DVA-C02 Development with AWS Services Practice Test 11 — 15 Questions

Question 1

A developer needs to deploy a containerized application on AWS. The application requires persistent storage for stateful data. Which AWS compute service should the developer choose?

Accepted Answer

Amazon ECS with Fargate. Option B is correct because Amazon ECS with Fargate supports persistent storage via EFS or bind mounts. Option A is wrong because AWS Lambda is stateless and ephemeral. Option C is wrong because AWS Elastic Beanstalk is for web apps, not containers. Option D is wrong because Amazon EKS also supports persistent storage, but it is more complex; ECS with Fargate is simpler and supports persistent storage.

Answer

AWS Elastic Beanstalk

Answer

Amazon EKS with Fargate

Answer

AWS Lambda

Question 2

A company uses AWS CodeBuild to run unit tests. The buildspec.yml file is stored in the source repository. The build fails intermittently with 'command not found' for a tool that is installed in the build environment. What should the developer do to ensure the tool is available?

Accepted Answer

Add a pre_build phase to install the tool.. Option A is correct because CodeBuild supports installing dependencies in the pre_build phase. Option B is wrong because phases are already defined. Option C is wrong because the tool may not be available in all environments. Option D is wrong because CodeBuild environments are not customizable via console.

Answer

Use a custom Docker image that includes the tool.

Answer

Configure the build environment to include the tool via the AWS Management Console.

Answer

Add a post_build phase to install the tool.

Question 3

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

Accepted Answer

Amazon S3 Event Notifications. Option D is correct because S3 Event Notifications can trigger Lambda asynchronously and support retry. Option A is wrong because API Gateway is for synchronous requests. Option B is wrong because Step Functions is an orchestrator, not a trigger. Option C is wrong because SQS requires a Lambda function to poll; S3 does not directly send to SQS.

Answer

Amazon SQS

Answer

Amazon API Gateway

Answer

AWS Step Functions

Question 4

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Accepted Answer

Scan and sort results client-side, then take first 10. Options B and D are correct. Query requires a partition key and can use ScanIndexForward to get descending order, then limit to 10. Scan can also retrieve all items and sort client-side, then limit to 10. Option A is wrong because GetItem retrieves a single item. Option C is wrong because BatchGetItem retrieves multiple items by key, not sorted. Option E is wrong because TransactGetItems is for transactional reads.

Answer

TransactGetItems

Answer

BatchGetItem

Answer

GetItem

Question 5

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. Which THREE services can be used for session state storage? (Choose THREE.)

Accepted Answer

Amazon ElastiCache for Redis. Options A, B, and D are correct. DynamoDB is a common session store; ElastiCache Redis is a popular in-memory session store; RDS can store sessions in a database. Option C is wrong because S3 is object storage, not suitable for session state due to latency and cost. Option E is wrong because CloudFront is a CDN, not a storage service.

Answer

Amazon S3

Answer

Amazon CloudFront

Question 6

A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)

Accepted Answer

Create an AWS KMS customer-managed key.. Options A, C, and D are correct. Using a KMS key for encryption ensures SSE-KMS; bucket policies can deny writes without the correct encryption header; default encryption enforces SSE-KMS. Option B is wrong because S3 does not automatically encrypt with SSE-KMS without configuration. Option E is wrong because bucket ACLs do not control encryption.

Answer

Configure the bucket ACL to require encryption.

Answer

Enable S3 default encryption with SSE-S3.

Question 7

A developer runs the command above. The output.txt file is empty. What could be the reason?

Accepted Answer

The Lambda function did not return any output.. Option C is correct because by default, Lambda returns only the response if the function is invoked synchronously and the output goes to output.txt; if the function returns nothing or errors, output.txt may be empty. Option A is wrong because a non-existent function returns a 404. Option B is wrong because incorrect payload may cause error but still output to stderr. Option D is wrong because Lambda invocation with --payload does not need an explicit return; empty output means the function returned nothing.

Answer

The payload is not valid JSON.

Answer

The Lambda function timed out.

Answer

The function name is incorrect.

Question 8

A developer attaches this IAM policy to a user. The user tries to upload an object to example-bucket without specifying encryption. What will happen?

Accepted Answer

The upload fails with an access denied error.. Option B is correct because the condition requires s3:x-amz-server-side-encryption to be AES256; if not specified, the condition fails and the request is denied. Option A is wrong because S3 default encryption would apply but the policy condition is not met. Option C is wrong because the condition does not require the header to be set; it requires it to be AES256 if present. Option D is wrong because the policy does not specify any encryption key.

Answer

The upload succeeds only if the object is smaller than 5 GB.

Answer

The upload succeeds but the object is not encrypted.

Answer

The upload succeeds because S3 default encryption is applied.

Question 9

A developer deploys this CloudFormation template. The Lambda function fails to access the DynamoDB table 'MyTable'. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks DynamoDB permissions.. Option B is correct because the Lambda execution role does not include dynamodb: permissions. Option A is wrong because the environment variable is correctly set. Option C is wrong because the runtime is supported. Option D is wrong because S3 bucket and key are specified correctly.

Answer

The runtime nodejs18.x is incorrect for this handler.

Answer

The S3 bucket 'my-bucket' does not exist.

Answer

The environment variable TABLE_NAME is misspelled.

Question 10

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. Option A is correct because the Lambda execution role can be attached to the function and include an IAM policy granting access to the S3 bucket. This follows the principle of least privilege and avoids hardcoding credentials. Option B is wrong because bucket policies are resource-based and not attached to functions. Option C is wrong because environment variables would expose credentials. Option D is wrong because Lambda does not have an inline policy property - policies are attached via roles.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

Accepted Answer

S3 is not a suitable store for session state due to its eventual consistency and higher latency.. Option C is correct because S3 is not designed for low-latency session state access and is eventually consistent, leading to lost writes. A managed service like ElastiCache or DynamoDB is better. Option A is wrong because ALB supports sticky sessions. Option B is wrong because S3 can be accessed from EC2. Option D is wrong because scaling alone does not cause session loss if storage is properly configured.

Answer

The EC2 instances do not have internet access to reach S3.

Answer

The ALB does not have sticky sessions enabled.

Answer

The application is not scaling properly, causing session loss.

Question 12

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. Option B is correct because API Gateway provides built-in usage plans with the ability to set rate limits per API key. Option A is wrong because Lambda reserved concurrency limits the overall concurrency, not per-key throttling. Option C is wrong because WAF is for web application firewall, not per-key throttling. Option D is wrong because CloudWatch alarms only alert, they don't throttle.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 13

A developer is using AWS CodePipeline to automate a build and deploy process. The pipeline has a build stage that uses AWS CodeBuild and a deploy stage that uses AWS CodeDeploy. The build stage produces a build artifact that is stored in Amazon S3. The deploy stage fails with 'NoSuchKey' error. What is the MOST likely cause?

Accepted Answer

The pipeline does not have an OutputArtifact configured for the build stage, so the artifact is not passed to the deploy stage.. Option B is correct because the artifact must be passed explicitly between stages via the OutputArtifacts and InputArtifacts configuration. Option A is wrong because S3 bucket policy is not typically the issue for cross-account same account. Option C is wrong because CodeBuild permissions are separate. Option D is wrong because CodeDeploy permissions are for deployment, not artifact access.

Answer

The CodeDeploy application does not have the correct service role.

Answer

The CodeBuild project does not have permissions to upload to the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to access the artifact.

Question 14

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. Option C is correct because AWS Systems Manager Parameter Store (or Secrets Manager) is designed for secure storage of secrets and can be accessed via IAM roles. Option A is wrong because environment variables can be exposed. Option B is wrong because S3 is not designed for secrets and requires encryption management. Option D is wrong because Lambda is a compute service, not a secret store.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 15

A developer is using AWS Lambda with Amazon API Gateway to build a REST API. The Lambda function is written in Node.js and uses the 'aws-sdk' to interact with DynamoDB. When the function is invoked, it consistently takes more than 10 seconds to complete, causing API Gateway to timeout (default timeout is 29 seconds). The developer wants to reduce latency. What should the developer do FIRST?

Accepted Answer

Enable provisioned concurrency on the Lambda function to reduce cold starts.. Option D is correct because the cold start is the most common cause of high latency in Lambda, especially for Node.js. Provisioned concurrency keeps the function warm. Option A is wrong because increasing timeout does not reduce latency. Option B is wrong because Lambda has execution role, not IAM role attached. Option C is wrong because DynamoDB is not the bottleneck typically.

Answer

Increase the Lambda function timeout in the function configuration.

Answer

Switch from DynamoDB to Amazon RDS for faster queries.

Answer

Attach an IAM role to the Lambda function to speed up DynamoDB access.