DVA-C02 Mock Exam 90 — 25 Questions

Question 1

A developer is building a serverless application that uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The workflow involves three steps: validate input, process data, and store results. The developer notices that the workflow occasionally fails due to transient errors in the process data step. The developer wants to implement error handling so that the workflow retries the process data step up to three times with an exponential backoff. Additionally, if all retries fail, the workflow should send a notification to an Amazon SNS topic and transition to a failure state. The developer has defined the state machine in Amazon States Language (ASL). How should the developer configure the state machine?

Accepted Answer

In the process data state definition, add a Retry field with MaxAttempts: 3 and BackoffRate: 2, and add a Catch field that transitions to a failure state and sends an SNS notification.. Option B is correct because you can define Retry and Catch within a state. Retry specifies the retry behavior, and Catch specifies what to do after retries are exhausted. Option A is incorrect because you cannot define Retry and Catch at the workflow level; they must be per state. Option C is incorrect because you should modify the state definition, not the execution role. Option D is incorrect because you can handle this within the state machine without Lambda code changes.

Answer

Write custom retry logic inside the Lambda function code and catch exceptions there.

Answer

Modify the IAM execution role to allow the state machine to call SNS and then use a ResultPath to handle errors.

Answer

Add a Retry field at the workflow level and a Catch field at the workflow level.

Question 2

A company is using AWS CodePipeline to automate deployments of a serverless application. The pipeline has a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CloudFormation). The deploy stage fails intermittently with the error 'Rate exceeded' when creating or updating stacks. What should the developer do to resolve this issue?

Accepted Answer

Add a retry configuration with exponential backoff to the CloudFormation deployment action.. Option B is correct. CloudFormation has API rate limits; adding a retry with backoff in the pipeline configuration will handle transient throttling. Option A is wrong because increasing the timeout does not address rate limits. Option C is wrong because using a different deployment method may not avoid CloudFormation API calls. Option D is wrong because the issue is not related to IAM permissions.

Answer

Use the AWS CLI to deploy the CloudFormation stack instead of CodePipeline.

Answer

Increase the timeout for the CloudFormation deployment action in the pipeline.

Answer

Request a service limit increase for CloudFormation API calls.

Question 3

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer wants to enable X-Ray tracing to debug performance issues. What is the MINIMUM set of actions required to enable X-Ray tracing for the entire application?

Accepted Answer

Add Tracing: Active to the Globals section of the SAM template and attach the AWSXRayDaemonWriteAccess managed policy to the Lambda execution role.. Option A is correct. In AWS SAM, you can enable X-Ray globally by setting Tracing: Active in the Globals section, and the Lambda execution role needs the AWSXRayDaemonWriteAccess managed policy. Option B is wrong because enabling tracing on each function individually is more work but still achieves the goal, but the question asks for MINIMUM. Option C is wrong because API Gateway tracing alone does not trace Lambda. Option D is wrong because deploying the X-Ray daemon is not required for Lambda functions; the managed policy includes the daemon.

Answer

Enable X-Ray tracing on each Lambda function individually and deploy the X-Ray daemon as a Lambda layer.

Answer

Enable X-Ray tracing only on the API Gateway stage and configure the Lambda functions to forward traces.

Answer

Deploy the X-Ray daemon as a sidecar container on each Lambda function.

Question 4

A company runs a critical application on AWS Lambda that processes real-time financial transactions. The Lambda function is triggered by an SQS queue that receives messages from an API Gateway. Recently, the team has observed an increase in processing errors and occasional data loss. Upon investigation, they find that the Lambda function's concurrency limit is set to 5, and the SQS queue has a visibility timeout of 30 seconds. The function typically takes 2 seconds to process a message, but during peak hours, the queue depth grows to thousands of messages. The errors occur when the Lambda function throws an exception, causing the message to return to the queue after the visibility timeout expires. However, some messages are never processed again and are eventually lost. The team suspects that the messages are being sent to the dead-letter queue (DLQ) after multiple retries, but the DLQ is not configured. The team needs to ensure that no messages are lost and that processing errors are handled appropriately. What should the team do to resolve this issue?

Accepted Answer

Configure a dead-letter queue on the SQS source queue and set the maximum receives to 3. Implement error handling in the Lambda function to catch exceptions and log them.. Option B is correct. Configuring a dead-letter queue (DLQ) on the SQS queue ensures that messages that cannot be processed after a specified number of retries are moved to a separate queue for later analysis and reprocessing, preventing data loss. Option A is incorrect because increasing concurrency without a DLQ would still result in lost messages after retries are exhausted. Option C is incorrect because synchronous invocation does not solve the retry and loss problem. Option D is incorrect because Lambda's on-failure destination is for async invocations, not SQS-triggered Lambda (which uses event source mapping).

Answer

Increase the Lambda concurrency limit to 100 and set the SQS visibility timeout to 60 seconds.

Answer

Configure an Amazon CloudWatch alarm on the queue depth and set a Lambda function as the on-failure destination for asynchronous invocations.

Answer

Change the Lambda invocation mode to synchronous and use API Gateway as a proxy to invoke the function directly.

Question 5

A developer is building a real-time chat application using WebSockets via API Gateway. The backend uses AWS Lambda functions to handle connect, disconnect, and message events. The application needs to broadcast messages to all connected clients. What is the most scalable and cost-effective way to maintain the list of connection IDs and broadcast messages?

Accepted Answer

Store connection IDs in a DynamoDB table. Use a Lambda function to query all connection IDs and send messages using the API Gateway Management API.. Option A is correct. DynamoDB is a scalable, low-latency database that can store connection IDs and allow Lambda to query all connections for broadcasting. Option B is wrong because an in-memory list in a single Lambda instance does not scale across multiple instances. Option C is wrong because ElastiCache is more expensive and complex than DynamoDB for this use case. Option D is wrong because SQS is not designed for real-time broadcasting and would require polling.

Answer

Use an SQS FIFO queue to store connection IDs and have a Lambda function poll the queue to broadcast.

Answer

Maintain an in-memory list of connection IDs in a global variable of a single Lambda function.

Answer

Use Amazon ElastiCache Redis to store connection IDs and use Redis Pub/Sub for broadcasting.

Question 6

An organization uses AWS CodeCommit for source control and AWS CodeBuild for building a Java application. The build process needs to run integration tests that require a MySQL database. The team wants to ensure the database is provisioned only during the build and cleaned up afterward to minimize costs. What is the most efficient solution?

Accepted Answer

Use a Docker container running MySQL within the CodeBuild environment.. Option C is correct. Using AWS CodeBuild's local custom image with Docker Compose allows running a MySQL container as part of the build, which is ephemeral and cost-effective. Option A is wrong because provisioned RDS instances incur costs even when not in use. Option B is wrong because DynamoDB is not a relational database and may not support the same SQL queries. Option D is wrong because creating and destroying RDS instances in every build is slow and may hit API rate limits.

Answer

Provision a small RDS MySQL instance and keep it running for the build process.

Answer

Use AWS CloudFormation to create an RDS instance at the start of the build and delete it at the end.

Answer

Use Amazon DynamoDB as a substitute for MySQL for the integration tests.

Question 7

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL database. Recently, the application started experiencing frequent database connection timeouts. The development team discovered that the application is not closing database connections properly, leading to exhausted database connections. The team wants a solution that does not require code changes. Which option should they choose?

Accepted Answer

Configure Amazon RDS Proxy in front of the RDS instance and update the application to connect through the proxy.. Option A is correct. RDS Proxy manages connection pooling and reduces the number of open connections to the database, thus preventing connection exhaustion without code changes. Option B is wrong because increasing the max_connections setting only postpones the problem and may cause resource contention. Option C is wrong because Multi-AZ is for high availability, not connection management. Option D is wrong because switching to Aurora with Auto Scaling does not address the connection leak issue and requires migration effort.

Answer

Enable Multi-AZ on the RDS instance to handle failover and reduce connection timeouts.

Answer

Migrate the database to Amazon Aurora and enable Auto Scaling for read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more concurrent connections.

Question 8

A company runs a production web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic across multiple EC2 instances in an Auto Scaling group. The application uses an Amazon Aurora MySQL database. The operations team reports that the application is experiencing intermittent latency spikes, especially during peak hours. Investigation reveals that the database CPU utilization is consistently above 80% and there are many slow queries. The developer is asked to improve database performance without changing the application code. Which solution should the developer implement?

Accepted Answer

Implement an Amazon RDS Proxy in front of the Aurora cluster to manage database connections efficiently.. Option A is correct because adding an RDS Proxy reduces connection management overhead and can improve latency. Option B is wrong because scaling EC2 instances does not help database performance. Option C is wrong because ElastiCache requires application changes. Option D is wrong because increasing instance size helps but may be costly and not address connection pooling.

Answer

Use Amazon ElastiCache to cache frequently accessed data.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances.

Answer

Upgrade the Aurora instance to a larger instance type.

Question 9

A developer is creating a CI/CD pipeline using AWS CodeBuild and AWS CodeDeploy for a Java application that runs on EC2 instances. The build process must compile the code, run unit tests, and package the application into a WAR file. The deployment should use the blue/green deployment strategy. What is the correct sequence of actions?

Accepted Answer

Use CodeCommit to store the source code, CodeBuild to build, and CodePipeline to orchestrate the deployment.. Option B is correct. CodeBuild compiles and packages the application, then CodeDeploy performs the blue/green deployment. Option A is wrong because CodeDeploy does not build. Option C is wrong because CodeCommit is for source control, not building. Option D is wrong because Elastic Beanstalk is a platform-as-a-service, not a CI/CD service.

Answer

Use CodeDeploy to build the application and then use CodePipeline to deploy it.

Answer

Use Elastic Beanstalk to build and deploy the application.

Question 10

A developer is working on an application that uses Amazon SQS as a message queue. The application polls the queue using long polling with a wait time of 20 seconds. Recently, the team noticed that messages are being processed multiple times. The application is idempotent, but duplicate processing is causing unnecessary costs. What should the developer do to reduce duplicate message processing?

Accepted Answer

Use a DynamoDB table to track processed message IDs and ignore duplicates.. Option D is correct. Enabling the visibility timeout to be at least as long as the processing time ensures that if the consumer fails to delete the message within the visibility timeout, the message becomes visible again, causing duplicates. Option A is wrong because SQS already provides at-least-once delivery; deduplication is not natively supported for standard queues. Option B is wrong because increasing the visibility timeout helps but does not eliminate duplicates entirely. Option C is wrong because FIFO queues provide exactly-once processing but may not be suitable if the application requires higher throughput or ordering not needed.

Answer

Switch to a FIFO queue to enable exactly-once processing.

Answer

Increase the visibility timeout to a value greater than the maximum processing time.

Question 11

A company runs a microservices architecture on Amazon ECS with Fargate. Each service uses an Application Load Balancer and stores data in Amazon DynamoDB. The operations team notices that during traffic spikes, some requests fail with HTTP 503 errors. CloudWatch metrics show that the ALB's TargetResponseTime is increasing, and the DynamoDB table's ConsumedWriteCapacityUnits are reaching the provisioned limit. The team wants to handle traffic spikes gracefully without manual intervention. What should they do?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity and configure ECS Service Auto Scaling based on ALB request count.. Option B is correct. DynamoDB Auto Scaling adjusts the provisioned capacity based on traffic, preventing throttling. ECS Service Auto Scaling adds more tasks to handle increased load. Option A is wrong because increasing the throughput limit without auto scaling would still require manual changes. Option C is wrong because DynamoDB Accelerator (DAX) is a cache for reads, not writes. Option D is wrong because SQS for write requests adds complexity and may not be real-time.

Answer

Increase the DynamoDB table's provisioned write capacity and the ALB's target group deregistration delay.

Answer

Use an SQS queue to buffer write requests and process them asynchronously.

Answer

Add a DynamoDB Accelerator (DAX) cluster to cache frequently accessed data.

Question 12

A company runs a Node.js application on AWS Elastic Beanstalk. The application writes log files to /var/log/app/. The operations team wants to stream these logs to Amazon CloudWatch Logs for monitoring and alerting. The developer configures the Elastic Beanstalk environment to include a .ebextensions configuration file that sets up the CloudWatch Logs agent. The configuration file specifies the log group and the log stream prefix. After deploying the updated environment, the logs are not appearing in CloudWatch Logs. The developer checks the EC2 instance and confirms that the CloudWatch Logs agent is running and the configuration file is present in /etc/awslogs/. What is the most likely reason the logs are not being sent?

Accepted Answer

The CloudWatch Logs agent configuration file does not specify the correct log file path or the log files do not exist.. Option D is correct because the CloudWatch Logs agent configuration must specify the path to the log files. If the path is incorrect or the log files are not being written, the agent will not send logs. Option A is incorrect because the agent runs as root; permissions to read /var/log/app/ are typically fine. Option B is incorrect because CloudWatch Logs does not require IAM roles to be attached to the instance profile; the instance profile must have proper permissions, but that's separate. Option C is incorrect because the agent configuration can be in the .ebextensions file, and that is a valid method.

Answer

The CloudWatch Logs agent does not have read permissions on the /var/log/app/ directory.

Answer

The .ebextensions configuration file is not executed because it is in the wrong directory.

Answer

The IAM instance profile does not have the necessary permissions to write to CloudWatch Logs.

Question 13

A developer is deploying a web application using AWS Elastic Beanstalk. The application requires a relational database. The developer wants the database to be automatically created and configured as part of the Elastic Beanstalk environment. Which approach should they use?

Accepted Answer

Configure the Elastic Beanstalk environment to include an RDS database instance.. Option A is correct. Elastic Beanstalk can provision an RDS database as part of the environment using the AWS::ElasticBeanstalk::Environment resource with a linked RDS instance. Option B is wrong because manually creating an RDS instance outside of Elastic Beanstalk does not integrate with environment management. Option C is wrong because DynamoDB is NoSQL, not relational. Option D is wrong because adding a database to the application code as a file-based database like SQLite is not suitable for production and does not scale.

Answer

Use Amazon DynamoDB as the database and configure it in the Elastic Beanstalk environment.

Answer

Create an RDS database manually and configure the application to connect to it using environment properties.

Answer

Embed a SQLite database file in the application deployment package.

Question 14

A developer is deploying a new version of a microservice that runs on AWS Fargate. The service is part of an Amazon ECS cluster and has an associated Application Load Balancer (ALB). The developer wants to perform a rolling update without downtime and ensure that at least 50% of the service's desired count remains available during the deployment. The current desired count is 4. The developer updates the task definition and triggers a new service deployment using the AWS CLI. After the update, the developer notices that the service briefly goes to 0 running tasks during the deployment, causing downtime. The ECS service deployment configuration has: minimumHealthyPercent=50 and maximumPercent=200. What is the most likely cause of this downtime?

Accepted Answer

The service is using the CODE_DEPLOY deployment controller instead of the default ECS rolling update controller.. Option B is correct because the deployment controller default is ECS, not CODE_DEPLOY. ECS rolling update with min/max settings should work, but if the deployment controller is set to 'CODE_DEPLOY', the service does not manage the rollout automatically; it expects an external deployment. In this case, the developer triggered a new deployment with the updated task definition but the service might have been configured with CODE_DEPLOY controller, causing it to stop all tasks. Option A is incorrect because 50% minimum healthy percent should keep at least 2 tasks. Option C is incorrect because deregistration delay affects draining, not immediate 0 count. Option D is incorrect because the ALB health check doesn't cause tasks to stop.

Answer

The ALB health check is misconfigured, causing healthy tasks to be marked as unhealthy and replaced.

Answer

The minimumHealthyPercent value of 50% is too low, allowing the service to scale down to 0 tasks.

Answer

The ALB deregistration delay is set to 0, causing tasks to be removed immediately.

Question 15

A developer is building a serverless application using AWS Lambda that processes messages from an Amazon SQS queue. The queue receives about 100 messages per second, and each message takes about 30 seconds to process. The Lambda function is configured with a reserved concurrency of 10. The developer notices that messages are frequently being sent to the dead-letter queue (DLQ) after three failed processing attempts. The Lambda function's execution role has the necessary permissions to read from the SQS queue and write to the DLQ. The SQS queue's visibility timeout is set to 60 seconds, and the Lambda function's timeout is set to 60 seconds. What is the most likely cause of the messages being sent to the DLQ?

Accepted Answer

The reserved concurrency of 10 is too low to handle the incoming message rate, causing messages to be repeatedly retried until they exceed the maxReceiveCount.. Option C is correct because the Lambda function's reserved concurrency of 10 limits the number of concurrent executions. With 100 messages per second and 30 seconds processing time, each invocation can process only 10 messages at a time (since concurrency is 10), so messages accumulate. The SQS queue's visibility timeout of 60 seconds means that if a message is not processed within 60 seconds, it becomes visible again and can be retried. However, with high volume and low concurrency, messages may be repeatedly retrieved but not processed in time, leading to three failed attempts and then sent to DLQ. Option A is incorrect because the DLQ configuration does not cause reprocessing. Option B is incorrect because 60-second timeout is ample for 30-second processing. Option D is incorrect because batch processing is optional and not required.

Answer

The SQS queue is not configured to use long polling, causing the Lambda function to receive empty responses and waste time.

Answer

The Lambda function timeout is too short for the processing time required.

Answer

The DLQ is incorrectly configured to receive all failed messages after the first attempt.

Question 16

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores user session data in an Amazon ElastiCache for Redis cluster. Recently, users have been experiencing intermittent session timeouts and data loss. The developer examines the application logs and finds errors indicating that the Redis cluster is returning 'READONLY You can't write against a read-only replica.' The ElastiCache cluster is configured as a Redis replication group with one primary and two replicas. The application's connection code uses the primary endpoint. What is the most likely cause of this issue?

Accepted Answer

A failover event occurred, and the application is still trying to write to the old primary node, which is now a replica.. Option A is correct because a failover event may have promoted one of the replicas to become the new primary. The application might have cached the old primary endpoint IP, or the DNS TTL could cause the application to still connect to the old primary (now a replica). Writing to a replica results in the READONLY error. Option B is incorrect because ElastiCache does not automatically scale down. Option C is incorrect because ElastiCache cluster mode is for sharding, not primary-replica. Option D is incorrect because security groups block connections entirely, not cause intermittent writes.

Answer

The ElastiCache cluster has been scaled down to a single node, causing the primary to become unavailable.

Answer

The ElastiCache security group is blocking write traffic to the primary endpoint.

Answer

The Redis cluster mode is enabled, and the application is not using the correct cluster endpoint.

Question 17

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets across all accounts have server-side encryption enabled. They have created an SCP that denies the s3:PutBucketAcl action unless the request includes the x-amz-server-side-encryption header. However, some application teams report that they cannot create buckets even when they include the required header. What is the MOST likely cause of this issue?

Accepted Answer

The SCP is incorrectly targeting s3:PutBucketAcl instead of s3:CreateBucket.. Option A is correct because the SCP denies s3:PutBucketAcl, not s3:CreateBucket. The SCP should deny s3:CreateBucket unless the encryption header is present. Option B is wrong because SCPs do not evaluate resource-based policies. Option C is wrong because SCPs apply to all principals in the account. Option D is wrong because the issue is with the SCP action, not the header condition.

Answer

The SCP is not applied to the root OU, only to specific accounts.

Answer

The condition key in the SCP is misspelled.

Answer

The SCP is being overridden by a resource-based policy on the S3 bucket.

Question 18

A developer is building a mobile application that uses Amazon Cognito User Pools for authentication. The app needs to access a REST API hosted on AWS. The developer wants to use Cognito to authorize API requests. The API Gateway is configured with a Cognito User Pool authorizer. However, when testing, the API returns a 401 Unauthorized error even though the user is authenticated. The developer verified that the user exists in the user pool and the ID token is valid. What is the MOST likely cause and solution?

Accepted Answer

The API request is missing the Authorization header with the token. The developer should add the token to the Authorization header.. Option A is correct because the API Gateway authorizer expects an Authorization header with the token, and if the token is missing or in the wrong header, it returns 401. Option B is wrong because the method request header is not needed. Option C is wrong because the token should be the ID token, not access token. Option D is wrong because the Authorizer is already configured.

Answer

The API Gateway authorizer is not properly configured. The developer should delete and recreate the authorizer.

Answer

The developer is using the wrong token. The API Gateway authorizer requires the access token, not the ID token.

Answer

The API Gateway method request header is not mapped. The developer should add a mapping template to pass the token.

Question 19

A company runs a web application on EC2 instances in an Auto Scaling group. The application uses an IAM role to access an S3 bucket that stores user uploads. Recently, the security team discovered that some uploaded files contain malicious content. The team wants to implement a solution that automatically scans new objects for malware and blocks access if threats are detected. The solution must be cost-effective and minimize latency for legitimate uploads. The developer is tasked with designing this solution. Which approach should the developer take?

Accepted Answer

Enable Amazon GuardDuty with S3 protection, configure an S3 event notification to trigger a Lambda function that scans new objects using a third-party malware engine, and update the bucket policy to deny access to objects that fail the scan.. Option D is correct because using Amazon GuardDuty with S3 protection and an S3 Event Notification to trigger a Lambda function for scanning provides automated threat detection and response. Option A is wrong because S3 Object Lambda is for modifying objects, not scanning. Option B is wrong because Macie is for sensitive data discovery, not malware. Option C is wrong because S3 Batch Operations is for large-scale batch jobs, not real-time scanning.

Answer

Use S3 Batch Operations to run a scanning script on all existing objects and then schedule periodic scans.

Answer

Use S3 Object Lambda to transform objects upon retrieval and check for malware.

Answer

Enable Amazon Macie on the S3 bucket to automatically detect malicious content.

Question 20

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that the encryption keys be rotated every 90 days and that access to the keys be auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation.. Option B is correct because SSE-KMS with automatic key rotation meets the requirements with minimal overhead. Option A is wrong because SSE-S3 uses S3-managed keys that cannot be rotated on a schedule. Option C is wrong because SSE-C requires managing keys yourself. Option D is wrong because client-side encryption adds complexity.

Answer

Use SSE-S3 with default encryption enabled.

Answer

Use client-side encryption with the AWS Encryption SDK.

Answer

Use SSE-C with keys stored in AWS Secrets Manager.