DVA-C02 Practice Test 30 — 15 Questions

Question 1

A company uses CodePipeline to deploy a web application to Elastic Beanstalk. The deployment fails at the Build stage with an error 'BUILD FAILED'. Which step should the developer take first to troubleshoot?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the buildspec.yml file for syntax errors. The error 'BUILD FAILED' originates from the Build stage, which is executed by CodeBuild. The first step in troubleshooting a CodeBuild failure is to review the buildspec.yml file for syntax errors or misconfigurations, as this file defines the build commands, environment variables, and phases. Incorrect YAML formatting, missing required fields (e.g., 'phases'), or invalid commands will cause the build to fail immediately, making it the most direct and logical starting point.

Answer

Verify the CodeDeploy application revision

Answer

Examine the Elastic Beanstalk environment logs

Answer

Check AWS CloudTrail for API calls

Question 2

A developer is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails during the 'BeforeInstall' lifecycle event. Which file should the developer check to debug the failure?

Accepted Answer

appspec.yml. The 'BeforeInstall' lifecycle event in AWS CodeDeploy is a hook defined in the appspec.yml file. This file specifies the deployment lifecycle hooks, including scripts to run before installation. When a deployment fails during this event, the appspec.yml is the primary file to inspect for misconfigured scripts, incorrect permissions, or missing script paths.

Answer

index.js

Answer

taskdef.json

Answer

buildspec.yml

Question 3

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of several Lambda functions and an API Gateway. The developer wants to enable gradual deployment of Lambda function versions with automatic rollback based on CloudWatch alarms. What should the developer add to the SAM template?

Accepted Answer

Add 'AutoPublishAlias' and 'DeploymentPreference' properties to the Lambda function resource, specifying a canary deployment with a CloudWatch alarm for rollback.. The SAM template supports gradual deployments through the 'AutoPublishAlias' property combined with 'DeploymentPreference'. This allows you to specify a canary deployment (or linear) and define CloudWatch alarms for automatic rollback. Option A is incorrect because manually managing 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' does not provide automated rollback. Option B is incorrect because while 'DeploymentPreference' with 'Type: Linear' does enable gradual deployment, the question specifically asks for the SAM-native approach using 'AutoPublishAlias' and 'DeploymentPreference' together; also the 'Alarms' list is specified within 'DeploymentPreference'. Option D is incorrect because 'CodeDeployLambdaAlias' is not a valid SAM resource; SAM abstracts CodeDeploy configuration through the 'DeploymentPreference' property on the Lambda function resource.

Answer

Use 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' resources to manually shift traffic and set up CloudWatch alarms to revert the alias if needed.

Answer

Add a 'DeploymentPreference' property with 'Type' set to 'Linear' and specify a 'Alarms' list for rollback.

Answer

Add a 'CodeDeployLambdaAlias' resource to the template and configure the deployment group with a canary deployment configuration.

Question 4

A REST API requires request validation before invoking Lambda to reduce unnecessary function executions for malformed payloads. Where should validation be configured?

Accepted Answer

In API Gateway request models and validators. API Gateway provides built-in request validation using models (JSON Schema) and validators. By configuring validation at the API Gateway layer, malformed payloads are rejected before they reach the Lambda function, reducing unnecessary invocations and associated costs. This is the correct approach because API Gateway acts as the entry point for REST APIs and can enforce payload structure without invoking the backend.

Answer

Inside the Lambda timeout setting

Answer

In the IAM execution role

Answer

In the S3 bucket policy

Question 5

A developer receives an AccessDenied error when trying to put an object into an S3 bucket using the AWS SDK. The IAM user has an attached policy that grants s3:PutObject on the bucket. What is the MOST likely cause of the error?

Accepted Answer

The bucket policy explicitly denies the action.. The most likely cause is that the bucket policy explicitly denies the s3:PutObject action. IAM policies grant permissions, but S3 bucket policies can override them with an explicit deny, which takes precedence over any allow. Since the IAM user already has an attached policy allowing s3:PutObject, the only way to get an AccessDenied error is if a bucket policy explicitly denies the action.

Answer

The request is being throttled by S3.

Answer

The object key is too long.

Answer

The AWS SDK version is outdated.

Question 6

A company is developing a serverless application using AWS Lambda and API Gateway. The application needs to process user uploads to Amazon S3. The Lambda function must be invoked asynchronously after an object is uploaded to an S3 bucket. Which configuration should the developer use to invoke the Lambda function?

Accepted Answer

Configure the S3 bucket to send events to Lambda by adding a Lambda trigger in the S3 bucket properties.. S3 can directly invoke Lambda asynchronously via a bucket notification configuration. When an object is uploaded, S3 publishes an event to the Lambda service, which then executes the function without requiring any intermediary services. This is the simplest and most direct way to trigger a Lambda function from an S3 event.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue and have Lambda poll the queue.

Answer

Configure the S3 bucket to send events to Amazon CloudWatch Events and have CloudWatch invoke Lambda.

Answer

Configure the S3 bucket to send events to an Amazon API Gateway endpoint that triggers the Lambda function.

Question 7

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket. Users from the 192.0.2.0/24 network can access objects, but users from a different network (203.0.113.0/24) get access denied. What change should be made to allow both networks?

Accepted Answer

Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].. The `aws:SourceIp` condition key accepts a list of IP ranges in an array format. By specifying both `192.0.2.0/24` and `203.0.113.0/24` in the condition, the bucket policy will grant access to requests originating from either network, resolving the access denied error for the second network.

Answer

Add a new statement with a different Principal.

Answer

Change the Condition to aws:SourceIp: "203.0.113.0/24".

Answer

Remove the Condition block entirely.

Question 8

A developer is deploying a new version of a Lambda function using an alias for blue/green deployment. Traffic is gradually shifted to the new version. During the shift, a high error rate is observed. What should the developer do to minimize impact?

Accepted Answer

Configure the alias with a canary deployment and an error rate alarm for automatic rollback.. It automates the rollback process using AWS CodeDeploy's canary deployment with an Amazon CloudWatch alarm on the error rate. When the alarm triggers, CodeDeploy automatically shifts traffic back to the previous version, minimizing impact without manual intervention. This is the recommended approach for safe blue/green deployments with Lambda aliases.

Answer

Use the Lambda function's provisioned concurrency to pre-warm the new version.

Answer

Manually revert the alias to point back to the old version.

Answer

Delete the new version and redeploy after fixing the issue.

Question 9

A company uses AWS CloudFormation to deploy resources. The templates are stored in an S3 bucket. A developer wants to ensure that only authorized users can create stacks from these templates. What should be implemented?

Accepted Answer

Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.. It combines two layers of access control: IAM policies restrict the ability to call the CreateStack API action, and S3 bucket policies restrict access to the template objects stored in S3. This ensures that even if a user has IAM permissions to create stacks, they cannot retrieve or use the template unless the S3 bucket policy also grants them access. Without both controls, an unauthorized user could bypass IAM by directly accessing the template URL or using a different AWS account.

Answer

Use a stack policy to restrict updates.

Answer

Enable CloudTrail to log template access.

Answer

Set the S3 bucket to private and rely on bucket policies.

Question 10

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 11

A Lambda function reading from Kinesis is falling behind. Which two metrics/settings should be reviewed first?

Accepted Answer

IteratorAge for the event source mapping. The IteratorAge metric measures how far behind the Lambda function is in processing records from the Kinesis stream. A high IteratorAge indicates the function is falling behind, making it the primary metric to review. The batch size, parallelization factor, and shard count directly control the concurrency and throughput of the event source mapping, so adjusting these settings can help catch up.

Answer

S3 bucket public access settings

Answer

Route 53 hosted zone count

Question 12

A developer is using AWS Step Functions to orchestrate a workflow. The developer wants to handle errors and retries for a task. Which TWO fields can be used in a state definition to configure error handling? (Choose TWO.)

Accepted Answer

Retry. The `Retry` field in an AWS Step Functions state definition defines an array of retry policies, specifying which errors to retry, the maximum number of retry attempts, the interval between retries, and the backoff rate. Option B is correct because the `Catch` field defines an array of fallback states or state machine transitions that are executed when a specific error occurs after all retry attempts are exhausted, allowing the workflow to handle errors gracefully.

Answer

FailureState

Answer

ErrorOutput

Answer

ErrorAction

Question 13

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 14

A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.. Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.

Answer

Use Amazon CloudFront to proxy requests to the S3 bucket.

Answer

Hardcode the AWS access keys in the application code.

Answer

Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.

Question 15

A DynamoDB table shows throttling on one partition key value. Which two signs point to a hot partition problem?

Accepted Answer

Most traffic targets the same partition key. A hot partition occurs when a single partition key value receives a disproportionate share of read/write traffic, causing throttling on that partition even if the table's total provisioned capacity is not fully utilized. This imbalance means the partition's capacity is exhausted while other partitions remain underutilized, leading to request throttling for that specific key.

Answer

The table has point-in-time recovery enabled

Answer

CloudTrail is enabled in all regions