DVA-C02 Practice Test 4 — 10 Questions

Question 1

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

Accepted Answer

The bucket policy denies the upload. The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer

The user needs s3:PutObjectAcl permission

Answer

The policy does not allow s3:ListBucket

Answer

The user does not have s3:GetObject permission

Question 2

A developer is building a serverless API using Amazon API Gateway and AWS Lambda. The API accepts JSON payloads in the request body. The developer wants to ensure that incoming requests have a valid structure before being passed to the Lambda function to reduce unnecessary invocations. Which API Gateway feature should the developer use?

Accepted Answer

Request validation using models and request validators. API Gateway's request validation feature allows you to define a JSON Schema model for the request body and attach a request validator to the method. This validates the payload structure before the request reaches the Lambda function, preventing invalid payloads from triggering unnecessary invocations and reducing costs.

Answer

Usage plans with API keys

Answer

WAF (AWS WAF) integration

Answer

Custom authorizer (Lambda authorizer)

Question 3

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 4

A developer notices that an AWS Lambda function is timing out after 15 seconds. The function makes HTTP requests to an external API. How can the developer resolve this issue without changing the function code?

Accepted Answer

Increase the timeout setting of the Lambda function. The Lambda function is timing out because its configured execution timeout (15 seconds) is too short for the HTTP requests to the external API to complete. Increasing the timeout setting (up to the maximum limit of 15 minutes) allows the function to run longer and wait for the API response, resolving the timeout without modifying the code. This is a configuration change in the Lambda function settings, not a code change.

Answer

Increase the reserved concurrency

Answer

Place the Lambda function in a VPC

Answer

Decrease the memory allocation of the Lambda function

Question 5

A developer is building a serverless application that processes images uploaded to an S3 bucket. The bucket triggers a Lambda function that creates a thumbnail and stores it in another S3 bucket. The developer notices that the Lambda function is invoked multiple times for the same object, causing duplicate thumbnails. What is the MOST likely cause?

Accepted Answer

S3 event notifications are eventually consistent and may deliver duplicates.. Amazon S3 event notifications are designed to provide at-least-once delivery. This means that while most events are delivered exactly once, duplicate event notifications can occasionally occur. To handle this, the Lambda function should be designed to be idempotent, ensuring that processing the same event multiple times does not cause unintended side effects (like duplicate thumbnails).

Answer

The Lambda function is configured with a DLQ that causes retries.

Answer

The Lambda function is idempotent and should handle duplicates.

Answer

The S3 bucket has multiple event notifications that trigger the same Lambda function.

Question 6

A developer invokes an AWS Lambda function and receives a timeout error. The function is configured with a 3-second timeout. The developer needs to process data that sometimes takes up to 10 seconds. What should the developer do?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error indicates the Lambda function is timing out because its configured timeout of 3 seconds is insufficient for processing that sometimes takes up to 10 seconds. Option B directly addresses this by increasing the timeout to 10 seconds, which is within the maximum Lambda timeout of 15 minutes (900 seconds). This ensures the function can complete its execution without being prematurely terminated.

Answer

Change the invocation type to Event (async).

Answer

Increase the memory allocation for the Lambda function.

Answer

Set reserved concurrency to 1.

Question 7

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

Accepted Answer

Noncurrent versions of objects are deleted 30 days after they become noncurrent.. The CloudFormation template defines an S3 Lifecycle rule with `NoncurrentVersionExpiration` set to 30 `NoncurrentDays`. This rule specifically targets noncurrent versions of objects, meaning that after an object version becomes noncurrent (e.g., due to a PUT or DELETE of the current version), that noncurrent version will be permanently deleted 30 days later. The `Status: Enabled` ensures the rule is active, and versioning is enabled via the `VersioningConfiguration` property.

Answer

The bucket will have versioning disabled because the rule conflicts.

Answer

Current versions are transitioned to another storage class after 30 days.

Answer

Objects are automatically deleted after 30 days.

Question 8

A developer is creating an AWS Lambda function that processes files uploaded to an S3 bucket. The developer wants to invoke the Lambda function automatically when a new file is uploaded. Which approach should the developer use?

Accepted Answer

Configure S3 event notifications to invoke the Lambda function directly.. S3 can directly invoke a Lambda function via S3 event notifications. When a new object is created in the bucket, S3 publishes a notification with the event type `s3:ObjectCreated:*` and the Lambda function is triggered asynchronously. This is the simplest and most direct integration for this use case, requiring no intermediate services.

Answer

Use Amazon API Gateway to expose an endpoint and have S3 call it.

Answer

Configure S3 to send events to an SQS queue, and configure Lambda to poll the queue.

Answer

Use Amazon CloudWatch Events to trigger Lambda on S3 PUT events.

Question 9

A developer is deploying an application using AWS CloudFormation. The template includes an AWS::Lambda::Function resource. The developer wants to ensure that the Lambda function's code is automatically updated when the source code in S3 changes. Which approach should the developer use?

Accepted Answer

Specify the S3 object version in the template and update the version number in the template when code changes.. AWS CloudFormation detects changes to the `AWS::Lambda::Function` resource's `Code` property only when the properties defined in the template (such as `S3Key` or `S3ObjectVersion`) change. If you upload a new deployment package to S3 using the same bucket and key, CloudFormation will not detect any change and will not update the Lambda function. To resolve this, you should enable S3 Versioning on the bucket, specify the `S3ObjectVersion` in the CloudFormation template, and update this version parameter in the template whenever the code is updated.

Answer

Use the AWS::Lambda::Version resource to create a new version.

Answer

Include the S3 bucket and key as template parameters and update the stack with a new key when code changes.

Answer

Use a custom resource backed by a Lambda function that polls S3 for changes.

Question 10

A company runs an application on Amazon EC2 instances that need to read data from an Amazon DynamoDB table. The developer must grant access to DynamoDB without storing any long-term credentials on the instance. Which approach should the developer use?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the AWS access key and secret key in a configuration file.

Answer

Use an IAM user and store credentials in AWS Secrets Manager.

Answer

Use the DynamoDB table's resource-based policy to allow the EC2 instance.