Global Tables

Answer

DynamoDB Time to Live (TTL)

Question 5

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest. The developer must implement a solution that uses server-side encryption with AWS KMS managed keys (SSE-KMS). Which TWO steps are required to meet this requirement? (Choose TWO.)

Accepted Answer

Grant the IAM role used by the application the kms:GenerateDataKey permission for the KMS key.. Options B and D are correct. Option B: The bucket policy must deny uploads without the x-amz-server-side-encryption header. Option D: The IAM role must have kms:GenerateDataKey permission. Option A is wrong because the header is 'x-amz-server-side-encryption' not 'x-amz-sse'. Option C is wrong because SSE-S3 uses Amazon S3 managed keys, not KMS. Option E is wrong because the default encryption setting can be overridden by individual PUT requests.

Answer

Set the default encryption on the S3 bucket to SSE-KMS and disable the option to override it.

Answer

Set the x-amz-sse header to 'aws:kms' when uploading objects.

Answer

Enable default encryption on the S3 bucket with SSE-S3.

Question 6

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. Option C is correct because S3 can send event notifications to Lambda directly. Option A is wrong because SQS is an intermediate step that adds complexity. Option B is wrong because CloudWatch Events is not the native way to trigger Lambda from S3. Option D is wrong because API Gateway is for HTTP APIs, not for S3 events.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 7

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload a file to s3://my-bucket/confidential/report.pdf. What will happen?

Accepted Answer

The upload fails because the Deny statement overrides the Allow.. Option B is correct because the Deny statement explicitly denies all s3 actions on the confidential prefix, overriding the Allow. Option A is wrong because the Deny takes precedence. Option C is wrong because the Deny applies to the specific path. Option D is wrong because the Deny applies to the user.

Answer

The upload succeeds because the Deny statement applies only to the bucket, not the user.

Answer

The upload fails because the policy does not allow PutObject on that path.

Answer

The upload succeeds because the Allow statement grants PutObject.

Question 8

A company runs a containerized application on Amazon ECS using the Fargate launch type. The application needs to store temporary data that must persist across container restarts but does not need to be shared across multiple tasks. The data should be automatically deleted when the task stops. Which storage option should the developer use?

Accepted Answer

Use the ephemeral storage provided by Fargate.. Amazon EFS is a shared file system and persists beyond task lifecycle; not suitable for temporary data. Fargate ephemeral storage is temporary and deleted when the task stops, but it is not persistent across restarts. EBS volumes are not supported with Fargate. A Docker volume using the 'tmpfs' driver is memory-backed and not persistent.

Answer

Attach an Amazon EBS volume to the task.

Answer

Mount an Amazon EFS file system to the container.

Answer

Create a Docker volume using the 'tmpfs' driver.

Question 9

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function sometimes fails to process a message due to a transient error. The company wants to automatically retry failed messages up to 3 times, with a 5-minute delay between retries. What should the company configure?

Accepted Answer

Configure a dead-letter queue on the Lambda function with a redrive policy that allows up to 3 retries and a 5-minute delay.. Option A is correct because the Lambda dead-letter queue (DLQ) with a redrive policy allows specifying the maximum number of retries and the delay. Option B is wrong because Lambda's maximum retry count is limited to 2 for synchronous invocations. Option C is wrong because SQS delay queues are for delaying new messages, not retries. Option D is wrong because Step Functions is overkill for this simple retry logic.

Answer

Use AWS Step Functions to poll the SQS queue and implement a retry loop with exponential backoff.

Answer

Set the Lambda function's reserved concurrency to 1 and enable the 'Retry attempts' option to 3 in the function configuration.

Answer

Configure the SQS queue with a delivery delay of 5 minutes and a redrive policy to move messages to a dead-letter queue after 3 receives.

Question 10

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to create a custom resource that runs a Lambda function during stack creation and update. What must the developer do to ensure the custom resource works correctly?

Accepted Answer

The Lambda function must send a response to an S3 pre-signed URL.. Option D is correct because the Lambda function must send a response to the pre-signed S3 URL to signal completion. Option A is wrong because the function does not need to return a value directly. Option B is wrong because the function can be in any language. Option C is wrong because the function can be in the same template or referenced by ARN.

Answer

The Lambda function must be defined in the same CloudFormation template.

Answer

The Lambda function must return a JSON object with the desired output.

Answer

The Lambda function must be written in Python.

Question 11

A developer is troubleshooting an AWS Lambda function that is timing out. The function has a timeout of 5 seconds and is configured with 128 MB of memory. Which TWO of the following are effective ways to resolve the timeout?

Accepted Answer

Increase the memory allocation to 512 MB.. Option A is correct because increasing memory often also increases CPU, which can improve performance. Option C is correct because optimizing the code can reduce execution time. Option B is wrong because increasing timeout alone may not solve the root cause. Option D is wrong because increasing memory is an alternative to increasing timeout. Option E is wrong because deploying in a VPC adds latency due to ENI creation.

Answer

Decrease the memory allocation to 64 MB.

Answer

Deploy the function inside a VPC.

Answer

Increase the function timeout to 10 seconds.

Question 12

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Option A is correct because a read replica can serve read traffic. Option C is correct because the application should use the read replica endpoint for read queries. Option B is wrong because Multi-AZ does not provide a separate read endpoint; the secondary is standby. Option D is wrong because RDS Proxy is for connection pooling, not read scaling. Option E is wrong because creating additional primary instances is not supported; RDS has one primary per DB instance.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 13

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. Options A, C, and D are correct. Option A: AWS Systems Manager Parameter Store or AWS Secrets Manager can store credentials. Option C: Task execution role allows ECS to retrieve secrets. Option D: Secrets can be injected as environment variables. Option B is wrong because database credentials are not stored in ECR. Option E is wrong because Secrets Manager cannot be directly accessed by the application without proper IAM permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 14

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Option A is correct because using an SQS FIFO queue ensures exactly-once processing and preserves message order. Lambda can poll FIFO queues with a batch size of 1 to maintain order. Option B is wrong because standard queues do not guarantee order. Option C is wrong because Kinesis Data Streams does not integrate natively with Lambda's event source mapping for ordered processing of individual messages. Option D is wrong because SNS does not provide ordering guarantees.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 15

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to all connected clients. Which THREE actions are required to implement this functionality? (Choose THREE.)

Accepted Answer

Use the API Gateway callback URL to post messages to a specific connection.. Options A, B, and D are correct. Option A: The Lambda function needs the execute-api:ManageConnections permission to post to connections. Option B: The callback URL is used to send messages to clients. Option D: The connection ID is obtained from the event object. Option C is wrong because the WebSocket URL is not needed for posting; the callback URL is derived from the API endpoint. Option E is wrong because DynamoDB is not required for sending messages; it's optional for persistence.

Answer

Store the WebSocket URL in the Lambda function environment variables.

Answer

Store the connection IDs in an Amazon DynamoDB table for later retrieval.