DVA-C02 Practice Exam 63 — 20 Questions

Question 1

A company is using Amazon ElastiCache for Redis to improve the performance of a high-traffic web application. Recently, the application has been experiencing increased latency. The developer suspects that cache misses are causing the application to read from the database more frequently. Which THREE metrics should the developer examine in Amazon CloudWatch to troubleshoot this issue? (Choose THREE.)

Accepted Answer

CacheMisses. Option A, option B, and option C are correct. Option A: CacheMisses shows the number of requests that did not find a key in the cache. Option B: Evictions indicates keys removed due to memory pressure, which can cause increased misses. Option C: CurrConnections helps understand if there is a connection bottleneck. Option D (CPUUtilization) is not directly related to cache efficiency. Option E (SwapUsage) indicates memory pressure, which is related to evictions, but CPU is not the best metric for this issue. The three best are CacheMisses, Evictions, and CurrConnections.

Answer

SwapUsage

Answer

CPUUtilization

Question 2

A company is using AWS Elastic Beanstalk for a Node.js application. The environment's health is 'Severe' and the logs show 'ELB health check target http://:80/ is not responding'. What is the MOST likely cause?

Accepted Answer

The application is listening on a different port than the health check expects.. Option D is correct because the health check path is set to HTTP port 80 by default, but the application may be listening on a custom port. Option A is wrong because if the application is not deployed, the error would be different. Option B is wrong because the health check error is about the target, not the load balancer. Option C is wrong because the security group would block all traffic, not just health checks.

Answer

The application is not deployed to the EC2 instances.

Answer

The security group for the EC2 instances is blocking traffic on port 80.

Answer

The load balancer is not configured to listen on port 80.

Question 3

A developer is deploying a new version of a Lambda function using AWS CodeDeploy. The deployment fails with a 'DeploymentLimitExceeded' error. What is the most likely cause?

Accepted Answer

The deployment group has reached the maximum number of concurrent deployments.. AWS CodeDeploy has a limit on the number of concurrent deployments per deployment group. Option D is correct. The error indicates the limit is exceeded. Option A is incorrect because deployment limits are per deployment group, not per function. Option B is incorrect because the error is not about version conflicts. Option C is incorrect because the error is not about IAM permissions.

Answer

The Lambda function has reached the maximum number of versions.

Answer

Another deployment is in progress for the same Lambda function.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Question 4

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer runs 'sam deploy' and the deployment succeeds. However, when the developer tests the API endpoint using curl, the request times out. The CloudWatch logs for the Lambda function show that the function is not being invoked. The API Gateway logs are not enabled. The developer checks the API Gateway console and sees that the integration type is 'AWS Service' instead of 'Lambda Function'. The developer used the following SAM template snippet:

Resources:
  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      DefinitionBody:
        swagger: 2.0
        info:
          title: My API
        paths:
          /items:
            get:
              x-amazon-apigateway-integration:
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFunction.Arn}/invocations
              responses: {}
  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: index.handler
      Runtime: nodejs14.x
      Events:
        ApiEvent:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /items
            Method: GET

What is the most likely cause of the timeout?

Accepted Answer

The API Gateway integration type is misconfigured; the SAM template should use 'AWS::Serverless::Function' event source instead of manual Swagger integration.. The SAM template defines the API using both the 'AWS::Serverless::Api' resource with a Swagger definition inline and the 'AWS::Serverless::Function' with an Api event. This may cause a conflict or incorrect configuration. Option D is correct: the 'x-amazon-apigateway-integration' type is set to 'aws_proxy' but the URI is incorrect. However, the API Gateway integration type shown as 'AWS Service' indicates that the integration was not properly set up. The most likely cause is that the SAM template incorrectly defines the integration, leading to a misconfiguration. Option A is wrong because the timeout is not due to Lambda limits. Option B is wrong because the code is not invoked. Option C is wrong because the API is correctly set up for public access.

Answer

The API Gateway endpoint is not publicly accessible due to a resource policy.

Answer

The Lambda function's code is throwing an unhandled exception before it can log.

Answer

The Lambda function has reached the concurrency limit.

Question 5

A developer attached the IAM policy above to an IAM user. The user reports that they receive an AccessDenied error when trying to upload a file to the S3 bucket using the AWS CLI without specifying any server-side encryption. What is the reason for the error?

Accepted Answer

The request does not include the required server-side encryption header.. Option B is correct because the policy requires s3:x-amz-server-side-encryption to be AES256. If not specified, the condition fails and the request is denied. Option A is wrong because the resource is correct. Option C is wrong because the action is allowed. Option D is wrong because putting an object without encryption does not match the condition.

Answer

The policy does not allow the s3:PutObject action on the bucket itself.

Answer

The IAM user does not have permissions to use the s3:PutObject action.

Answer

The bucket policy overrides the IAM policy.

Question 6

A developer has attached the IAM policy shown in the exhibit to a user. The user reports that they can upload and delete objects in the bucket 'my-bucket', but cannot list the objects in the bucket. What is the MOST likely reason?

Accepted Answer

The bucket has a bucket policy that denies s3:ListBucket.. Option A is correct. The ListBucket permission is granted at the bucket level (arn:aws:s3:::my-bucket), but the condition that the user must have s3:ListBucket permission is granted. However, the issue is that the user cannot list objects. The policy looks correct. The most common reason for being unable to list objects despite having ListBucket permission is that the bucket policy denies listing, or the user is trying to list a specific prefix without proper permissions. But in this case, the policy allows ListBucket on the bucket. Option B: The user is using an incorrect API call (e.g., ListObjectsV2) is unlikely. Option C: The bucket is in a different region would not affect permissions. Option D: The user needs s3:GetObject to list? No, listing requires ListBucket. So the correct answer is that the bucket policy overrides the IAM policy. Let me adjust: Actually, the most likely reason is that the bucket has a bucket policy that denies s3:ListBucket. That is option A. Yes.

Answer

The IAM policy is missing the s3:GetObject permission for listing.

Answer

The user is using the ListObjectsV2 API call instead of ListObjects.

Answer

The bucket is in a different region than the default region configured in the AWS CLI.

Question 7

A developer is troubleshooting an Amazon RDS for MySQL instance that is experiencing high CPU utilization. The application performs many read operations. The developer wants to reduce the load on the database. What is the MOST effective solution?

Accepted Answer

Create a read replica and direct read queries to it.. Option C is correct because adding a read replica offloads read traffic from the primary instance, reducing CPU utilization. Option A is wrong because vertical scaling increases capacity but does not specifically address read load efficiently. Option B is wrong because reserved instances do not reduce CPU usage. Option D is wrong because Multi-AZ provides high availability, not performance improvement.

Answer

Upgrade the DB instance to a larger instance class.

Answer

Enable Multi-AZ for automatic failover.

Answer

Purchase reserved instances to reduce costs.

Question 8

A developer is trying to decrypt an S3 object using an AWS KMS key. The decryption fails with an 'AccessDenied' error. The IAM policy attached to the developer's user includes the statement in the exhibit. The KMS key policy includes the following statement:

{
  "Sid": "Enable IAM User Permissions",
  "Effect": "Allow",
  "Principal": {
    "AWS": "arn:aws:iam::123456789012:root"
  },
  "Action": "kms:*",
  "Resource": "*"
}

What is the most likely reason for the failure?

Accepted Answer

The developer's IAM policy does not include 'kms:GenerateDataKey' permission.. The IAM policy only grants kms:Decrypt, but to decrypt an S3 object, the developer also needs kms:GenerateDataKey (if using envelope encryption) or kms:ReEncrypt. However, the most common issue is that the IAM policy does not allow the necessary action. Option B is correct because the developer's IAM policy lacks 'kms:GenerateDataKey' which is often needed. Option A is wrong because the key policy allows IAM users. Option C is wrong because the key policy uses the root account. Option D is wrong because the key policy does not restrict the principal.

Answer

The KMS key policy does not grant access to the developer's IAM user.

Answer

The KMS key policy specifies 'kms:*' which is too broad and causes a conflict.

Answer

The developer's IAM policy uses 'Resource' with the full key ARN but the key policy requires a different format.

Question 9

A developer is troubleshooting a Lambda function that occasionally times out. The function makes HTTPS calls to an external API. Which configuration change is MOST likely to resolve the issue without increasing the risk of further timeouts?

Accepted Answer

Increase the function's timeout setting.. Option B is correct because adjusting the timeout setting gives the function more time to complete the external API call. Option A is wrong because increasing memory/CPU won't help if the external API is slow. Option C is wrong because synchronous invocation is not relevant to timeout. Option D is wrong because reducing timeout would worsen the issue.

Answer

Increase the function's memory allocation.

Answer

Decrease the function's reserved concurrency.

Answer

Change the function invocation type to synchronous.

Question 10

A company has a DynamoDB table with a global secondary index (GSI) for querying. The write capacity is provisioned at 1000 WCU, and the GSI has 500 WCU. During a traffic spike, writes to the table are throttled, but the GSI is not throttled. What is the MOST likely cause?

Accepted Answer

The total write traffic to the table exceeds 1000 WCU.. Option B is correct because throttling occurs when writes exceed provisioned WCU on the table, not the GSI. Option A is wrong because hot partition would cause throttling on specific partitions, but the scenario mentions general throttling. Option C is wrong because GSI throttling would affect writes to the GSI, not the table. Option D is wrong because adaptive capacity would mitigate throttling, not cause it.

Answer

DynamoDB adaptive capacity is reducing the table's write capacity.

Answer

A hot partition in the table is exceeding its partition-level write limits.

Answer

The GSI is throttling writes because its write capacity is insufficient.

Question 11

A developer notices that an RDS MySQL instance's CPU utilization is consistently above 80% during peak hours. Which AWS service can be used to analyze the database queries and identify the root cause?

Accepted Answer

RDS Performance Insights. RDS Performance Insights provides a dashboard to analyze database load and identify top SQL queries. Option B is the correct service. CloudWatch Logs Insights (A) is for log analysis, not database query performance. AWS X-Ray (C) traces requests, not database queries. RDS Enhanced Monitoring (D) provides OS-level metrics but not query-level detail.

Answer

RDS Enhanced Monitoring

Answer

AWS X-Ray

Answer

CloudWatch Logs Insights

Question 12

A developer is debugging an application that uses Amazon SQS. The application occasionally processes the same message twice. Which TWO configurations can help prevent duplicate processing?

Accepted Answer

Increase the visibility timeout to ensure messages are deleted before becoming visible again.. Option A is correct: enabling content-based deduplication for FIFO queues ensures exactly-once processing. Option B is correct: increasing the visibility timeout gives the consumer more time to process and delete the message before it becomes visible again. Option C is wrong: increasing the delivery delay only delays the first delivery. Option D is wrong: enabling long polling improves efficiency but does not prevent duplicates. Option E is wrong: using a dead-letter queue handles failed messages, not duplicates.

Answer

Configure a dead-letter queue to capture duplicates.

Answer

Increase the delivery delay to defer message processing.

Answer

Enable long polling to reduce empty responses.

Question 13

A developer is using Amazon RDS for MySQL and notices that the database performance has degraded. The developer suspects that slow queries are the cause. Which THREE actions should the developer take to identify and address the slow queries?

Accepted Answer

Enable the slow query log in RDS and review the logs.. Options A, C, and E are correct. Option A: Enabling slow query log captures queries that exceed a threshold. Option C: Performance Insights provides a dashboard to identify database load and wait events. Option E: Reviewing queries with high latency helps pinpoint problematic SQL. Option B is wrong because increasing instance size is a reactive scaling action, not a diagnostic step. Option D is wrong because read replicas help with read scaling, not diagnosing slow queries.

Answer

Increase the DB instance size to improve performance.

Answer

Create a read replica to offload read traffic.

Question 14

A developer is optimizing an API Gateway REST API that uses Lambda integration. The response times are high, and CloudWatch logs show that the Lambda function has cold starts frequently. The function is written in Java and uses a large library. What is the MOST effective optimization?

Accepted Answer

Enable provisioned concurrency on the Lambda function.. Option B is correct because using provisioned concurrency keeps the function initialized and warm, eliminating cold starts. Option A is wrong because increasing memory does not directly reduce cold start time. Option C is wrong because using the AWS SDK alone does not reduce cold starts. Option D is wrong because using a Node.js function would reduce cold starts but may require rewriting the code, which is not as effective as provisioned concurrency.

Answer

Rewrite the function in Node.js to reduce cold start time.

Answer

Increase the Lambda function's memory allocation to 3008 MB.

Answer

Use the AWS SDK for Java 2.x to reduce initialization time.

Question 15

A developer is troubleshooting an EC2 instance that is unreachable via SSH. The instance passed the status checks, and the security group allows SSH from the developer's IP. What should the developer check next?

Accepted Answer

The network ACL's outbound rules.. The network ACL is stateless and must allow both inbound and outbound traffic. Option B is correct: the outbound ephemeral port range must be allowed for the return traffic. Option A is wrong because the security group is stateful and allows return traffic automatically. Option C is wrong because the instance is reachable for status checks. Option D is wrong because route tables do not affect direct connectivity to the instance from the internet if it has a public IP.

Answer

The security group's outbound rules.

Answer

The route table for the subnet.

Answer

The instance's system log for kernel errors.

Question 16

A developer runs the AWS CLI command above to view the latest log stream for a Lambda function. The output shows a log stream with lastEventTimestamp of 1710493200000 (approximately 1 hour ago). However, the function was invoked 5 minutes ago and did not produce any errors. What is the MOST likely explanation?

Accepted Answer

The command returned only the oldest log stream because of the limit and ordering parameters.. Option D is correct because the command only returns one log stream due to the limit 1 parameter. There may be newer log streams that are not shown. Option A is wrong because the function did not fail. Option B is wrong because the log stream exists. Option C is wrong because the function was invoked recently.

Answer

The Lambda function was not actually invoked 5 minutes ago.

Answer

The Lambda function execution role lacks permissions to write to CloudWatch Logs.

Answer

The log stream was deleted after the last invocation.

Question 17

A company is using AWS CodePipeline for CI/CD. The pipeline has a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The deployment is failing with 'Error: Health checks failed'. Which TWO steps should the developer take to troubleshoot this issue? (Select TWO.)

Accepted Answer

Verify that the target group's health check path and port are correctly configured.. Options B and D are correct. Checking the CodeDeploy deployment logs (B) will show detailed error messages. Verifying the target group's health check configuration (D) ensures the application is responding correctly. Option A (checking CodeBuild logs) is irrelevant because the build stage succeeded. Option C (increasing instance count) does not address health check failure. Option E (checking S3 bucket) is not directly related.

Answer

Check the S3 bucket where the build artifacts are stored.

Answer

Check the CodeBuild build logs for errors.

Answer

Increase the number of EC2 instances in the Auto Scaling group.

Question 18

A developer is using SQS to decouple microservices. The producer sends messages, but the consumer (an EC2 instance) does not process them. The CloudWatch metric 'ApproximateNumberOfMessagesVisible' is increasing. The consumer's IAM role has 'sqs:ReceiveMessage' and 'sqs:DeleteMessage' permissions. What is the most likely cause?

Accepted Answer

The consumer is not using long polling, so calls to ReceiveMessage return empty frequently.. The consumer must also have 'sqs:ChangeMessageVisibility' to extend the visibility timeout if needed, but the key issue is that the consumer may not be calling ReceiveMessage with the correct queue URL or there is a network issue. However, the most common cause is that the visibility timeout is too short and messages are not being deleted before becoming visible again, but that would cause the metric to fluctuate. Another possibility is that the consumer is polling the wrong queue. Option D is correct: the consumer is not using long polling, which can lead to empty responses and the impression that there are no messages. Option A is wrong because the permissions include ReceiveMessage. Option B is wrong because a DLQ would receive messages after max receives, but messages are still visible. Option C is wrong because the queue is not encrypted by default.

Answer

A dead-letter queue is configured and messages are being moved there.

Answer

The consumer does not have permission to call 'sqs:ReceiveMessage'.

Answer

The queue is encrypted with SSE, and the consumer does not have permission to use the KMS key.

Question 19

A developer notices that an S3 bucket configured for static website hosting returns 403 Forbidden errors when accessed from a browser. The bucket policy allows s3:GetObject for principal "*" but only over HTTPS. What is the MOST likely reason for the error?

Accepted Answer

The request was sent over HTTP instead of HTTPS.. Option D is correct because the bucket policy condition requires HTTPS, but the browser may have used HTTP. Option A is wrong because the bucket policy does not require authentication. Option B is wrong because the website endpoint does not support HTTPS by default. Option C is wrong because the bucket policy explicitly allows GetObject.

Answer

The requester is not authenticated with AWS IAM.

Answer

The bucket policy denies s3:GetObject for anonymous principals.

Answer

The S3 bucket website endpoint does not support HTTPS.

Question 20

A company runs a critical application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the company noticed that the ALB returns 502 Bad Gateway errors during peak traffic hours. The developer checks the ECS service metrics and sees that the number of running tasks remains constant, while CPU and memory utilization are below 50%. The ALB target group health checks are failing intermittently for some tasks. What is the MOST likely cause of the 502 errors?

Accepted Answer

The ALB idle timeout is set too low, causing connections to be closed before the application responds.. Option A is correct because if the tasks are overloaded and cannot respond within the idle timeout, the ALB returns 502. The health checks fail because the tasks are slow to respond. Option B is wrong because the tasks are not at capacity and the service does not need to scale. Option C is wrong because the security group is not likely the issue if health checks succeed sometimes. Option D is wrong because the tasks are not failing to start; they are running but slow.

Answer

The task definition's startup command is failing, causing the tasks to never become healthy.

Answer

The ECS service is not configured with auto scaling to handle the increased traffic.

Answer

The security group for the ECS tasks is blocking traffic from the ALB.