DVA-C02 Practice Test 43 — 15 Questions

Question 1

A company runs a Node.js application on AWS Elastic Beanstalk. The application experiences high latency during peak hours. The developer suspects that the environment's EC2 instances are under-provisioned. Which configuration change would MOST effectively address the latency issue with minimal cost increase?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Auto Scaling and configure scaling triggers based on CPU utilization.. Enabling Auto Scaling with CPU utilization triggers dynamically adds EC2 instances during peak hours, distributing the load and reducing latency without over-provisioning during off-peak times. This matches the symptom of under-provisioned instances and minimizes cost by scaling only when needed, unlike static solutions that waste resources.

Answer

Place the environment behind an Application Load Balancer.

Answer

Change the instance type to a larger size in the environment configuration.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 2

A developer is creating an IAM policy to allow a Lambda function to write logs to CloudWatch. Which policy should be attached to the Lambda execution role?

Accepted Answer

AWSLambdaBasicExecutionRole. The AWSLambdaBasicExecutionRole managed policy grants permissions for Lambda to write logs to CloudWatch Logs, specifically allowing the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions. This is the minimal set of permissions required for a Lambda function to send execution logs to CloudWatch, making it the correct choice for this use case.

Answer

AdministratorAccess

Answer

AmazonDynamoDBFullAccess

Answer

AmazonS3FullAccess

Question 3

Which TWO deployment methods can be used to update an AWS Lambda function with no downtime? (Select TWO.)

Accepted Answer

Use a weighted alias to gradually shift traffic to a new version.. A weighted alias allows you to route a small percentage of traffic to a new Lambda version while keeping the majority on the current version, enabling canary deployments with zero downtime. Option C is correct because creating a new version and updating the alias to point to it performs an instant, atomic switch, ensuring all traffic is served by the new version without any interruption.

Answer

Update the function code using update-function-code.

Answer

Create a new Lambda function and delete the old one.

Answer

Update the function configuration to increase memory.

Question 4

A developer is deploying a serverless application using AWS SAM. The developer wants to define a Lambda function that is invoked by an Amazon API Gateway REST API. Which SAM resource type should the developer use to define the API?

Accepted Answer

AWS::Serverless::Api. AWS::Serverless::Api defines an API Gateway REST API in SAM. Option A is wrong because AWS::Serverless::SimpleTable defines a DynamoDB table, not an API. Option C is wrong because AWS::ApiGateway::RestApi is a raw CloudFormation resource, not a SAM shorthand resource type. Option D is wrong because AWS::Serverless::Function defines a Lambda function, not an API.

Answer

AWS::Serverless::SimpleTable

Answer

AWS::ApiGateway::RestApi

Answer

AWS::Serverless::Function

Question 5

A developer is deploying a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party OIDC provider. The developer wants to minimize latency and avoid managing sessions. What is the BEST approach to achieve this?

Accepted Answer

Use Amazon Cognito User Pools with the OIDC identity provider and integrate with API Gateway.. Amazon Cognito User Pools natively support OIDC identity providers as federated IdPs, and API Gateway can use a Cognito User Pool authorizer to validate the resulting JWT tokens at the edge with minimal latency and no session management. This offloads authentication to a managed service, satisfying the requirements for third-party OIDC auth, low latency, and statelessness.

Answer

Use Lambda@Edge to validate tokens at CloudFront edge locations.

Answer

Use Amazon Cognito Identity Pools with the OIDC provider.

Answer

Implement a custom Lambda authorizer in API Gateway to validate tokens.

Question 6

A developer is building a REST API using Amazon API Gateway and wants to validate the incoming request body against a JSON schema before passing the request to the backend Lambda function. Which API Gateway feature should the developer use?

Accepted Answer

Request validation. API Gateway's request validation feature allows you to define a JSON schema (using JSON Schema Draft 4) for the request body and automatically reject requests that do not conform before they reach the backend. This offloads validation from the Lambda function, reducing cold start overhead and ensuring only valid payloads are processed. The developer can configure this in the API Gateway console or via the OpenAPI specification.

Answer

Mapping templates

Answer

Integration request

Answer

Stage variables

Question 7

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent errors where some requests return HTTP 503 (Service Unavailable) errors. The developers have verified that the application code is healthy and the EC2 instances pass health checks. The ALB health check is configured to hit a specific endpoint (/health) with a healthy threshold of 2 and an unhealthy threshold of 2. The health check interval is 30 seconds, and the timeout is 5 seconds. The application's /health endpoint sometimes takes up to 6 seconds to respond due to a dependency on a third-party service. The developers want to minimize the 503 errors without changing the application code. Which action should the developer take?

Accepted Answer

Increase the health check timeout to 10 seconds to accommodate the slow /health endpoint.. Increasing the health check timeout to 10 seconds allows the /health endpoint to respond within the timeout period, preventing the ALB from marking the instance as unhealthy due to a slow response. Since the endpoint sometimes takes up to 6 seconds, a 5-second timeout is too short, causing health checks to fail intermittently. By increasing the timeout, the health checks will succeed, and the ALB will not remove the instance from service, thus reducing 503 errors.

Answer

Decrease the unhealthy threshold to 1 so that instances are marked unhealthy after one failed health check.

Answer

Increase the deregistration delay to 300 seconds to allow connections to drain.

Answer

Decrease the health check interval to 10 seconds to detect health changes faster.

Question 8

A developer attached the IAM policy above to an IAM user. What is the effect when the user tries to download an object from the 'confidential' folder in 'example-bucket'?

Accepted Answer

The user is denied access because of the explicit Deny statement. In AWS IAM, an explicit Deny statement always overrides any Allow statement, regardless of order or specificity. The policy includes a Deny for s3:* on the confidential folder, so the user is denied access to download objects there even if a separate Allow exists.

Answer

The policy is invalid because Deny cannot be used with s3:*

Answer

The user can download only if the object is encrypted

Answer

The user can download the object because of the Allow statement

Question 9

A developer is using AWS CodeDeploy to deploy an application to an EC2 instance. The deployment fails with the error 'The overall deployment failed because the deployment group did not have enough instances to successfully deploy.' What is the most likely cause?

Accepted Answer

The deployment group contains zero instances.. The error message 'the deployment group did not have enough instances to successfully deploy' is CodeDeploy's way of saying it could not find any healthy target instances matching the deployment group's criteria. When a deployment group contains zero registered EC2 instances (or none matching the tag/ASG filters), CodeDeploy has nothing to deploy to and fails immediately with this exact error. The fix is to verify the deployment group's tag filters or Auto Scaling group association and ensure at least one instance is registered and healthy.

Answer

The revision has an incorrect file format.

Answer

The CodeDeploy agent on the instance is not running.

Answer

The appspec file contains an invalid lifecycle hook.

Question 10

A developer runs the AWS CLI command shown in the exhibit. The output includes 'FunctionError': 'Unhandled'. What does this indicate?

Accepted Answer

The function threw an unhandled exception.. 'Unhandled' indicates that the function code threw an exception that was not caught by any try-catch block. Option A is incorrect because a caught error would typically result in a 'Handled' status in the function logs, not 'Unhandled'. Option B is incorrect because a timeout error would produce a different error message, such as 'Task timed out', not 'Unhandled'. Option D is incorrect because an invocation failure (e.g., permissions or configuration issues) would result in an error before the function runs, not an 'Unhandled' function error.

Answer

The function threw an error that was caught by the code.

Answer

The function timed out.

Answer

The function was not invoked successfully.

Question 11

A developer needs to encrypt secrets such as database passwords used by an application running on EC2. Which AWS service should be used to securely store and rotate these secrets?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate secrets such as database passwords, API keys, and other credentials. It integrates natively with AWS services like RDS, Redshift, and DocumentDB to enable automatic rotation of secrets without custom code, and it enforces encryption at rest using AWS KMS. This makes it the ideal service for the use case described, where secrets must be both stored securely and rotated automatically.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

AWS Systems Manager Parameter Store

Question 12

A mobile application must let authenticated users upload only to their own S3 prefix. Which approach best follows least privilege?

Accepted Answer

Use Cognito identity credentials with an IAM policy scoped to the user's prefix using policy variables. It uses Amazon Cognito identity pools to issue temporary AWS credentials scoped to a specific S3 prefix via IAM policy variables (e.g., `${cognito-identity.amazonaws.com:sub}`). This ensures each authenticated user can only upload to their own prefix (e.g., `uploads/${user_id}/`), adhering to the principle of least privilege by granting no more access than necessary.

Answer

Use a single hardcoded access key in the app

Answer

Make the bucket public and validate names in the client

Answer

Give every user AmazonS3FullAccess

Question 13

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

Accepted Answer

The DynamoDB table's read capacity units are underprovisioned, causing throttling.. The most likely cause is that the DynamoDB table's read capacity units are underprovisioned, leading to throttling (ProvisionedThroughputExceededException). When DynamoDB throttles requests, the Lambda function must retry them, which adds latency and can cause the function to exceed its 5-minute timeout. Since the code hasn't changed, this points to a scaling or capacity issue on the DynamoDB side.

Answer

The SQS queue's visibility timeout is too short, causing duplicate processing.

Answer

The Lambda function's memory is too low, causing CPU throttling.

Answer

The DynamoDB table's indexes are missing, causing full table scans.

Question 14

A company has a web application running on Amazon ECS with Fargate launch type. The application needs to store and retrieve user session data. The sessions are small and require very low latency access. The development team wants a fully managed solution. Which storage options meet these requirements? (Choose TWO.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is correct because it is a fully managed NoSQL key-value database that provides single-digit millisecond latency for read and write operations, making it ideal for storing small session data with low latency requirements. It scales automatically and requires no server management, aligning with the fully managed requirement and the Fargate launch type's serverless nature.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for PostgreSQL

Question 15

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline includes a deploy action that uses AWS CloudFormation to create the S3 bucket and upload files. The developer notices that the deploy action fails intermittently with a 'BucketAlreadyExists' error. What is the most likely cause?

Accepted Answer

The S3 bucket name is already taken by another AWS account.. The 'BucketAlreadyExists' error occurs when an S3 bucket name is globally unique across all AWS accounts. If the bucket name specified in the CloudFormation template has already been claimed by another AWS account, the deployment will fail intermittently if the bucket is deleted and recreated or if the pipeline runs in a different region where the name is taken. This is a common issue when using hardcoded or non-unique bucket names.

Answer

The S3 bucket has versioning enabled.

Answer

The CloudFormation template has incorrect IAM permissions.

Answer

The S3 bucket policy is too restrictive.