DVA-C02 Practice Exam 60 — 20 Questions

Question 1

A developer notices that an AWS Lambda function processing S3 events is being retried frequently due to throttling errors from Amazon DynamoDB. The function writes records to a DynamoDB table and has reserved concurrency set to 100. The DynamoDB table uses on-demand capacity mode. What should the developer do to reduce retries and improve overall throughput?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement exponential backoff and retry in the Lambda function code for DynamoDB API calls.. Implementing exponential backoff and retry in the Lambda function code for DynamoDB API calls directly addresses the throttling errors. Even with on-demand capacity, DynamoDB can throttle requests if they exceed the table's burst capacity or if there are hot partitions. Exponential backoff reduces the retry rate, allowing DynamoDB to recover and improving overall throughput without changing the Lambda concurrency or capacity mode.

Answer

Increase the Lambda function's reserved concurrency to 500.

Answer

Disable the Lambda function's S3 event source mapping and use Amazon SQS to buffer events.

Answer

Switch the DynamoDB table to provisioned capacity with a high write capacity unit setting.

Question 2

A company has a Lambda function that processes records from an SQS queue. The function is failing intermittently with timeout errors. The processing time per record varies, but the SQS queue has a visibility timeout of 30 seconds. The Lambda function has a timeout of 1 minute. What is the MOST likely cause of the timeout errors?

Accepted Answer

The SQS visibility timeout is shorter than the Lambda function timeout.. When the SQS visibility timeout (30 seconds) is shorter than the Lambda function timeout (1 minute), the message becomes visible again in the queue before the function finishes processing it. This causes the same message to be picked up by another consumer (or the same Lambda invocation) while the original invocation is still running, leading to duplicate processing and eventual timeout errors as the function repeatedly attempts to process the same record.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The SQS queue has too many messages causing Lambda to throttle.

Answer

The SQS queue's default visibility timeout of 30 seconds is too long.

Question 3

A developer needs to allow an EC2 instance to access an S3 bucket without storing credentials on the instance. Which approach is the most secure?

Accepted Answer

Use an IAM role for EC2 with a policy granting S3 access.. An IAM role attached to an EC2 instance delivers temporary, automatically rotated credentials via the Instance Metadata Service (IMDS), so no long-lived secrets ever touch the instance filesystem. The role's trust policy allows ec2.amazonaws.com to assume it, and the attached permissions policy scopes exactly which S3 actions and resources are allowed. This is AWS's recommended pattern for granting AWS service access to compute resources.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Use S3 bucket policy to allow the EC2 instance's public IP.

Answer

Store the access keys in Systems Manager Parameter Store and retrieve at runtime.

Question 4

A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)

Accepted Answer

Create a customer managed KMS key and specify it when creating the DB instance.. You can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption after the DB instance is created by modifying the DB instance.

Answer

Use S3 server-side encryption (SSE-S3) with the RDS instance.

Answer

Use an AWS owned KMS key for encryption.

Question 5

A company is deploying a containerized application on Amazon ECS using the Fargate launch type. The deployment must ensure zero downtime. Which ECS deployment configuration should be used?

Accepted Answer

Blue/green deployment using AWS CodeDeploy. Blue/green deployment using AWS CodeDeploy is correct because it creates a separate, fully functional replacement environment (green) alongside the existing one (blue), allowing traffic to be switched instantly after validation. This ensures zero downtime by avoiding in-place updates that could temporarily reduce capacity or serve errors during the transition. For ECS Fargate, CodeDeploy orchestrates the shift using an AppSpec file and can automatically roll back on health check failures.

Answer

Rolling update with a minimum healthy percent of 50% and maximum percent of 200%

Answer

Set the task placement strategy to REPLICA

Answer

Use the DAEMON scheduling strategy with a deployment circuit breaker

Question 6

A company runs a microservices application on Amazon ECS with Fargate. The application includes a service that processes messages from an SQS queue. The service's CPU utilization is consistently above 80%, and messages are accumulating in the queue. The service is configured with a desired count of 2 tasks and auto scaling based on CPU utilization. What should a developer do to improve message processing throughput?

Accepted Answer

Change the auto scaling metric to use the SQS queue's ApproximateNumberOfMessagesVisible.. The correct answer because using the SQS queue's ApproximateNumberOfMessagesVisible metric for auto scaling is more responsive to the actual workload than CPU utilization. When messages accumulate in the queue, scaling based on queue depth triggers task additions sooner, improving throughput. Option A is wrong because simply increasing the desired count without a dynamic scaling policy may not adapt to varying load and could lead to over-provisioning or under-provisioning. Option B is wrong because increasing task size (CPU/memory) does not directly address the scaling trigger; it might help a single task process more, but the bottleneck is the number of tasks. Option D is wrong because decreasing the batch size reduces the number of messages processed per poll, which would decrease throughput, not improve it.

Answer

Increase the desired count of tasks to 5.

Answer

Increase the task size to use more CPU and memory.

Answer

Decrease the batch size of messages polled from SQS.

Question 7

Which TWO services can be used to store and retrieve application configuration data in AWS? (Choose 2)

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (Option C) is a managed service specifically designed to store and retrieve application configuration data, such as database connection strings, passwords, and license keys. It integrates with AWS KMS for encryption and supports hierarchical parameter paths, making it ideal for configuration management without custom code.

Answer

AWS CloudTrail

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon DynamoDB

Question 8

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. CloudWatch metrics show a high rate of DynamoDBProvisionedThroughputExceededException errors. The DynamoDB table has 5 read and 5 write capacity units (RCU/WCU). What is the most effective action to reduce the function's execution time?

Accepted Answer

Increase the DynamoDB table's read and write capacity units.. The high rate of DynamoDBProvisionedThroughputExceededException errors indicates that the Lambda function is being throttled by DynamoDB due to insufficient read and write capacity units. This throttling causes the function to retry operations, significantly increasing execution time. Increasing the RCU/WCU from 5 to a higher value directly addresses the bottleneck, allowing operations to complete without retries and reducing overall execution time.

Answer

Increase the Lambda function's memory allocation.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the Lambda function's timeout.

Question 9

A developer has an Amazon S3 bucket containing private user documents. The application must generate a time-limited URL for users to download their own documents without requiring the users to have AWS credentials. Which solution should the developer use?

Accepted Answer

Create a pre-signed URL for each object using the AWS SDK with an appropriate expiration time.. Pre-signed URLs allow temporary, time-limited access to private S3 objects without requiring the user to have AWS credentials. The developer generates the URL server-side using the AWS SDK, embedding an expiration time, and the user can download the object directly via HTTP GET. This meets the requirement of granting ephemeral access to specific documents for unauthenticated users.

Answer

Use CloudFront signed URLs with an origin access identity (OAI) to restrict access to the S3 bucket.

Answer

Set a bucket policy that allows public read access for the specific users based on their IP addresses.

Answer

Provide the users with IAM user credentials that have read access to the bucket.

Question 10

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 11

A developer is creating an IAM policy for a Lambda function that needs to read from an SQS queue and write to a DynamoDB table. Which THREE permissions are required? (Select THREE.)

Accepted Answer

sqs:DeleteMessage. A is correct because the Lambda function must delete messages from the SQS queue after processing them to prevent them from being reprocessed. The sqs:DeleteMessage permission is required to call the DeleteMessage API, which removes the message from the queue using its receipt handle. Without this permission, the function would successfully receive and process the message but fail to delete it, causing the message to become visible again after the visibility timeout expires.

Answer

sqs:SendMessage

Answer

dynamodb:GetItem

Question 12

Which TWO are valid deployment strategies supported by AWS CodeDeploy? (Choose TWO.)

Accepted Answer

In-place deployment. AWS CodeDeploy supports in-place deployments (option B) where the application is updated on the existing instances without provisioning new ones. This is a valid deployment strategy that updates the current fleet by stopping and starting the application, and it is one of the two core strategies explicitly documented by AWS.

Answer

Immutable deployment

Answer

Canary deployment

Answer

All at once deployment

Question 13

A Lambda function must retrieve feature flags at runtime with low latency and controlled rollout. Which AWS service is most appropriate?

Accepted Answer

AWS AppConfig. AWS AppConfig is the correct choice because it is purpose-built for managing application configuration at runtime, including feature flags, with support for controlled rollouts (e.g., percentage-based deployments, canary releases) and low-latency retrieval via the AppConfig agent or direct API calls. It integrates with AWS Lambda to fetch configuration values on-demand without requiring a full deployment, enabling dynamic feature toggling.

Answer

AWS CloudFormation Parameters

Answer

AWS IAM Access Analyzer

Answer

Amazon Inspector

Question 14

A developer needs to share an S3 bucket with a third-party AWS account. The third-party will upload files to the bucket using their own IAM users. The developer creates a bucket policy that grants s3:PutObject to the third-party account's root user. However, the third-party reports that their IAM users cannot upload files. What is the MOST likely reason?

Accepted Answer

The third-party's IAM users do not have an IAM policy allowing s3:PutObject.. For cross-account access to S3, both the resource-based policy (bucket policy) and the identity-based policy (IAM policy attached to the third-party's IAM users) must grant the required permission. The bucket policy correctly grants s3:PutObject to the third-party account, but the third-party's IAM users also need an IAM policy allowing s3:PutObject. Without that identity-based permission, the request is denied even though the bucket policy allows it.

Answer

The bucket policy must include a condition requiring encryption.

Answer

The bucket policy should grant access to the IAM user ARN instead of the root user.

Answer

The developer must create IAM users in their own account for the third-party.

Question 15

Which TWO AWS services can be used to store and retrieve application configuration data? (Choose two.)

Accepted Answer

AWS AppConfig. AWS AppConfig is a feature of AWS Systems Manager that allows you to create, manage, and deploy application configuration data separately from your code. It supports feature flags, tuning parameters, and other dynamic configuration, and can validate configuration changes before deployment to reduce risk. This makes it a correct choice for storing and retrieving application configuration data.

Answer

AWS Secrets Manager

Answer

Amazon S3

Answer

AWS CloudFormation

Question 16

A developer is designing a serverless application that uses Amazon DynamoDB as the data store. The application must handle sudden spikes in read traffic without throttling. Which THREE actions should the developer take?

Accepted Answer

Configure DynamoDB auto scaling for the table. DynamoDB auto scaling (option A) dynamically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This ensures the table can handle sudden spikes in read traffic without manual intervention, preventing throttling exceptions.

Answer

Use a global secondary index with a different partition key

Answer

Use strongly consistent reads for all queries

Question 17

A company uses Amazon CloudFront to distribute content from an S3 bucket. The content is static and rarely changes. The developer wants to reduce the load on the origin and improve performance for users. Which configuration change would achieve this?

Accepted Answer

Increase the TTL (Time to Live) for the cache behavior.. Increasing the TTL for the cache behavior tells CloudFront edge locations to retain cached copies of the static content for a longer period before re-validating with the origin S3 bucket. This reduces the number of requests that reach the origin, lowering load on the S3 bucket, and improves user performance by serving content directly from the edge cache more frequently.

Answer

Disable caching for the distribution.

Answer

Enable Lambda@Edge to process requests at edge locations.

Answer

Decrease the TTL (Time to Live) for the cache behavior.

Question 18

A company is using Amazon DynamoDB with on-demand capacity. A developer notices that write requests are being throttled during peak hours. What is the MOST effective way to resolve this issue?

Accepted Answer

Review the partition key design and consider adding a suffix to distribute writes.. DynamoDB on-demand mode automatically scales to accommodate traffic, so throttling during peak hours usually indicates a hot partition caused by an unevenly distributed partition key. Adding a suffix (write sharding) distributes writes across more partitions, eliminating the hot partition and resolving throttling without changing capacity mode.

Answer

Switch to provisioned capacity mode with auto-scaling.

Answer

Increase the write capacity units.

Answer

Increase the read capacity units.

Question 19

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

Accepted Answer

Implement retry logic with exponential backoff in the Lambda function.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is exceeding the write capacity units (WCUs) provisioned for the DynamoDB table. Implementing retry logic with exponential backoff in the Lambda function allows it to handle throttling gracefully by pausing and retrying failed writes, which is the standard AWS-recommended pattern for managing DynamoDB throttling.

Answer

Decrease the batch size of the Kinesis event source mapping.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the memory allocated to the Lambda function.

Question 20

A developer is using AWS Elastic Beanstalk to deploy a web application. The application requires a highly available environment across multiple Availability Zones. The developer wants to update the application without any downtime while minimizing the number of new instances launched. Which deployment policy should the developer use?

Accepted Answer

Rolling with additional batch. (Rolling with additional batch) is correct because it launches a new batch of instances before taking the old ones out of service, ensuring full capacity is maintained during the deployment. This provides high availability across multiple Availability Zones while minimizing the number of new instances compared to an immutable deployment, which would double the instance count. The additional batch absorbs the traffic during the rolling update, preventing any downtime.

Answer

All at once

Answer

Rolling

Answer

Immutable