DVA-C02 Practice Exam 61 — 20 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they can access objects in the S3 bucket from their office IP address (192.0.2.15) but cannot access from home (203.0.113.5). What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy restricts access based on source IP address.. The correct option is C: the policy restricts access based on source IP address. Since the user can access the S3 bucket from the office IP 192.0.2.15 but not from the home IP 203.0.113.5, the IAM policy most likely includes a Condition element using aws:SourceIp (or NotIpAddress) that allows only the office IP range. Options A, B, and D do not fit: a VPC requirement would not explain why the office IP works, a bucket policy denying the user would block both locations, and a blanket Deny on s3:GetObject would also block access from the office.

Answer

The policy requires requests to originate from a VPC.

Answer

The bucket policy does not allow the user.

Answer

The policy denies all s3:GetObject actions.

Question 2

A developer is managing an application that uses Amazon S3 to store user-uploaded images. The application generates thumbnails using AWS Lambda and stores them in a separate S3 bucket. The security team requires that all objects in both buckets be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The developer has configured the Lambda function to use an IAM role with permissions to call KMS Encrypt and Decrypt. However, when a user uploads an image, the Lambda function fails to write the thumbnail with an 'Access Denied' error. The upload bucket has default encryption set to SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The Lambda execution role lacks kms:GenerateDataKey permission for the KMS key.. SSE-KMS encryption requires the caller to have both kms:Encrypt and kms:GenerateDataKey permissions on the KMS key. The Lambda execution role was granted Encrypt and Decrypt but not GenerateDataKey, so when S3 attempts to encrypt the thumbnail using SSE-KMS, the KMS call fails and S3 returns Access Denied. Adding kms:GenerateDataKey (and typically kms:Decrypt for reads) resolves the issue.

Answer

The Lambda function is not in a VPC that has access to the KMS key.

Answer

The output bucket does not have a bucket policy allowing the Lambda function to write.

Answer

The upload bucket's default encryption is not applied to objects uploaded by Lambda.

Question 3

A developer is deploying a serverless application using AWS SAM. The application consists of an API Gateway REST API and multiple AWS Lambda functions. The developer wants to deploy the application to a production environment with minimal downtime. Which deployment strategy should the developer use?

Accepted Answer

Use SAM's built-in canary deployment with traffic shifting.. AWS SAM supports built-in canary deployments with traffic shifting, which gradually routes a percentage of traffic to the new version while monitoring CloudWatch alarms. This minimizes downtime and allows automatic rollback if errors occur. It is the recommended strategy for serverless applications on API Gateway and Lambda.

Answer

Create a blue/green deployment using AWS Elastic Beanstalk.

Answer

Delete the existing stack and deploy a new one.

Answer

Perform a rolling update by updating functions one by one.

Question 4

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The Lambda function queries an Amazon RDS database. Under heavy load, the database connection pool is exhausted, causing errors. What is the BEST way to manage database connections in this serverless architecture?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between Lambda and RDS, managing a pool of database connections that can be reused across multiple concurrent Lambda invocations. This prevents connection exhaustion under heavy load without requiring code changes, as the proxy handles connection multiplexing and keeps idle connections warm.

Answer

Migrate the database to Amazon DynamoDB.

Answer

Increase the concurrency limit of the Lambda function.

Answer

Use Amazon ElastiCache to cache database connections.

Question 5

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the uploaded file, transform it, and write the result to a DynamoDB table. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:PutItem"],"Resource":"*"}. The Lambda function needs to read the uploaded file from S3 (requiring s3:GetObject) and write the transformed result to DynamoDB (requiring dynamodb:PutItem). Option A correctly grants both actions with a wildcard resource, which is acceptable for a learning scenario but should be scoped in production. This matches the exact permissions needed for the described workflow.

Answer

{"Effect":"Allow","Action":["s3:PutObject","dynamodb:PutItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:UpdateItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:GetItem"],"Resource":"*"}

Question 6

A developer is troubleshooting an AWS Lambda function that is triggered by an Amazon SQS queue. The function processes messages but occasionally fails. The failed messages are not being sent to the dead-letter queue (DLQ). What is the most likely reason?

Accepted Answer

The SQS queue's redrive policy is not configured.. For Lambda functions triggered by SQS, the dead-letter queue is configured on the SQS queue via its redrive policy, not on the Lambda function. If the redrive policy is missing or misconfigured, failed messages will not be moved to a DLQ even if the Lambda function has its own DLQ configured. The most likely reason is that the SQS queue's redrive policy is not configured.

Answer

The Lambda function's execution role does not have permission to send messages to the DLQ.

Answer

The Lambda function's reserved concurrency is set to 0.

Answer

The Lambda function does not have a dead-letter queue configured.

Question 7

A developer invokes a Lambda function from the AWS CLI and receives the response shown in the exhibit. The output file contains an error message. What is the MOST likely cause of the FunctionError field being set to 'Unhandled'?

Accepted Answer

The function code threw an uncaught exception.. The FunctionError field set to 'Unhandled' in a Lambda invocation response indicates that the function's code raised an uncaught exception during execution, so option C is correct. AWS Lambda returns this value when the runtime catches an error that the handler did not handle, and the error details appear in the response payload. Option A would typically cause logging failures rather than an 'Unhandled' FunctionError, and could even prevent error details from being logged. Option B is incorrect because the synchronous invocation payload limit is 6 MB, not 6 KB, and exceeding it produces a request validation error, not an 'Unhandled' FunctionError. Option D is incorrect because a timeout produces a different error type (for example, 'Task timed out after X seconds') rather than the generic 'Unhandled' value.

Answer

The function's execution role does not have permission to write to CloudWatch Logs.

Answer

The invocation request payload exceeded the 6 KB limit for synchronous invocation.

Answer

The function timed out before completing execution.

Question 8

A developer is deploying a new version of a Lambda function and wants to roll back immediately if errors are detected. Which deployment strategy should the developer use?

Accepted Answer

Use AWS CodeDeploy with a canary deployment configuration. The correct option is A: AWS CodeDeploy with a canary deployment configuration. CodeDeploy supports Lambda deployments with traffic-shifting configurations, and a canary deployment shifts a small percentage of traffic first (e.g., 10% for 5 minutes) so that CloudWatch alarms can trigger an automatic rollback if errors are detected, satisfying the requirement to roll back immediately. Option B is wrong because EC2 rolling updates apply to EC2 instances, not Lambda functions. Option C is less suitable because a linear configuration shifts traffic in equal increments over time, which delays error detection compared to a canary's initial small traffic slice. Option D is wrong because immutable updates are an EC2/Elastic Beanstalk strategy, not a Lambda deployment strategy.

Answer

Use an EC2 rolling update strategy

Answer

Use AWS CodeDeploy with a linear deployment configuration

Answer

Use an immutable update strategy

Question 9

A developer is deploying a microservices application on Amazon ECS with the Fargate launch type. The application uses an Application Load Balancer (ALB) to route traffic. The developer wants to perform a blue/green deployment with automated traffic shifting using AWS CodeDeploy. What is the minimum number of target groups required for this deployment?

Accepted Answer

Two. In a blue/green deployment with AWS CodeDeploy and an Application Load Balancer (ALB) on Amazon ECS (Fargate), two target groups are required: one for the 'blue' (current) environment and one for the 'green' (new) environment. CodeDeploy shifts traffic from the blue target group to the green target group by updating the ALB listener rules, allowing zero-downtime deployments and automated rollback if needed.

Answer

One

Answer

Three

Answer

Four

Question 10

A developer is building a serverless application using AWS SAM. The application includes a Lambda function that needs read-only access to an S3 bucket. The developer wants to use SAM's built-in policy templates to grant this permission. Which policy template should be used in the SAM template?

Accepted Answer

S3ReadPolicy. The S3ReadPolicy template is the correct choice because it grants read-only access to an S3 bucket, which aligns with the requirement for the Lambda function. AWS SAM provides this built-in IAM policy template to simplify attaching least-privilege permissions, specifically allowing s3:GetObject, s3:ListBucket, and similar read operations.

Answer

S3CrudPolicy

Answer

S3FullAccessPolicy

Answer

S3StreamPolicy

Question 11

A developer needs to store application configuration data, such as database connection strings and third-party API keys, securely. The data must be encrypted at rest and automatically rotated. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, encrypt, and automatically rotate secrets such as database connection strings and API keys. It integrates with AWS KMS for encryption at rest and provides built-in rotation capabilities for supported services like Amazon RDS, Redshift, and DocumentDB, meeting the requirement for automatic rotation without custom code.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 12

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses a MySQL database. During deployment, the developer needs to apply database schema migrations. Which approach should the developer use to run database migrations as part of the Elastic Beanstalk deployment?

Accepted Answer

Use an .ebextensions configuration file to run a migration script during deployment.. Elastic Beanstalk supports .ebextensions configuration files that can execute custom commands or scripts during deployment. By placing a migration script (e.g., a shell script that runs `mysql` commands or a framework migration tool) in the `.ebextensions` directory and using the `commands` or `container_commands` key, the developer can ensure the migration runs automatically after the application is deployed but before the new environment serves traffic. This approach integrates the migration into the deployment lifecycle without external dependencies.

Answer

Configure an RDS event subscription to trigger a Lambda function that runs migrations.

Answer

Run the migration script as a scheduled task using CloudWatch Events.

Answer

Use AWS CodeDeploy's AppSpec file to run the migration script.

Question 13

A developer is building a serverless application using AWS Step Functions to orchestrate multiple AWS Lambda functions. One of the Lambda functions occasionally fails due to a transient error. The developer wants the Step Functions execution to automatically retry the failed task up to three times with exponential backoff. Which configuration should the developer set in the Step Functions state machine definition?

Accepted Answer

Use the Amazon States Language (ASL) Retry field in the Task state definition.. The Amazon States Language (ASL) provides a native Retry field within a Task state definition that allows you to specify retry policies, including a maximum retry count and exponential backoff. This is the intended mechanism for handling transient failures in Step Functions without requiring custom code or external retry logic.

Answer

Add a Retry clause in the Lambda function's configuration with a maximum retry count of 3.

Answer

Wrap the Lambda function invocation in a custom while loop within the function code.

Answer

Use the Amazon States Language Catch field in the Task state to redirect to a retry logic.

Question 14

A developer wants to store session state for a web application running on multiple EC2 instances. Which AWS service provides a fully managed, in-memory data store that is ideal for this use case?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for storing session state across multiple EC2 instances. Redis supports atomic operations, TTL-based key expiration, and high-speed reads/writes, making it perfect for session management where low-latency access and automatic data eviction are critical. Unlike disk-based stores, ElastiCache for Redis keeps session data in memory, ensuring sub-millisecond response times and seamless scaling as the web application grows.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon RDS for MySQL

Question 15

Which THREE AWS services are commonly used together to build a serverless event-driven architecture that processes real-time streaming data? (Choose three.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams (A) is correct because it ingests and buffers real-time streaming data at scale, serving as the event source for downstream serverless processing. AWS Lambda (B) is correct because it provides serverless compute that can be triggered by Kinesis stream records via event source mappings, enabling event-driven processing without managing servers. Amazon DynamoDB (C) is correct because it is a fully managed, serverless NoSQL database commonly used as the sink to store processed streaming results, and DynamoDB Streams can further propagate events. Amazon SQS (D) is not selected because it is a message queue for decoupling components, not a real-time streaming data service, and it is not one of the three services typically combined for streaming ingestion and processing in this scenario. Amazon Redshift (E) is not selected because it is a data warehouse designed for analytical queries on batch-loaded data, not for real-time serverless stream processing.

Answer

Amazon SQS

Answer

Amazon Redshift

Question 16

A company uses AWS OpsWorks to manage a stack of EC2 instances. The operations team needs to deploy a new configuration file to all instances in a layer. Which approach should the team use to automate this deployment?

Accepted Answer

Add a Chef recipe to the layer's custom cookbooks that copies the configuration file to the instances. The correct answer is B: adding a Chef recipe to the layer's custom cookbooks that copies the configuration file to the instances. AWS OpsWorks Stacks is built on Chef, so configuration management tasks like distributing files to all instances in a layer are performed through recipes executed during lifecycle events (Setup, Configure, Deploy), making this the native and automated approach. Option A is not the OpsWorks-native mechanism and would bypass the stack's Chef-based lifecycle, requiring manual invocation or separate targeting. Option C is incorrect because CloudFormation provisions infrastructure and does not manage in-instance configuration files for an existing OpsWorks stack. Option D is also wrong because CodeDeploy is a separate deployment service not integrated with OpsWorks Stacks' Chef recipe model.

Answer

Use AWS Systems Manager Run Command to execute a script that deploys the file

Answer

Create a new AWS CloudFormation stack to update the instances

Answer

Use AWS CodeDeploy to deploy the configuration file

Question 17

A developer is writing an AWS Lambda function in Python that needs to download a file from Amazon S3, process it, and upload the result to a different S3 bucket. The function currently runs within the default 3-second timeout, but the developer expects the file size to increase. What is the MOST cost-effective way to handle the increase in processing time?

Accepted Answer

Increase the Lambda function's timeout to a value higher than the expected processing time.. Increasing the Lambda function's timeout is the most cost-effective solution because it directly addresses the expected increase in processing time without incurring additional costs. Lambda pricing is based on the number of invocations and duration (in GB-seconds), so extending the timeout only charges for the actual time the function runs, not for idle time or additional services. This approach avoids the complexity and cost of Step Functions or provisioned concurrency, which would add unnecessary overhead for a simple sequential task.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use Lambda provisioned concurrency to keep the function warm.

Answer

Refactor the code to use AWS Step Functions to orchestrate the processing.

Question 18

A developer is deploying a new version of a Lambda function using the AWS CLI. The function is part of a serverless application that processes S3 events. The developer wants to ensure that the new version is production-ready and that the old version is still available for rollback. Which CLI command should the developer use to create a new version of the Lambda function?

Accepted Answer

aws lambda publish-version --function-name my-function. The `aws lambda publish-version` command creates an immutable, versioned snapshot of the Lambda function's code and configuration, which is required for production-ready deployments. This ensures the old version remains available for rollback while the new version is published with a unique version number (e.g., $LATEST, 1, 2). The command explicitly publishes the current $LATEST version as a new numbered version, making it production-ready without affecting existing versions.

Answer

aws lambda update-function-configuration --function-name my-function --handler new-handler

Answer

aws lambda update-function-code --function-name my-function --zip-file fileb://my-code.zip

Answer

aws lambda create-function --function-name my-function --zip-file fileb://my-code.zip

Question 19

A developer is building a serverless application using AWS Lambda and needs to securely store database credentials. Which AWS service should be used to store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (option B) is the correct choice because it is purpose-built to store, rotate, and retrieve secrets such as database credentials via API calls, and Lambda functions can fetch them at runtime using the AWS SDK with fine-grained IAM permissions. It also natively supports automatic rotation of credentials for supported databases like Amazon RDS, MySQL, and PostgreSQL, which reduces the risk of long-lived static credentials. AWS CloudFormation (A) is an infrastructure-as-code service for provisioning resources, not for storing secrets. AWS Systems Manager Parameter Store (C) can hold parameters including SecureString values, but it lacks built-in secret rotation and is less tailored to credential lifecycle management. AWS KMS (D) is an encryption key management service that encrypts data but does not itself store or serve database credentials.

Answer

AWS CloudFormation

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 20

A developer has deployed an AWS Lambda function that is triggered by an Amazon S3 event. The function processes image files and stores metadata in an Amazon DynamoDB table. CloudWatch metrics show that the function's error count has increased. The developer checks CloudWatch Logs and sees errors related to insufficient memory. The function is configured with 128 MB of memory. What should the developer do to resolve the errors?

Accepted Answer

Increase the function's memory to 256 MB or higher.. The error is caused by insufficient memory, which directly impacts the CPU and execution resources allocated to the Lambda function. Increasing the memory allocation to 256 MB or higher provides more CPU throughput and memory, resolving the out-of-memory errors without requiring code changes.

Answer

Increase the function's timeout to 30 seconds.

Answer

Reduce the size of the images being uploaded to S3.

Answer

Move the DynamoDB write operation to an asynchronous invocation.