DVA-C02 Practice Test 38 — 15 Questions

Question 1

A developer is using Amazon Kinesis Data Streams to ingest real-time events. The application uses the Kinesis Client Library (KCL) to process records. The developer notices that one shard is falling behind while others are processing fine. Which THREE actions can help improve processing of the lagging shard? (Choose THREE.)

Accepted Answer

Use Enhanced Fan-Out to reduce contention.. Options A, C, and D are correct. A: Increasing the number of workers can increase parallelism within a shard. C: Using Enhanced Fan-Out allows multiple consumers to read from the same shard without contention. D: Resharding splits the hot shard into multiple shards. Option B is wrong because decreasing the record size reduces data volume but is not a direct fix for lag. Option E is wrong because reducing shard count reduces parallelism.

Answer

Decrease the record size by compressing the data.

Answer

Reduce the number of shards in the stream.

Question 2

A developer wants to store session state for a web application running on multiple EC2 instances. Which AWS service provides a fully managed, in-memory data store that is ideal for this use case?

Accepted Answer

Amazon ElastiCache for Redis. Option B is correct because Amazon ElastiCache for Redis is a fully managed in-memory data store that supports session state management with features like persistence, replication, and high availability.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon RDS for MySQL

Question 3

A developer is designing a workflow using AWS Step Functions that includes a task to invoke an AWS Lambda function. The Lambda function sometimes times out due to long-running operations. The developer needs the workflow to wait for the Lambda function to complete asynchronously and retry on failure. Which Step Functions pattern should the developer use?

Accepted Answer

Use a Task state with .waitForTaskToken and have the Lambda function return the token upon completion.. Option A is correct because the Task token (.waitForTaskToken) allows the Lambda function to run asynchronously and call back with the token upon completion, enabling long-running operations. Option B is wrong because it's synchronous and tied to Lambda's timeout. Option C is wrong because it's for parallel execution. Option D is wrong because it doesn't involve Lambda.

Answer

Use a Task state that directly invokes the Lambda function synchronously.

Answer

Use a Parallel state to run multiple Lambda functions concurrently.

Answer

Use a Choice state to branch based on the Lambda function's output.

Question 4

Which TWO actions should a developer take to securely store secrets (e.g., database passwords) used by a Lambda function?

Accepted Answer

Use AWS Secrets Manager to store and retrieve the secret at runtime.. Options B and D are correct. AWS Secrets Manager can automatically rotate secrets, and the Lambda function retrieves them at runtime via API. Option A is wrong because environment variables are visible in the console and logs. Option C is wrong because storing secrets in source code is insecure. Option E is wrong because S3 is not designed for secret management and would require encryption and access control.

Answer

Upload the secret to an S3 bucket and read it from the Lambda function.

Answer

Store the secret as an environment variable in the Lambda function.

Answer

Hardcode the secret in the Lambda function code.

Question 5

A developer needs to store application configuration that can be accessed by multiple microservices running on Amazon ECS. The configuration must be encrypted at rest and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store. Option C is correct because AWS Systems Manager Parameter Store supports encryption (using KMS) and can store configuration data as parameters. For automatic rotation of secrets, AWS Secrets Manager is better, but Parameter Store can integrate with Secrets Manager. In this scenario, Parameter Store is the appropriate choice for configuration storage with encryption.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Secrets Manager

Question 6

A developer is deploying an application using AWS Elastic Beanstalk. The application requires a relational database. Which THREE components are created by Elastic Beanstalk when you add a database to your environment?

Accepted Answer

An Amazon RDS DB instance. Options A, C, and D are correct. Elastic Beanstalk creates an Amazon RDS DB instance, a security group for the DB, and a CloudFormation stack that manages the resources. Option B is incorrect because the DB subnet group is created but not listed as a separate component; it is part of the RDS configuration. Option E is incorrect because Elastic Beanstalk does not create a DynamoDB table by default.

Answer

A DB subnet group

Answer

An Amazon DynamoDB table

Question 7

A company uses AWS CloudFormation to deploy infrastructure. The developer needs to pass a list of security group IDs to an EC2 instance launch configuration. The security groups are created in another stack. How should the developer obtain the security group IDs?

Accepted Answer

Use Fn::ImportValue to import the exported outputs from the other stack.. Option C is correct because Fn::ImportValue imports exported outputs from another stack. Option A is wrong because Fn::GetAtt only works within the same stack. Option B is wrong because Fn::Ref returns a single value. Option D is wrong because nested stacks are more complex.

Answer

Use Fn::GetAtt to retrieve the IDs from the other stack's resources.

Answer

Use a nested stack to include the security group resources in the same template.

Answer

Use Fn::Ref to reference the security group IDs directly.

Question 8

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support CORS to allow requests from a web application hosted on a different domain. The developer has enabled CORS on the API Gateway resource and configured the Lambda function to return the appropriate headers. However, the web application is still receiving CORS errors. What is the most likely cause?

Accepted Answer

The Lambda function is not returning the CORS headers in the response.. Option D is correct when the Lambda function is a custom integration (not proxy), the Lambda function must return the CORS headers in the response. For proxy integrations, API Gateway automatically handles CORS headers. If the developer enabled CORS on API Gateway but the Lambda is a custom integration, the headers from API Gateway may not be passed through; the Lambda must return them. Option A is the correct answer: the Lambda function must return the CORS headers because the API Gateway CORS configuration only applies to the mock response, not the Lambda response.

Answer

The API Gateway stage is not redeployed after enabling CORS.

Answer

The API Gateway CORS configuration is incorrect; the allowed origin should be set to '*'.

Answer

The web application is not sending the preflight OPTIONS request.

Question 9

A developer is implementing a REST API using Amazon API Gateway and AWS Lambda. The API should return a static response from an Amazon S3 bucket for a specific GET endpoint without invoking a Lambda function. Which API Gateway integration type should be used?

Accepted Answer

HTTP_PROXY. Option C is correct because the HTTP proxy integration forwards requests directly to an HTTP endpoint, such as an S3 static website. Option A is wrong because MOCK returns a static response but does not integrate with S3. Option B is wrong because AWS proxy integrates with Lambda. Option D is wrong because it's for private integrations.

Answer

MOCK

Answer

AWS_PROXY

Answer

AWS

Question 10

Refer to the exhibit. An IAM policy is attached to a Lambda function's execution role. The Lambda function is triggered by an S3 event and needs to invoke another Lambda function and decrypt an S3 object encrypted with a customer-managed KMS key. However, the invocation fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The policy is missing kms:GenerateDataKey and kms:Decrypt might not be sufficient for all decryption scenarios.. Option C is correct because the policy allows kms:Decrypt but not kms:DescribeKey or other necessary actions for decryption; also, the function might need kms:Decrypt on the key. Option A is wrong because kms:Decrypt is allowed. Option B is wrong because the resource is specific. Option D is wrong because the policy does not cover S3 actions, but the error is about invocation.

Answer

The policy does not allow s3:GetObject on the S3 bucket.

Answer

The policy resource for Lambda is incorrect.

Answer

The policy does not allow kms:Decrypt for the key.

Question 11

A developer is building a RESTful API using AWS Lambda and Amazon API Gateway. The API will be accessed by external customers. The developer needs to implement authentication and authorization. Which THREE steps should the developer take to secure the API? (Choose three.)

Accepted Answer

Use Amazon Cognito user pools for user authentication and to generate JWT tokens.. Option A is correct because API Gateway can use a Lambda authorizer to validate custom tokens. Option B is correct because Amazon Cognito can manage user sign-up/sign-in and issue JWT tokens. Option D is correct because API Gateway can integrate with Cognito to validate tokens. Option C is incorrect because IAM roles are for internal AWS services, not external users. Option E is incorrect because resource policies are for cross-account access, not user authentication.

Answer

Configure the API to use AWS IAM roles for authentication by passing the role ARN in the request.

Answer

Attach a resource policy to the API Gateway that allows only specific IAM users.

Question 12

A developer is designing a serverless application using AWS Lambda and Amazon S3. The application must process files immediately after they are uploaded to an S3 bucket. Which TWO services can be used to trigger the Lambda function?

Accepted Answer

Amazon SNS. Options A and C are correct. S3 can publish events to SNS, and SNS can invoke Lambda via subscription. S3 can also directly invoke Lambda via S3 event notifications. Option B is incorrect because SQS cannot directly invoke Lambda; it requires a Lambda trigger configured with SQS as event source. Option D is incorrect because Kinesis Data Streams is not a direct S3 event target. Option E is incorrect because CloudWatch Events can schedule Lambda but not trigger on S3 events directly without a custom solution.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Events

Answer

Amazon SQS

Question 13

A company is using AWS CodePipeline to automate deployments. The pipeline has a source stage that retrieves code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The build stage is failing intermittently with errors related to missing dependencies. What should a developer do to ensure the build environment has all required dependencies?

Accepted Answer

Create a custom buildspec.yml file in the source code that installs the dependencies in the install phase.. Option C is correct because a custom buildspec.yml can install dependencies in the install phase. Option A is wrong because CodePipeline does not manage environment variables for CodeBuild. Option B is wrong because it's not efficient to install manually. Option D is wrong because CodeCommit is a different source.

Answer

Configure environment variables in CodePipeline to set dependency paths.

Answer

Manually install dependencies on the CodeBuild build server each time.

Answer

Use AWS CodeCommit as the source repository instead of S3.

Question 14

Refer to the exhibit. A developer creates a CloudFormation stack with this template. The developer wants to ensure that all objects uploaded to the bucket are encrypted at rest using SSE-KMS. However, the current policy allows anyone to put objects without encryption. What additional change is needed to enforce SSE-KMS?

Accepted Answer

Set the bucket's default encryption configuration to SSE-KMS.. Option B is correct because the policy condition only checks for the header, but if the user does not specify it, the request is denied. However, the bucket policy should also deny PutObject if the header is not present, which is already done via the condition. But the issue is that the bucket does not have a default encryption setting. Option A is wrong because the condition already requires the header. Option C is wrong because the condition is already correct. Option D is wrong because bucket policy already exists.

Answer

Add a bucket policy that denies PutObject if encryption is not set.

Answer

Modify the condition to use s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

Remove the condition to allow all PutObject requests.

Question 15

A developer is troubleshooting a Lambda function that is failing with a 'Task timed out' error. The function is configured with a 3-second timeout. The function makes an HTTP request to an external API that sometimes takes more than 3 seconds to respond. Which THREE actions should the developer take to resolve this issue?

Accepted Answer

Use an asynchronous invocation pattern with a queue to decouple the HTTP request.. Options B, C, and E are correct. Increasing the Lambda timeout (B) allows the function to wait longer for the API response. Implementing a retry logic with exponential backoff (C) helps handle transient delays. Using an asynchronous invocation pattern (E) decouples the request from the response, allowing the function to return quickly and process the response later. Option A is incorrect because VPC configuration does not affect timeout. Option D is incorrect because reducing batch size is not relevant to timeout.

Answer

Place the Lambda function in a VPC to improve network latency.

Answer

Reduce the batch size in the event source mapping.