DVA-C02 Practice Test 49 — 15 Questions

Question 1

Which TWO actions can help reduce the cold start time for an AWS Lambda function? (Choose 2)

Accepted Answer

Increase the function's memory allocation. Options B and D are correct. Increasing the function's memory allocation also increases CPU and network throughput, which can speed up initialization and reduce cold start time. Implementing a scheduled CloudWatch Event to invoke the function every 5 minutes keeps the function warm by preventing the container from being reclaimed, minimizing cold starts. Option A is incorrect because placing the function in a VPC adds latency due to ENI creation, increasing cold start time. Option C is incorrect because a larger deployment package increases download time, worsening cold starts. Option E is incorrect because provisioned concurrency eliminates cold starts entirely, but it's a different solution that requires additional cost; the question asks for actions that reduce cold start time, and provisioned concurrency is a separate feature.

Answer

Place the Lambda function in a VPC

Answer

Use a larger deployment package with all dependencies included

Answer

Use provisioned concurrency to pre-warm the function

Question 2

A company has a monolithic application running on an EC2 instance that needs to be migrated to a microservices architecture on AWS. The development team wants to use AWS services to handle service discovery, configuration management, and secrets management. Which combination of AWS services should the team use?

Accepted Answer

Use AWS Cloud Map for service discovery, AWS AppConfig for configuration, and AWS Secrets Manager for secrets.. AWS Cloud Map provides service discovery for microservices by registering service instances and enabling DNS-based or API-based resolution. AWS AppConfig manages application configuration with validation and controlled rollouts, and AWS Secrets Manager handles secrets management with automatic rotation and fine-grained access control. Together, these services meet the specific needs of service discovery, configuration management, and secrets management in a microservices architecture.

Answer

Use Amazon ECS Service Discovery for service discovery, AWS Config for configuration, and AWS Systems Manager Parameter Store for secrets.

Answer

Use AWS Cloud Map for service discovery, AWS Systems Manager Parameter Store for configuration, and AWS Secrets Manager for secrets.

Answer

Use AWS Service Discovery for service discovery, EC2 Image Builder for configuration, and AWS Key Management Service (KMS) for secrets.

Question 3

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an Amazon DynamoDB table and a Lambda function that reads from the table. The developer wants to define the DynamoDB table and the Lambda function in the SAM template. Which THREE resource types should the developer include in the template? (Choose THREE.)

Accepted Answer

AWS::DynamoDB::Table. The correct options are A (AWS::DynamoDB::Table), D (AWS::Serverless::SimpleTable), and E (AWS::Serverless::Function). In an AWS SAM template, you can define a DynamoDB table using either the standard CloudFormation resource AWS::DynamoDB::Table (for full control) or the SAM shorthand AWS::Serverless::SimpleTable (for simpler use cases). For a Lambda function, the recommended SAM resource is AWS::Serverless::Function, which provides additional SAM features like event mappings and policies. Option B (AWS::Lambda::Function) is a CloudFormation resource that could be used but is not the typical SAM choice; the question asks for resource types to include in a SAM template, so the serverless type is expected. Option C (AWS::Serverless::DynamoDB) is not a valid AWS resource type.

Answer

AWS::Lambda::Function

Answer

AWS::Serverless::DynamoDB

Question 4

A developer is using AWS Elastic Beanstalk to deploy a web application. The application is experiencing high latency. Which TWO steps should the developer take to troubleshoot and optimize the application?

Accepted Answer

Enable AWS X-Ray integration and analyze service maps.. AWS X-Ray integration provides tracing to identify bottlenecks in the application. Option C is correct because enhanced health reporting gives detailed environment health metrics for troubleshooting. Option A is wrong because an RDS read replica is for database read scaling, not directly for latency troubleshooting. Option D is wrong because increasing the instance type is a scaling solution, not a troubleshooting step. Option E is wrong because deploying to a different region does not address latency for existing users.

Answer

Configure an Amazon RDS read replica.

Answer

Increase the instance type to a larger size.

Answer

Deploy the application to a different AWS region.

Question 5

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which options are managed by AWS KMS? (Choose TWO.)

Accepted Answer

SSE-KMS. SSE-KMS (option B) is a server-side encryption option where AWS KMS manages the customer master key (CMK) used to encrypt S3 objects. Envelope encryption with KMS (option C) is the underlying mechanism used by SSE-KMS, where a data key is generated by KMS to encrypt the object, and that data key is then encrypted by the CMK. Both options involve AWS KMS managing the encryption keys, making them the correct choices for the question.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 6

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

Accepted Answer

Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.. Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Answer

Check that the application is using HTTPS instead of HTTP.

Answer

Check that the EC2 instance has permissions to decrypt the KMS key used by S3.

Answer

Check that the EC2 instance is in the same VPC as the S3 bucket.

Question 7

A developer is building a real-time chat application using WebSocket APIs in API Gateway and Lambda. The application must handle thousands of concurrent connections. Which TWO actions should the developer take to ensure the application scales properly?

Accepted Answer

Set the Lambda function's reserved concurrency to a high enough value.. Setting reserved concurrency ensures the Lambda function has enough allocated capacity to handle the high volume of concurrent WebSocket connections without being throttled by the account-level concurrency limit. Without reserved concurrency, the function could experience throttling errors (HTTP 429) during traffic spikes, causing dropped connections and poor user experience.

Answer

Use CloudFront to distribute the WebSocket endpoints.

Answer

Place the Lambda function in a VPC to improve security.

Answer

Enable API Gateway caching to reduce Lambda invocations.

Question 8

Match each AWS deployment strategy to its description.

Accepted Answer

Rolling deployment: Incrementally replaces instances of the previous version with new version instances.. Common deployment strategies include Rolling, Blue/Green, and Canary. Rolling deploys incrementally, Blue/Green switches between environments, and Canary tests with a small subset. Distractors often confuse these definitions.

Answer

Rolling deployment: Simultaneously updates all instances.

Answer

Canary deployment: Deploys to a full separate environment and then switches traffic.

Question 9

A company uses AWS CodePipeline with CodeBuild to test and deploy a web application. The pipeline has been failing at the deploy stage with an error: 'Access Denied'. CloudTrail shows the CodePipeline service role is making the call. What is the MOST likely cause?

Accepted Answer

The CodePipeline service role lacks permissions for the deploy action.. The error 'Access Denied' in the deploy stage, with CloudTrail showing the CodePipeline service role making the call, indicates that the IAM role assumed by CodePipeline does not have the necessary permissions to perform the deploy action against the target provider (e.g., ECS, S3, Elastic Beanstalk). CodePipeline uses its service role to invoke the deploy action, and if that role lacks the required `codedeploy:*`, `s3:PutObject`, or `ecs:UpdateService` permissions, the API call will be denied.

Answer

The CodeBuild project does not have internet access.

Answer

The deploy provider (e.g., ECS, S3) is not in the same AWS region.

Answer

The source code repository does not have the correct branch.

Question 10

A company uses AWS KMS customer master keys (CMKs) to encrypt sensitive data in Amazon S3. A compliance requirement mandates that the backing keys for the CMKs be automatically rotated every year. The developer must implement this with minimal operational overhead. Which solution meets the requirement?

Accepted Answer

Enable automatic key rotation for the CMK in AWS KMS.. AWS KMS supports automatic key rotation for customer managed CMKs. When enabled, KMS automatically rotates the backing key annually (approximately every 365 days) with no additional operational overhead. This satisfies the compliance requirement for yearly rotation without manual intervention.

Answer

Create a new CMK every year and update the S3 bucket policy to use the new key.

Answer

Use an AWS managed key (aws/s3) which automatically rotates annually.

Answer

Use SSE-S3 encryption with automatically rotated keys instead of KMS.

Question 11

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

Accepted Answer

The SQS visibility timeout is too short for the Lambda function's execution time.. When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Answer

The Lambda function's reserved concurrency is set too high.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The Lambda function's batch size is set to more than 1.

Question 12

A developer is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database. The developer wants to use Amazon RDS for the database and needs to ensure that each microservice can only access its own set of tables. Which approach should the developer take?

Accepted Answer

Use RDS with IAM database authentication and create database users with limited privileges for each microservice.. IAM database authentication allows the developer to create database users with granular, table-level privileges using standard SQL GRANT statements, ensuring each microservice can only access its own set of tables. By combining IAM roles with database user credentials, the developer can enforce least-privilege access without sharing a single database user across services. This approach directly addresses the requirement for per-microservice table isolation while leveraging RDS's native authentication and authorization capabilities.

Answer

Create a single RDS instance with a separate database per microservice.

Answer

Use RDS in a VPC and restrict network access per microservice using security groups.

Answer

Use Amazon RDS Proxy to control access.

Question 13

A development team uses AWS Elastic Beanstalk to deploy a web application. They want to perform a blue/green deployment to minimize downtime. What should they do to implement this?

Accepted Answer

Create a new environment, deploy the new version, and then swap the environment URLs.. Blue/green deployment in Elastic Beanstalk is achieved by creating a separate environment (the green environment) with the new application version, then swapping the CNAME records (URLs) of the two environments. This instantly routes traffic from the old (blue) environment to the new (green) environment with zero downtime, and allows quick rollback by swapping back.

Answer

Create an Auto Scaling group and manually replace instances.

Answer

Update the existing environment with the new version and set the deployment policy to 'Rolling'.

Answer

Use AWS CodeDeploy to perform a blue/green deployment on the EC2 instances.

Question 14

A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks permissions to write to CloudWatch Logs.. The most likely cause is that the Lambda execution role lacks the necessary IAM permissions to write logs to CloudWatch Logs. Without permissions such as `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`, the Lambda function cannot create the log group or stream, nor can it write log events, resulting in 0 stored bytes despite successful invocations.

Answer

The CloudWatch Logs log group does not exist.

Answer

The Lambda function is failing before any logging code is executed.

Answer

The Lambda function is configured to use a different log group name.

Question 15

A team is using AWS CodeBuild to compile and test code. The build takes longer than expected. The team wants to reduce build times by caching dependencies. Which option should the team use to cache dependencies in CodeBuild?

Accepted Answer

Local caching or Amazon S3 caching. AWS CodeBuild supports two caching modes: local caching and Amazon S3 caching. Local caching stores dependencies on the build host's local file system, while S3 caching stores them in an S3 bucket. Both options reduce build times by reusing previously downloaded dependencies across builds, avoiding redundant downloads.

Answer

Amazon DynamoDB

Answer

Amazon EFS

Answer

Amazon ECR