DVA-C02 Practice Test 35 — 15 Questions

Question 1

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of several Lambda functions and an API Gateway. The developer wants to enable gradual deployment of Lambda function versions with automatic rollback based on CloudWatch alarms. What should the developer add to the SAM template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add 'AutoPublishAlias' and 'DeploymentPreference' properties to the Lambda function resource, specifying a canary deployment with a CloudWatch alarm for rollback.. AWS SAM natively supports gradual deployments through the `AutoPublishAlias` and `DeploymentPreference` properties on the `AWS::Serverless::Function` resource. `AutoPublishAlias` automatically creates a new Lambda version and an alias pointing to it whenever the function code changes. `DeploymentPreference` then instructs SAM to use AWS CodeDeploy to shift traffic to the new version according to a specified strategy (e.g., Canary, Linear, AllAtOnce) and to automatically roll back if any specified CloudWatch alarms trigger. This is the standard, declarative way to enable safe deployments in SAM.

Answer

Use 'AWS::Lambda::Version' and 'AWS::Lambda::Alias' resources to manually shift traffic and set up CloudWatch alarms to revert the alias if needed.

Answer

Add a 'DeploymentPreference' property with 'Type' set to 'Linear' and specify a 'Alarms' list for rollback.

Answer

Add a 'CodeDeployLambdaAlias' resource to the template and configure the deployment group with a canary deployment configuration.

Question 2

A REST API requires request validation before invoking Lambda to reduce unnecessary function executions for malformed payloads. Where should validation be configured?

Accepted Answer

In API Gateway request models and validators. API Gateway provides built-in request validation using models (JSON Schema) and validators. By configuring validation at the API Gateway layer, malformed payloads are rejected before they reach the Lambda function, reducing unnecessary invocations and associated costs. This is the correct approach because API Gateway acts as the entry point for REST APIs and can enforce payload structure without invoking the backend.

Answer

Inside the Lambda timeout setting

Answer

In the IAM execution role

Answer

In the S3 bucket policy

Question 3

A developer receives an AccessDenied error when trying to put an object into an S3 bucket using the AWS SDK. The IAM user has an attached policy that grants s3:PutObject on the bucket. What is the MOST likely cause of the error?

Accepted Answer

The bucket policy explicitly denies the action.. The most likely cause is that the bucket policy explicitly denies the s3:PutObject action. IAM policies grant permissions, but S3 bucket policies can override them with an explicit deny, which takes precedence over any allow. Since the IAM user already has an attached policy allowing s3:PutObject, the only way to get an AccessDenied error is if a bucket policy explicitly denies the action.

Answer

The request is being throttled by S3.

Answer

The object key is too long.

Answer

The AWS SDK version is outdated.

Question 4

A company is developing a serverless application using AWS Lambda and API Gateway. The application needs to process user uploads to Amazon S3. The Lambda function must be invoked asynchronously after an object is uploaded to an S3 bucket. Which configuration should the developer use to invoke the Lambda function?

Accepted Answer

Configure the S3 bucket to send events to Lambda by adding a Lambda trigger in the S3 bucket properties.. S3 can directly invoke Lambda asynchronously via a bucket notification configuration. When an object is uploaded, S3 publishes an event to the Lambda service, which then executes the function without requiring any intermediary services. This is the simplest and most direct way to trigger a Lambda function from an S3 event.

Answer

Configure the S3 bucket to send events to an Amazon SQS queue and have Lambda poll the queue.

Answer

Configure the S3 bucket to send events to Amazon CloudWatch Events and have CloudWatch invoke Lambda.

Answer

Configure the S3 bucket to send events to an Amazon API Gateway endpoint that triggers the Lambda function.

Question 5

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload a file to s3://my-bucket/confidential/report.pdf. What will happen?

Accepted Answer

The upload fails because the Deny statement overrides the Allow.. IAM policy evaluation logic dictates that an explicit Deny always overrides any Allow. In this scenario, the Deny statement denies `s3:PutObject` on the path `arn:aws:s3:::my-bucket/confidential/*`, which matches the user's upload target `s3://my-bucket/confidential/report.pdf`. Even though the Allow statement grants `s3:PutObject` on `arn:aws:s3:::my-bucket/*`, the explicit Deny takes precedence, causing the upload to fail.

Answer

The upload succeeds because the Deny statement applies only to the bucket, not the user.

Answer

The upload fails because the policy does not allow PutObject on that path.

Answer

The upload succeeds because the Allow statement grants PutObject.

Question 6

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket. Users from the 192.0.2.0/24 network can access objects, but users from a different network (203.0.113.0/24) get access denied. What change should be made to allow both networks?

Accepted Answer

Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].. The `aws:SourceIp` condition key accepts a list of IP ranges in an array format. By specifying both `192.0.2.0/24` and `203.0.113.0/24` in the condition, the bucket policy will grant access to requests originating from either network, resolving the access denied error for the second network.

Answer

Add a new statement with a different Principal.

Answer

Change the Condition to aws:SourceIp: "203.0.113.0/24".

Answer

Remove the Condition block entirely.

Question 7

A developer is deploying a new version of a Lambda function using an alias for blue/green deployment. Traffic is gradually shifted to the new version. During the shift, a high error rate is observed. What should the developer do to minimize impact?

Accepted Answer

Configure the alias with a canary deployment and an error rate alarm for automatic rollback.. It automates the rollback process using AWS CodeDeploy's canary deployment with an Amazon CloudWatch alarm on the error rate. When the alarm triggers, CodeDeploy automatically shifts traffic back to the previous version, minimizing impact without manual intervention. This is the recommended approach for safe blue/green deployments with Lambda aliases.

Answer

Use the Lambda function's provisioned concurrency to pre-warm the new version.

Answer

Manually revert the alias to point back to the old version.

Answer

Delete the new version and redeploy after fixing the issue.

Question 8

A company uses AWS CloudFormation to deploy resources. The templates are stored in an S3 bucket. A developer wants to ensure that only authorized users can create stacks from these templates. What should be implemented?

Accepted Answer

Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.. It combines two layers of access control: IAM policies restrict the ability to call the CreateStack API action, and S3 bucket policies restrict access to the template objects stored in S3. This ensures that even if a user has IAM permissions to create stacks, they cannot retrieve or use the template unless the S3 bucket policy also grants them access. Without both controls, an unauthorized user could bypass IAM by directly accessing the template URL or using a different AWS account.

Answer

Use a stack policy to restrict updates.

Answer

Enable CloudTrail to log template access.

Answer

Set the S3 bucket to private and rely on bucket policies.

Question 9

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 10

A Lambda function reading from Kinesis is falling behind. Which two metrics/settings should be reviewed first?

Accepted Answer

IteratorAge for the event source mapping. The IteratorAge metric measures how far behind the Lambda function is in processing records from the Kinesis stream. A high IteratorAge indicates the function is falling behind, making it the primary metric to review. The batch size, parallelization factor, and shard count directly control the concurrency and throughput of the event source mapping, so adjusting these settings can help catch up.

Answer

S3 bucket public access settings

Answer

Route 53 hosted zone count

Question 11

A developer is using AWS Step Functions to orchestrate a workflow. The developer wants to handle errors and retries for a task. Which TWO fields can be used in a state definition to configure error handling? (Choose TWO.)

Accepted Answer

Retry. The `Retry` field in an AWS Step Functions state definition defines an array of retry policies, specifying which errors to retry, the maximum number of retry attempts, the interval between retries, and the backoff rate. Option B is correct because the `Catch` field defines an array of fallback states or state machine transitions that are executed when a specific error occurs after all retry attempts are exhausted, allowing the workflow to handle errors gracefully.

Answer

FailureState

Answer

ErrorOutput

Answer

ErrorAction

Question 12

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 13

A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.. Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.

Answer

Use Amazon CloudFront to proxy requests to the S3 bucket.

Answer

Hardcode the AWS access keys in the application code.

Answer

Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.

Question 14

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) is experiencing increased latency. The developer suspects the ALB is the bottleneck. How can the developer confirm this using CloudWatch metrics?

Accepted Answer

Monitor the TargetResponseTime metric and compare it to the client's perspective.. To determine if the ALB or the backend targets are causing the latency, the developer should monitor the 'TargetResponseTime' metric. This metric measures the time elapsed (in seconds) from when the request leaves the ALB until a response from the target is received. If 'TargetResponseTime' is low but the client-side latency is high, the bottleneck lies within the ALB itself or the network. If 'TargetResponseTime' is high, the bottleneck is the backend EC2 instances. 'SurgeQueueLength' is a Classic Load Balancer metric and is not available on ALBs.

Answer

Monitor the HealthyHostCount metric and ensure it is equal to the number of instances.

Answer

Monitor the SurgeQueueLength metric and look for sustained high values.

Answer

Monitor the RequestCount metric and check if it exceeds the ALB's limit.

Question 15

A DynamoDB table shows throttling on one partition key value. Which two signs point to a hot partition problem?

Accepted Answer

Most traffic targets the same partition key. A hot partition occurs when a single partition key value receives a disproportionate share of read/write traffic, causing throttling on that partition even if the table's total provisioned capacity is not fully utilized. This imbalance means the partition's capacity is exhausted while other partitions remain underutilized, leading to request throttling for that specific key.

Answer

The table has point-in-time recovery enabled

Answer

CloudTrail is enabled in all regions