DVA-C02 Practice Test 30 — 15 Questions

Question 1

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint and a Lambda function. The developer wants to ensure that the Lambda function can be invoked only by the API Gateway and not directly. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a resource-based policy with 'aws:SourceArn' condition set to the API Gateway ARN.. Adding a resource-based policy with an `aws:SourceArn` condition set to the API Gateway ARN ensures that the Lambda function can only be invoked by that specific API Gateway. This uses the AWS Identity and Access Management (IAM) condition key to restrict the `lambda:InvokeFunction` action based on the ARN of the invoking resource, preventing direct invocation from other sources like the AWS CLI or SDK.

Answer

Configure a VPC endpoint policy that allows only API Gateway.

Answer

Add a resource-based policy with 'aws:SourceAccount' condition.

Answer

Add a resource-based policy with 'aws:SourceVpce' condition set to the API Gateway VPC endpoint ID.

Question 2

A developer is troubleshooting a web application that intermittently returns HTTP 504 errors. The application runs on EC2 instances behind an Application Load Balancer. What is the most likely cause of these errors?

Accepted Answer

The load balancer idle timeout is set too low, and the application takes longer than the timeout to respond.. HTTP 504 (Gateway Timeout) errors from an Application Load Balancer indicate that the load balancer successfully connected to the target (EC2 instance) but the target did not respond within the configured idle timeout period. The default idle timeout is 60 seconds, and if the application's processing time exceeds this value, the load balancer terminates the connection and returns a 504. Option C directly addresses this mismatch between the load balancer timeout and the application response time.

Answer

The target group is using an HTTPS health check but the instances only support HTTP.

Answer

The load balancer's cross-zone load balancing is disabled.

Answer

The security group for the EC2 instances is missing an inbound rule for the load balancer.

Question 3

A developer is using AWS KMS to encrypt data in an S3 bucket. The developer wants to ensure that the S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) by default. Which configuration should be applied?

Accepted Answer

Set the bucket's default encryption to SSE-KMS with a KMS key.. Setting the bucket's default encryption to SSE-KMS with a KMS key ensures that all objects uploaded to the S3 bucket are automatically encrypted using server-side encryption with AWS KMS managed keys (SSE-KMS). This configuration enforces encryption at rest without requiring the client to specify encryption headers in the request, meeting the requirement for default SSE-KMS encryption.

Answer

Add a bucket policy that denies PutObject without the 'x-amz-server-side-encryption' header set to 'aws:kms'.

Answer

Configure the bucket to use SSE-C with a customer-provided key.

Answer

Set the bucket's default encryption to SSE-S3.

Question 4

A developer wants to store session state for a web application that runs on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use to store the session state in a centralized, highly available location?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service that supports Redis or Memcached, which are ideal for storing session state in a centralized, highly available manner. Session data requires low-latency reads and writes, and ElastiCache offers sub-millisecond performance, replication across multiple Availability Zones, and automatic failover, making it suitable for stateless web applications behind an Application Load Balancer.

Answer

Amazon RDS

Answer

Amazon S3

Answer

AWS Lambda

Question 5

A developer is building a REST API using API Gateway and Lambda. The API must support multiple HTTP methods and use a custom domain name with an SSL certificate. The developer wants to enable caching for the /products GET endpoint to reduce latency. Which step is essential to enable caching for this specific endpoint?

Accepted Answer

Enable caching on the /products GET method and specify cache key parameters.. Enabling caching on a specific method (e.g., /products GET) in API Gateway allows you to configure cache key parameters, which control how the cache key is generated based on request parameters. This is essential for per-endpoint caching, as it ensures that only responses for the /products GET endpoint are cached, reducing latency for that specific method without affecting other endpoints.

Answer

Set the TTL (time-to-live) for the /products GET method to a non-zero value.

Answer

Flush the API cache to start fresh.

Answer

Enable caching on the API stage and set the 'Cache Status' to 'AVAILABLE'.

Question 6

A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?

Accepted Answer

Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.. Fetching the public key from a well-known URL (e.g., the JWKS endpoint) at runtime allows the Lambda authorizer to automatically use the latest signing key without manual intervention. This approach decouples key rotation from the authorizer code, ensuring that valid tokens signed with the new key are accepted immediately. It is the most efficient method as it avoids redeployments, environment variable updates, or recreating the authorizer.

Answer

Update the API Gateway stage deployment to redeploy the API.

Answer

Delete and recreate the API Gateway authorizer with the new key.

Answer

Update the Lambda authorizer's environment variable with the new key and publish a new version.

Question 7

A developer is building a serverless web application using AWS Lambda and Amazon DynamoDB. The application needs to perform complex aggregations on data stored in DynamoDB. Which AWS service should the developer use to perform these aggregations efficiently without reading all the data into Lambda?

Accepted Answer

DynamoDB Streams with AWS Lambda. DynamoDB Streams captures item-level changes in near real-time and can trigger a Lambda function to perform incremental aggregations without scanning the entire table. This pattern avoids reading all data into Lambda, making it efficient for continuous aggregation workloads.

Answer

AWS Glue

Answer

Amazon EMR

Answer

Amazon Redshift

Question 8

A team uses AWS CodePipeline to automate deployments. They notice that a deployment to Amazon ECS fails because the task definition is not updated. The pipeline includes a source stage from CodeCommit, a build stage using AWS CodeBuild, and a deploy stage to Amazon ECS. What is the most likely missing step?

Accepted Answer

The build stage does not output the updated task definition as an artifact.. In a CodePipeline that deploys to Amazon ECS, the build stage must output the updated task definition file (typically `imagedefinitions.json` or a task definition JSON) as an artifact. Without this artifact, the deploy stage cannot reference the new task definition revision, so it continues using the old one, causing the deployment to fail.

Answer

The pipeline has a manual approval step before deployment.

Answer

The deploy stage action is set to 'Create a new ECS service'.

Answer

The task definition is not registered in the Amazon ECS console.

Question 9

A company is using Amazon CloudFront to distribute static content from an S3 bucket. The content is updated frequently, but users see stale content. The developer wants to ensure that new content is served as soon as possible after an update. Which action should be taken?

Accepted Answer

Create a CloudFront invalidation for the updated files.. CloudFront caches content at edge locations based on TTL settings. When content is updated in the S3 origin, existing cached copies remain stale until they expire or are explicitly invalidated. Creating a CloudFront invalidation for the updated files immediately removes the cached objects from all edge locations, forcing CloudFront to fetch the latest version from S3 on the next request. This ensures new content is served as soon as possible after an update.

Answer

Enable 'Origin Shield' to reduce the number of requests to S3.

Answer

Set the 'Minimum TTL' to 0 and 'Default TTL' to 0.

Answer

Set the 'Object Caching' to 0 in the CloudFront distribution.

Question 10

A developer is deploying a new version of an AWS Lambda function. The function uses an environment variable for a database password. The developer wants to securely store the password and automatically rotate it. Which combination of AWS services should the developer use?

Accepted Answer

Store the password in AWS Secrets Manager and retrieve it in the Lambda function using the AWS SDK.. AWS Secrets Manager is specifically designed to securely store secrets like database passwords, supports automatic rotation of secrets, and integrates with Lambda via the AWS SDK to retrieve the secret at runtime. This ensures the password is never hardcoded or exposed in environment variables, and rotation can be scheduled without code changes.

Answer

Use AWS KMS to generate a data key and store it in the Lambda environment variable.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it in the Lambda function.

Answer

Encrypt the password using AWS KMS and store it in Amazon DynamoDB.

Question 11

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. Lately, the API is returning 502 Bad Gateway errors. What is the MOST likely cause?

Accepted Answer

The Lambda function is returning an unhandled exception.. A 502 Bad Gateway error from API Gateway typically indicates that the backend integration (in this case, the Lambda function) returned an error response. When a Lambda function throws an unhandled exception, API Gateway receives a 200 OK with a function error payload, but it cannot parse the response into a valid HTTP response, resulting in a 502. This is distinct from throttling or permission issues, which produce different HTTP status codes.

Answer

The API Gateway request throttling limit has been exceeded.

Answer

The API Gateway API key is invalid.

Answer

The Lambda function's execution role does not allow API Gateway to invoke it.

Question 12

An e-commerce platform uses AWS CodePipeline to deploy a web application to an Auto Scaling group behind an Application Load Balancer. The deployment strategy must minimize downtime and allow immediate rollback if the new version fails health checks. Which deployment configuration meets these requirements?

Accepted Answer

Use blue/green deployment with an immutable infrastructure.. Blue/green deployment with immutable infrastructure minimizes downtime by running the new version (green) alongside the old (blue) and switching traffic only after health checks pass. If the new version fails, rollback is immediate by routing traffic back to the blue environment without redeploying. AWS CodePipeline supports this via CodeDeploy with a blue/green configuration, ensuring zero-downtime deployments and instant rollback capability.

Answer

Use all-at-once deployment to the Auto Scaling group.

Answer

Use canary deployment shifting 10% traffic for 5 minutes.

Answer

Use in-place rolling update with a batch size of 50%.

Question 13

A developer is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The application needs to handle a sudden spike in traffic. The Lambda function performs CPU-intensive operations. What should the developer do to ensure the application scales without errors?

Accepted Answer

Configure the Lambda function with reserved concurrency and provisioned concurrency.. Reserved concurrency guarantees that the Lambda function has a dedicated pool of concurrency available to handle traffic spikes without being throttled by other functions in the account, while provisioned concurrency pre-warms execution environments to eliminate cold starts for CPU-intensive operations. This combination ensures that the application scales smoothly under sudden load without encountering Lambda throttling errors (HTTP 429) or latency spikes from cold starts.

Answer

Set the API Gateway throttling limits to a high value.

Answer

Use an Amazon SQS queue to buffer requests before processing.

Answer

Increase the Lambda function timeout to the maximum value.

Question 14

A developer is using AWS Secrets Manager to store database credentials. The application runs on EC2 and needs to retrieve the secret. Which approach is the most secure?

Accepted Answer

Use an IAM role attached to the EC2 instance with permissions to access the secret, and call the AWS SDK to retrieve it at runtime.. It follows the principle of least privilege and avoids hardcoding or storing secrets in insecure locations. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret from AWS Secrets Manager at runtime using the AWS SDK, without ever exposing the secret in code, configuration files, or environment variables. This approach leverages IAM's temporary credentials from the instance metadata service (IMDS) to authenticate the SDK call, ensuring the secret is never persisted locally.

Answer

Store the secret in an environment variable in the user data script.

Answer

Retrieve the secret at application startup and store it in a configuration file.

Answer

Download the secret from an S3 bucket using pre-signed URLs.

Question 15

A developer is building a REST API using Amazon API Gateway that will serve static content from an Amazon S3 bucket. The API should cache responses for frequently accessed objects to reduce latency. Which API Gateway feature should the developer enable?

Accepted Answer

API Gateway caching with TTL set per method.. API Gateway caching allows you to cache responses from your backend (e.g., an S3 bucket) for a specified Time-to-Live (TTL) per method, reducing the number of calls to the backend and lowering latency for frequently accessed objects. This feature is natively integrated with API Gateway and requires no additional services or complex configurations, making it the most direct solution for caching static content served through a REST API.

Answer

Amazon CloudFront as a custom domain.

Answer

Lambda@Edge for caching.

Answer

S3 Transfer Acceleration.