DVA-C02 Mock Exam 77 — 25 Questions

Question 1

A developer is debugging an issue where an Amazon S3 bucket policy is not allowing cross-account access for a user from another AWS account. The bucket policy grants access to the other account's root user. The IAM user in the other account has an IAM policy that allows s3:GetObject on the bucket. When the user tries to download an object, they get an Access Denied error. What is the most likely cause?

Accepted Answer

The bucket is encrypted with SSE-KMS and the user does not have kms:Decrypt permission. The most likely cause is that the bucket is encrypted with SSE-KMS. When an S3 bucket uses AWS KMS customer master keys (CMKs) for server-side encryption, the bucket policy granting access to the root user of the other account is not sufficient. The IAM user in the other account must also have explicit kms:Decrypt permission on the KMS key, because S3 GetObject calls require decrypting the object before returning it. Without this KMS permission, the request fails with Access Denied even though the S3 bucket policy and IAM policy appear correct.

Answer

The bucket policy does not specify the user's ARN

Answer

The object's ACL is set to private

Answer

The IAM policy does not include s3:ListBucket

Question 2

Match each AWS storage class to its description.

Question 3

Drag and drop the steps to troubleshoot an application that cannot connect to an RDS database in the correct order.

Question 4

Drag and drop the steps to authenticate a user using Amazon Cognito User Pools in the correct order.

Question 5

A developer is monitoring an AWS Lambda function that is triggered by an Amazon SQS queue. The function's CloudWatch metrics show a high number of throttles. The function has a reserved concurrency of 10 and the SQS queue has a large backlog of messages. The function processes each message in about 2 seconds and has a timeout of 60 seconds. Which action will most effectively reduce the throttles and increase throughput?

Accepted Answer

Increase the reserved concurrency of the Lambda function to 50. The high throttles indicate that the Lambda function's reserved concurrency of 10 is insufficient to handle the incoming messages from the SQS queue. By increasing reserved concurrency to 50, you allow more concurrent executions, which reduces throttling and increases throughput. The function's 2-second processing time and 60-second timeout are not the bottleneck; the concurrency limit is.

Answer

Increase the batch size in the SQS event source mapping to 100

Answer

Increase the function timeout to 120 seconds

Answer

Decrease the reserved concurrency to 5

Question 6

A developer is troubleshooting an AWS Lambda function that processes streaming data from Amazon Kinesis Data Streams. The function processes records in batches. The developer notices that the function often experiences high latency even though the average invocation rate is well below the account concurrency limit. Which action would MOST effectively reduce latency?

Accepted Answer

Use provisioned concurrency for the function.. Provisioned concurrency pre-warms a specified number of execution environments, eliminating cold starts and ensuring that the function can handle sudden bursts of traffic without latency spikes. Since the function processes streaming data from Kinesis and experiences high latency despite low average concurrency, the issue is likely cold starts or initialization overhead, which provisioned concurrency directly mitigates.

Answer

Increase the batch size for the Kinesis event source mapping.

Answer

Enable reserved concurrency for the function.

Answer

Increase the number of shards in the Kinesis data stream.

Question 7

A developer is troubleshooting performance issues in an application that uses Amazon DynamoDB as the primary data store. The application reads a large set of items using a Query operation on a Global Secondary Index (GSI). The developer notices high read latency and throttled requests on the GSI. The base table has sufficient read capacity. The GSI is projected with KEYS_ONLY. Which action would most likely reduce the latency and throttling?

Accepted Answer

Increase the read capacity units (RCU) of the GSI.. The correct answer is C because a Global Secondary Index (GSI) has its own provisioned read capacity, separate from the base table. When a Query operation reads from a GSI, it consumes RCUs from the GSI's capacity, not the base table's. Since the base table has sufficient read capacity but the GSI is experiencing throttling and high latency, increasing the GSI's RCU directly addresses the bottleneck by allowing more read requests per second against the index.

Answer

Increase the read capacity units (RCU) of the base table.

Answer

Change the GSI projection to ALL.

Answer

Create a Local Secondary Index instead.

Question 8

A DynamoDB application receives ProvisionedThroughputExceededException during predictable daily peaks. The workload is not cacheable. What should be changed?

Accepted Answer

Use on-demand capacity or configure autoscaling/scheduled scaling for the table. The ProvisionedThroughputExceededException indicates that the table's read/write capacity is insufficient during peak loads. Since the workload is predictable but not cacheable, the correct solution is to either switch to on-demand capacity mode, which automatically scales to handle any traffic level, or configure auto scaling with scheduled scaling to match the predictable peaks. This directly addresses the capacity shortfall without requiring application changes.

Answer

Enable S3 Transfer Acceleration

Answer

Disable CloudWatch metrics

Answer

Move all reads to strongly consistent mode

Question 9

Users receive AccessDenied when downloading SSE-KMS encrypted S3 objects cross-account. Which two policies may need changes?

Accepted Answer

S3 bucket/object access policy or IAM policy. When accessing SSE-KMS encrypted S3 objects cross-account, the S3 bucket policy or the IAM policy must explicitly grant the s3:GetObject permission to the caller. Additionally, the KMS key policy must allow the kms:Decrypt action for the caller's AWS account or IAM role, because SSE-KMS uses a customer master key (CMK) to encrypt the object, and decryption requires KMS permissions. Without both policies, the request fails with AccessDenied even if the S3 permissions are correct.

Answer

CloudFront cache policy

Answer

Route 53 resolver rule policy

Question 10

A developer is managing an application running on Amazon EC2 instances behind an Application Load Balancer. Users report that the application becomes unresponsive after several hours, and restarting the instance temporarily fixes the issue. The developer suspects a memory leak but cannot add custom instrumentation. Which AWS service can collect memory utilization metrics and help identify the memory leak with minimal configuration?

Accepted Answer

Install the CloudWatch agent on the EC2 instances to collect memory metrics and emit them to CloudWatch.. The CloudWatch agent can collect custom metrics, including memory utilization, from EC2 instances and publish them to Amazon CloudWatch. This allows the developer to monitor memory usage over time and identify a memory leak without modifying the application code. The default EC2 metrics do not include memory utilization, so the CloudWatch agent is the minimal-configuration solution for this requirement.

Answer

Use Amazon CloudWatch Logs agent to capture application logs.

Answer

Use the EC2 instance metadata service to query memory usage.

Answer

Use AWS X-Ray to trace memory allocation.

Question 11

A developer is troubleshooting an AWS Lambda function that experiences high latency for the first few invocations after being idle. The function is written in Python and uses a large library (e.g., Pandas). The function connects to an RDS database in a VPC. What is the most effective way to reduce the latency for the first invocation after idle?

Accepted Answer

Enable provisioned concurrency on the function.. Provisioned concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating the cold start latency that occurs after a period of idle time. This is the most direct solution for reducing latency on the first invocation after idle, especially for functions with large libraries like Pandas that take significant time to load.

Answer

Increase the function's memory allocation to 3008 MB.

Answer

Move the large library to a Lambda layer.

Answer

Replace the RDS database with Amazon DynamoDB.

Question 12

A developer notices that an AWS Lambda function, configured to access an Amazon RDS database in the same VPC, is timing out. The function has a 30-second timeout. CloudWatch Logs show that the function starts execution but never reaches the database. The VPC configuration includes private subnets without a NAT gateway. The RDS database is in the same VPC. What is the most likely cause of the timeout?

Accepted Answer

The security group of the RDS database does not allow inbound traffic from the Lambda function's security group.. Option B is correct because the Lambda function is timing out when trying to connect to the RDS database, which is in the same VPC. The most likely cause is that the RDS database's security group does not have an inbound rule allowing traffic from the Lambda function's security group on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). Without this rule, the TCP connection attempt is silently dropped or rejected, causing the Lambda function to wait until its 30-second timeout expires.

Answer

The Lambda function does not have internet access because it is in a VPC without a public IP.

Answer

The Amazon RDS database is not publicly accessible and the Lambda function cannot resolve the database endpoint.

Answer

The VPC does not have a VPC endpoint for Amazon RDS, and the Lambda function cannot access the database through the NAT gateway.

Question 13

A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The developer notices that the function is processing records slowly, and the iterator age is increasing. CloudWatch Logs show that the function is not experiencing errors or throttling, but the execution time per invocation is close to the 5-minute timeout. The stream has 10 shards. What is the most cost-effective way to increase processing throughput?

Accepted Answer

Increase the parallelization factor to 10. Increasing the parallelization factor to 10 allows each shard to be processed by up to 10 concurrent Lambda invocations, which directly increases throughput without additional shard costs. Since the function is not throttled or erroring, the bottleneck is the per-invocation processing time; parallelization reduces the iterator age by processing multiple batches per shard simultaneously.

Answer

Increase the batch size to 1000

Answer

Increase the memory of the Lambda function

Answer

Split the stream into more shards

Question 14

A developer is monitoring an AWS Lambda function that processes events from an Amazon Kinesis stream. The function's CloudWatch metrics show high IteratorAge and the function is often throttled. The function's batch size is 100, maximum record age is 60s, and reserved concurrency is 100. The Kinesis stream has 10 shards, each with 5000 records/sec. Which action is most effective to reduce the IteratorAge and throttle rate?

Accepted Answer

Increase the number of shards. The high IteratorAge indicates that the Lambda function is falling behind in processing records from the Kinesis stream. Throttling occurs because the function's reserved concurrency of 100 is insufficient to handle the total throughput of 10 shards × 5000 records/sec = 50,000 records/sec. Increasing the number of shards (option B) directly increases the parallelism of the stream, allowing more Lambda invocations to run concurrently (up to the reserved concurrency limit) and reducing the backlog, thereby decreasing IteratorAge and throttle rate.

Answer

Increase the batch size to 1000

Answer

Decrease the maximum record age

Answer

Increase the function's memory and CPU allocation

Question 15

A developer is troubleshooting an AWS Lambda function that processes files uploaded to an Amazon S3 bucket. The function sometimes times out when processing large files. CloudWatch Logs show that the function's execution time correlates with file size. The function is configured with 128 MB memory and a timeout of 30 seconds. Which action should the developer take to resolve the timeout for large files without refactoring the code?

Accepted Answer

Increase the Lambda function's timeout. The Lambda function times out because processing large files exceeds the 30-second timeout. Since the execution time correlates with file size and the code cannot be refactored, the only way to resolve the timeout is to increase the function's timeout setting. This directly extends the maximum allowed execution duration, allowing large files to complete processing without code changes.

Answer

Increase the Lambda function's memory

Answer

Increase the S3 event notification batch size

Answer

Enable Lambda function reserved concurrency

Question 16

A developer is troubleshooting an AWS Lambda function that is invoked from an Amazon S3 bucket via event notifications. The function processes images and stores metadata in Amazon DynamoDB. The developer notices that some images are being processed multiple times, resulting in duplicate entries in DynamoDB. The S3 event notification is configured to send events to the Lambda function with the 's3:ObjectCreated:*' event type. The function uses the 'uuid' library to generate a unique ID for each image upon processing. What is the most likely cause of the duplicate processing?

Accepted Answer

S3 event notifications are delivered at least once, and the Lambda function is not idempotent.. Amazon S3 event notifications are delivered on an 'at least once' basis, meaning the same event can be sent to Lambda multiple times. If the Lambda function is not idempotent—i.e., processing the same event multiple times produces duplicate side effects—then duplicate DynamoDB entries will occur. The use of a 'uuid' library inside the function does not help because a new UUID is generated on each invocation, so the same image gets different IDs and is stored as a separate item each time.

Answer

The Lambda function's concurrency is set too high, causing race conditions.

Answer

The DynamoDB table does not have a primary key that prevents duplicates.

Answer

The S3 bucket is configured with versioning, causing multiple object creation events.

Question 17

A developer is troubleshooting an AWS Lambda function that processes records from an Amazon Kinesis Data Stream. The function is configured with a batch size of 100 and a parallelization factor of 1. The iterator age metric is increasing, and CloudWatch Logs show the function execution time is around 4 minutes (timeout is 5 minutes). The stream has 10 shards. What is the most cost-effective way to increase processing throughput?

Accepted Answer

Increase the parallelization factor per shard. Increasing the parallelization factor per shard (option D) allows each shard to be processed by multiple Lambda instances concurrently, which directly increases throughput without requiring additional shards or changes to the stream. Since the function is not hitting the 5-minute timeout but is taking ~4 minutes per batch, the bottleneck is processing concurrency per shard, not batch size or execution duration. This is the most cost-effective solution because it uses existing shards and avoids the cost of additional shards or unnecessary timeout increases.

Answer

Increase the batch size to 500

Answer

Increase the number of shards

Answer

Increase the timeout to 10 minutes

Question 18

A developer is troubleshooting an application that uses Amazon ElastiCache for Redis to improve performance. The application periodically experiences high latency during peak hours. The developer checks the ElastiCache metrics and sees that the 'Evictions' metric is consistently high and the 'CacheHitRate' metric is low. The cluster has a single node with a cache.t3.small instance type. Which action will most likely improve the cache hit rate and reduce latency?

Accepted Answer

Scale up to a larger node type (e.g., cache.t3.medium) to increase available memory.. The high 'Evictions' and low 'CacheHitRate' metrics indicate that the Redis node is running out of memory, forcing it to evict keys to make room for new data. Scaling up to a larger node type (cache.t3.medium) increases the available memory, allowing more data to be cached and reducing evictions, which directly improves the cache hit rate and reduces latency.

Answer

Enable cluster mode and distribute data across multiple shards to reduce memory pressure.

Answer

Change the eviction policy to 'allkeys-lfu' to better manage which keys are evicted.

Answer

Add a read replica for the Redis cluster to offload read traffic.

Question 19

A developer is troubleshooting an AWS Lambda function that writes items to an Amazon DynamoDB table. The function frequently fails with ProvisionedThroughputExceededException. The table has provisioned write capacity of 500 write capacity units (WCUs). The function has reserved concurrency of 10, and each invocation writes 10 items of approximately 1 KB each. There are no other writers to the table. What is the most likely cause of the throttling?

Accepted Answer

The function is writing to a single partition key, causing hot partition throttling. The most likely cause is that the function is writing to a single partition key, creating a 'hot partition' that exceeds the 1,000 WCU per-partition limit (or 3,000 WCU for burst capacity) even though the table's total provisioned capacity of 500 WCU is not exhausted. DynamoDB distributes throughput across partitions based on the partition key; if all writes target the same key, they are throttled at the partition level regardless of table-level capacity.

Answer

The function's reserved concurrency is too high, causing excessive write requests

Answer

The table's read capacity is insufficient, causing write throttling

Answer

The function is exceeding the DynamoDB item size limit of 400 KB

Question 20

A developer is troubleshooting an AWS Lambda function that returns timeout errors when calling an external HTTPS API. The function is configured with a 30-second timeout and runs in a VPC with a public subnet and NAT Gateway. The developer checks CloudWatch logs and sees that the function is timing out at exactly 30 seconds. What is the most likely cause?

Accepted Answer

The Lambda function's security group does not allow outbound traffic.. Option B is correct because Lambda functions running in a VPC do not automatically get internet access; they require a route to a NAT Gateway or NAT instance. Even with a NAT Gateway, the Lambda function's security group must allow outbound traffic (e.g., HTTPS on port 443) to reach the external API. Without this rule, outbound packets are dropped, causing the function to hang until the configured timeout (30 seconds) expires, resulting in a timeout error.

Answer

The NAT Gateway is not configured with a route to the internet.

Answer

The external API's response time exceeds 30 seconds.

Answer

The Lambda function's VPC does not have an internet gateway.