DVA-C02 Practice Exam 65 — 20 Questions

Question 1

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

Accepted Answer

aws lambda update-function-code. The AWS CLI command `aws lambda update-function-code` is specifically designed to update the code of an existing Lambda function. It allows you to specify the function name and the location of the new code (e.g., S3 bucket and key, or a local zip file). This is the correct command for deploying a new version of the function code.

Answer

aws lambda update-function-configuration

Answer

aws lambda invoke

Answer

aws lambda create-function

Question 2

A developer is deploying a new version of a Lambda function using the AWS CLI. Which command should the developer use to update the function code?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update function code, publish version, update alias. The correct sequence is to first update the function code, then publish a new version, and finally update the alias to point to that new version. The `update-function-code` command uploads the new code to the $LATEST version, `publish-version` creates an immutable numbered version from $LATEST, and `update-alias` updates the alias to reference that specific version. This ensures the alias always points to a stable, published version rather than the mutable $LATEST.

Answer

Update alias, update function code, publish version

Answer

Create alias, update function code, publish version

Answer

Publish version, update function code, update alias

Question 3

A developer is using Amazon DynamoDB as a data store for a serverless application. The application requires strongly consistent reads and must be able to recover from failures. Which THREE measures should the developer implement? (Choose THREE.)

Accepted Answer

Use the ConsistentRead parameter set to true in GetItem and Query operations.. Option A is correct because setting ConsistentRead to true on GetItem, Query, and Scan forces a strongly consistent read that returns the most up-to-date data instead of a possibly stale eventually consistent result. Option C is correct because DynamoDB global tables provide multi-region, active-active replication, allowing the application to continue serving reads and writes from another Region if one Region fails, which directly supports failure recovery. Option D is incorrect because DynamoDB Streams is a change-data-capture feature that records item-level changes for event-driven processing, replication, or auditing; it does not itself provide failure recovery or strongly consistent reads. Option B is incorrect because DynamoDB does not offer native read replicas as a standalone feature; read scaling is achieved through partitions, global tables, or DAX. Option E is incorrect because DAX is an in-memory write-through cache that serves eventually consistent reads by default and does not provide strongly consistent reads or cross-Region failure recovery.

Answer

Use DynamoDB read replicas to offload read traffic.

Answer

Enable DynamoDB Streams to capture changes.

Answer

Implement DAX (DynamoDB Accelerator) for caching.

Question 4

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function sometimes fails to process a message due to a transient error. The company wants to automatically retry failed messages up to 3 times, with a 5-minute delay between retries. What should the company configure?

Accepted Answer

Configure the SQS queue with a delivery delay of 5 minutes and a redrive policy to move messages to a dead-letter queue after 3 receives.. For an SQS-triggered Lambda, retries are managed by SQS. To retry a failed message up to 3 times with a 5-minute delay between attempts, set the queue's visibility timeout to 5 minutes and configure a redrive policy with maxReceiveCount = 3 so the message is moved to a dead-letter queue after 3 failed receives. Note that a delivery delay only postpones the initial delivery of a message and does not create a delay between retries, so option D's 'delivery delay' is the wrong mechanism. Option A is incorrect because Lambda functions do not have a redrive policy; retries for SQS-triggered Lambda are managed by SQS. Option B is unnecessary overhead. Option C is invalid because reserved concurrency and a 'Retry attempts' setting do not control SQS-triggered Lambda retries.

Answer

Configure a dead-letter queue on the Lambda function with a redrive policy that allows up to 3 retries and a 5-minute delay.

Answer

Use AWS Step Functions to poll the SQS queue and implement a retry loop with exponential backoff.

Answer

Set the Lambda function's reserved concurrency to 1 and enable the 'Retry attempts' option to 3 in the function configuration.

Question 5

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. The correct answer. The best practice for granting an AWS Lambda function access to an S3 bucket in the same account is to create an IAM execution role with a policy that allows the necessary S3 actions, and then attach that role to the Lambda function. This provides temporary credentials via STS, follows the principle of least privilege, and avoids hardcoding credentials.

Option B is incorrect because storing AWS credentials in environment variables is insecure and can lead to accidental exposure. AWS recommends using IAM roles for temporary credentials.

Option C is incorrect because Lambda functions do not support attaching IAM policies directly. Policies must be attached to an IAM role, and that role is assigned to the function.

Option D is incorrect because while a bucket policy could grant access based on the function's ARN, it is not the best approach for same-account access. Using an execution role is more scalable, easier to manage, and follows the principle of least privilege.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 6

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.

Answer

Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.

Answer

Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.

Answer

Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.

Question 7

A developer is designing a web application that will run on EC2 instances behind an Application Load Balancer. The application needs to authenticate users. Which service should the developer use to manage user identities and provide single sign-on?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications. It provides user sign-up, sign-in, and access control, and supports single sign-on (SSO) through federation with social identity providers (e.g., Google, Facebook) and enterprise identity providers via SAML 2.0 or OIDC. This makes it ideal for authenticating users in an application running behind an Application Load Balancer.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Security Token Service (STS)

Question 8

A developer is using the AWS Serverless Application Model (SAM) to define a serverless application with an API Gateway endpoint. The developer wants to enable API caching only in the development stage to speed up testing, but disable it in the production stage to ensure data freshness. What is the most efficient way to achieve this with SAM?

Accepted Answer

Use AWS SAM parameters with a condition to set CacheClusterEnabled based on the stage parameter.. AWS SAM parameters allow you to define a stage parameter (e.g., 'dev' or 'prod') and use a condition to conditionally set the `CacheClusterEnabled` property on the `AWS::Serverless::Api` resource. This is the most efficient approach because it uses a single template and SAM's built-in intrinsic functions (like `Fn::Equals`) to toggle caching based on the deployment stage, avoiding separate templates or post-deployment custom resources.

Answer

Deploy two separate SAM templates, one for each stage.

Answer

Use a custom resource to toggle caching after deployment.

Answer

Enable caching globally and configure a usage plan with a quota for production.

Question 9

A developer is using AWS CodeDeploy to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application must remain available during the deployment. The developer wants to update one instance at a time, ensuring that only one instance is taken offline at any moment. Which deployment configuration should the developer choose?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application to only one instance at a time, ensuring that the remaining instances continue to serve traffic. This matches the requirement to take only one instance offline at any moment, preserving high availability throughout the deployment.

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes

Question 10

A developer is creating a web application that uses Amazon Cognito for user authentication. The application needs to verify the identity of users before allowing access to the API. Which Cognito feature should the developer use?

Accepted Answer

User Pools. Amazon Cognito User Pools provide a fully managed identity and access management service specifically designed for user authentication and authorization in web and mobile applications. They handle user sign-up, sign-in, and identity verification through features like multi-factor authentication (MFA) and JSON Web Token (JWT) issuance, making them the correct choice for verifying user identity before granting API access.

Answer

Identity Pools

Answer

Cognito Sync

Answer

Cognito Events

Question 11

A developer is creating an AWS Lambda function to process events from an Amazon SQS queue. The function must process each message exactly once and in order. Which SQS queue type should the developer use?

Accepted Answer

FIFO queue.. FIFO queue. FIFO (First-In-First-Out) queues guarantee exactly-once processing and preserve the order of messages, which is required by the use case. Standard queues offer at-least-once delivery and do not guarantee order, making them unsuitable for this requirement.

Answer

Standard queue.

Answer

Dead-letter queue.

Answer

Delay queue.

Question 12

A developer needs different configuration values for dev, test, and prod in the same SAM template. Which feature is suitable?

Accepted Answer

Parameters and environment-specific parameter overrides. AWS SAM supports Parameters and environment-specific parameter overrides, allowing you to define a single template and supply different configuration values (e.g., database URLs, API keys) for dev, test, and prod environments at deployment time. This is achieved by passing a JSON or YAML file with the `--parameter-overrides` flag in the `sam deploy` command, or by using the `parameters` section in a `samconfig.toml` file. This approach avoids duplicating templates and keeps infrastructure-as-code DRY and maintainable.

Answer

Hardcoded ARNs in every function

Answer

One AWS root account per environment

Answer

Disabling stack updates

Question 13

A developer is building a serverless application using AWS SAM that includes an API Gateway REST API and a Lambda function. The developer wants to pass environment variables to the Lambda function based on the deployment stage (dev/prod). The stage name is provided as a SAM parameter. How should the developer define this in the SAM template?

Accepted Answer

Define a SAM Parameter for the stage name, and reference it in the Lambda function's Environment property. AWS SAM allows you to define parameters (e.g., StageName) and reference them directly in the Lambda function's Environment property using CloudFormation intrinsic functions like !Ref. This enables dynamic injection of environment variables based on the deployment stage without modifying the template structure, aligning with Infrastructure as Code best practices for multi-environment deployments.

Answer

Use the Globals section of the SAM template to set environment variables

Answer

Hard-code the environment variables with different values in the template

Answer

Use an AWS Systems Manager Parameter Store parameter and reference it in the function

Question 14

A developer is building a multi-region application using Amazon DynamoDB global tables. The application needs to read data from a replica table in a different region shortly after a write in the primary region. The developer notices that reads sometimes return stale data. Which of the following explains this behavior?

Accepted Answer

Global tables use asynchronous replication, introducing unavoidable replication lag.. Amazon DynamoDB global tables use asynchronous replication to propagate writes from one region to all other replica tables. This means that after a write in the primary region, there is an inherent replication lag (typically sub-second but can be higher under load or network issues) before the change is visible in other regions. The developer observes stale reads because the read is hitting a replica that has not yet received the update, which is expected behavior for eventually consistent reads on global tables.

Answer

The developer must use DynamoDB Streams to capture changes and replicate them separately.

Answer

The developer must enable strong consistency reads on the replica table.

Answer

The global table must be configured with write forwarding.

Question 15

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to encrypt data in transit between the client and the ALB. Which AWS service should be used to manage the SSL/TLS certificate?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provisions, manages, and deploys public and private SSL/TLS certificates that can be associated with an Application Load Balancer (ALB) to encrypt data in transit between clients and the ALB. ACM handles certificate renewal automatically and integrates natively with ALB, removing the need for manual certificate management. This ensures HTTPS termination at the load balancer, securing the client-to-ALB communication.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 16

A company uses a customer managed AWS KMS key to encrypt sensitive data stored in DynamoDB. A Lambda function reads from the DynamoDB table and needs to decrypt the data. The Lambda function's execution role has an IAM policy that allows kms:Decrypt on the key. However, access is denied. What must the developer add to the KMS key policy to resolve the issue?

Accepted Answer

Add a statement granting kms:Decrypt to the Lambda function's execution role.. KMS key policies are resource-based policies that control access to the key itself. Even if the Lambda execution role has an IAM policy granting kms:Decrypt, the KMS key policy must explicitly allow the role (or the user/account) to perform that action. Without this statement in the key policy, the IAM permission is ineffective, resulting in an access denied error.

Answer

Add a statement granting kms:Decrypt to the Lambda function's resource-based policy.

Answer

Add a statement granting kms:Decrypt to the Lambda service principal.

Answer

Add a statement granting kms:Decrypt to the account root user with a condition for the Lambda function.

Question 17

An application running on Amazon EC2 instances behind an Application Load Balancer (ALB) intermittently returns 503 errors. The ALB health checks are failing for some instances intermittently. The developer checks the instance system logs and finds no application errors. What is the most likely cause of the health check failures?

Accepted Answer

The application on the instances is experiencing resource exhaustion (e.g., memory or CPU) which causes it to stop responding to health checks temporarily. Intermittent 503 errors from the ALB combined with intermittent health check failures and no application errors in the system logs strongly point to transient resource exhaustion (CPU or memory) on the EC2 instances. When an instance runs out of memory or CPU, the application process may become unresponsive or be killed by the OS (e.g., OOM killer), causing it to fail health checks temporarily. Once resources are freed (e.g., after a spike subsides), the application resumes responding, which explains the intermittent nature of the failures.

Answer

The security group for the instances does not allow inbound traffic from the ALB on the health check port

Answer

The health check path is not configured correctly and the default path returns a 404 status

Answer

The target group is not configured with the correct protocol

Question 18

A developer is using AWS CodeBuild to build a Java application. The buildspec.yml file currently runs unit tests. The developer wants to generate a code coverage report and publish it to the CodeBuild console for analysis. Which CodeBuild feature should be used?

Accepted Answer

Test reports. AWS CodeBuild's test reports feature allows developers to create reports from test result files, including code coverage reports, and publish them to the CodeBuild console for analysis. This feature supports various report formats such as JaCoCo, Cobertura, and SimpleCov, enabling the developer to visualize coverage metrics directly in the console without external tools.

Answer

Build artifacts

Answer

Amazon CloudWatch Logs

Answer

Amazon S3 access logs

Question 19

A developer is building a serverless application that needs to process messages from an Amazon SQS queue and store the results in an Amazon DynamoDB table. Which AWS service should the developer use to orchestrate the processing logic without managing servers?

Accepted Answer

AWS Lambda. AWS Lambda is the correct choice because it is a serverless compute service that can be triggered by SQS messages via event source mappings, process each message, and write results to DynamoDB without provisioning or managing any servers. The developer simply uploads the processing code, and Lambda handles scaling, concurrency, and execution, making it ideal for this event-driven, serverless workflow.

Answer

Amazon Elastic Container Service (ECS) with Fargate

Answer

Amazon EC2 instances with a custom application

Answer

AWS Step Functions

Question 20

A developer is running an AWS Lambda function that is triggered by Amazon S3 events. The function writes processed data to an Amazon DynamoDB table. Over time, the function's execution time has increased significantly. CloudWatch Logs show many DynamoDBProvisionedThroughputExceededException errors. The table is configured with 5 read capacity units (RCUs) and 5 write capacity units (WCUs). The function performs both reads and writes. Which optimization will MOST effectively reduce throttling errors while maintaining performance?

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode. The DynamoDBProvisionedThroughputExceededException errors indicate that the Lambda function is exceeding the provisioned write capacity of 5 WCUs. Switching to on-demand capacity mode eliminates the need to manage throughput, automatically scaling to handle the workload without throttling. This directly resolves the root cause—capacity exhaustion—without requiring manual adjustments or architectural changes.

Answer

Increase the RCUs and WCUs of the table to 50 each

Answer

Implement a DynamoDB Accelerator (DAX) cluster for caching reads

Answer

Increase Lambda function memory to 1024 MB