DVA-C02 Development with AWS Services Practice Test 12 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user tries to upload an object to s3://example-bucket/secret/file.txt?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the secret/ prefix.. The Deny statement in the IAM policy explicitly denies the s3:PutObject action for any object with the prefix secret/ in the example-bucket. Since the user is trying to upload to s3://example-bucket/secret/file.txt, which matches the Deny condition, the request is denied regardless of any Allow statements. AWS IAM policy evaluation is explicit deny by default, meaning a Deny always overrides an Allow.

Answer

The upload fails only if the user is not the bucket owner.

Answer

The upload succeeds because the Deny statement does not match the specific action.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Question 2

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function asynchronously. What does the response indicate?

Accepted Answer

The function invocation was accepted but the function failed to execute successfully.. When a Lambda function is invoked asynchronously (using the 'Event' invocation type), AWS Lambda queues the event and immediately returns a 202 Accepted status code. This indicates that the invocation request was successfully accepted and queued for execution. It does not mean the function failed to execute, nor does it guarantee successful execution, as the actual execution happens asynchronously and its status must be tracked via CloudWatch Logs, Destinations, or DLQs.

Answer

The function executed successfully and returned output.

Answer

The invocation was denied due to insufficient permissions.

Answer

The function was invoked synchronously and returned an error.

Question 3

Refer to the exhibit. A developer deploys this CloudFormation stack. The Lambda function is triggered by SQS messages. However, the function fails to process messages. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have permissions to poll from SQS.. The Lambda function's execution role must include permissions for the `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes` actions to poll messages from an SQS queue. Without these permissions, the Lambda service cannot retrieve messages from the queue, causing the function to fail processing even if the event source mapping is correctly configured.

Answer

The SQS queue event source mapping is not configured correctly.

Answer

The batch size of 10 exceeds the maximum allowed batch size.

Answer

The Lambda function code has a syntax error.

Question 4

A developer is debugging a Lambda function that is triggered by an S3 event. The function is supposed to process images and store metadata in DynamoDB. However, the function times out after 3 seconds for large images. The function's timeout is currently set to 5 seconds. What should the developer do to resolve the issue without increasing the timeout?

Accepted Answer

Increase the Lambda function's memory allocation to improve performance.. Increasing the Lambda function's memory allocation also increases CPU and network performance, which can reduce execution time for CPU-bound or memory-bound tasks like image processing. This allows the function to complete within the current timeout without increasing the timeout value. Option C, multipart upload or stream processing, is not directly applicable to processing images within a Lambda function; it applies to uploading large objects to S3, not to processing within Lambda. Option B increases timeout, which is explicitly prohibited. Option D introduces asynchronous processing via SQS, but that does not address the timeout issue within the function itself.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use multipart upload or stream processing to handle the image in chunks.

Answer

Offload the processing to an Amazon SQS queue and process asynchronously.

Question 5

A company uses AWS Lambda to process incoming messages from an Amazon SQS queue. The Lambda function sometimes fails with a timeout error when the queue has a large backlog. What is the MOST efficient way to increase throughput without causing duplicate processing?

Accepted Answer

Decrease the batch size in the event source mapping.. When an SQS queue has a large backlog, Lambda retrieves the maximum number of messages allowed by the configured batch size. If processing this full batch takes longer than the Lambda function's timeout, the function times out and fails. When a Lambda function times out, the entire batch of messages is returned to the queue, leading to duplicate processing of messages that may have already been processed during that run. Decreasing the batch size (Option C) ensures that the function receives fewer messages per invocation, allowing it to successfully complete within its timeout limit, which stops the cycle of timeouts and retries, thereby increasing actual throughput.

Answer

Increase the batch size in the event source mapping.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Increase the reserved concurrency of the Lambda function.

Question 6

A developer is writing a Lambda function that needs to access an Amazon RDS MySQL database. The function will be invoked frequently. What is the BEST practice for managing the database connection?

Accepted Answer

Use Amazon RDS Proxy to manage the connection pool.. For Lambda functions accessing relational databases like Amazon RDS, the best practice is to use Amazon RDS Proxy. Because Lambda functions can scale rapidly to hundreds or thousands of concurrent executions, they can quickly exhaust the database's connection pool. RDS Proxy pools and shares these connections, improving scalability and application resilience. While opening connections outside the handler (Option C) is a good general practice, it does not solve the connection exhaustion problem under high concurrency and frequent invocations.

Answer

Close the database connection at the end of each invocation.

Answer

Open a new database connection inside the handler for each invocation.

Answer

Open the database connection outside the handler function and reuse it.

Question 7

A developer is deploying a microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other using service discovery. The developer wants to use AWS Cloud Map for service discovery. Which configuration is required for the services to register and discover each other?

Accepted Answer

Create a Cloud Map namespace and service; then configure ECS tasks to register with the service.. AWS Cloud Map requires a namespace (either HTTP or DNS) and a service resource. ECS tasks configured with service discovery can register themselves with the Cloud Map service, and other tasks can discover them via DNS queries or the Cloud Map API. Option A is incorrect because an Application Load Balancer is used for load balancing traffic, not for service discovery. Option B is incorrect because VPC endpoints provide private connectivity to AWS services, not service registration and discovery. Option C is incorrect because Security Groups control network traffic but do not facilitate service discovery.

Answer

Create an Application Load Balancer and register each service as a target group.

Answer

Create a VPC endpoint for each service.

Answer

Configure Security Groups to allow traffic between services.

Question 8

A developer needs to store session state for a web application running on multiple EC2 instances behind an Application Load Balancer. Which AWS service should the developer use for a fully managed, highly available session store?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache (specifically Redis) is the correct choice because it provides a fully managed, highly available, and low-latency in-memory data store ideal for session state management. While DynamoDB is also widely used for session state due to its serverless nature, ElastiCache is the premier choice when an 'in-memory' store is explicitly required for sub-millisecond performance.

Answer

Amazon RDS

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 9

Which TWO AWS services can be used to build a serverless event-driven application that processes data from Amazon S3 and stores results in Amazon DynamoDB? (Choose 2.)

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered directly by S3 events (e.g., ObjectCreated) to process data as soon as it arrives, and it can write the processed results to DynamoDB via the AWS SDK. This creates a fully serverless, event-driven pipeline without provisioning any servers.

Answer

Amazon Kinesis Data Streams

Answer

Amazon EC2

Answer

Amazon EMR

Question 10

Which THREE actions should a developer take to secure an AWS Lambda function that processes sensitive data? (Choose 3.)

Accepted Answer

Attach an IAM role with least privilege permissions.. A fundamental security best practice: applying the principle of least privilege to the Lambda function's execution role ensures it has only the permissions necessary to access data and services, minimizing potential damage if compromised. Option C: enabling encryption of environment variables with KMS adds a layer of protection for sensitive data stored in environment variables. Option D: running the Lambda function inside a VPC allows it to access resources securely within a private network, preventing exposure to the public internet. Option A: storing configuration in environment variables is a common practice but does not directly secure the function; it is about separating config from code, and the security benefit comes from encrypting them (Option C). Therefore, the three most directly security-relevant actions are B, C, D.

Answer

Store configuration values in Lambda environment variables.

Answer

Enable AWS CloudTrail for the Lambda function.

Question 11

A developer is designing a messaging system where orders are placed into an SQS queue and processed by a Lambda function. The developer wants to ensure that failed messages are not lost and can be analyzed later. Which TWO steps should the developer take? (Choose 2.)

Accepted Answer

Configure a dead-letter queue (DLQ) for the SQS queue.. Configuring a dead-letter queue (DLQ) for the SQS queue ensures that messages that cannot be processed successfully after a specified number of attempts are moved to a separate queue. This prevents message loss and allows the developer to analyze the failed messages later, fulfilling the requirement to not lose failed messages and to enable analysis.

Answer

Enable Lambda function retries on failure.

Answer

Increase the visibility timeout of the SQS queue.

Answer

Set up a CloudWatch alarm to monitor the queue depth.

Question 12

An IAM policy is attached to a user. What is the effect when the user tries to download an object from the 'confidential' folder in 'my-bucket' from an IP address within the 192.0.2.0/24 range?

Accepted Answer

The request is allowed.. The IAM policy includes both an Allow statement and a Deny statement. The Allow statement grants `s3:GetObject` for the `confidential` folder in `my-bucket` when the request originates from the IP range 192.0.2.0/24. The Deny statement denies the same action for requests from outside that range (using the `NotIpAddress` condition). Since the user's IP is within the 192.0.2.0/24 range, the Deny condition is not met (so the Deny does not apply), and the Allow condition is satisfied. Thus, the request is allowed, making Option C correct.

Answer

The request is denied.

Answer

The request results in an error due to conflicting statements.

Answer

The request is denied because the Deny statement overrides the Allow.

Question 13

A developer invoked a Lambda function using the AWS CLI. The response includes 'FunctionError': 'Handled'. What does this indicate?

Accepted Answer

The function threw an exception that was caught by the code.. When a Lambda function returns 'FunctionError': 'Handled', it indicates that the function execution failed because of an error thrown by the function code which was caught and handled by the Lambda runtime (for example, an uncaught exception in the function code). If the user's code had caught the exception and handled it without rethrowing or returning an error, the execution would have succeeded with no 'FunctionError'. 'Unhandled' is used when the runtime itself crashes, the function times out, or runs out of memory.

Answer

The function timed out.

Answer

The function executed successfully without any errors.

Answer

The function experienced an unhandled runtime error.

Question 14

A developer deployed this CloudFormation template. What happens to a message after it has been received from 'MyQueue' 3 times but not deleted?

Accepted Answer

The message is moved to the dead-letter queue.. The question stem mentions 'this CloudFormation template' but the actual YAML/JSON template is missing. The template must be included in the stem so that the user can see the RedrivePolicy and maxReceiveCount configuration of 3.

Answer

The message remains in the queue and is retried indefinitely.

Answer

The message is deleted from the queue.

Answer

The message is deleted after the visibility timeout expires.

Question 15

A developer is building a serverless application using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the uploaded file, transform it, and write the result to a DynamoDB table. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:PutItem"],"Resource":"*"}. The Lambda function needs to read the uploaded file from S3 (requiring s3:GetObject) and write the transformed result to DynamoDB (requiring dynamodb:PutItem). Option A correctly grants both actions with a wildcard resource, which is acceptable for a learning scenario but should be scoped in production. This matches the exact permissions needed for the described workflow.

Answer

{"Effect":"Allow","Action":["s3:PutObject","dynamodb:PutItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:UpdateItem"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:GetObject","dynamodb:GetItem"],"Resource":"*"}