DVA-C02 Practice Test 48 — 15 Questions

Question 1

A developer is deploying a new version of a Lambda function using AWS CodeDeploy with a linear canary deployment. The function is part of a serverless application. After the deployment starts, the developer notices that the new version is receiving only 10% of traffic initially, but after 10 minutes, the traffic increases to 100%. What should the developer do to ensure a more gradual traffic shift?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes instead of canary.. The developer is using a canary deployment configuration that shifts 10% of traffic immediately and then waits 10 minutes before shifting to 100%. To achieve a more gradual traffic shift, the developer should modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes, which will increment traffic by 10% every 5 minutes, taking 50 minutes to reach 100%.

Answer

Use Lambda function aliases with weighted traffic shifting.

Answer

Use multiple Lambda function versions and update the alias gradually.

Answer

Configure AWS CloudFormation to update the Lambda alias.

Question 2

A company uses AWS Elastic Beanstalk to deploy a web application. The developer has updated the application code and wants to deploy the new version with a rolling deployment strategy to minimize downtime. Which configuration should the developer use?

Accepted Answer

Set the deployment policy to 'Rolling'. The 'Rolling' deployment policy in AWS Elastic Beanstalk updates instances in batches, moving the new application version into a subset of instances while keeping the rest serving traffic, which minimizes downtime by ensuring capacity is never fully reduced. This is the correct choice for a rolling update that balances speed and availability without requiring a full parallel environment.

Answer

Set the deployment policy to 'Immutable'

Answer

Set the deployment policy to 'All at once'

Answer

Set the deployment policy to 'Blue/green'

Question 3

A company is deploying a critical application using AWS CloudFormation. The stack contains a resource that, if deleted accidentally, would cause data loss. The company wants to protect this resource from being deleted during stack updates or deletions. Which THREE strategies can achieve this? (Choose THREE.)

Accepted Answer

Enable termination protection on the CloudFormation stack.. The correct strategies to protect a resource from accidental deletion during stack updates or deletions are: Enable termination protection on the CloudFormation stack (Option B) prevents the entire stack from being deleted, thus protecting all resources. Use a stack policy to deny delete actions on the resource (Option D) can explicitly deny updates or deletions to specific resources. Set the DeletionPolicy attribute to 'Retain' on the resource (Option E) ensures the resource is retained even if the stack is deleted. Option A is incorrect because wrapping a resource in a nested stack does not inherently protect it from deletion; the nested stack itself could be deleted. Option C is incorrect because UpdateReplacePolicy only affects behavior during stack updates that replace the resource, not during deletions; it is used to retain the old resource when a replacement occurs, but does not prevent deletion during stack deletion.

Answer

Wrap the resource in a nested stack.

Answer

Set the UpdateReplacePolicy attribute to 'Retain' on the resource.

Question 4

A developer is deploying a containerized application on Amazon ECS with Fargate. The application requires access to an Amazon RDS database. The developer needs to securely pass database credentials to the container. Which THREE methods can the developer use?

Accepted Answer

Store the credentials in AWS Systems Manager Parameter Store and reference the parameter in the task definition.. AWS Systems Manager Parameter Store allows you to securely store database credentials as parameters and reference them directly in the ECS task definition using the 'secrets' field. This enables Fargate to inject the credentials as environment variables at container startup without exposing them in plaintext.

Answer

Hardcode the credentials in the container image.

Answer

Define environment variables in the task definition with the credentials.

Question 5

A developer needs to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon Elastic File System (EFS). Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances across different Availability Zones. This makes it the ideal choice for shared persistent storage when containers running on separate EC2 instances need to access the same data simultaneously.

Answer

Amazon S3

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon RDS

Question 6

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 read and 5 write capacity units (RCU/WCU). What is the most effective action to reduce the function's execution time?

Accepted Answer

Increase the DynamoDB table's read and write capacity units.. The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient read and write capacity units. This throttling causes the function to retry operations, significantly increasing execution time. Increasing the RCU/WCU from 5 to a higher value directly addresses the bottleneck, allowing operations to complete without retries and reducing overall execution time.

Answer

Increase the Lambda function's memory allocation.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the Lambda function's timeout.

Question 7

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is configured with a reserved concurrency of 10. The SQS queue receives a burst of 1000 messages. The Lambda function processes each message in about 5 seconds. What is the most likely behavior of the system?

Accepted Answer

Lambda processes up to 10 messages concurrently, and the rest remain in the queue until processing capacity is available.. Lambda's reserved concurrency of 10 caps the maximum number of concurrent executions. When the SQS queue receives 1000 messages, Lambda polls the queue and invokes the function with up to 10 messages at a time (based on batch size, default 1). The remaining messages stay in the queue and are retried after the visibility timeout expires, as Lambda processes messages in batches limited by the reserved concurrency.

Answer

Lambda rejects the messages and sends them to the dead-letter queue.

Answer

Lambda automatically scales up to 1000 concurrent executions to process all messages quickly.

Answer

Lambda increases the reserved concurrency to accommodate the burst.

Question 8

A developer is using AWS Elastic Beanstalk to deploy a web application. The application experiences high latency during peak hours. The developer wants to scale the application automatically based on CPU utilization. Which configuration should the developer use?

Accepted Answer

Configure an Auto Scaling simple scaling policy based on Average CPU Utilization > 70% for scale-out and < 30% for scale-in.. AWS Elastic Beanstalk integrates with Auto Scaling to automatically adjust the number of EC2 instances based on a simple scaling policy that uses the Average CPU Utilization metric. By setting a scale-out threshold at >70% and a scale-in threshold at <30%, the application can dynamically handle peak-hour traffic while reducing costs during low usage. This directly addresses the developer's requirement to scale based on CPU utilization.

Answer

Configure an Auto Scaling step scaling policy based on MemoryReservation metric.

Answer

Use AWS CloudFront to cache responses and reduce load on the application.

Answer

Configure an Auto Scaling target tracking policy based on NetworkIn metric.

Question 9

A developer is troubleshooting a DynamoDB table that is experiencing high write throttling (ProvisionedThroughputExceededException) on certain days. The table has provisioned write capacity of 1000 WCU. The table has a partition key of 'user_id' which is a UUID. The table is accessed by multiple services. CloudWatch metrics show that the WriteThrottleEvents are spiking during specific hours, and the ConsumedWriteCapacityUnits often reaches 1000. What is the most likely cause of the throttling?

Accepted Answer

The provisioned write capacity is insufficient to handle the traffic spikes.. The ConsumedWriteCapacityUnits consistently reaches the provisioned 1000 WCU during specific hours, and WriteThrottleEvents spike at those same times. This indicates that the provisioned capacity is insufficient to handle peak traffic, causing requests to be throttled. The partition key (UUID) is well-distributed, so a hot partition is unlikely.

Answer

The partition key is not distributed evenly, causing a hot partition.

Answer

The table does not have DynamoDB Accelerator (DAX) enabled.

Answer

The table is configured with eventual consistency, which throttles writes.

Question 10

A developer needs to store application logs from multiple EC2 instances in a centralized location for analysis. The logs should be retained for 90 days. Which AWS service should be used to collect and store the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct service for collecting, monitoring, and storing application logs from EC2 instances in a centralized location. It integrates directly with the CloudWatch Logs agent (or unified CloudWatch agent) installed on EC2 instances to stream log data, and it supports configurable retention policies, including a 90-day retention period. This makes it the ideal choice for centralized log storage and analysis without requiring additional infrastructure.

Answer

Amazon Kinesis Data Firehose

Answer

AWS CloudTrail

Answer

Amazon S3 with S3 Server Access Logs

Question 11

A developer is creating an AWS Lambda function that processes events from an Amazon S3 bucket. The function writes logs to Amazon CloudWatch Logs. The developer wants to ensure that the Lambda function has the minimum required permissions. Which IAM policy should be attached to the Lambda execution role?

Accepted Answer

A policy that includes 'logs:CreateLogGroup', 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:GetObject' on the specific bucket.. It grants the minimum required permissions for the Lambda function to read objects from the specific S3 bucket (s3:GetObject) and to write logs to CloudWatch Logs (logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents). The s3:GetObject action is necessary to process events from S3, and the three logs actions are the minimum needed for the Lambda runtime to create a log group, create a log stream, and write log events. This policy follows the principle of least privilege by scoping permissions to the specific bucket and avoiding wildcards.

Answer

A policy that includes 'logs:CreateLogStream', 'logs:PutLogEvents', and 's3:*' on the bucket.

Answer

A policy that includes 'logs:*' and 's3:*' on the bucket.

Answer

A policy that includes 'logs:PutLogEvents' and 's3:ListBucket' on the bucket.

Question 12

A developer notices that an AWS Lambda function, configured to access an Amazon RDS database in the same VPC, is timing out. The function has a 30-second timeout. CloudWatch Logs show that the function starts execution but never reaches the database. The VPC configuration includes private subnets without a NAT gateway. The RDS database is in the same VPC. What is the most likely cause of the timeout?

Accepted Answer

The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.. The Lambda function is timing out when trying to connect to the RDS database, which is in the same VPC. The most likely cause is that the RDS database's security group does not have an inbound rule allowing traffic from the Lambda function's security group on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this rule, the TCP connection attempt is silently dropped or rejected, causing the Lambda function to wait until its 30-second timeout expires.

Answer

The Lambda function does not have internet access because it is in a VPC without a public IP.

Answer

The Amazon RDS database is not publicly accessible and the Lambda function cannot resolve the database endpoint.

Answer

The VPC does not have a VPC endpoint for Amazon RDS, and the Lambda function cannot access the database through the NAT gateway.

Question 13

A developer wants to deploy a serverless application using AWS CloudFormation. The application consists of an API Gateway, Lambda functions, and DynamoDB tables. The developer wants to ensure that the stack can be updated without resource interruption when possible. Which CloudFormation feature should the developer use?

Accepted Answer

Use a Lambda alias with a DeploymentPreference update policy. The `DeploymentPreference` update policy on a Lambda alias enables canary, linear, or all-at-once traffic shifting during stack updates. This allows the developer to update Lambda function versions without interrupting existing invocations, as traffic is gradually routed to the new version while the old version continues to serve requests until the transition completes.

Answer

Use a ChangeSet to review changes before applying them

Answer

Use a StackPolicy to protect critical resources

Answer

Use a Custom Resource to manage updates

Question 14

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 15

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.