DVA-C02 Practice Test 45 — 15 Questions

Question 1

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 2

A developer is designing a serverless application that processes large files uploaded to Amazon S3. Each file can be up to 5 GB. The processing involves extracting metadata and generating thumbnails. The developer wants to minimize processing time and cost. Which approach should the developer take?

Accepted Answer

Use an S3 event notification to invoke a Lambda function that downloads the file, processes it, and uploads results.. S3 event notifications can trigger a Lambda function immediately after an object is uploaded. The Lambda function can download the file from S3, extract metadata and generate thumbnails, then store the results. This approach is serverless and cost-effective, as you pay only for compute time. While Lambda has execution time and memory limits, processing a 5 GB file for metadata and thumbnails can be optimized to fit within these limits, making it the most appropriate choice among the options.

Answer

Use S3 Object Lambda to process the object as it is being retrieved.

Answer

Use an S3 event notification to invoke a Lambda function that copies the object to an EC2 instance for processing.

Answer

Use AWS Fargate to run a container that polls S3 for new objects and processes them.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets across all accounts have server-side encryption enabled. They have created an SCP that denies the s3:PutBucketAcl action unless the request includes the x-amz-server-side-encryption header. However, some application teams report that they cannot create buckets even when they include the required header. What is the MOST likely cause of this issue?

Accepted Answer

The SCP is incorrectly targeting s3:PutBucketAcl instead of s3:CreateBucket.. The SCP denies s3:PutBucketAcl, not s3:CreateBucket. The SCP should deny s3:CreateBucket unless the encryption header is present. Option B is wrong because even if the SCP is not applied to the root OU, but only to specific accounts, it would still apply to those accounts; the issue is the action being denied, not the scope. Option C is wrong because if the condition key were misspelled, the condition would simply not be evaluated, and the deny would still block bucket creation despite the header being present. Option D is wrong because SCPs are evaluated before resource-based policies; if the SCP denies the action, the request fails regardless of any resource-based policy that might allow it.

Answer

The SCP is not applied to the root OU, only to specific accounts.

Answer

The condition key in the SCP is misspelled.

Answer

The SCP is being overridden by a resource-based policy on the S3 bucket.

Question 4

A developer is troubleshooting an AWS Lambda function that returns timeout errors when calling an external HTTPS API. The function is configured with a 30-second timeout and runs in a VPC with a public subnet and NAT Gateway. The developer checks CloudWatch logs and sees that the function is timing out at exactly 30 seconds. What is the most likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic.. Lambda functions running in a VPC do not automatically get internet access; they require a route to a NAT Gateway or NAT instance. Even with a NAT Gateway, the Lambda function's security group must allow outbound traffic (e.g., HTTPS on port 443) to reach the external API. Without this rule, outbound packets are dropped, causing the function to hang until the configured timeout (30 seconds) expires, resulting in a timeout error.

Answer

The NAT Gateway is not configured with a route to the internet.

Answer

The external API's response time exceeds 30 seconds.

Answer

The Lambda function's VPC does not have an internet gateway.

Question 5

A developer is troubleshooting performance issues in an application that uses Amazon DynamoDB as the primary data store. The application reads a large set of items using a Query operation on a Global Secondary Index (GSI). The developer notices high read latency and throttled requests on the GSI. The base table has sufficient read capacity. The GSI is projected with KEYS_ONLY. Which action would most likely reduce the latency and throttling?

Accepted Answer

Increase the read capacity units (RCU) of the GSI.. A Global Secondary Index (GSI) has its own provisioned read capacity, separate from the base table. When a Query operation reads from a GSI, it consumes RCUs from the GSI's capacity, not the base table's. Since the base table has sufficient read capacity but the GSI is experiencing throttling and high latency, increasing the GSI's RCU directly addresses the bottleneck by allowing more read requests per second against the index.

Answer

Increase the read capacity units (RCU) of the base table.

Answer

Change the GSI projection to ALL.

Answer

Create a Local Secondary Index instead.

Question 6

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout. Which action should be taken to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the rotation process, which indicates that the default 3-second timeout is insufficient for the rotation logic. Increasing the Lambda function timeout (Option B) directly addresses this by allowing the function more time to complete the rotation, such as calling the Secrets Manager API, updating the database, and verifying the new credentials.

Answer

Reduce the rotation schedule interval.

Answer

Place the Lambda function in a VPC with a NAT gateway.

Answer

Store the rotation schedule in EC2 user data.

Question 7

A company is using Amazon S3 to store large objects. Users report that uploads are slow. Which THREE actions should the developer take to optimize upload performance?

Accepted Answer

Use multipart upload for objects over 100 MB.. Multipart upload improves throughput for large objects over 100 MB by uploading parts in parallel. Option C is correct because S3 Transfer Acceleration uses CloudFront edge locations to reduce latency for uploads over long distances. Option E is correct because using multiple S3 prefixes (i.e., parallelizing requests across different key prefixes) can increase the request rate and overall throughput. Option B is incorrect because S3 Select is used to retrieve subsets of data from an object, not to upload. Option D is incorrect because transitioning to S3 Glacier is for data lifecycle management, not for improving upload performance.

Answer

Use S3 Select to upload only specific parts of the object.

Answer

Transition objects to S3 Glacier after upload.

Question 8

A developer is troubleshooting performance issues in an application that uses Amazon ElastiCache for Redis. The application experiences periodic latency spikes during peak hours. The developer checks CloudWatch metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster uses a single cache.t3.small node. Which action will most likely improve the cache hit rate and reduce latency?

Accepted Answer

Use a larger instance type. The symptoms—high evictions and low cache hit rate—indicate that the single cache.t3.small node is running out of memory. Using a larger instance type increases the available memory, allowing more data to be cached, reducing evictions, and improving the cache hit rate. This directly addresses the root cause of memory pressure without changing the cluster architecture or data expiration behavior.

Answer

Increase the number of replicas

Answer

Enable cluster mode and add more shards

Answer

Increase the TTL of cached items

Question 9

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.

Question 10

A developer notices that an AWS Lambda function processing S3 events is being retried frequently due to throttling errors from Amazon DynamoDB. The function writes records to a DynamoDB table and has reserved concurrency set to 100. The DynamoDB table uses on-demand capacity mode. What should the developer do to reduce retries and improve overall throughput?

Accepted Answer

Implement exponential backoff and retry in the Lambda function code for DynamoDB API calls.. Implementing exponential backoff and retry in the Lambda function code for DynamoDB API calls directly addresses the throttling errors. Even with on-demand capacity, DynamoDB can throttle requests if they exceed the table's burst capacity or if there are hot partitions. Exponential backoff reduces the retry rate, allowing DynamoDB to recover and improving overall throughput without changing the Lambda concurrency or capacity mode.

Answer

Increase the Lambda function's reserved concurrency to 500.

Answer

Disable the Lambda function's S3 event source mapping and use Amazon SQS to buffer events.

Answer

Switch the DynamoDB table to provisioned capacity with a high write capacity unit setting.

Question 11

A company has a Lambda function that processes records from an SQS queue. The function is failing intermittently with timeout errors. The processing time per record varies, but the SQS queue has a visibility timeout of 30 seconds. The Lambda function has a timeout of 1 minute. What is the MOST likely cause of the timeout errors?

Accepted Answer

The SQS visibility timeout is shorter than the Lambda function timeout.. When the SQS visibility timeout (30 seconds) is shorter than the Lambda function timeout (1 minute), the message becomes visible again in the queue before the function finishes processing it. This causes the same message to be picked up by another consumer (or the same Lambda invocation) while the original invocation is still running, leading to duplicate processing and eventual timeout errors as the function repeatedly attempts to process the same record.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The SQS queue has too many messages causing Lambda to throttle.

Answer

The SQS queue's default visibility timeout of 30 seconds is too long.

Question 12

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

Accepted Answer

aws lambda update-function-code. The `update-function-code` command updates the code of a Lambda function. Option B (`update-function-configuration`) updates configuration settings only, not the code. Option C (`invoke`) is for invoking the function, and option D (`create-function`) is for creating a new function, not updating an existing one.

Answer

aws lambda update-function-configuration

Answer

aws lambda invoke

Answer

aws lambda create-function

Question 13

A company is deploying a critical application using AWS CodeDeploy. To minimize downtime, they want to perform a blue/green deployment. Which TWO strategies should they implement?

Accepted Answer

Create an Elastic Load Balancer to route traffic between the blue and green environments.. Blue/green deployments with AWS CodeDeploy involve two environments: the current (blue) and the new (green). To minimize downtime, traffic must be seamlessly switched from blue to green. This is achieved by using an Elastic Load Balancer (ELB) to route traffic between the environments (option A). Additionally, the new instances must be registered with the target group before traffic is switched (option E). Option B (Route53 weighted routing) is not the primary mechanism; CodeDeploy leverages the ELB for traffic shifting. Option C (Lambda for A/B testing) is unrelated to blue/green deployment. Option D (CloudFront with multiple origins) can be used but is not a required strategy for CodeDeploy blue/green; it is more relevant for content delivery. Therefore, the correct strategies are A and E.

Answer

Use an Amazon Route 53 weighted routing policy to gradually shift traffic.

Answer

Configure an AWS Lambda function to perform A/B testing during deployment.

Answer

Use an Amazon CloudFront distribution with multiple origins.

Question 14

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The deployment must ensure zero downtime. Which ECS deployment configuration should be used?

Accepted Answer

Blue/green deployment using AWS CodeDeploy. Blue/green deployment using AWS CodeDeploy is correct because it creates a separate, fully functional replacement environment (green) alongside the existing one (blue), allowing traffic to be switched instantly after validation. This ensures zero downtime by avoiding in-place updates that could temporarily reduce capacity or serve errors during the transition. For ECS Fargate, CodeDeploy orchestrates the shift using an AppSpec file and can automatically roll back on health check failures.

Answer

Rolling update with a minimum healthy percent of 50% and maximum percent of 200%

Answer

Set the task placement strategy to REPLICA

Answer

Use the DAEMON scheduling strategy with a deployment circuit breaker

Question 15

Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?

Accepted Answer

S3 bucket/object access policy or IAM policy. When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.

Answer

CloudFront cache policy

Answer

Route 53 resolver rule policy