DVA-C02 Practice Test 42 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API requires that the same Lambda function handle different HTTP methods (GET, POST, DELETE) for the same resource. The developer wants to minimize code and configuration. Which integration type should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Lambda proxy integration. Lambda proxy integration (option A) is correct because it automatically passes the entire HTTP request (method, headers, query parameters, path parameters) to the Lambda function as a single event object, allowing the same function to inspect the `httpMethod` field and branch logic for GET, POST, DELETE without any additional API Gateway mapping or transformation configuration. This minimizes both code (the function handles routing internally) and configuration (no need to define separate integration requests/responses per method).

Answer

Lambda custom integration

Answer

HTTP integration

Answer

Mock integration

Question 2

A developer needs to grant least-privilege access to a Lambda function to write logs to CloudWatch Logs. Which IAM policy effect should be used?

Accepted Answer

Allow. IAM policies use the Effect element with valid values of Allow or Deny; to grant least-privilege access, the policy statement must specify Effect: Allow with the specific action logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents scoped to the function's log group. Allow is the only effect that grants permissions in an identity-based policy. Deny would explicitly block the action, which is the opposite of the requirement.

Answer

Always allow

Answer

Deny

Answer

Revoke

Question 3

A developer is building an API using Amazon API Gateway and AWS Lambda. The API must authenticate users using a third-party OAuth 2.0 provider. Which TWO components are required to implement this authentication?

Accepted Answer

The OAuth 2.0 access token in the Authorization header. Option D is correct because a Lambda authorizer (formerly a custom authorizer) is the API Gateway mechanism that lets you plug in custom authentication logic; the function receives the caller's token, validates it against the third-party OAuth 2.0 provider (e.g., by verifying the JWT signature or calling the provider's introspection endpoint), and returns an IAM policy that allows or denies the request. Option A is correct because the client must present the OAuth 2.0 access token to API Gateway, and the standard convention is to send it in the Authorization header (typically as 'Bearer <token>'), which is exactly what the Lambda authorizer reads to perform validation. Option B is not required because a CloudFront distribution is only an optional caching/edge layer and plays no role in OAuth 2.0 authentication. Option C is incorrect because resource policies control access to the API based on source IP, VPC endpoint, or AWS account/IAM principal, not by invoking a Lambda authorizer; the authorizer is attached via the API method's authorization settings. Option E is incorrect because the scenario specifies a third-party OAuth 2.0 provider, so an Amazon Cognito user pool is not needed and would instead make Cognito the identity provider.

Answer

Amazon CloudFront distribution for API caching

Answer

An API Gateway resource policy that invokes the Lambda authorizer

Answer

An Amazon Cognito user pool as the OAuth provider

Question 4

A developer wants a Lambda function to process SQS messages in batches but avoid losing the whole batch when only one record fails. Which feature should be enabled?

Accepted Answer

Partial batch response for SQS event source mapping. Partial batch response for SQS event source mapping allows the Lambda function to report which messages in a batch failed processing. When enabled, Lambda retries only the failed messages instead of the entire batch, preventing successful messages from being reprocessed or lost. This is achieved by returning a `batchItemFailures` array in the function's response, which tells Lambda which message IDs to retry.

Answer

Reserved concurrency of one

Answer

Maximum message size increase

Answer

SQS short polling

Question 5

A developer is troubleshooting an AWS Lambda function that times out when processing large files from Amazon S3. The function has a 15-minute timeout and 512 MB memory. What should the developer do to resolve this issue?

Accepted Answer

Increase the Lambda function memory to 3008 MB.. Increasing the Lambda function memory to 3008 MB is correct because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like file parsing. The 15-minute timeout is already the maximum, so the issue is insufficient compute resources, not timeout duration. With 512 MB, the function lacks the CPU throughput to process large files within the timeout, so boosting memory (and thus CPU) directly addresses the root cause.

Answer

Use Amazon S3 batch operations to split the files before processing.

Answer

Add an S3 Event Notification to trigger the function asynchronously.

Answer

Reduce the Lambda timeout to 5 minutes to force faster processing.

Question 6

A company has an S3 bucket that stores sensitive data. They want to ensure that any object uploaded to the bucket is automatically encrypted with server-side encryption using AWS KMS (SSE-KMS). They also want to deny any uploads that do not specify the correct encryption. Which bucket policy condition should be used to enforce this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals aws:kms. The condition `s3:x-amz-server-side-encryption equals aws:kms` enforces that any PUT request to the S3 bucket must include the `x-amz-server-side-encryption` header set to `aws:kms`, which triggers SSE-KMS encryption. This policy condition ensures that objects uploaded without specifying SSE-KMS are denied, meeting the requirement to automatically encrypt all uploaded objects with AWS KMS.

Answer

s3:x-amz-server-side-encryption equals AES256

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals a specific key ARN

Answer

aws:SecureTransport equals true

Question 7

A developer is using Amazon RDS for MySQL and notices that the database performance has degraded. The developer suspects that slow queries are the cause. Which THREE actions should the developer take to identify and address the slow queries?

Accepted Answer

Enable the slow query log in RDS and review the logs.. Option A is correct because enabling the MySQL slow query log on RDS captures queries exceeding long_query_time, and these logs can be downloaded or published to CloudWatch Logs for review to pinpoint offending SQL. Option C is correct because Performance Insights provides a database load view (DB load by wait event and SQL) so the developer can identify the top SQL statements and waits causing degradation. Option D is correct because RDS console CloudWatch metrics such as CPUUtilization and ReadIOPS/WriteIOPS help correlate resource saturation with suspected slow queries and confirm the bottleneck. Option B is not appropriate as a first step because resizing the instance masks symptoms without identifying the slow queries and may not resolve inefficient SQL. Option E is also not appropriate because a read replica offloads read traffic but does not diagnose or fix the slow queries themselves.

Answer

Increase the DB instance size to improve performance.

Answer

Create a read replica to offload read traffic.

Question 8

A developer needs to store application configuration settings that may change at runtime and wants to avoid redeploying the application. Which AWS service should be used?

Accepted Answer

AWS AppConfig. AWS AppConfig is purpose-built for managing application configuration that changes at runtime, supporting feature flags, dynamic configuration, and safe deployments with validation and rollback. It allows applications to fetch configuration via the AppConfig agent or API without redeploying, and integrates with CloudWatch alarms for automatic rollback on errors.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Secrets Manager

Answer

Amazon DynamoDB

Question 9

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API requires that the same Lambda function handle different HTTP methods (GET, POST, DELETE) for the same resource. The developer wants to minimize code and configuration. Which integration type should the developer use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it manages a pool of database connections, allowing Lambda functions to reuse them efficiently and avoid exhausting MySQL connection limits under high concurrency. It also enforces IAM authentication and securely stores credentials in AWS Secrets Manager, eliminating the need to hardcode database passwords in the function code.

Answer

NAT Gateway

Answer

VPC Endpoint

Answer

AWS PrivateLink

Question 10

A company is using AWS Lambda with a 1 GB memory configuration. The function processes large CSV files from S3 and occasionally times out after 15 seconds. The function currently uses synchronous invocation. What is the MOST cost-effective solution to handle larger files without losing data?

Accepted Answer

Increase the Lambda timeout to 15 minutes and keep memory at 1 GB.. Increasing the Lambda timeout from 15 seconds to 15 minutes directly addresses the timeout issue without incurring additional costs. Keeping memory at 1 GB avoids the higher per-GB-second cost of larger memory configurations, making it the most cost-effective solution. Lambda charges based on memory allocation and execution duration, so extending the timeout alone does not increase the cost per invocation if the function runs for the same duration.

Answer

Switch to asynchronous Lambda invocation to allow up to 15 minutes of processing.

Answer

Increase the Lambda memory to 3 GB to improve processing speed.

Answer

Use AWS Step Functions to orchestrate the processing in smaller chunks.

Question 11

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that uses Amazon S3. The developer updates a file in the S3 bucket, but the pipeline does not start automatically. What is the MOST likely cause?

Accepted Answer

Amazon S3 versioning is not enabled on the bucket.. CodePipeline requires S3 versioning to be enabled on the source bucket to automatically detect changes and start the pipeline. Without versioning, CodePipeline cannot uniquely identify new object versions, so it relies on manual or scheduled polling instead of event-based triggers. Enabling versioning ensures that each PUT operation generates a new version ID, which CodePipeline uses to invoke the pipeline automatically.

Answer

The IAM role for CodePipeline does not have s3:GetObject permission.

Answer

The pipeline is configured to use polling instead of event-based triggers.

Answer

AWS CloudTrail is not enabled.

Question 12

A company is deploying a microservices application on Amazon ECS using the Fargate launch type. The application includes a service that must process messages from an Amazon SQS queue. The developer wants to ensure that the service scales based on the number of messages in the queue. Which scaling solution should the developer implement?

Accepted Answer

Use Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task.. Amazon ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue backlog per task (calculated as ApproximateNumberOfMessages divided by the number of running tasks) directly correlates the number of ECS tasks to the queue depth. This ensures the service scales up when messages accumulate and scales down when the backlog clears, using a predefined or custom metric that reflects the workload.

Answer

Configure DynamoDB auto scaling to adjust read capacity based on queue depth.

Answer

Configure AWS Lambda with reserved concurrency and trigger it from the SQS queue.

Answer

Use Application Auto Scaling with a scheduled scaling policy to increase the number of tasks during peak hours.

Question 13

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

Accepted Answer

--log-type Tail. The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Answer

--client-context string

Answer

--qualifier alias

Answer

--invocation-type Event

Question 14

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 15

A developer is deploying a new version of an application to Amazon ECS using AWS CodeDeploy. The application uses a blue/green deployment strategy. After the deployment, traffic is automatically shifted to the new task set. However, the developer wants to test the new version with a small percentage of users before shifting all traffic. What should the developer do?

Accepted Answer

Use CodeDeploy to perform a canary deployment that shifts 10% of traffic initially.. CodeDeploy supports canary deployments for ECS, which allow you to shift a specified percentage of traffic to the new task set initially (e.g., 10%) and then, after a configured interval, shift the remaining traffic. This matches the requirement to test with a small percentage of users before shifting all traffic. Option B directly implements this canary strategy.

Answer

Create a new ECS task definition with a different CPU/memory allocation.

Answer

Configure the target group to route traffic to a specific task set.

Answer

Use ECS service auto scaling to gradually increase the number of tasks.