DVA-C02 Practice Exam 51 — 20 Questions

Question 1

A developer is building a serverless application using AWS SAM that includes an API Gateway REST API and a Lambda function. The developer wants to pass environment variables to the Lambda function based on the deployment stage (dev/prod). The stage name is provided as a SAM parameter. How should the developer define this in the SAM template?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define a SAM Parameter for the stage name, and reference it in the Lambda function's Environment property. AWS SAM allows you to define parameters (e.g., StageName) and reference them directly in the Lambda function's Environment property using CloudFormation intrinsic functions like !Ref. This enables dynamic injection of environment variables based on the deployment stage without modifying the template structure, aligning with Infrastructure as Code best practices for multi-environment deployments.

Answer

Use the Globals section of the SAM template to set environment variables

Answer

Hard-code the environment variables with different values in the template

Answer

Use an AWS Systems Manager Parameter Store parameter and reference it in the function

Question 2

A developer is building a multi-region application using Amazon DynamoDB global tables. The application needs to read data from a replica table in a different region shortly after a write in the primary region. The developer notices that reads sometimes return stale data. Which of the following explains this behavior?

Accepted Answer

Global tables use asynchronous replication, introducing unavoidable replication lag.. Amazon DynamoDB global tables use asynchronous replication to propagate writes from one region to all other replica tables. This means that after a write in the primary region, there is an inherent replication lag (typically sub-second but can be higher under load or network issues) before the change is visible in other regions. The developer observes stale reads because the read is hitting a replica that has not yet received the update, which is expected behavior for eventually consistent reads on global tables.

Answer

The developer must use DynamoDB Streams to capture changes and replicate them separately.

Answer

The developer must enable strong consistency reads on the replica table.

Answer

The global table must be configured with write forwarding.

Question 3

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to encrypt data in transit between the client and the ALB. Which AWS service should be used to manage the SSL/TLS certificate?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provisions, manages, and deploys public and private SSL/TLS certificates that can be associated with an Application Load Balancer (ALB) to encrypt data in transit between clients and the ALB. ACM handles certificate renewal automatically and integrates natively with ALB, removing the need for manual certificate management. This ensures HTTPS termination at the load balancer, securing the client-to-ALB communication.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 4

A company uses a customer managed AWS KMS key to encrypt sensitive data stored in DynamoDB. A Lambda function reads from the DynamoDB table and needs to decrypt the data. The Lambda function's execution role has an IAM policy that allows kms:Decrypt on the key. However, access is denied. What must the developer add to the KMS key policy to resolve the issue?

Accepted Answer

Add a statement granting kms:Decrypt to the Lambda function's execution role.. KMS key policies are resource-based policies that control access to the key itself. Even if the Lambda execution role has an IAM policy granting kms:Decrypt, the KMS key policy must explicitly allow the role (or the user/account) to perform that action. Without this statement in the key policy, the IAM permission is ineffective, resulting in an access denied error.

Answer

Add a statement granting kms:Decrypt to the Lambda function's resource-based policy.

Answer

Add a statement granting kms:Decrypt to the Lambda service principal.

Answer

Add a statement granting kms:Decrypt to the account root user with a condition for the Lambda function.

Question 5

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) intermittently returns 503 errors. The ALB health checks are failing for some instances intermittently. The developer checks the instance system logs and finds no application errors. What is the most likely cause of the health check failures?

Accepted Answer

The application on the instances is experiencing resource exhaustion (e.g., memory or CPU) which causes it to stop responding to health checks temporarily. Intermittent 503 errors from the ALB combined with intermittent health check failures and no application errors in the system logs strongly point to transient resource exhaustion (CPU or memory) on the EC2 instances. When an instance runs out of memory or CPU, the application process may become unresponsive or be killed by the OS (e.g., OOM killer), causing it to fail health checks temporarily. Once resources are freed (e.g., after a spike subsides), the application resumes responding, which explains the intermittent nature of the failures.

Answer

The security group for the instances does not allow inbound traffic from the ALB on the health check port

Answer

The health check path is not configured correctly and the default path returns a 404 status

Answer

The target group is not configured with the correct protocol

Question 6

A developer is using AWS CodeBuild to build a Java application. The buildspec.yml file currently runs unit tests. The developer wants to generate a code coverage report and publish it to the CodeBuild console for analysis. Which CodeBuild feature should be used?

Accepted Answer

Test reports. AWS CodeBuild's test reports feature allows developers to create reports from test result files, including code coverage reports, and publish them to the CodeBuild console for analysis. This feature supports various report formats such as JaCoCo, Cobertura, and SimpleCov, enabling the developer to visualize coverage metrics directly in the console without external tools.

Answer

Build artifacts

Answer

Amazon CloudWatch Logs

Answer

Amazon S3 access logs

Question 7

A developer is building a serverless application that needs to process messages from an Amazon SQS queue and store the results in an Amazon DynamoDB table. Which AWS service should the developer use to orchestrate the processing logic without managing servers?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that can be triggered by SQS messages via event source mappings, process each message, and write results to DynamoDB without provisioning or managing any servers. The developer simply uploads the processing code, and Lambda handles scaling, concurrency, and execution, making it ideal for this event-driven, serverless workflow.

Answer

Amazon Elastic Container Service (ECS) with Fargate

Answer

Amazon EC2 instances with a custom application

Answer

AWS Step Functions

Question 8

A developer is running an AWS Lambda function that is triggered by Amazon S3 events. The function writes processed data to an Amazon DynamoDB table. Over time, the function's execution time has increased significantly. CloudWatch Logs show many DynamoDBProvisionedThroughputExceededException errors. The table is configured with 5 read capacity units (RCUs) and 5 write capacity units (WCUs). The function performs both reads and writes. Which optimization will MOST effectively reduce throttling errors while maintaining performance?

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode. The DynamoDBProvisionedThroughputExceededException errors indicate that the Lambda function is exceeding the provisioned write capacity of 5 WCUs. Switching to on-demand capacity mode eliminates the need to manage throughput, automatically scaling to handle the workload without throttling. This directly resolves the root cause—capacity exhaustion—without requiring manual adjustments or architectural changes.

Answer

Increase the RCUs and WCUs of the table to 50 each

Answer

Implement a DynamoDB Accelerator (DAX) cluster for caching reads

Answer

Increase Lambda function memory to 1024 MB

Question 9

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). During peak hours, users report receiving HTTP 503 (Service Unavailable) errors. The developer checks Amazon CloudWatch metrics and finds that the ALB's request count is high but below the limit, and the target group's healthy host count drops to zero intermittently. The Auto Scaling group for the instances is configured with a minimum of 2, maximum of 10, and a simple scaling policy to add 2 instances when CPU utilization exceeds 70% for 5 consecutive minutes. What is the most likely cause of the 503 errors?

Accepted Answer

The Auto Scaling group's cooldown period prevents new instances from being added quickly enough during rapid traffic spikes. The 503 errors occur because the simple scaling policy has a cooldown period (default 300 seconds) that prevents the Auto Scaling group from launching new instances during rapid traffic spikes. When CPU exceeds 70% for 5 minutes, the policy adds 2 instances, but the cooldown blocks further scaling actions until it expires, even if the newly launched instances are still initializing and the healthy host count drops to zero. This mismatch between traffic demand and scaling responsiveness causes the ALB to have no healthy targets, resulting in 503 errors.

Answer

The ALB's idle timeout is set too low, causing dropped connections

Answer

The Auto Scaling group's maximum capacity of 10 is insufficient

Answer

The health check grace period is preventing instances from being marked healthy

Question 10

A developer is building a serverless application and wants to invoke an AWS Lambda function every hour to perform a cleanup task. Which AWS service should the developer use to schedule the invocation?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Amazon EventBridge (formerly CloudWatch Events) is the correct service for scheduling AWS Lambda invocations on a recurring basis. It provides a cron or rate expression to trigger a Lambda function at a defined interval, such as every hour, without the need for managing any servers or additional infrastructure.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon SQS

Question 11

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to improve performance. The application periodically experiences high latency during peak hours. The developer checks the ElastiCache metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster has a single node with a cache.t3.small instance type. Which action will most likely improve the cache hit rate and reduce latency?

Accepted Answer

Scale up to a larger node type (e.g., cache.t3.medium) to increase available memory.. The high 'Evictions' and low 'CacheHitRate' metrics indicate that the Redis node is running out of memory, forcing it to evict keys to make room for new data. Scaling up to a larger node type (cache.t3.medium) increases the available memory, allowing more data to be cached and reducing evictions, which directly improves the cache hit rate and reduces latency.

Answer

Enable cluster mode and distribute data across multiple shards to reduce memory pressure.

Answer

Change the eviction policy to 'allkeys-lfu' to better manage which keys are evicted.

Answer

Add a read replica for the Redis cluster to offload read traffic.

Question 12

A DynamoDB application receives ProvisionedThroughputExceededException during predictable daily peaks. The workload is not cacheable. What should be changed?

Accepted Answer

Use on-demand capacity or configure autoscaling/scheduled scaling for the table. The ProvisionedThroughputExceededException indicates that the table's read/write capacity is insufficient during peak loads. Since the workload is predictable but not cacheable, the correct solution is to either switch to on-demand capacity mode, which automatically scales to handle any traffic level, or configure auto scaling with scheduled scaling to match the predictable peaks. This directly addresses the capacity shortfall without requiring application changes.

Answer

Enable S3 Transfer Acceleration

Answer

Disable CloudWatch metrics

Answer

Move all reads to strongly consistent mode

Question 13

Drag and drop the steps to authenticate a user using Amazon Cognito User Pools in the correct order.

Accepted Answer

Create the user pool and app client, then authenticate to receive tokens, then use tokens for authorization.. First create the user pool and app client, then authenticate to receive tokens, and use tokens for authorization.

Answer

Authenticate to receive tokens, then create the user pool and app client, then use tokens for authorization.

Answer

Create the user pool and app client, then use tokens for authorization, then authenticate to receive tokens.

Answer

Use tokens for authorization, then create the user pool and app client, then authenticate to receive tokens.

Question 14

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero status.. The error message explicitly states that the CodeDeploy agent logs show the BeforeInstall lifecycle event script returned a non-zero exit code. This directly indicates that the script itself failed during execution, which is the most likely cause of the deployment failure. The BeforeInstall script is a custom script run by the CodeDeploy agent on each instance, and a non-zero exit code signals an error condition that halts the deployment for that instance.

Answer

The application revision is missing from the S3 bucket.

Answer

The IAM instance profile does not have permissions to call CodeDeploy APIs.

Answer

The CodeDeploy agent is not running on the instances.

Question 15

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint backed by a Lambda function. The developer wants to enable canary deployments to shift 10% of traffic to the new version for 5 minutes before routing all traffic. Which configuration should the developer add to the SAM template?

Accepted Answer

DeploymentPreference with Type: Canary10Percent5Minutes. The `DeploymentPreference` property with `Type: Canary10Percent5Minutes` instructs AWS SAM to use AWS CodeDeploy to shift 10% of traffic to the new Lambda version for 5 minutes, then automatically route the remaining 90% after the canary period ends. This matches the requirement exactly, leveraging SAM's built-in integration with CodeDeploy for canary deployments.

Answer

Add a CodeDeploy application and deployment group manually

Answer

DeploymentPreference with Type: Linear10PercentEvery1Minute

Answer

DeploymentPreference with Type: AllAtOnce

Question 16

Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)

Accepted Answer

A security group rule allowing inbound traffic on port 443. A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.

Answer

Server Name Indication (SNI) support

Answer

An HTTP to HTTPS redirect rule

Question 17

A developer needs to package and deploy a serverless application with Lambda functions, API Gateway, and DynamoDB using concise syntax. Which framework is AWS-native for this purpose?

Accepted Answer

AWS Serverless Application Model. The AWS Serverless Application Model (SAM) is an AWS-native framework that uses a simplified YAML or JSON syntax to define and deploy serverless resources such as Lambda functions, API Gateway, and DynamoDB. It extends AWS CloudFormation, allowing developers to package and deploy with concise syntax using the `sam build` and `sam deploy` commands, making it the correct choice for this purpose.

Answer

AWS Control Tower

Answer

Amazon Macie

Answer

AWS Backup

Question 18

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Accepted Answer

Scan and sort results client-side, then take first 10. Scanning all items and sorting them client-side by score descending gives the global top 10, regardless of partition keys. Option E is correct if the table is designed with a single partition key (e.g., a constant value like 'Leaderboard'), because a Query with ScanIndexForward=false and Limit=10 then retrieves the top 10 items from that partition efficiently. Options A, C, and D are incorrect because they cannot return the top 10 items sorted globally.

Answer

TransactGetItems

Answer

BatchGetItem

Answer

GetItem

Question 19

A company uses AWS Secrets Manager to rotate database credentials for an RDS MySQL instance. The rotation Lambda function fails with the error: 'Secret is scheduled for deletion.' What is the MOST likely cause?

Accepted Answer

The secret has been marked for deletion and is in the waiting period.. The error 'Secret is scheduled for deletion' indicates that the secret has been marked for deletion and is currently in the mandatory waiting period (default 7 to 30 days). During this period, AWS Secrets Manager prevents any operations on the secret, including rotation, to ensure the deletion is intentional. The rotation Lambda function fails because it cannot access or modify a secret that is pending deletion.

Answer

The secret's rotation schedule has been disabled.

Answer

The Lambda function does not have permission to access the secret.

Answer

The RDS instance is not in the same VPC as the Lambda function.

Question 20

A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?

Accepted Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.. To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.

Answer

Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.

Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.

Answer

Enable client certificate authentication on the ALB.