DVA-C02 Practice Test 31 — 15 Questions

Question 1

A developer is using AWS Lambda with an Amazon RDS MySQL database. The Lambda function frequently times out when connecting to the database. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to the same VPC as the RDS instance. Lambda functions must be attached to the same VPC as the RDS instance to connect via a private IP address. Without VPC attachment, the Lambda function attempts to connect over the public internet, which can cause timeouts due to network latency, security group restrictions, or the RDS instance being configured as publicly inaccessible.

Answer

The Lambda function is not configured with enough memory

Answer

The Lambda function is not using a reserved concurrency limit

Answer

The Lambda function's execution role lacks RDS permissions

Question 2

A company uses AWS OpsWorks for configuration management. They have a stack with multiple layers. They want to deploy a new application version to the application layer using rolling updates. What is the correct way to achieve this?

Accepted Answer

Update the app with the new version and run the 'deploy' command on the stack.. In AWS OpsWorks, deploying a new application version to a layer is done by updating the app configuration with the new version and then running the 'deploy' command on the stack. This command triggers the built-in Chef deploy recipes on the layer's instances, performing a rolling update that installs the new application version while minimizing downtime. The 'deploy' lifecycle event is specifically designed for application deployment, unlike 'setup' which configures the instance's initial state.

Answer

Update the custom cookbook and run the 'setup' command on the layer.

Answer

Clone the stack and then delete the old stack.

Answer

Modify the Auto Scaling group to launch new instances with the updated app.

Question 3

A development team is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to maintain a connection to each user and broadcast messages to all connected clients. Which approach should the developer use to scale the application efficiently?

Accepted Answer

Store connection IDs in Amazon DynamoDB and use the API Gateway Management API to send messages to all connections.. DynamoDB provides a scalable, serverless key-value store to persist WebSocket connection IDs, and the API Gateway Management API allows Lambda to send messages directly to any connected client via its connection ID. This combination efficiently handles the broadcast requirement without managing infrastructure, as Lambda can iterate over stored connection IDs and call the Management API for each message.

Answer

Use Amazon ElastiCache to cache connection IDs and have Lambda send messages using the Redis pub/sub feature.

Answer

Use Amazon SNS to publish messages to all connected clients via the WebSocket API.

Answer

Use Amazon SQS to queue messages and have Lambda poll the queue to send messages to all connections.

Question 4

A developer needs to analyze real-time streaming data from thousands of devices. The data consists of JSON messages that must be processed and stored in Amazon S3. Which AWS service should the developer use to ingest and buffer the streaming data?

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time ingestion and buffering of large-scale streaming data, such as JSON messages from thousands of devices. It can capture and store data in shards for up to 365 days, allowing downstream consumers (e.g., Lambda, Kinesis Data Analytics) to process the data before storing it in Amazon S3. This makes it the correct choice for ingesting and buffering the streaming data before persistent storage.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon Simple Queue Service (SQS)

Question 5

A developer is deploying a Docker container to Amazon ECS using the Fargate launch type. The developer wants to ensure the container has access to an Amazon RDS database. What is the best way to securely pass the database credentials to the container?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store the credentials and reference them in the task definition.. AWS Systems Manager Parameter Store and AWS Secrets Manager are designed to securely store and manage sensitive information like database credentials. In Amazon ECS with Fargate, you can reference these secrets directly in the task definition using the 'secrets' parameter, which injects them as environment variables at runtime without exposing them in plain text or requiring additional code to fetch them. This approach adheres to the principle of least privilege and integrates natively with IAM roles for secure access.

Answer

Pass the credentials as plain text environment variables in the task definition.

Answer

Store the credentials in an Amazon S3 bucket and download them at container startup.

Answer

Store the credentials in the container image as environment variables.

Question 6

A developer must locally test a SAM-based Lambda function with an API event before deployment. Which tool command family is designed for this?

Accepted Answer

AWS SAM CLI local invoke/start-api. The AWS SAM CLI provides the `local invoke` and `local start-api` commands specifically for testing Lambda functions locally with simulated API Gateway events before deployment. `sam local start-api` creates a local HTTP server that mimics API Gateway, allowing developers to send requests to their Lambda functions as if they were deployed, while `sam local invoke` directly invokes the function with a specified event payload. This is the only tool family designed for local testing of SAM-based Lambda functions with API events.

Answer

AWS Shield Advanced CLI

Answer

AWS Organizations policy simulator

Answer

Amazon Inspector SBOM export

Question 7

Messages in an SQS queue are processed successfully but later reappear and are processed again. What is the most likely configuration issue?

Accepted Answer

The visibility timeout is shorter than the processing time or messages are not deleted after processing. When a message is processed but not deleted from the SQS queue, or when the visibility timeout expires before processing completes, the message becomes visible again in the queue and can be consumed by another worker. This causes duplicate processing. The correct fix is to ensure the visibility timeout is set longer than the expected processing time and that the message is explicitly deleted after successful processing.

Answer

The queue uses long polling

Answer

The queue has a dead-letter queue

Answer

The messages are encrypted with SSE-SQS

Question 8

A development team wants to automatically deploy a web application to Amazon EC2 instances when new code is pushed to the master branch of an AWS CodeCommit repository. Which AWS service should the team use to orchestrate the build, test, and deployment phases?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that orchestrates the entire build, test, and deployment phases as a pipeline. It can be configured to automatically trigger on code pushes to the master branch of an AWS CodeCommit repository, then invoke AWS CodeBuild for building and testing, and finally deploy to EC2 instances via AWS CodeDeploy, providing end-to-end automation.

Answer

AWS CloudFormation

Answer

AWS CodeBuild

Answer

AWS CodeDeploy

Question 9

A developer creates an AWS CloudFormation stack with the template snippet shown. The stack creation fails with the error: "Bucket with name my-unique-bucket-12345 already exists." What is the MOST likely cause?

Accepted Answer

The bucket name is already taken by another AWS account.. The error message 'Bucket with name my-unique-bucket-12345 already exists' indicates that the bucket name is globally unique across all AWS accounts. Since the bucket name is already taken, the most likely cause is that another AWS account has already created a bucket with that exact name. S3 bucket names are unique across all of AWS, not just within a single account or region.

Answer

The developer does not have permission to create S3 buckets.

Answer

The CloudFormation template has a syntax error.

Answer

The bucket name was used by another stack in the same account.

Question 10

A developer is troubleshooting an AWS Lambda function that experiences high latency for the first few invocations after being idle. The function is written in Python and uses a large library (e.g., Pandas). The function connects to an RDS database in a VPC. What is the most effective way to reduce the latency for the first invocation after idle?

Accepted Answer

Enable provisioned concurrency on the function.. Provisioned concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating the cold start latency that occurs after a period of idle time. This is the most direct solution for reducing latency on the first invocation after idle, especially for functions with large libraries like Pandas that take significant time to load.

Answer

Increase the function's memory allocation to 3008 MB.

Answer

Move the large library to a Lambda layer.

Answer

Replace the RDS database with Amazon DynamoDB.

Question 11

A developer is designing a serverless application using AWS Lambda. The function needs to process messages from an Amazon SQS queue. The developer wants to configure the Lambda function to be triggered by the SQS queue. Which TWO actions are required? (Choose TWO.)

Accepted Answer

Attach an IAM execution role to Lambda with permission to receive messages from SQS.. Option A is correct because the Lambda function's IAM execution role must grant permissions such as sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes so the service can poll and consume messages from the SQS queue on the function's behalf. Option C is correct because SQS is a pull-based source, so you must create an event source mapping that tells the Lambda service to poll the queue, batch records, and invoke the function with those messages. Option B is not required because SQS integration uses the execution role for polling rather than a resource-based policy invoking Lambda directly, as would be the case for push-based sources like S3 or SNS. Option D is not required, though a dead-letter queue or Lambda destinations can optionally handle failed messages. Option E is not required because Lambda can reach SQS over the AWS network without being placed in a VPC.

Answer

Configure a resource-based policy on the SQS queue to allow Lambda invocation.

Answer

Set up a dead-letter queue for failed messages.

Answer

Place the Lambda function in a VPC to access the SQS queue.

Question 12

A developer is building a serverless application using AWS Lambda. The Lambda function needs to access a VPC to connect to an RDS database. Which TWO resources must the developer configure to allow the Lambda function to access the VPC?

Accepted Answer

A security group that allows inbound/outbound traffic to the RDS database.. A security group acts as a virtual firewall for the Lambda function, controlling inbound and outbound traffic. To connect to an RDS database in a VPC, the Lambda function's security group must allow outbound traffic to the RDS database's security group on the database port (e.g., 3306 for MySQL), and the RDS security group must allow inbound traffic from the Lambda security group. This two-way rule ensures the Lambda function can establish a TCP connection to the database.

Answer

A NAT gateway in the VPC.

Answer

An IAM role with permissions to access RDS.

Answer

An internet gateway attached to the VPC.

Question 13

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. It uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 14

A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms. It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.

Answer

Deny s3:PutObject if the request includes x-amz-server-side-encryption

Answer

Allow s3:PutObject only if the request uses a specific KMS key

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256

Question 15

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

Accepted Answer

Configure an SQS event source mapping on the Lambda function.. AWS Lambda supports native SQS event source mappings, which allow Lambda to poll an SQS queue and invoke the function automatically when new messages arrive. This integration handles the polling, batch retrieval, and deletion of messages from the queue, making it the simplest and most efficient way to process SQS messages with Lambda.

Answer

Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

Answer

Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

Answer

Use AWS Step Functions to poll the SQS queue and invoke Lambda.