DVA-C02 Practice Exam 55 — 20 Questions

Question 1

A company uses AWS CloudFormation to deploy a stack that includes an RDS MySQL instance. During an update, the stack fails with a 'DELETE_FAILED' status on a security group resource. The security group has a dependency on the RDS instance. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The RDS instance is not fully deleted because of a deletion protection flag.. The most likely cause is that the RDS instance has deletion protection enabled, preventing it from being deleted even when CloudFormation attempts to delete it. The security group depends on the RDS instance, so if the RDS instance cannot be deleted, the security group also fails to delete, resulting in a DELETE_FAILED status. Option A correctly identifies this. Option B is incorrect because a self-referencing rule would not cause a delete failure. Option C is incorrect because manual deletion is not required; the issue is with the RDS instance. Option D is incorrect because the security group being attached to an external EC2 instance would cause a different error, not a dependency-related failure.

Answer

The security group has a rule that references itself.

Answer

The security group must be deleted manually before updating the stack.

Answer

The security group is attached to an EC2 instance outside the stack.

Question 2

A developer is using AWS Lambda with a VPC configuration. The function needs to access an Amazon RDS instance in the same VPC. The function is timing out after 3 seconds. What is the MOST likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic to the RDS instance.. The most likely cause of the Lambda function timing out when accessing an RDS instance in the same VPC is that the Lambda function's security group does not allow outbound traffic to the RDS instance's security group. Lambda functions in a VPC require security group rules that permit outbound traffic to the database, and inbound rules on the RDS security group to allow traffic from the Lambda function. Option A is incorrect because IAM permissions like rds:Connect are not used for network connectivity; they control API actions. Option C is incorrect because an RDS proxy is not required for Lambda to connect to RDS; it's an optional feature for connection pooling. Option D is incorrect because although increasing the timeout might temporarily mask the issue, the root cause is a network connectivity problem, not the timeout value itself.

Answer

The Lambda function's execution role does not have rds:Connect permission.

Answer

The Lambda function does not have an RDS proxy configured.

Answer

The Lambda function timeout is set too low.

Question 3

A developer is troubleshooting a Lambda function that intermittently times out. The function makes HTTP requests to an external API. The function's CloudWatch logs show 'Task timed out after 3.01 seconds'. What is the MOST likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds, but the HTTP request takes longer.. The Lambda function timeout is set to 3 seconds, and the HTTP request to the external API takes longer than that, causing the 'Task timed out after 3.01 seconds' error. Option B is incorrect because throttling due to insufficient reserved concurrency would result in a 'Rate exceeded' error, not a timeout. Option C is incorrect because if the function couldn't reach the external API due to VPC configuration, it would result in a connection error, not a timeout. Option D is incorrect because a missing IAM role would prevent the function from executing at all, and the logs show the function started execution.

Answer

The Lambda function has insufficient reserved concurrency causing throttling.

Answer

The Lambda function is not configured with a VPC and cannot reach the external API.

Answer

The Lambda function is not starting execution due to a missing IAM role.

Question 4

A company runs a production web application on EC2 instances behind an Application Load Balancer. Users report intermittent 502 errors. The developers find that the ALB access logs show 'target_response_code' of 502 for some requests. What is the MOST likely cause?

Accepted Answer

The EC2 instances are closing idle connections prematurely due to a short keep-alive timeout.. The 502 Bad Gateway error from an Application Load Balancer indicates that the target (EC2 instance) closed the connection before the ALB could finish writing the request or reading the response. This commonly occurs when the keep-alive timeout on the EC2 instance is set too low, causing idle connections to be closed prematurely. Option A is incorrect because DNS resolution issues would not cause a 502; they would cause a 503 or connection failure. Option B is incorrect because a security group blocking traffic would result in health check failures and a 503, not a 502. Option D is incorrect because unhealthy instances would cause a 503, not a 502.

Answer

The EC2 instances are unable to resolve DNS for the ALB.

Answer

The security group for the EC2 instances is blocking traffic from the ALB.

Answer

The ALB health checks are failing and the target group has unhealthy instances.

Question 5

A company wants to encrypt data at rest in Amazon S3. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for Amazon S3's server-side encryption with KMS (SSE-KMS). Option A is wrong because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not encryption keys for S3. Option B is wrong because AWS CloudHSM provides hardware-based key management but is not directly integrated with S3 for SSE; KMS is the managed service for this use case. Option C is wrong because AWS Identity and Access Management (IAM) controls access permissions, not encryption key management.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 6

A developer notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. Which AWS service can the developer use to analyze the database queries and identify the root cause?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights is the correct service for analyzing database queries and identifying the root cause of high CPU utilization. Performance Insights provides a database performance analysis feature that offers a visual dashboard and query-level metrics, enabling developers to pinpoint resource-intensive queries. AWS X-Ray is used for tracing application requests, not database queries. CloudWatch Logs is for log data storage and monitoring, not query-level analysis. Trusted Advisor provides cost and security recommendations, not database performance insights. Therefore, Performance Insights is the appropriate tool for this scenario.

Answer

AWS X-Ray

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Question 7

A company runs a microservices architecture on Amazon ECS with Fargate. Each service uses an Application Load Balancer and stores data in Amazon DynamoDB. The operations team notices that during traffic spikes, some requests fail with HTTP 503 errors. CloudWatch metrics show that the ALB's TargetResponseTime is increasing, and the DynamoDB table's ConsumedWriteCapacityUnits are reaching the provisioned limit. The team wants to handle traffic spikes gracefully without manual intervention. What should they do?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity and configure ECS Service Auto Scaling based on ALB request count.. DynamoDB Auto Scaling automatically adjusts the provisioned write capacity based on traffic, preventing throttling and 503 errors from write capacity exhaustion. ECS Service Auto Scaling adds more tasks when the ALB request count increases, distributing the load. Together, they handle traffic spikes without manual intervention. Option A is wrong because manually increasing provisioned capacity does not scale automatically, and deregistration delay does not address capacity issues. Option B is wrong because while SQS can buffer write requests, it adds complexity and latency; the question asks for graceful handling, and auto scaling addresses the root cause more directly. Option C is wrong because DAX is a cache for read operations, not write capacity.

Answer

Increase the DynamoDB table's provisioned write capacity and the ALB's target group deregistration delay.

Answer

Use an SQS queue to buffer write requests and process them asynchronously.

Answer

Add a DynamoDB Accelerator (DAX) cluster to cache frequently accessed data.

Question 8

A developer is creating an IAM policy to allow an EC2 instance to access an S3 bucket. Which AWS service should the developer use to securely provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. IAM roles are designed to be assumed by AWS services like EC2. Instance profiles deliver temporary credentials to the EC2 instance automatically, avoiding hard-coded keys. Option A is incorrect because Cognito identity pools are intended for user identity in mobile/web apps, not for EC2 instances. Option B is incorrect because storing IAM user access keys on the instance is insecure and not recommended. Option D is incorrect because AWS Secrets Manager is for managing secrets such as database credentials, not for providing credentials to EC2 instances. Option C is the correct approach: create an IAM role with the necessary S3 permissions and attach it to the EC2 instance profile.

Answer

Use Amazon Cognito identity pools to generate temporary credentials for the instance.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Store the AWS access key in AWS Secrets Manager and retrieve it at runtime.

Question 9

A developer receives the above error when trying to launch an EC2 instance. What is the most likely cause?

Accepted Answer

An SCP at the organizational level denies ec2:RunInstances. The error message explicitly mentions a service control policy (SCP) that denies the action, indicating that an SCP at the organizational level is blocking the ec2:RunInstances action. Option C is therefore correct. Option A is incorrect because instance limit errors show a message about reaching the maximum number of instances, not an SCP denial. Option B is incorrect because VPC restrictions typically produce errors related to network constraints, not an explicit SCP reference. Option D is incorrect because an IAM policy denial would result in an 'UnauthorizedOperation' error, not one mentioning SCP.

Answer

The account has reached its EC2 instance limit

Answer

The developer is trying to launch the instance in a restricted VPC

Answer

The developer's IAM policy does not allow ec2:RunInstances

Question 10

A developer runs the commands above. The key is disabled. An application that uses this key to encrypt S3 objects starts failing. What should the developer do to fix the issue?

Accepted Answer

Enable the KMS key. Enable the KMS key. The key is disabled, so enabling it will restore functionality. Option A (delete the key and recreate it) would create a new key, but the application would need to be updated to use the new key, which is unnecessary since the original key exists and can simply be re-enabled. Option B (create a new KMS key and update the application to use it) is also a valid but more complex fix; however, the simplest and most direct solution is to re-enable the key. Option D (enable automatic key rotation) does not affect the disabled state; it only sets a rotation policy for future key updates.

Answer

Delete the key and recreate it

Answer

Create a new KMS key and update the application to use it

Answer

Enable automatic key rotation

Question 11

A developer needs to grant an IAM user access to an S3 bucket for read-only operations. Which IAM policy action should be used?

Accepted Answer

s3:GetObject. S3:GetObject allows reading objects from S3, which is required for read-only operations. Option A (s3:PutObject) allows writing, option B (s3:DeleteObject) allows deletion, and option C (s3:ListBucket) allows listing bucket contents but not reading object content, so none of these provide read-only access.

Answer

s3:PutObject

Answer

s3:DeleteObject

Answer

s3:ListBucket

Question 12

A developer is using Amazon API Gateway with a Lambda authorizer to control access to APIs. The authorizer is failing with a 500 error. The Lambda function logs show 'User: arn:aws:iam::123456789012:role/MyLambdaRole is not authorized to perform: sts:AssumeRole'. What is the most likely cause?

Accepted Answer

The Lambda function's execution role does not have sts:AssumeRole permission for the target role.. The error message indicates that the Lambda function's execution role (MyLambdaRole) attempted to call sts:AssumeRole but was denied. This occurs when the Lambda function's code tries to assume another IAM role (e.g., to access a resource in another account or service) but the execution role lacks the necessary sts:AssumeRole permission for that target role. Option D correctly identifies this root cause. Option A is incorrect because an invalid policy from the authorizer would generate a different error (e.g., 403 or 401). Option B is incorrect because resource-based policies are for granting cross-account access to the Lambda function, not for assuming roles. Option C is incorrect because while API Gateway needs permission to invoke the Lambda function, a missing invoke permission would cause a different error (e.g., 500 with 'The API Gateway is not authorized to invoke the Lambda function'), not an sts:AssumeRole error.

Answer

The Lambda authorizer is not returning a valid policy.

Answer

The Lambda function's resource-based policy is missing.

Answer

The API Gateway does not have permission to invoke the Lambda function.

Question 13

A developer is troubleshooting an AWS Lambda function that is timing out. The function has a timeout of 5 seconds and is configured with 128 MB of memory. Which TWO of the following are effective ways to resolve the timeout?

Accepted Answer

Increase the memory allocation to 512 MB.. Increasing memory allocation in AWS Lambda proportionally increases CPU and network throughput, which can reduce execution time and prevent timeouts. With 128 MB, the function may be CPU-bound; raising it to 512 MB provides more compute resources, often resolving timeout issues without code changes.

Answer

Decrease the memory allocation to 64 MB.

Answer

Deploy the function inside a VPC.

Answer

Increase the function timeout to 10 seconds.

Question 14

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives high traffic and needs to process incoming HTTP requests, store the request payload in an S3 bucket for auditing, and return a response. The development team uses AWS Lambda to process the payload. The team wants to ensure that the solution is scalable, fault-tolerant, and decoupled. The current approach is to have the EC2 instances send requests directly to the Lambda function via the AWS SDK. However, the team notices that during traffic spikes, some requests are lost and the Lambda function throttles. What should the team do to improve the architecture?

Accepted Answer

Have the EC2 instances send messages to an Amazon SQS queue, and configure the SQS queue as an event source for the Lambda function.. Using Amazon SQS decouples the EC2 instances from the Lambda function, providing a buffer that absorbs traffic spikes and prevents request loss. The SQS queue acts as an event source for Lambda, allowing the function to process messages at its own pace, reducing throttling. Option A is incorrect because increasing reserved concurrency may reduce throttling but does not buffer requests; if the function is still overwhelmed, requests can be dropped. Option B is incorrect because API Gateway still invokes Lambda synchronously, and throttling can still occur. Option C is incorrect because Kinesis Data Streams is designed for real-time streaming and analytics, not for simple request queuing, and introduces unnecessary complexity.

Answer

Increase the Lambda function's reserved concurrency to the maximum allowed.

Answer

Place API Gateway in front of Lambda and have EC2 send requests to API Gateway.

Answer

Use Amazon Kinesis Data Streams instead of Lambda to process the payload.

Question 15

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. Amazon SNS is used to send notifications to approvers when a manual approval action is pending in the pipeline. The approval action in CodePipeline can be configured with an SNS topic ARN, and when the pipeline reaches that stage, it publishes a notification to the topic, alerting approvers to review and approve or reject the deployment.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 16

A company wants to encrypt data in transit between an EC2 instance and an S3 bucket. What should they do?

Accepted Answer

Use the S3 HTTPS endpoint for all API calls.. Data in transit between EC2 and S3 is encrypted by using the S3 HTTPS endpoint for all API calls, which uses TLS/SSL to encrypt the connection. Option A is incorrect because S3 does not support SSH transfers; SSH is used for secure shell access, not for S3 API calls. Option B is incorrect because S3 does not support VPN connections; VPN is used for network-level encryption between on-premises networks and AWS, not directly between EC2 and S3. Option C is incorrect because client-side encryption encrypts data before sending, but it does not address encryption in transit; HTTPS is the standard for in-transit encryption, and client-side encryption is for data at rest on the client side.

Answer

Use SSH to transfer files to S3.

Answer

Establish a VPN connection between the instance and S3.

Answer

Enable client-side encryption using the AWS SDK.

Question 17

A developer is deploying an application on EC2 instances behind an Application Load Balancer (ALB). The application must authenticate users using an identity provider (IdP) that supports OpenID Connect (OIDC). What is the MOST secure way to offload authentication to the ALB?

Accepted Answer

Configure the ALB with an OIDC identity provider and use the authenticate-oidc action.. The ALB supports OIDC authentication natively through the `authenticate-oidc` action, which securely offloads user authentication to the IdP. This is the most secure and efficient approach because it keeps authentication at the edge of the load balancer. Option B is incorrect because Lambda@Edge is used with CloudFront, not directly with ALB. Option C is incorrect because IAM federation is for granting AWS API access, not for web application authentication. Option D is incorrect because while Cognito User Pools can be used with ALB, the question specifies the organization already has an OIDC-compliant IdP; the ALB's native integration is more direct and secure than adding Cognito as an intermediary.

Answer

Use AWS Lambda@Edge to authenticate users at the CloudFront edge.

Answer

Use IAM federation to trust the IdP and assign IAM roles to users.

Answer

Use Amazon Cognito User Pools and configure the ALB to use Cognito as the authentication provider.

Question 18

A developer attached the following IAM policy to an IAM user:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
```

The user tries to download an object from example-bucket using the AWS CLI without specifying server-side encryption. What will happen?

Accepted Answer

The download fails with an AccessDenied error. The IAM policy allows s3:GetObject only if the request includes server-side encryption set to AES256. Since the user does not specify encryption, the condition is unmet, resulting in an AccessDenied error.

Answer

The download succeeds because the policy allows s3:GetObject

Answer

The download succeeds because the object is encrypted with SSE-S3

Answer

The download fails with a 500 Internal Server Error

Question 19

A developer is using Amazon API Gateway with a Lambda authorizer to secure a REST API. The developer wants to pass user context from the authorizer to the backend Lambda function. How should the developer accomplish this?

Accepted Answer

Return a context object from the Lambda authorizer that maps to integration request parameters.. The Lambda authorizer can return a context object alongside the IAM policy. This context object can be mapped to integration request parameters (such as headers or path parameters) using API Gateway's mapping templates or passthrough behavior. The backend function then receives the user context via those parameters. Option D is correct because returning a context object from the authorizer and mapping it to integration request parameters is the standard method. Option A is incorrect because the principal identifier is a single field, not suitable for passing multiple context values. Option B is incorrect because the authorization token is the input to the authorizer, not the output. Option C is incorrect because custom headers are not automatically mapped to resource path parameters; such a mapping would not pass user context from the authorizer.

Answer

Include the user context in the principal identifier returned by the authorizer.

Answer

Encode the user context in the authorization token.

Answer

Use a custom header that maps to a resource path parameter.

Question 20

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application consists of an API Gateway, Lambda functions, and a DynamoDB table. The developer wants to define and deploy this infrastructure as code. Which files and tools are required? (Choose THREE.)

Accepted Answer

aws cloudformation deploy command. The AWS SAM template file (template.yaml) is required to define the serverless application resources. The `aws cloudformation package` command uploads local artifacts (such as Lambda deployment packages) to an S3 bucket and returns a copy of the template with references to the S3 object locations. The `aws cloudformation deploy` command then provisions the stack using the processed template. Together, these three are essential for deploying a SAM application using CloudFormation commands. While SAM CLI provides convenient wrappers like `sam package` and `sam deploy`, the underlying CloudFormation commands can also be used directly.

Answer

Terraform configuration files

Answer

AWS CLI with aws lambda update-function-code command