DVA-C02 Practice Test 39 — 15 Questions

Question 1

A company is deploying a microservices application on Amazon ECS using the Fargate launch type. The application includes a service that must process messages from an Amazon SQS queue. The developer wants to ensure that the service scales based on the number of messages in the queue. Which scaling solution should the developer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task.. Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task (calculated as ApproximateNumberOfMessages divided by the number of running tasks) directly correlates the number of ECS tasks to the queue depth. This ensures the service scales up when messages accumulate and scales down when the backlog clears, using a predefined or custom metric that reflects the workload.

Answer

Configure DynamoDB auto scaling to adjust read capacity based on queue depth.

Answer

Configure AWS Lambda with reserved concurrency and trigger it from the SQS queue.

Answer

Use Application Auto Scaling with a scheduled scaling policy to increase the number of tasks during peak hours.

Question 2

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

Accepted Answer

--log-type Tail. The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Answer

--client-context string

Answer

--qualifier alias

Answer

--invocation-type Event

Question 3

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 4

A developer is using AWS Lambda and needs to ensure that the function can access an RDS database securely. Which THREE steps should be taken?

Accepted Answer

Place the Lambda function inside a VPC.. Options A, B, and E are correct. Option A: Placing the Lambda function inside a VPC allows it to communicate with the RDS database privately over the network. Option B: Storing database credentials in AWS Secrets Manager and retrieving them in the Lambda code is a secure practice, as it avoids hardcoding credentials and allows rotation. Option E: Configuring the security group of the RDS instance to allow inbound traffic from the Lambda function's security group ensures that only the Lambda function can connect. Option C is incorrect because granting rds:* permissions does not enable Lambda to authenticate to the database; IAM roles are for AWS API actions, not for database user authentication. Option D is incorrect because client certificates are not typically used for Lambda-to-RDS connections; authentication is done via database credentials.

Answer

Attach an IAM role to the Lambda function that grants rds:* permissions.

Answer

Configure the RDS instance to require client certificates.

Question 5

A developer is deploying a new version of an application to Amazon ECS using AWS CodeDeploy. The application uses a blue/green deployment strategy. After the deployment, traffic is automatically shifted to the new task set. However, the developer wants to test the new version with a small percentage of users before shifting all traffic. What should the developer do?

Accepted Answer

Use CodeDeploy to perform a canary deployment that shifts 10% of traffic initially.. CodeDeploy supports canary deployments for ECS, which allow you to shift a specified percentage of traffic to the new task set initially (e.g., 10%) and then, after a configured interval, shift the remaining traffic. This matches the requirement to test with a small percentage of users before shifting all traffic. Option B directly implements this canary strategy.

Answer

Create a new ECS task definition with a different CPU/memory allocation.

Answer

Configure the target group to route traffic to a specific task set.

Answer

Use ECS service auto scaling to gradually increase the number of tasks.

Question 6

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

Accepted Answer

Enable Auto Scaling and configure scaling triggers based on CPU utilization.. Enabling Auto Scaling with CPU utilization triggers dynamically adds EC2 instances during peak hours, distributing the load and reducing latency without over-provisioning during off-peak times. This matches the symptom of under-provisioned instances and minimizes cost by scaling only when needed, unlike static solutions that waste resources.

Answer

Place the environment behind an Application Load Balancer.

Answer

Change the instance type to a larger size in the environment configuration.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 7

A developer is creating an IAM policy to allow a Lambda function to write logs to CloudWatch. Which policy should be attached to the Lambda execution role?

Accepted Answer

AWSLambdaBasicExecutionRole. The AWSLambdaBasicExecutionRole managed policy grants permissions for Lambda to write logs to CloudWatch Logs, specifically allowing the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions. This is the minimal set of permissions required for a Lambda function to send execution logs to CloudWatch, making it the correct choice for this use case.

Answer

AdministratorAccess

Answer

AmazonDynamoDBFullAccess

Answer

AmazonS3FullAccess

Question 8

A developer is building a REST API using Amazon API Gateway and wants to validate the incoming request body against a JSON schema before passing the request to the backend Lambda function. Which API Gateway feature should the developer use?

Accepted Answer

Request validation. API Gateway's request validation feature allows you to define a JSON schema (using JSON Schema Draft 4) for the request body and automatically reject requests that do not conform before they reach the backend. This offloads validation from the Lambda function, reducing cold start overhead and ensuring only valid payloads are processed. The developer can configure this in the API Gateway console or via the OpenAPI specification.

Answer

Mapping templates

Answer

Integration request

Answer

Stage variables

Question 9

A developer needs to encrypt secrets such as database passwords used by an application running on EC2. Which AWS service should be used to securely store and rotate these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate secrets such as database passwords, API keys, and other credentials. It integrates natively with AWS services like RDS, Redshift, and DocumentDB to enable automatic rotation of secrets without custom code, and it enforces encryption at rest using AWS KMS. This makes it the ideal service for the use case described, where secrets must be both stored securely and rotated automatically.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 10

A mobile application must let authenticated users upload only to their own S3 prefix. Which approach best follows least privilege?

Accepted Answer

Use Cognito identity credentials with an IAM policy scoped to the user's prefix using policy variables. It uses Amazon Cognito identity pools to issue temporary AWS credentials scoped to a specific S3 prefix via IAM policy variables (e.g., `${cognito-identity.amazonaws.com:sub}`). This ensures each authenticated user can only upload to their own prefix (e.g., `uploads/${user_id}/`), adhering to the principle of least privilege by granting no more access than necessary.

Answer

Use a single hardcoded access key in the app

Answer

Make the bucket public and validate names in the client

Answer

Give every user AmazonS3FullAccess

Question 11

Which TWO actions can help reduce Lambda cold start times? (Choose two.)

Accepted Answer

Increase the memory allocated to the function.. Increasing memory also increases CPU, which speeds up initialization. Option C is correct because using Provisioned Concurrency keeps environments warm. Option A is incorrect because larger deployment packages increase cold start. Option D is incorrect because VPC adds network overhead, increasing cold start. Option E is incorrect because reducing the function timeout does not affect cold start time; timeout limits execution duration, not initialization.

Answer

Increase the deployment package size.

Answer

Place the function in a VPC.

Answer

Reduce the function timeout.

Question 12

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

Accepted Answer

The DynamoDB table's read capacity units are underprovisioned, causing throttling.. The most likely cause is that the DynamoDB table's read capacity units are underprovisioned, leading to throttling (ProvisionedThroughputExceededException). When DynamoDB throttles requests, the Lambda function must retry them, which adds latency and can cause the function to exceed its 5-minute timeout. Since the code hasn't changed, this points to a scaling or capacity issue on the DynamoDB side.

Answer

The SQS queue's visibility timeout is too short, causing duplicate processing.

Answer

The Lambda function's memory is too low, causing CPU throttling.

Answer

The DynamoDB table's indexes are missing, causing full table scans.

Question 13

A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing sensitive configuration parameters such as database credentials and API keys throughout their lifecycle. It offers automatic rotation of secrets with built-in integration for Amazon RDS, Redshift, and DocumentDB, and enforces fine-grained access control via IAM policies. This makes it the most suitable service for the developer's requirement of securely storing and managing database credentials and API keys for a Lambda function.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 14

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a deploy action that uses AWS CloudFormation to create the S3 bucket and upload files. The developer notices that the deploy action fails intermittently with a 'BucketAlreadyExists' error. What is the most likely cause?

Accepted Answer

The S3 bucket name is already taken by another AWS account.. The 'BucketAlreadyExists' error occurs when an S3 bucket name is globally unique across all AWS accounts. If the bucket name specified in the CloudFormation template has already been claimed by another AWS account, the deployment will fail intermittently if the bucket is deleted and recreated or if the pipeline runs in a different region where the name is taken. This is a common issue when using hardcoded or non-unique bucket names.

Answer

The S3 bucket has versioning enabled.

Answer

The CloudFormation template has incorrect IAM permissions.

Answer

The S3 bucket policy is too restrictive.

Question 15

A company wants to audit access to their S3 buckets. Which TWO services can be used to log and monitor S3 API calls?

Accepted Answer

S3 server access logs. S3 server access logs (Option B) provide detailed records about requests made to an S3 bucket, including object-level API calls. AWS CloudTrail (Option C) logs management events for S3, such as bucket creation or configuration changes, and can also be configured to log data events for object-level operations. Option A (AWS Config) is used for resource configuration tracking, not API call logging. Option D (AWS KMS) manages encryption keys. Option E (Amazon CloudWatch Logs) can store logs but does not directly capture S3 API calls; it works with CloudTrail or other sources.

Answer

AWS Config

Answer

AWS KMS

Answer

Amazon CloudWatch Logs