DVA-C02 Practice Exam 62 — 20 Questions

Question 1

A developer notices that an application is generating duplicate entries in a DynamoDB table. The application uses a Lambda function triggered by an SQS queue. Messages are processed with at-least-once delivery. Which design change will reduce duplicates?

Accepted Answer

Implement idempotent processing by checking a condition expression in DynamoDB PutItem.. SQS provides at-least-once delivery, so duplicates are possible. Making the Lambda function idempotent using a unique message deduplication ID (e.g., using the message ID as a condition in DynamoDB) prevents duplicates.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Use a FIFO SQS queue with content-based deduplication.

Answer

Use DynamoDB Transactions to ensure atomic writes.

Question 2

A developer tries to create a CloudFormation stack using the template above, but it fails with 'The bucket you tried to create already exists'. The developer has already deleted the bucket from the AWS Management Console. What is the MOST likely reason for the failure?

Accepted Answer

The bucket name is still globally reserved after deletion.. Even after deletion, the bucket name may still be in a 'pending deletion' state or may have been taken by another AWS account. S3 bucket names are globally unique. If the name is still reserved (e.g., recently deleted), you cannot recreate it immediately. The developer should use a different bucket name.

Answer

The CloudFormation template uses an incorrect intrinsic function.

Answer

Bucket versioning must be Disabled initially.

Answer

The developer does not have permission to create buckets in that region.

Question 3

A company's application runs on Amazon EC2 instances in an Auto Scaling group. The application experiences intermittent failures, and the developer suspects the application is not properly handling termination notifications. Which TWO steps should the developer take to diagnose the issue?

Accepted Answer

Configure a CloudWatch Events rule to capture Auto Scaling termination events.. Options B and D are correct. B: Lifecycle hooks allow the instance to perform actions before termination. D: CloudWatch Events can capture lifecycle transitions. Option A is wrong because detailed monitoring does not capture termination signals. Option C is wrong because CloudWatch Logs agent is for logs, not for termination notifications. Option E is wrong because replacing instances does not diagnose the issue.

Answer

Enable detailed monitoring on the Auto Scaling group.

Answer

Install the CloudWatch Logs agent on the instances to capture application logs.

Answer

Use an Elastic Load Balancer to replace instances automatically.

Question 4

A developer is troubleshooting a slow-running query in Amazon RDS for MySQL. The query is used by a reporting dashboard. Which AWS service should the developer use to identify the bottleneck?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides a detailed analysis of database performance, including wait events and SQL query performance, helping identify bottlenecks.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 5

A developer notices that an AWS Lambda function is timing out after 3 seconds. The function processes messages from an SQS queue. What is the MOST likely cause of the timeout?

Accepted Answer

The Lambda function timeout is set too low.. The function's timeout setting is likely lower than the time needed for processing. Option A is correct because the default Lambda timeout is 3 seconds, and increasing it can resolve the issue. Option B is wrong because SQS visibility timeout controls message redelivery, not function timeout. Option C is wrong because reserved concurrency affects scaling, not individual function timeout. Option D is wrong because the DLQ is for failed messages, not timeout control.

Answer

The SQS dead-letter queue is not configured.

Answer

The SQS queue visibility timeout is too short.

Answer

The Lambda function's reserved concurrency is set to zero.

Question 6

A developer attached the above IAM policy to an AWS Lambda function that writes encrypted objects to an S3 bucket. The function fails with an 'AccessDenied' error when putting objects. What is the most likely reason?

Accepted Answer

The policy does not include s3:PutObjectAcl permission.. Option C is correct because the policy allows s3:PutObject but does not include s3:PutObjectAcl or other permissions that may be needed by the Lambda function or the encryption context. Option A is wrong because the policy is not missing; it is there. Option B is wrong because KMS permissions are granted. Option D is wrong because s3:GetObject is not needed for writing; but missing s3:PutObjectAcl is common when bucket policies enforce specific ACLs.

Answer

The policy is missing a statement for the S3 bucket itself (not the objects).

Answer

The policy allows s3:GetObject, which is unnecessary and conflicts with PutObject.

Answer

The KMS key policy does not allow the Lambda function to decrypt.

Question 7

A developer is using AWS X-Ray to trace requests through a microservices application. One of the services, Service B, is not appearing in the trace map. What is the MOST likely reason?

Accepted Answer

Service B is not instrumented with the X-Ray SDK.. For X-Ray to trace requests across services, each service must be instrumented with the X-Ray SDK. If Service B is not instrumented, it won't send trace data, and it won't appear in the trace map.

Answer

Service B is using HTTP/2, which is not supported by X-Ray.

Answer

Service B is running in a different AWS region.

Answer

The X-Ray sampling rate is set too low.

Question 8

A developer deployed a new version of an AWS Lambda function using the AWS CLI update-function-code command. The function uses environment variables to store database credentials. After the update, the function returns errors indicating it cannot connect to the database. What is the MOST likely cause?

Accepted Answer

The environment variables were not set in the new version.. Option B is correct because update-function-code does not preserve environment variables; they are reset. Option A is wrong because the function code is updated, not the IAM role. Option C is wrong because environment variables are not encrypted by default but that wouldn't cause connection failure. Option D is wrong because the function ARN doesn't affect environment variables.

Answer

The function ARN changed after the update.

Answer

The database credentials are encrypted but the function cannot decrypt them.

Answer

The function's IAM role was changed during the update.

Question 9

A developer deployed the above AWS SAM template. Messages are not being processed; they end up in the DeadLetterQueue after 3 receives. The Lambda function timeout is 30 seconds. What is the most likely cause?

Accepted Answer

The SQS visibility timeout is equal to the Lambda function timeout.. Option A is correct because the VisibilityTimeout (30 seconds) equals the Lambda timeout (30 seconds). If the function takes near 30 seconds, the message becomes visible again before processing completes, causing another receive and eventually moving to DLQ. Option B is wrong because the function has the SQSPollerPolicy. Option C is wrong because BatchSize 10 is fine. Option D is wrong because a higher maxReceiveCount would delay DLQ, not prevent it.

Answer

The maxReceiveCount is too low; increase it to 5.

Answer

The batch size is too high, causing the function to timeout.

Answer

The Lambda function does not have permission to poll the SQS queue.

Question 10

Which TWO actions should a developer take to optimize cost and performance for a Lambda function that processes real-time streaming data from Amazon Kinesis? (Choose 2.)

Accepted Answer

Enable the parallelization factor to process multiple batches concurrently per shard.. Increasing batch size and enabling parallelization factor reduce the number of Lambda invocations and improve throughput. Provisioned concurrency is for latency, not cost/performance optimization for Kinesis. Increasing memory may be needed but not directly for cost optimization.

Answer

Enable provisioned concurrency to reduce cold starts.

Answer

Increase the Lambda function memory to improve processing speed.

Answer

Use a larger Kinesis shard count.

Question 11

A company uses Amazon API Gateway with a Lambda integration. The API returns a 502 Bad Gateway error for some requests. The Lambda function writes logs to CloudWatch. Which steps should a developer take to troubleshoot this issue? (Select the BEST combination.)

Accepted Answer

Increase the Lambda function timeout and review the CloudWatch logs for errors.. Option C is correct because increasing Lambda timeout and checking CloudWatch logs can identify if the function is timing out or has an error. Option A is wrong because API Gateway throttling returns 429, not 502. Option B is wrong because IAM permissions would cause 403. Option D is wrong because enabling detailed metrics helps but doesn't directly troubleshoot 502.

Answer

Enable API Gateway detailed metrics and create a dashboard.

Answer

Verify the IAM role permissions for API Gateway to invoke Lambda.

Answer

Check the API Gateway throttling settings and request limit.

Question 12

A developer attached the IAM policy above to an IAM role used by an EC2 instance. The instance is in a VPC with CIDR 10.0.0.0/16, but it cannot access objects in the S3 bucket 'example-bucket'. What is the MOST likely reason?

Accepted Answer

The condition should use 'aws:VpcSourceIp' instead of 'aws:SourceIp'.. The condition uses 'aws:SourceIp', but EC2 instances in a VPC have private IPs. For S3, the source IP that AWS sees is the public IP (if traffic goes through internet gateway) or the VPC endpoint's private IP. If the bucket policy uses 'aws:SourceIp', it compares against the source IP of the request, which for EC2 instances without a VPC endpoint is the instance's public IP (if any) or the NAT gateway's IP, not the private IP. The condition should use 'aws:VpcSourceIp' if using a VPC endpoint, or the policy should not rely on source IP from private ranges.

Answer

The policy does not allow 's3:ListBucket' action.

Answer

The IAM role does not have a trust policy.

Answer

The S3 bucket is in a different region than the EC2 instance.

Question 13

A developer notices that the Lambda function 'my-function' is not generating any logs in CloudWatch, although the function is invoked successfully. The developer runs the command above. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role is missing the 'logs:CreateLogStream' and 'logs:PutLogEvents' permissions.. The log group exists but has 0 stored bytes, meaning no log streams have been created. This typically indicates that the Lambda function's execution role does not have permissions to create log streams and put log events. The function runs but fails silently to write logs.

Answer

The log group retention policy is set to 0 days.

Answer

The Lambda function is configured to log to a custom log group.

Answer

The Lambda function has reserved concurrency set to 0.

Question 14

A company runs a Node.js application on Amazon EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. The developer checks the EC2 instance logs and sees no application errors. What is the MOST likely cause?

Accepted Answer

The health check path returns a 5xx status code due to a missing dependency.. Option D is correct because if health checks are failing but the application works, the health check path or configuration is likely wrong. Option A is wrong because security group rules blocking health checks would cause constant failure. Option B is wrong because the application is responding on the correct port. Option C is wrong because health checks target a specific path, not the root.

Answer

The health check path is set to '/' but the application serves on a different path.

Answer

The EC2 instances are running out of memory.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Question 15

A developer receives an Access Denied error when trying to download an object from an S3 bucket. The developer's IAM policy is shown in the exhibit. The bucket policy also grants access. What is the MOST likely cause?

Accepted Answer

The S3 bucket uses SSE-KMS and the user lacks kms:Decrypt permission.. Option B is correct because if the bucket is encrypted with a KMS key, the user must also have kms:Decrypt permission. Option A is wrong because the policy explicitly allows s3:GetObject. Option C is wrong because the bucket policy also grants access, so it's not a bucket policy issue. Option D is wrong because public access is not required if IAM policies allow access.

Answer

The S3 bucket has block public access enabled.

Answer

The IAM policy does not allow s3:GetObject.

Answer

The bucket policy denies access to the user.

Question 16

A developer is troubleshooting a CloudFront distribution that serves static content from an S3 bucket. Users in some geographic locations report slow load times. The developer checks the CloudFront metrics and sees a high number of cache misses. What is the MOST likely cause?

Accepted Answer

The object TTL is set to a very low value (e.g., 0 seconds).. Option B is correct because a short TTL causes objects to expire from edge caches quickly, leading to frequent cache misses and requests going back to the origin. Option A (price class) affects edge locations but not cache hits. Option C (compression) does not affect cache hits. Option D (signed URLs) would cause misses if URLs are not properly constructed but not high miss rate.

Answer

The CloudFront distribution is configured with Price Class 100, which uses only the US and Europe edge locations.

Answer

The S3 bucket is configured with signed URLs for access.

Answer

The CloudFront distribution is not configured to compress objects.

Question 17

A developer is optimizing an S3 bucket that stores large CSV files for analytics. The files are accessed frequently for the first 30 days, then rarely accessed. After 90 days, the data must be retained for compliance but accessed infrequently. What is the MOST cost-effective lifecycle policy?

Accepted Answer

Transition to S3 Standard-IA after 30 days, then to S3 Glacier Deep Archive after 90 days.. Option D is correct because it transitions to S3 Standard-IA after 30 days (when access becomes rare) and to S3 Glacier Deep Archive after 90 days (for long-term compliance with lowest cost). Option A is wrong because S3 One Zone-IA is less durable. Option B is wrong because S3 Glacier Flexible Retrieval is more expensive than Deep Archive for long-term storage. Option C is wrong because S3 Intelligent-Tiering has monitoring costs and is not needed if access patterns are known.

Answer

Use S3 Intelligent-Tiering to automatically move data between access tiers.

Answer

Transition to S3 One Zone-IA after 30 days, then delete after 90 days.

Answer

Transition to S3 Glacier Flexible Retrieval after 30 days, then to S3 Glacier Deep Archive after 90 days.

Question 18

A developer is troubleshooting a Lambda function that processes S3 events. The function runs successfully in the AWS Management Console test but fails when triggered by actual S3 PUT events. The error logs show 'AccessDenied' when attempting to read the object from S3. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks 's3:GetObject' permission for the bucket.. The Lambda function's execution role must have permission to read the S3 object. The error occurs only with actual events because the console test may use a different role or the event payload differs. Option C directly addresses the missing permission. Option A is wrong because S3 events do not require VPC access. Option B is wrong because the bucket policy may not grant access to the Lambda service principal. Option D is wrong because S3 event notifications do not have versioning restrictions.

Answer

The S3 bucket has versioning enabled and the event does not include the version ID.

Answer

The S3 bucket policy does not grant 's3:GetObject' to the Lambda service principal.

Answer

The Lambda function is not in the same VPC as the S3 bucket.

Question 19

A company is using CloudFront with an S3 origin to serve static content. Users in some geographic regions experience high latency. The developer wants to optimize performance. Which THREE actions should the developer take?

Accepted Answer

Increase the TTL for the cache behavior to reduce requests to the origin.. Option A is correct: adding more edge locations (through additional origins) is not possible directly, but optimizing the origin is. Actually, CloudFront has many edge locations, but adding more origins doesn't help. Option B is correct: enabling origin shield reduces load on the origin. Option C is correct: using multiple origins and failover can improve availability. Option D is wrong: S3 Transfer Acceleration is for uploading to S3, not for CloudFront. Option E is wrong: TTL does not affect latency, only cache hit ratio.

Answer

Enable S3 Transfer Acceleration for the origin bucket.

Answer

Add additional CloudFront edge locations in the affected regions.

Question 20

A developer is troubleshooting an AWS Lambda function that is invoked by an Amazon S3 bucket notification. The function processes new objects and writes results to a DynamoDB table. Recently, some objects are not being processed. The developer checks the CloudWatch Logs for the Lambda function and sees no errors. Which TWO actions should the developer take to investigate the issue?

Accepted Answer

Check the S3 bucket notification configuration to ensure it is properly set for the correct events.. Options B and D are correct. Option B: S3 event notifications can fail if the event is not configured correctly; checking the bucket notification configuration ensures the events are being sent. Option D: Lambda dead-letter queues (DLQ) capture events that failed to be processed; if configured, they can reveal unprocessed events. Option A is wrong because the function logs show no errors, indicating the function is not invoked for those objects. Option C is wrong because DynamoDB stream is not involved in this flow. Option E is wrong because the function is invoked, but the issue is before invocation.

Answer

Enable DynamoDB Streams on the table and process records.

Answer

Increase the Lambda function's memory allocation.

Answer

Review the Lambda function's CloudWatch Logs for timeout messages.