DVA-C02 Practice Exam 57 — 20 Questions

Question 1

An application running on EC2 instances behind an Application Load Balancer is experiencing high error rates. The ALB target group health checks are failing. The instances are in an Auto Scaling group with a minimum of 2 and maximum of 10. What should a developer do to troubleshoot?

Accepted Answer

Check the EC2 instance system log and screenshot.. Option A is correct because checking the instance system log and screenshot helps diagnose OS-level issues. Option B is wrong because that only shows traffic. Option C is wrong because scaling policies don't affect health check failures. Option D is wrong because increasing max size doesn't fix existing instances.

Answer

Review the ALB access logs.

Answer

Modify the Auto Scaling group's scaling policy.

Answer

Increase the maximum size of the Auto Scaling group.

Question 2

Refer to the exhibit. A developer invoked a Lambda function and received this response. What does the FunctionError field indicate?

Accepted Answer

The function threw an unhandled exception.. Option B is correct because FunctionError: Unhandled indicates that the function threw an exception that was not caught by the code. Option A is wrong because StatusCode 200 means invocation succeeded. Option C is wrong because throttling would return 429. Option D is wrong because configuration errors would return 400.

Answer

The function executed successfully.

Answer

The function was throttled.

Answer

The function timed out.

Question 3

A company runs a critical application on EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors. The health checks are configured correctly and the instances pass health checks consistently. What is the most likely cause?

Accepted Answer

The application response time exceeds the ALB idle timeout. Option D is correct because if the application takes longer than the idle timeout to respond, the ALB returns a 503. Option A is wrong because the target group might be deregistering instances that are terminating, but this would show as unhealthy. Option B is wrong because security groups denying traffic would cause connection timeouts, not 503. Option C is wrong because the health check path issue would cause health check failures, not intermittent 503.

Answer

The health check path is incorrect

Answer

The target group is deregistering instances prematurely

Answer

A security group is blocking traffic from the ALB to the instances

Question 4

The above IAM policy is attached to an IAM user. The user is unable to invoke the Lambda function 'my-function'. What is the most likely reason?

Accepted Answer

The Lambda function does not have a resource-based policy allowing the user to invoke it. Option D is correct because the function might have a resource-based policy that explicitly denies the user, or the function's permissions do not allow cross-account access. However, the most common issue is that the function's resource-based policy does not grant invoke permission to the user. The IAM policy allows the action, but the function also needs to allow the user via a resource-based policy. Option A is wrong because the action is correct. Option B is wrong because the resource is specific. Option C is wrong because the version is correct.

Answer

The resource ARN is missing the function version or alias

Answer

The action 'lambda:InvokeFunction' is not sufficient; need 'lambda:*'

Answer

The policy version is incorrect

Question 5

Refer to the exhibit. An IAM policy is attached to a user. The user tries to download an object from s3://my-bucket/secret/config.txt. What will happen?

Accepted Answer

The user is denied access because the Deny statement explicitly denies access to the 'secret/' prefix.. The Deny statement explicitly denies all s3 actions on the 'secret/' prefix. Deny statements override Allow statements. Option C is correct. Option A is wrong because the Deny is explicit. Option B is wrong because the Deny applies to the 'secret/' prefix. Option D is wrong because the Deny is not conditional.

Answer

The user is denied access only if the bucket policy also denies access.

Answer

The user can download the object because the Deny statement only applies to 's3:*' actions, not s3:GetObject.

Answer

The user can download the object because the Allow statement grants s3:GetObject on the bucket.

Question 6

A company runs a Node.js application on AWS Elastic Beanstalk. The application is experiencing high latency. The developer suspects the database queries are slow. Which step should the developer take first to diagnose the issue?

Accepted Answer

Enable enhanced health reporting and monitor CloudWatch metrics for database connection time.. The first step is to enable enhanced health reporting and use CloudWatch metrics to monitor database query performance. Option B is wrong because increasing instance size is a solution, not diagnosis. Option C is wrong because you need to identify the slow queries first. Option D is wrong because switching to DynamoDB is a major architectural change.

Answer

Migrate the database to Amazon DynamoDB for better performance.

Answer

Add database indexing to improve query performance.

Answer

Increase the instance size to improve performance.

Question 7

A developer is deploying a CloudFormation stack and sees the event above. What should the developer do to fix the error?

Accepted Answer

Change the runtime to a supported version like nodejs18.x.. The error indicates that the Node.js 12.x runtime is deprecated. The developer should update the runtime to a supported version, such as nodejs18.x, in the CloudFormation template and redeploy. Option A is wrong because the timeout is not the issue. Option B is wrong because the Lambda function code may be fine; the runtime is the problem. Option C is wrong because adding permissions won't fix the unsupported runtime.

Answer

Update the Lambda function code to use a different programming language.

Answer

Increase the Lambda function timeout in the template.

Answer

Add permissions to the Lambda function's execution role.

Question 8

A developer is troubleshooting an issue where an S3 bucket policy is not granting access to an IAM user. Which TWO actions should the developer take to resolve the issue?

Accepted Answer

Check the bucket policy for any explicit denies.. Option A and C are correct because checking the bucket policy and IAM user policy are the two places where permissions are evaluated. Option B is wrong because ACLs are legacy. Option D is wrong because CloudWatch does not show bucket policies. Option E is wrong because S3 Transfer Acceleration is not related to permissions.

Answer

Enable S3 Transfer Acceleration.

Answer

Verify the bucket's ACLs allow access.

Answer

Enable CloudTrail to log bucket access.

Question 9

An application uses an Auto Scaling group with a launch configuration that includes a user data script to configure instances. After a scaling event, new instances launch but fail to register with the target group. The existing instances continue to work. What should the developer do to resolve this issue?

Accepted Answer

Create a new launch configuration with corrected user data and update the Auto Scaling group. Option D is correct because the launch configuration is immutable; changes to it are not applied to existing instances. Updating the launch configuration and launching new instances will use the corrected user data. Option A is wrong because the Auto Scaling group does not automatically update launch configurations. Option B is wrong because modifying the launch configuration does not affect running instances. Option C is wrong because recreating the Auto Scaling group is unnecessary.

Answer

Modify the existing launch configuration with the correct user data

Answer

Update the Auto Scaling group to use the latest launch configuration version

Answer

Delete and recreate the Auto Scaling group

Question 10

A developer notices that an AWS Lambda function configured with a VPC is timing out when trying to access an Amazon S3 bucket. The function has the necessary IAM permissions. What is the most likely cause?

Accepted Answer

The Lambda function does not have a route to the internet or a VPC endpoint for S3.. A VPC-enabled Lambda function has no internet access unless configured with a NAT Gateway/Instance or VPC Endpoint. To access S3, the function either needs a VPC endpoint for S3 or a route to the internet via a NAT device. The IAM permissions are not the issue. Option A is wrong because the timeout is not due to IAM. Option B is wrong because security group rules would affect different resources. Option C is correct. Option D is wrong because Lambda can be in a VPC but needs proper routing.

Answer

Lambda functions cannot be configured inside a VPC.

Answer

The Lambda function's execution role lacks S3 permissions.

Answer

The security group attached to the Lambda function does not allow outbound traffic to S3.

Question 11

A developer is using AWS CodePipeline to deploy a web application. The pipeline has a source stage from GitHub and a deploy stage to Elastic Beanstalk. The deploy stage fails with the error 'The S3 bucket does not allow access to the artifact'. Which THREE actions could resolve this issue?

Accepted Answer

Add a bucket policy that grants the pipeline's service role access to the artifact bucket.. Option A: The artifact bucket may be in another account; setting bucket policy allows access. Option B: The pipeline role must have permissions to the bucket. Option C: If the artifact bucket is encrypted with KMS, the role needs kms:Decrypt. Option D is wrong because the bucket is already specified. Option E is wrong because versioning is not related to access.

Answer

Specify a different artifact bucket in the pipeline configuration.

Answer

Enable versioning on the artifact bucket.

Question 12

A developer is troubleshooting an AWS Lambda function that writes to an S3 bucket. The function is configured with a resource-based policy that allows the S3 service to invoke the function. However, the function fails with an access denied error when trying to write to S3. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have an IAM policy that allows s3:PutObject.. Option D is correct because the Lambda function needs an execution role with permissions to write to S3. The resource-based policy only allows S3 to invoke the function, not the function to write. Option A is wrong because bucket policy is not needed if the execution role has permissions. Option B is wrong because the function can be triggered correctly. Option C is wrong because VPC does not cause access denied.

Answer

The Lambda function is configured in a VPC without an S3 VPC endpoint.

Answer

The Lambda function's trigger (S3 event notification) is misconfigured.

Answer

The S3 bucket policy does not grant the Lambda function write access.

Question 13

A developer is troubleshooting an AWS Lambda function that is timing out. The function processes S3 events and writes to DynamoDB. The average execution time is 5 seconds, but the function times out after 3 seconds. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds.. The lambda timeout setting defaults to 3 seconds. To fix, increase the timeout in the Lambda configuration to a value higher than the maximum expected execution time (e.g., 10 seconds). Option A is wrong because S3 event notifications are asynchronous and do not cause timeout. Option B is wrong because DynamoDB write capacity issues would cause throttling, not timeout. Option D is wrong because Lambda concurrency limits affect invocation throttling, not execution timeout.

Answer

The S3 bucket is not configured to send event notifications.

Answer

DynamoDB write capacity is insufficient.

Answer

The Lambda function concurrency limit is exceeded.

Question 14

A developer is investigating why an AWS Lambda function that processes Kinesis records is experiencing high latency. Which THREE factors could contribute to this? (Select THREE.)

Accepted Answer

Low number of shards in the Kinesis stream.. High batch size can cause longer processing time per invocation. Insufficient memory slows execution. A low Kinesis shard count can cause throttling and retries, increasing latency. Option B is wrong because higher concurrency (within limits) reduces latency, not increases. Option E is wrong because Lambda@Edge is for CloudFront, not Kinesis.

Answer

High concurrency limit for the Lambda function.

Answer

Using Lambda@Edge to process the records.

Question 15

A developer is deploying a serverless application using AWS SAM. The deployment fails with the error 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

A resource in the stack failed to create.. Option D is correct because 'Resource creation cancelled' typically indicates a stack failure due to a previous resource creation failure. Option A is wrong because missing permissions cause access denied errors. Option B is wrong because timeout would cause a different error. Option C is wrong because invalid YAML causes a parse error.

Answer

The SAM template is malformed.

Answer

The Lambda function code has a timeout.

Answer

The IAM role does not have sufficient permissions.

Question 16

A developer is troubleshooting a slow-running Amazon RDS for MySQL query. The query performance has degraded over time. Which approach should the developer take first to identify the cause?

Accepted Answer

Enable Performance Insights and review the database load. Option C is correct because enabling RDS Performance Insights gives a quick view of database load and wait events. Option A is wrong because query caching is not directly available in RDS MySQL and may not help. Option B is wrong because a read replica does not fix the performance issue. Option D is wrong because increasing instance size may be unnecessary without first diagnosing the bottleneck.

Answer

Upgrade the DB instance to a larger instance class

Answer

Create a read replica to offload read traffic

Answer

Enable the MySQL query cache

Question 17

Which TWO actions can help reduce the cold start time for an AWS Lambda function? (Choose 2)

Accepted Answer

Increase the function's memory allocation. Options A and D are correct. Increasing memory allocation also increases CPU, which can speed up initialization. Keeping the function warm by using a scheduled CloudWatch Event invokes the function periodically to prevent the container from being reclaimed. Option B is wrong because using a VPC adds network latency and increases cold start time due to ENI creation. Option C is wrong because using a larger deployment package increases download time. Option E is wrong because provisioned concurrency eliminates cold starts but is not a reduction factor; it's a different solution.

Answer

Place the Lambda function in a VPC

Answer

Use a larger deployment package with all dependencies included

Answer

Use provisioned concurrency to pre-warm the function

Question 18

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'CREATE_FAILED: The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudFormation events and sees 'Resource creation cancelled'. What is the most likely cause?

Accepted Answer

Another resource in the stack failed, triggering a rollback and cancelling the Lambda creation.. CloudFormation cancels resource creation if a previous resource fails and the stack is set to roll back on failure. The Lambda function creation may have been cancelled due to another resource failure. Option A is correct. Option B is wrong because the error is not specific to IAM. Option C is wrong because the Lambda function creation was cancelled, not failed due to timeout. Option D is wrong because the error does not mention throttling.

Answer

The Lambda function code is too large and exceeds the deployment limit.

Answer

The Lambda function creation timed out due to a network issue.

Answer

The Lambda function's execution role is missing permissions.

Question 19

A developer is troubleshooting an AWS Lambda function that processes messages from an Amazon SQS queue. The function is configured with a batch size of 10 and a maximum concurrency of 5. The function frequently reports errors related to message processing timeouts. The function code is idempotent. Which combination of actions will reduce the number of timeouts and improve processing efficiency?

Accepted Answer

Reduce the batch size to 5 and increase the maximum concurrency to 10.. Option D is correct because reducing batch size lowers the work per invocation, and increasing concurrency allows more parallel processing. Option A is wrong because increasing batch size would increase processing time. Option B is wrong because increasing timeout may not solve the root cause if messages are heavy. Option C is wrong because increasing concurrency alone may help but not as much as reducing batch size.

Answer

Increase the function timeout to 30 seconds and set the SQS visibility timeout to 6 minutes.

Answer

Increase the batch size to 20 and increase the function timeout to 30 seconds.

Answer

Increase the maximum concurrency to 10 and set the SQS visibility timeout to 30 seconds.

Question 20

The exhibit shows an IAM policy attached to a Lambda function's execution role. The function writes objects to an S3 bucket that is encrypted with a KMS key (the key specified in the policy). When the function tries to write an object, it receives an access denied error. What is the MOST likely missing permission?

Accepted Answer

kms:GenerateDataKey is missing.. Option B is correct because to write an encrypted object, the function needs kms:GenerateDataKey or kms:Encrypt permission. Option A is wrong because s3:PutObject is allowed. Option C is wrong because KMS key policy might be restrictive, but the most direct missing permission is kms:GenerateDataKey. Option D is wrong because kms:ReEncrypt is not needed.

Answer

The KMS key policy does not allow the Lambda function role.

Answer

s3:GetObject is missing for the bucket.

Answer

kms:ReEncrypt is missing.