DVA-C02 Practice Test 32 — 15 Questions

Question 1

A company uses AWS Lambda to process incoming messages from an Amazon SQS queue. The Lambda function sometimes fails with a timeout error when the queue has a large backlog. What is the MOST efficient way to increase throughput without causing duplicate processing?

Accepted Answer

Increase the batch size in the event source mapping.. Option D is correct because increasing the batch size allows the function to retrieve more messages per invocation, improving throughput. Option A is wrong because increasing reserved concurrency alone may not help if the function is throttled due to concurrency limits; also, without adjusting batch size, each invocation still processes the same number of messages. Option B is wrong because decreasing the batch size reduces throughput. Option C is wrong because increasing visibility timeout may help with retries but does not directly increase throughput.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Decrease the batch size in the event source mapping.

Answer

Increase the reserved concurrency of the Lambda function.

Question 2

A developer is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage that uses an Amazon S3 bucket, a build stage that uses AWS CodeBuild, and a deploy stage that uses AWS CodeDeploy. The developer wants to ensure that the pipeline automatically triggers when a new file is uploaded to the S3 source bucket. Which TWO steps should the developer take to configure this? (Choose two.)

Accepted Answer

Enable S3 event notifications on the bucket to publish events to Amazon CloudWatch Events.. Option A is correct because enabling S3 event notifications on the bucket can trigger the pipeline. Option D is correct because the pipeline source configuration should be set to 'Amazon S3' and the event notification should be configured to invoke the pipeline. Option B is incorrect because CloudTrail is for auditing, not triggering. Option C is incorrect because Lambda is not required; S3 events can directly trigger CodePipeline. Option E is incorrect because webhooks are for third-party sources like GitHub.

Answer

Create a webhook in CodePipeline and configure S3 to send HTTP requests to the webhook URL.

Answer

Configure AWS CloudTrail to log S3 PutObject events and trigger the pipeline.

Answer

Create an AWS Lambda function that is invoked on S3 object creation and starts the pipeline.

Question 3

A developer is building a REST API using Amazon API Gateway with a Lambda integration. The API must validate that the 'Authorization' header contains a valid JWT token before invoking the backend. Which approach provides the LOWEST latency for token validation?

Accepted Answer

Use a Lambda authorizer (formerly custom authorizer) on the API Gateway.. Option A is correct because using a Lambda authorizer caches the policy and reduces latency for subsequent requests. Option B is wrong because request validation only checks format, not token validity. Option C is wrong because it adds a separate validation step in the integration. Option D is wrong because VPC Link is for private integrations, not token validation.

Answer

Use a VPC Link to connect to a private server for validation.

Answer

Validate the token inside the Lambda function integrated with the API.

Answer

Use API Gateway request validation to check the header format.

Question 4

A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager is designed to store and rotate secrets automatically. Option A is wrong because SSM Parameter Store can store secrets but does not natively rotate them. Option B is wrong because DynamoDB is not a secret management service. Option D is wrong because S3 can store encrypted objects but requires custom rotation logic.

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB with server-side encryption

Answer

AWS Systems Manager Parameter Store

Question 5

An IAM policy is attached to a user. What is the effect when the user tries to download an object from the 'confidential' folder in 'my-bucket' from an IP address within the 192.0.2.0/24 range?

Accepted Answer

The request is allowed.. Option A is correct because the Deny statement has a condition that checks if the source IP is NOT in the specified range. Since the condition is not met (the IP is in the range), the Deny does not apply, and the Allow statement allows s3:GetObject on the bucket. Option B is wrong because the Deny does not apply. Option C is wrong because the Deny condition is not met. Option D is wrong because the policy does not result in an error.

Answer

The request is denied.

Answer

The request results in an error due to conflicting statements.

Answer

The request is denied because the Deny statement overrides the Allow.

Question 6

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

Accepted Answer

Enable Auto Scaling and configure scaling triggers based on CPU utilization.. Option D is correct because enabling Auto Scaling and adjusting scaling triggers allows the environment to add instances during peak hours and remove them during low traffic, balancing performance and cost. Option A is wrong because increasing instance size may be more expensive and less elastic. Option B is wrong because reducing the number of instances would worsen latency. Option C is wrong because using a load balancer alone does not change instance provisioning.

Answer

Place the environment behind an Application Load Balancer.

Answer

Change the instance type to a larger size in the environment configuration.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 7

A developer invoked a Lambda function using the AWS CLI. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught by the code.. Option C is correct because 'Handled' means the function was invoked but threw an exception that was caught by the Lambda runtime, indicating the code threw an error that was handled (e.g., a custom error). Option A is wrong because successful invocation returns 'StatusCode': 200 without FunctionError. Option B is wrong because 'Unhandled' indicates an unhandled error. Option D is wrong because a timeout would be 'Unhandled'.

Answer

The function timed out.

Answer

The function executed successfully without any errors.

Answer

The function experienced an unhandled runtime error.

Question 8

A developer is deploying a microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other using service discovery. The developer wants to use AWS Cloud Map for service discovery. Which configuration is required for the services to register and discover each other?

Accepted Answer

Create a Cloud Map namespace and service; then configure ECS tasks to register with the service.. Option C is correct because Cloud Map requires a namespace (either HTTP or DNS) and service resources. The ECS tasks use the Cloud Map API or DNS queries to discover services. Option A is wrong because ALB is for load balancing, not service discovery. Option B is wrong because VPC endpoints are for private connectivity to AWS services. Option D is wrong because Security Groups are for firewall rules, not discovery.

Answer

Create an Application Load Balancer and register each service as a target group.

Answer

Create a VPC endpoint for each service.

Answer

Configure Security Groups to allow traffic between services.

Question 9

A company runs a microservices application on Amazon ECS with Fargate. Each service has its own task definition and uses service discovery via AWS Cloud Map. Recently, one service is failing to connect to another service using the service discovery endpoint. The developer verified that both services are running and the security groups allow traffic. What is the most likely cause of the connectivity issue?

Accepted Answer

The service discovery namespace is of type private but the DNS records are not being created.. Service discovery namespace must be of type 'private' for ECS tasks to resolve. Option C identifies this. Option A is incorrect because Fargate tasks use awsvpc network mode by default. Option B is incorrect because ECS service discovery works within VPC. Option D is incorrect because Cloud Map does not require an internet gateway for private namespaces.

Answer

The task definitions are not using the awsvpc network mode.

Answer

The service discovery namespace is of type public and the services are in a private subnet.

Answer

The VPC does not have an internet gateway attached.

Question 10

A developer is designing a messaging system where orders are placed into an SQS queue and processed by a Lambda function. The developer wants to ensure that failed messages are not lost and can be analyzed later. Which TWO steps should the developer take? (Choose 2.)

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. A and C are correct. Configuring a dead-letter queue (A) captures failed messages for later analysis. Setting the redrive policy (C) allows moving messages to the DLQ after a number of failed attempts. Option B (increasing visibility timeout) may help but does not preserve failed messages. Option D (Lambda retries) is already done by default but does not preserve messages. Option E (CloudWatch alarms) only alerts, does not preserve messages.

Answer

Enable Lambda function retries on failure.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Set up a CloudWatch alarm to monitor the queue depth.

Question 11

A developer wants to invoke an AWS Lambda function every hour to perform a maintenance task. Which AWS service should be used to schedule the invocation?

Accepted Answer

Amazon CloudWatch Events (EventBridge). Amazon CloudWatch Events (now Amazon EventBridge) can schedule Lambda invocations. Option C is correct. Option A (SQS) is for message queues. Option B (SNS) is for notifications. Option D (Step Functions) is for workflows, not simple scheduling.

Answer

Amazon Simple Queue Service (SQS)

Answer

AWS Step Functions

Answer

Amazon Simple Notification Service (SNS)

Question 12

A developer is building a serverless application using API Gateway and Lambda. The API Gateway REST API endpoint needs to be accessible only from a specific VPC. Which configuration should be used?

Accepted Answer

Configure a resource policy with a condition using aws:SourceVpc.. Option C is correct because API Gateway REST APIs can be configured with a resource policy to allow access only from a specific VPC using the aws:SourceVpc condition key. Option A is wrong because private DNS is for VPC endpoints, not for controlling access. Option B is wrong because security groups are not used for API Gateway; they are for EC2. Option D is wrong because API Gateway does not have VPC endpoints in the same way as other services.

Answer

Attach a security group to the API Gateway.

Answer

Create a VPC endpoint for API Gateway and associate it with the API.

Answer

Enable private DNS on the API Gateway API.

Question 13

A company uses AWS CodePipeline to deploy a web application to an EC2 instance. The deployment often fails because the application is still running when new files are copied. Which THREE actions can be combined to achieve zero-downtime deployments?

Accepted Answer

Use AWS CodeDeploy with an in-place deployment configuration.. Options A, B, and D are correct. Using CodeDeploy (A) with an in-place deployment can manage the lifecycle. The AppSpec file (B) can define hooks to stop the application before install and start it after. Auto Scaling group (D) with a rolling update can ensure instances are replaced without downtime. Option C is wrong because CodeBuild is for building, not deployment. Option E is wrong because Amazon Inspector is for security scanning.

Answer

Use AWS CodeBuild to build and deploy the application.

Answer

Use Amazon Inspector to check the application before deployment.

Question 14

A developer is designing a mobile application that needs to upload files to Amazon S3. The developer wants to use temporary credentials to avoid storing long-term AWS credentials on the device. Which TWO services should the developer use together?

Accepted Answer

AWS Security Token Service (STS). Option A (Amazon Cognito) is correct because it provides identity pools for temporary AWS credentials. Option D (AWS STS) is correct because it issues temporary credentials. Option B is wrong because IAM is for long-term users. Option C is wrong because KMS is for encryption. Option E is wrong because S3 Transfer Acceleration is for speed.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Key Management Service (KMS)

Question 15

A developer deployed this CloudFormation template. What happens to a message after it has been received from 'MyQueue' 3 times but not deleted?

Accepted Answer

The message is moved to the dead-letter queue.. Option D is correct because the RedrivePolicy specifies maxReceiveCount: 3, so after 3 receives, the message is sent to the dead-letter queue (MyDeadLetterQueue). Option A is wrong because the message is not deleted; it is moved. Option B is wrong because it is not kept in the queue indefinitely; it is moved after 3 receives. Option C is wrong because the message is not deleted automatically after the 3rd receive; it is redirected.

Answer

The message remains in the queue and is retried indefinitely.

Answer

The message is deleted from the queue.

Answer

The message is deleted after the visibility timeout expires.