DVA-C02 Mock Exam 85 — 25 Questions

Question 1

A Lambda function processing SQS messages is failing with concurrency errors. The function is configured with reserved concurrency of 5. The SQS queue has a batch size of 10. What is the most effective way to prevent throttling?

Accepted Answer

Increase the reserved concurrency to a higher value.. Option C is correct because the function is throttling due to insufficient reserved concurrency. With a batch size of 10, each SQS batch triggers one invocation, but the function's reserved concurrency of 5 limits concurrent executions to 5. Increasing reserved concurrency allows more concurrent invocations to handle the SQS messages without throttling.

Answer

Reduce the batch size to 1 to spread out invocations.

Answer

Increase the Lambda function memory to get more concurrency.

Answer

Set the SQS queue's concurrency limit to match the Lambda reserved concurrency.

Question 2

A developer notices that an S3 bucket used for static website hosting returns 403 Forbidden for anonymous requests. The bucket policy allows s3:GetObject for Principal "*". What is the most likely issue?

Accepted Answer

The S3 Block Public Access settings are enabled.. D is correct because S3 Block Public Access settings, when enabled at the account or bucket level, override any bucket policy or ACL that grants public access. Even though the bucket policy allows s3:GetObject for Principal "*", the Block Public Access settings explicitly deny all public requests, resulting in a 403 Forbidden error for anonymous users.

Answer

The bucket does not have server access logging enabled.

Answer

The bucket ACL does not allow public read.

Answer

The bucket policy is not attached to the correct bucket.

Question 3

A developer receives an AccessDeniedException when trying to invoke a Lambda function from an Amazon API Gateway REST API. The Lambda resource-based policy allows API Gateway. What is the most likely issue?

Accepted Answer

The API Gateway execution role lacks lambda:InvokeFunction permission.. Option C is correct because when API Gateway invokes a Lambda function, it must have the `lambda:InvokeFunction` permission. Even if the Lambda resource-based policy grants API Gateway access, the API Gateway execution role must also explicitly allow the `lambda:InvokeFunction` action. Without this permission, API Gateway cannot invoke the function, resulting in an AccessDeniedException.

Answer

The Lambda function is in a VPC without a NAT gateway.

Answer

The Lambda function concurrency limit is exceeded.

Answer

API Gateway caching is enabled, returning stale responses.

Question 4

A developer is optimizing costs for an S3 bucket that stores infrequently accessed data but requires millisecond retrieval. The bucket receives 100 PUT requests per second and 10 GET requests per second. Which storage class is most cost-effective?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the most cost-effective choice because it automatically moves objects between access tiers based on changing access patterns, optimizing costs without performance impact. The workload has a high write-to-read ratio (100 PUTs vs 10 GETs per second) and requires millisecond retrieval, which Intelligent-Tiering supports while avoiding the retrieval fees and minimum storage duration penalties of One Zone-IA or Glacier Deep Archive.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Glacier Deep Archive

Question 5

A company runs a stateful web application on EC2 instances in an Auto Scaling group. Users report that their session data is lost when instances are replaced during scaling events. What is the best solution to preserve session state?

Accepted Answer

Use ElastiCache as a centralized session store.. ElastiCache provides a centralized, in-memory session store that is external to the EC2 instances. This ensures session data persists independently of the instance lifecycle, so when an instance is replaced during a scaling event, the new instance can retrieve the session from ElastiCache, preserving user state. This is the best solution because it decouples session state from compute resources, aligning with the stateless application pattern recommended for Auto Scaling groups.

Answer

Enable sticky sessions on the Application Load Balancer.

Answer

Store sessions in the Application Load Balancer.

Answer

Use an S3 bucket to store session data.

Question 6

A developer is using Amazon S3 to host a static website. The website returns 403 Forbidden errors. The bucket policy allows public read access. What is the most likely cause?

Accepted Answer

The bucket's 'Block public access' settings are enabled.. The most likely cause is that the bucket's 'Block public access' settings are enabled. Even if the bucket policy explicitly grants public read access, S3's Block Public Access settings act as an overarching security override that denies all public requests, resulting in a 403 Forbidden error. These settings are enabled by default for new buckets and can be applied at the account or bucket level, making them a common pitfall.

Answer

The bucket has an ACL that denies read access.

Answer

The bucket policy does not include the 's3:GetObject' action.

Answer

The bucket policy is not correctly attached to the bucket.

Question 7

A developer deployed a new version of a Lambda function that processes S3 events. After deployment, some S3 events are not being processed. The CloudWatch Logs show no errors. What is the most likely cause?

Accepted Answer

The S3 bucket's event notification still points to the old Lambda function.. Option B is correct because after deploying a new version of a Lambda function, the S3 bucket's event notification configuration still references the Amazon Resource Name (ARN) of the old Lambda function version or the function without a qualifier. S3 event notifications are configured to invoke a specific Lambda function ARN, and if the ARN does not point to the new version (e.g., by using an alias or the $LATEST qualifier), events will continue to be sent to the old version, which may not be processing them. Since CloudWatch Logs show no errors, the old version is likely not being invoked or is not logging, confirming the mismatch.

Answer

The Lambda function has a syntax error.

Answer

The Lambda function alias is not pointing to the new version.

Answer

The S3 events are being throttled by Lambda.

Question 8

A company uses AWS Lambda functions that are invoked by an Amazon S3 bucket notification. The function sometimes fails with a 'ResourceNotFoundException' for the S3 bucket. Which THREE steps should the developer take to resolve the issue?

Accepted Answer

Check the S3 bucket notification configuration for the correct Lambda function ARN.. Option B is correct because the 'ResourceNotFoundException' indicates that the Lambda function ARN specified in the S3 bucket notification configuration is incorrect or does not match the actual function ARN. S3 uses the notification configuration to invoke the Lambda function, and if the ARN is malformed, outdated, or points to a deleted function, S3 will throw this error. Verifying and correcting the ARN in the S3 event notification ensures S3 can successfully invoke the Lambda function.

Answer

Ensure the S3 bucket has versioning enabled.

Answer

Increase the Lambda function timeout.

Question 9

Refer to the exhibit. A developer runs the AWS CLI command for an EC2 instance. The instance is in the 'running' state, but the application hosted on it is not reachable. What should the developer check first?

Accepted Answer

Check the security group rules for inbound traffic.. The application is unreachable despite the EC2 instance being in the 'running' state, which indicates the OS and instance services are operational. The most common cause for this scenario is that the security group's inbound rules are not allowing traffic on the application's port (e.g., HTTP/HTTPS on port 80/443). Security groups act as a virtual firewall at the instance level, and unless an inbound rule explicitly permits the traffic, it will be silently dropped, making the application unreachable.

Answer

Check the ELB health check settings.

Answer

Check the instance status checks in the EC2 console.

Answer

Verify the instance ID is correct.

Question 10

A developer attached the IAM policy above to an IAM user. The user reports being unable to list objects in the bucket 'my-bucket' using the AWS CLI command 'aws s3 ls s3://my-bucket/'. What is the most likely reason?

Accepted Answer

The IAM policy does not include the s3:GetBucketLocation action.. The `aws s3 ls s3://my-bucket/` command requires the `s3:GetBucketLocation` permission to determine the bucket's region before listing its contents. Without this action, the CLI fails with an error like 'An error occurred (AccessDenied) when calling the GetBucketLocation operation', even if `s3:ListBucket` is granted. Option D correctly identifies this missing permission as the root cause.

Answer

The IAM policy does not allow the s3:GetObject action on the bucket.

Answer

The IAM policy resource for s3:ListBucket should include the bucket and objects.

Answer

The IAM policy is missing the s3:ListAllMyBuckets action.

Question 11

A developer is deploying a serverless application using AWS CloudFormation. The stack creation fails with the error 'The following resource(s) failed to create: [MyLambdaFunction]'. The developer checks the CloudWatch logs but finds no logs for the Lambda function. What is the most likely reason?

Accepted Answer

The Lambda function's IAM role does not have permission to write to CloudWatch Logs.. Option C is correct because the error indicates the Lambda function resource failed to create, and the absence of CloudWatch logs suggests the function was created but lacked the necessary IAM permissions to write logs. Without the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` permissions, Lambda cannot write to CloudWatch Logs, so no logs appear even if the function is invoked. This is a common misconfiguration when deploying Lambda via CloudFormation without attaching the proper IAM policy.

Answer

The Lambda function code has a syntax error that prevents creation.

Answer

The Lambda function was never invoked.

Answer

The CloudFormation template has a syntax error.

Question 12

A developer is troubleshooting a slow Amazon RDS for MySQL database. The application experiences high latency on write operations. Which TWO actions can improve write performance?

Accepted Answer

Increase the allocated storage size to get better I/O performance.. Option B is correct because increasing the allocated storage size for an Amazon RDS for MySQL instance can improve I/O performance by providing a higher baseline IOPS rate. Larger volumes in RDS, especially those using General Purpose SSD (gp2/gp3), have higher throughput and IOPS limits, which directly reduces write latency under heavy load.

Answer

Add a read replica to offload read traffic.

Answer

Enable deletion protection.

Answer

Enable Multi-AZ deployment for high availability.

Question 13

An application running on Amazon ECS Fargate is experiencing intermittent connection timeouts when calling an external API. The task has a public IP and a security group that allows outbound HTTPS. What is the most likely cause?

Accepted Answer

The task is running in a private subnet without a NAT gateway.. Option D is correct because ECS Fargate tasks running in a private subnet do not have direct internet access. Without a NAT gateway, outbound traffic to the external API is routed to the subnet’s route table, which lacks an internet gateway target, causing connection timeouts. The task’s public IP assignment is irrelevant in a private subnet, as the subnet itself has no route to the internet.

Answer

The ECS service is not configured to auto-assign public IP.

Answer

The task's security group does not allow inbound traffic.

Answer

The security group outbound rules are misconfigured.

Question 14

A developer is deploying a new version of a Lambda function using AWS CodeDeploy with a linear canary deployment. The function is part of a serverless application. After the deployment starts, the developer notices that the new version is receiving only 10% of traffic initially, but after 10 minutes, the traffic increases to 100%. What should the developer do to ensure a more gradual traffic shift?

Accepted Answer

Modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes instead of canary.. Option D is correct because the developer is using a canary deployment configuration that shifts 10% of traffic immediately and then waits 10 minutes before shifting to 100%. To achieve a more gradual traffic shift, the developer should modify the CodeDeploy deployment configuration to use a linear 10% every 5 minutes, which will increment traffic by 10% every 5 minutes, taking 50 minutes to reach 100%.

Answer

Use Lambda function aliases with weighted traffic shifting.

Answer

Use multiple Lambda function versions and update the alias gradually.

Answer

Configure AWS CloudFormation to update the Lambda alias.

Question 15

A developer is using Amazon S3 Transfer Acceleration to upload a large file. The upload is slower than expected. Which metric should the developer check to determine if Transfer Acceleration is providing a benefit?

Accepted Answer

CloudWatch metric 'TotalRequestLatency' for the S3 bucket.. TotalRequestLatency measures the time taken for a complete S3 request, including the time to send the request to the S3 endpoint and receive the response. For S3 Transfer Acceleration, this metric reflects the end-to-end latency improvement achieved by routing traffic through AWS edge locations and the optimized network path. A lower TotalRequestLatency compared to a non-accelerated upload indicates that Transfer Acceleration is providing a benefit.

Answer

CloudWatch metric 'Requests' for the S3 bucket.

Answer

CloudWatch metric 'BytesDownloaded' for the S3 bucket.

Answer

CloudWatch metric 'FirstByteLatency' for the S3 bucket.

Question 16

A team uses AWS CodeCommit for source control and wants to automatically trigger a build and deployment when code is pushed to the master branch. Which AWS service should be used to create this automation?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is the correct service because it is a fully managed continuous delivery service that can be configured to automatically start a pipeline execution when a change is pushed to a specific branch in AWS CodeCommit. By setting the source stage to the CodeCommit repository and master branch, CodePipeline triggers subsequent build and deploy actions without manual intervention, enabling a complete CI/CD workflow.

Answer

AWS CodeBuild

Answer

AWS Lambda

Answer

AWS CodeDeploy

Question 17

A developer is deploying a new version of an application to Amazon ECS using AWS CodeDeploy. The application uses a blue/green deployment strategy. After the deployment, traffic is automatically shifted to the new task set. However, the developer wants to test the new version with a small percentage of users before shifting all traffic. What should the developer do?

Accepted Answer

Use CodeDeploy to perform a canary deployment that shifts 10% of traffic initially.. CodeDeploy supports canary deployments for ECS, which allow you to shift a specified percentage of traffic to the new task set initially (e.g., 10%) and then, after a configured interval, shift the remaining traffic. This matches the requirement to test with a small percentage of users before shifting all traffic. Option B directly implements this canary strategy.

Answer

Create a new ECS task definition with a different CPU/memory allocation.

Answer

Configure the target group to route traffic to a specific task set.

Answer

Use ECS service auto scaling to gradually increase the number of tasks.

Question 18

Refer to the exhibit. An IAM policy is attached to a user who needs to deploy a serverless application. The user reports that they cannot upload a new version of a Lambda function using the AWS CLI. What is the MOST likely reason?

Accepted Answer

The policy does not include lambda:UpdateFunctionCode.. The error occurs because the IAM policy attached to the user does not include the `lambda:UpdateFunctionCode` permission, which is required to upload a new version of a Lambda function via the AWS CLI. Without this action, the `update-function-code` command fails, even if other Lambda permissions like `lambda:InvokeFunction` are present. The policy must explicitly allow `lambda:UpdateFunctionCode` to enable code updates.

Answer

The Lambda invoke permission is scoped to a specific function.

Answer

The user does not have permission to write to the S3 bucket.

Answer

The user is not in the same AWS region as the Lambda function.

Question 19

A developer receives an alert that an EC2 instance's status check fails. The instance is running, but the developer cannot SSH into it. What is the most likely cause?

Accepted Answer

There is a problem with the underlying host.. A status check failure on a running EC2 instance indicates that the instance is passing the system status check (i.e., the underlying host is operational) but failing the instance status check, which tests network connectivity, OS responsiveness, and file system integrity. Since the instance is running but SSH is unavailable, the most likely cause is a problem with the underlying physical host (e.g., hardware degradation, network connectivity loss at the hypervisor level) that prevents the instance from responding to network traffic, even though the instance state shows as 'running'.

Answer

The security group inbound rules are incorrect.

Answer

The instance has been terminated.

Answer

The key pair is missing.

Question 20

A company wants to deploy an application using AWS Elastic Beanstalk. The application requires a relational database. What is the BEST practice for managing the database?

Accepted Answer

Create an Amazon RDS database instance separately and configure the application to connect to it.. The best practice for managing a relational database in Elastic Beanstalk is to decouple the database from the application lifecycle by creating an Amazon RDS instance separately. This ensures the database is not deleted when the Elastic Beanstalk environment is terminated, provides better control over backups, scaling, and maintenance, and allows the application to connect via environment variables or configuration files. Using a separate RDS instance aligns with production best practices for durability and operational flexibility.

Answer

Use the Elastic Beanstalk console to add an RDS database to the environment.

Answer

Use an S3 bucket to store data.

Answer

Use Amazon DynamoDB as the database.