DVA-C02 Practice Exam 59 — 20 Questions

Question 1

A developer invoked a Lambda function and saw the above output. What is the root cause of the error?

Accepted Answer

The function code expects a property that is missing from the event payload.. The correct answer is B: the function code expects a property that is missing from the event payload. In Lambda, when the handler accesses a key on the parsed event object (e.g., event['detail'] or event.detail) that does not exist, the runtime raises a KeyError or TypeError, which surfaces as an invocation error in the response. This is a data-shape mismatch between what the code reads and what the caller sent, not an infrastructure or configuration failure. Option A is wrong because payload access is not gated by IAM permissions; the event is always delivered to the handler. Option C is wrong because an incorrect handler name produces a Runtime.HandlerNotFound or 'handler does not exist' error before any code runs. Option D is wrong because a timeout returns Task timed out after X seconds rather than a missing-property error.

Answer

The Lambda function lacks permission to access the event payload.

Answer

The Lambda function's handler name is incorrect.

Answer

The Lambda function timed out.

Question 2

A developer is building a web application that uses Amazon Cognito for user authentication. Which TWO actions should be taken to secure the application?

Accepted Answer

Enable multi-factor authentication (MFA) for users.. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond just a password, requiring users to provide a second factor (e.g., a one-time code from an authenticator app or SMS). This significantly reduces the risk of unauthorized access due to compromised credentials. Amazon Cognito supports MFA natively, allowing developers to enforce it for user pools.

Answer

Disable token expiration to avoid frequent re-authentication.

Answer

Use IAM users for authentication instead of Cognito.

Answer

Store user tokens in local storage for persistence.

Question 3

Which TWO actions can help reduce Lambda cold start times? (Choose two.)

Accepted Answer

Increase the memory allocated to the function.. Option B is correct because AWS Lambda allocates CPU proportionally to the configured memory, so increasing the memory allocated to the function gives it more CPU power and speeds up initialization of the runtime and code, thereby reducing cold start duration. Option C is correct because Provisioned Concurrency pre-initializes a requested number of execution environments and keeps them warm, so invocations are served by already-initialized environments and avoid the cold start entirely. Option A is incorrect because a larger deployment package takes longer to download and unpack during initialization, which increases cold start time. Option D is incorrect because placing the function in a VPC adds ENI creation and attachment overhead during initialization, typically worsening cold starts. Option E is incorrect because the function timeout only limits how long an invocation may run; it does not affect initialization time and can even cause failures if set too low.

Answer

Increase the deployment package size.

Answer

Place the function in a VPC.

Answer

Reduce the function timeout.

Question 4

A developer is optimizing an API Gateway REST API that uses Lambda integration. The response times are high, and CloudWatch logs show that the Lambda function has cold starts frequently. The function is written in Java and uses a large library. What is the MOST effective optimization?

Accepted Answer

Enable provisioned concurrency on the Lambda function.. The most effective optimization is C: enabling provisioned concurrency on the Lambda function, because it pre-initializes execution environments so that invocations are served by already-warm instances, eliminating the cold starts that CloudWatch logs show are frequent. This directly addresses the Java runtime's heavy initialization cost caused by the large library, without changing application code. Option A is a major rewrite that may reduce cold start duration but does not guarantee elimination and changes the technology stack. Option B increases memory and can proportionally speed initialization, but cold starts would still occur. Option D may modestly improve Java initialization, but it does not prevent cold starts the way provisioned concurrency does.

Answer

Rewrite the function in Node.js to reduce cold start time.

Answer

Increase the Lambda function's memory allocation to 3008 MB.

Answer

Use the AWS SDK for Java 2.x to reduce initialization time.

Question 5

A developer is working on a serverless application that uses AWS Lambda functions to process user uploads. The uploads are stored in an S3 bucket, and each upload triggers a Lambda function that resizes images and stores metadata in DynamoDB. Recently, users have reported that some images are not being resized. The developer checks the CloudWatch logs and sees that the Lambda function is invoked, but it fails with a timeout error after 15 seconds for a few large images. The function has a timeout of 15 seconds and a memory of 512 MB. The image sizes vary from 1 MB to 50 MB. The developer wants to handle large images without increasing the timeout significantly, as that would increase costs. The function is CPU-bound during image processing. Which solution should the developer implement?

Accepted Answer

Increase the memory allocated to the Lambda function to 3008 MB, which also increases CPU power, allowing faster processing within the same timeout.. AWS Lambda allocates CPU power proportionally to memory, so raising memory from 512 MB to 3008 MB gives the function roughly 6x more CPU, letting the CPU-bound image resizing finish within the existing 15-second timeout without extending the timeout and thus without increasing per-invocation duration costs. This directly addresses the timeout caused by CPU-bound processing of large images. Option B is impractical because chunking and reassembling images adds complexity and does not speed up the CPU-bound resize work. Option C would allow more time but increases cost and duration, which the developer explicitly wants to avoid. Option D does not solve the underlying CPU bottleneck and Step Functions cannot extend a single Lambda invocation beyond its configured timeout.

Answer

Split the large images into smaller chunks before uploading to S3, then reassemble them after processing.

Answer

Increase the Lambda function timeout to 5 minutes to accommodate large images.

Answer

Use AWS Step Functions to orchestrate the image processing workflow, allowing longer timeouts for individual steps.

Question 6

A developer is troubleshooting a deployment failure in AWS CodePipeline. The deploy stage uses the above IAM policy for the service role. The pipeline fails when trying to update the Elastic Beanstalk environment. What is the most likely cause?

Accepted Answer

The policy restricts the UpdateEnvironment action to a specific environment ARN, but the pipeline is updating a different environment.. The most likely cause is option A: the policy restricts the UpdateEnvironment action to a specific environment ARN, but the pipeline is updating a different environment. In Elastic Beanstalk, elasticbeanstalk:UpdateEnvironment must be allowed on the exact environment ARN being updated; if the Resource element names a different environment, the API call is denied and the deploy stage fails. Option B is not the issue because DescribeEnvironmentResources is a read-only action and is not required to perform the environment update. Option C is too broad and inaccurate, since the policy does not deny all actions on the environment. Option D is also incorrect because DeleteEnvironment is not needed to update an existing Elastic Beanstalk environment.

Answer

The policy does not allow DescribeEnvironmentResources, which is required for the deployment.

Answer

The policy denies all actions on the environment, preventing the update.

Answer

The policy denies DeleteEnvironment, which is required for the update.

Question 7

A company is using AWS CodePipeline to automate the deployment of a web application. The pipeline has three stages: Source (Amazon S3), Build (AWS CodeBuild), and Deploy (AWS CodeDeploy). The application is deployed to an Auto Scaling group of EC2 instances. Recently, a deployment failed because the CodeDeploy agent on one of the instances was not running. The developer wants to ensure that the CodeDeploy agent is always running on all instances. What is the MOST efficient solution?

Accepted Answer

Modify the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent.. The correct option is C: modifying the Auto Scaling group's launch configuration to include a user data script that installs and starts the CodeDeploy agent. This is the most efficient solution because user data scripts run automatically on every new EC2 instance at launch, ensuring the CodeDeploy agent is installed and started on all instances without manual intervention or ongoing monitoring. It directly addresses the root cause by making agent installation part of the instance provisioning process. Option A is inefficient because CloudTrail records API activity, not agent process status, and adding Lambda-based remediation is unnecessarily complex. Option B is not viable because CloudWatch cannot natively detect whether a local process like the CodeDeploy agent is running without custom metrics or agents. Option D could work but requires scheduled Run Command executions and doesn't guarantee the agent is present on newly launched instances before deployments occur.

Answer

Use AWS CloudTrail to monitor the CodeDeploy agent status and trigger an AWS Lambda function to restart it.

Answer

Configure a CloudWatch alarm to detect when the CodeDeploy agent is not running and restart it automatically.

Answer

Use AWS Systems Manager Run Command to run a script that checks and restarts the CodeDeploy agent on a schedule.

Question 8

A developer is building a web application that stores user session data in an ElastiCache Redis cluster. The cluster is in a VPC and is not publicly accessible. The developer needs to ensure that data in transit is encrypted. What should the developer do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster.. ElastiCache for Redis supports encryption in transit, which encrypts data between the client and the Redis cluster. Placing an Application Load Balancer in front of the Redis cluster (Option B) is not supported; Redis uses a custom protocol that ALB cannot handle. Configuring security groups (Option C) controls network traffic but does not encrypt data. VPC peering (Option D) allows network connectivity but does not provide encryption in transit.

Answer

Place an Application Load Balancer in front of the Redis cluster and enable TLS termination.

Answer

Configure the security group to only allow traffic from the application servers.

Answer

Use VPC peering to connect the application VPC to the ElastiCache VPC.

Question 9

A startup is deploying a Node.js application using AWS Elastic Beanstalk. They have configured the environment to use a load-balanced, auto-scaled environment with a minimum of 2 instances and a maximum of 4. The application connects to an Amazon RDS MySQL database. After a successful deployment, users report that the application is intermittently returning errors. The developer checks the Elastic Beanstalk logs and finds that the application is timing out when connecting to the database. The developer also notices that the database connection string is hardcoded in the application code. What is the most likely cause of the intermittent errors?

Accepted Answer

The RDS instance has reached its maximum number of concurrent connections because the application instances are not using connection pooling.. The RDS instance has reached its maximum number of concurrent connections because the application instances are not using connection pooling. In a load-balanced, auto-scaled Elastic Beanstalk environment with 2-4 Node.js instances, each instance opens its own database connections, and without connection pooling or Amazon RDS Proxy, the total can exceed the MySQL max_connections limit, producing intermittent connection timeouts under load. Option A is unlikely because a security group misconfiguration would typically cause consistent, not intermittent, connection failures across all instances. Option C is not supported by the symptom of timeouts when connecting, which points to connection exhaustion rather than premature closure. Option D is irrelevant because lack of Multi-AZ affects availability during an AZ failure, not routine intermittent connection timeouts.

Answer

The security group for the RDS instance does not allow inbound traffic from the Elastic Beanstalk environment's security group.

Answer

The application code has a bug that causes the database connection to be closed prematurely.

Answer

The RDS instance is not configured for Multi-AZ deployment, causing failover issues.

Question 10

A company has a production environment running on AWS. The environment includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application is deployed using AWS CodeDeploy with a blue/green deployment strategy. Recently, the deployment started failing because the new instances do not pass the health checks configured on the ALB. The health check path is '/health'. The developer has verified that the application starts correctly and responds to the health check on the new instances when accessed directly via the instance's private IP. However, the health checks from the ALB are failing. The security group for the ALB allows inbound traffic on port 80 from 0.0.0.0/0, and the security group for the EC2 instances allows inbound traffic on port 80 from the ALB's security group. The VPC has both public and private subnets. The Auto Scaling group launches instances in private subnets. The ALB is in public subnets. What is the MOST likely cause of the health check failure?

Accepted Answer

The network ACL on the private subnets is blocking inbound traffic from the ALB's subnets.. The correct answer is D: the network ACL on the private subnets is blocking inbound traffic from the ALB's subnets. Network ACLs are stateless and operate at the subnet level, so even though the EC2 security group allows port 80 from the ALB's security group, a NACL rule denying inbound traffic from the ALB's public subnet CIDR would silently drop the ALB health check packets before they reach the instances. This matches the symptom that the app responds on its private IP directly but ALB health checks to '/health' fail. Option A is wrong because the developer confirmed the application starts and responds on port 80 directly. Option B is wrong because the path '/health' was verified as working on the instances. Option C is wrong because an ALB can only target instances in the same VPC (or peered VPCs), and the scenario implies they are in the same VPC.

Answer

The application is not listening on port 80 on the new instances.

Answer

The health check path is configured incorrectly in the ALB target group.

Answer

The ALB is not in the same VPC as the instances.

Question 11

Refer to the exhibit. A CloudFormation stack creation failed. What is the most likely cause of the failure?

Accepted Answer

The IAM role's trust policy does not allow Lambda to assume the role.. The IAM role's trust policy does not allow Lambda to assume the role. In CloudFormation, when a stack provisions a Lambda function with an execution role, the role's trust policy must include lambda.amazonaws.com as a principal with sts:AssumeRole; if that trust relationship is missing or misconfigured, role assumption fails and the stack creation fails. Option B is unlikely because Lambda function names only need to be unique within an account and Region, and CloudFormation would typically surface a naming conflict differently. Option C is not the most likely cause because a code syntax error usually causes invocation failures after deployment, not stack creation failure. Option D would cause runtime logging failures, but the role could still be assumed and the function created, so it would not typically fail the stack at creation time.

Answer

The Lambda function name conflicts with an existing function.

Answer

The Lambda function code has a syntax error.

Answer

The Lambda execution role does not have the required permissions to write to CloudWatch Logs.

Question 12

Refer to the exhibit. A developer ran the above commands to inspect a KMS key. What can be determined about this key?

Accepted Answer

The key is a customer managed key.. The KeyManager field shows 'CUSTOMER', indicating it is a customer managed key. Option A is incorrect because KeyState is 'Enabled', so the key is not disabled. Option B is incorrect because MultiRegion is false, so the key is not multi-region. Option C is incorrect because the key is customer managed, not AWS managed.

Answer

The key is disabled.

Answer

The key can be used in multiple AWS regions.

Answer

The key is an AWS managed key.

Question 13

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to deploy updates to the production environment gradually and automatically roll back if health checks fail. Which AWS service and deployment configuration should the engineer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment and a CloudWatch alarm to trigger automatic rollback.. AWS CodeDeploy with a canary deployment (option C) is the right choice because CodeDeploy natively supports gradual traffic shifting to a new version and integrates with CloudWatch alarms to automatically roll back when health checks or alarms fail, which directly matches the requirement for gradual deployment with automatic rollback. Canary deployments shift a small percentage of traffic first, then the rest, minimizing blast radius if something goes wrong. Option A is wrong because CloudFormation blue/green handles infrastructure replacement but does not provide CodeDeploy-style gradual traffic shifting with alarm-driven automatic rollback for application deployments. Option B is wrong because Elastic Beanstalk rolling updates replace instances in batches but do not offer the same alarm-triggered automatic rollback semantics as CodeDeploy. Option D is wrong because CodePipeline is an orchestration service, and a manual approval step actually blocks automation rather than enabling gradual automated deployment with rollback.

Answer

Use AWS CloudFormation with a blue/green deployment and a CloudWatch alarm to trigger rollback.

Answer

Use AWS Elastic Beanstalk with a rolling update and a CloudWatch alarm to trigger rollback.

Answer

Use AWS CodePipeline with a manual approval step and a CloudWatch alarm to trigger rollback.

Question 14

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout. Which action should be taken to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the rotation process, which indicates that the default 3-second timeout is insufficient for the rotation logic. Increasing the Lambda function timeout (Option B) directly addresses this by allowing the function more time to complete the rotation, such as calling the Secrets Manager API, updating the database, and verifying the new credentials.

Answer

Reduce the rotation schedule interval.

Answer

Place the Lambda function in a VPC with a NAT gateway.

Answer

Store the rotation schedule in EC2 user data.

Question 15

A company is using Amazon S3 to store large objects. Users report that uploads are slow. Which THREE actions should the developer take to optimize upload performance?

Accepted Answer

Use multipart upload for objects over 100 MB.. Multipart upload improves throughput for large objects over 100 MB by uploading parts in parallel. Option C is correct because S3 Transfer Acceleration uses CloudFront edge locations to reduce latency for uploads over long distances. Option E is correct because using multiple S3 prefixes (i.e., parallelizing requests across different key prefixes) can increase the request rate and overall throughput. Option B is incorrect because S3 Select is used to retrieve subsets of data from an object, not to upload. Option D is incorrect because transitioning to S3 Glacier is for data lifecycle management, not for improving upload performance.

Answer

Use S3 Select to upload only specific parts of the object.

Answer

Transition objects to S3 Glacier after upload.

Question 16

A developer is using AWS Lambda to process records from an Amazon Kinesis Data Stream. The Lambda function is invoked with a batch of records. The function processes each record and then returns a response. The developer notices that some records are being processed multiple times. The function's execution time is within the Lambda timeout. The Kinesis stream has 10 shards. The developer wants to ensure that each record is processed exactly once. What should the developer do?

Accepted Answer

Modify the Lambda function to use the sequence number of each record to deduplicate processing.. The correct option is B: modify the Lambda function to use the sequence number of each record to deduplicate processing. AWS Lambda's Kinesis event source mapping provides at-least-once delivery, so a batch or individual records can be retried after a failure or timeout, causing duplicates; Kinesis sequence numbers uniquely identify each record within a shard, so the function can track processed sequence numbers (for example in DynamoDB) and skip records already handled. Option A is wrong because reducing shards does not change Lambda's at-least-once semantics and would only lower throughput. Option C is wrong because retry configuration cannot prevent duplicates from Lambda's own retries or checkpointing behavior. Option D is wrong because a larger batch size does not provide exactly-once processing and can actually increase the number of records reprocessed after a failure.

Answer

Reduce the number of shards to minimize the chance of duplicates.

Answer

Configure the Lambda function's error handling to retry only failed records.

Answer

Increase the batch size to process more records per invocation.

Question 17

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

Accepted Answer

The application code is not retrieving the secret from Secrets Manager at startup.. The correct option is B: the application code is not retrieving the secret from Secrets Manager at startup. Since the credentials are no longer in code or environment variables, the app must call the Secrets Manager API (e.g., GetSecretValue) at runtime to obtain the DB host, username, and password; if it never does so, it has no host to resolve, producing the 'Host not found' error. Option A is wrong because environment properties are explicitly not used for credentials here, and the failure is a missing hostname, not a misreferenced property. Option C is wrong because the instance profile already has read permission to the secret, so an access-denied error would occur instead. Option D is wrong because a cross-region secret would cause an access/not-found error for the secret, not a 'Host not found' database connection error.

Answer

The secret is not correctly referenced in the Elastic Beanstalk environment properties.

Answer

The IAM instance profile does not have the necessary permissions to access the secret.

Answer

The secret is stored in a different region than the Elastic Beanstalk environment.

Question 18

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. The correct answer is B: the IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy. In S3, when a bucket policy explicitly names a Principal, the request must come from exactly that principal; if the instance's role ARN differs (for example, a different role name, path, or account), the bucket policy does not grant access and the request is denied even though the identity-based policy allows s3:GetObject. Option A is wrong because SSE-S3 encryption is transparent to clients and does not cause AccessDenied. Option C is wrong because it merely restates that both policies allow the action, which would not produce a denial. Option D is wrong because the shown bucket policy contains no MFA condition.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 19

A developer is troubleshooting performance issues in an application that uses Amazon ElastiCache for Redis. The application experiences periodic latency spikes during peak hours. The developer checks CloudWatch metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster uses a single cache.t3.small node. Which action will most likely improve the cache hit rate and reduce latency?

Accepted Answer

Use a larger instance type. The symptoms—high evictions and low cache hit rate—indicate that the single cache.t3.small node is running out of memory. Using a larger instance type increases the available memory, allowing more data to be cached, reducing evictions, and improving the cache hit rate. This directly addresses the root cause of memory pressure without changing the cluster architecture or data expiration behavior.

Answer

Increase the number of replicas

Answer

Enable cluster mode and add more shards

Answer

Increase the TTL of cached items

Question 20

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.