DVA-C02 Development with AWS Services Practice Test 13 — 15 Questions

Question 1

A company runs a microservices application on Amazon ECS with Fargate. Each service has its own task definition and uses service discovery via AWS Cloud Map. Recently, one service is failing to connect to another service using the service discovery endpoint. The developer verified that both services are running and the security groups allow traffic. What is the most likely cause of the connectivity issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The service discovery namespace is of type private but the DNS records are not being created.. For Amazon ECS service discovery using AWS Cloud Map with a private DNS namespace, AWS creates a Route 53 private hosted zone associated with your VPC. For resources within the VPC to resolve these private DNS queries, both 'enableDnsSupport' and 'enableDnsHostnames' must be set to 'true' in the VPC configuration. If either is disabled, DNS resolution for the service discovery endpoints will fail, even if the tasks are healthy and security groups are correctly configured.

Answer

The task definitions are not using the awsvpc network mode.

Answer

The service discovery namespace is of type public and the services are in a private subnet.

Answer

The VPC does not have an internet gateway attached.

Question 2

A developer is using API Gateway to expose a Lambda function as a REST API. The API must be accessible from a web application hosted on a different domain. The developer configured CORS but the browser still shows CORS errors. What should the developer do to resolve the issue?

Accepted Answer

Set the Access-Control-Allow-Origin header in the Lambda function response.. When using API Gateway with a Lambda proxy integration, enabling CORS via the API Gateway console only configures the OPTIONS preflight method. For the actual API request (such as GET or POST) to succeed without CORS violations in the browser, the backend Lambda function must explicitly return the 'Access-Control-Allow-Origin' header in its JSON response payload.

Answer

Enable CORS in API Gateway and ensure the OPTIONS method returns the required headers.

Answer

Configure the Lambda function to return HTTP 200 for preflight OPTIONS requests.

Answer

Add the web application's domain to an API Gateway usage plan.

Question 3

A developer is using AWS CodePipeline to automate CI/CD. The pipeline has a Source stage (CodeCommit), a Build stage (CodeBuild), and a Deploy stage (CodeDeploy). The Build stage runs tests and packages the application. The developer notices that the Deploy stage is triggered even when the Build stage fails. How can the developer prevent deployment on build failure?

Accepted Answer

Set a transition between Build and Deploy stages that only allows successful builds.. In AWS CodePipeline, the default behavior is to stop the pipeline execution immediately if any action in a stage fails. If a Deploy stage is triggered despite test failures in the Build stage, it indicates that the CodeBuild build succeeded because the test command did not return a non-zero exit code. To prevent deployment on test failure, the developer must ensure that the test command in the buildspec.yml returns a non-zero exit code upon failure, which will cause the CodeBuild action (and thus the Build stage) to fail, stopping the pipeline.

Proposed Options:
- A: Ensure the test command in the buildspec.yml file returns a non-zero exit code on failure, which will fail the CodeBuild action and stop the pipeline. [CORRECT]
- B: Disable the transition between the Build and Deploy stages in CodePipeline. [WRONG]
- C: Add a manual approval action before the Deploy stage. [WRONG]
- D: Configure the Build stage with 'On failure: Abort' in the pipeline settings. [WRONG]

Answer

Add a manual approval action before Deploy stage.

Answer

Add a CloudWatch Events rule to trigger a Lambda function that stops the pipeline on build failure.

Answer

Configure the Build stage with 'On failure: Abort' in the pipeline settings.

Question 4

An application running on Amazon EC2 instances in an Auto Scaling group processes messages from an SQS queue. The application runs in a private subnet and needs to send metrics to Amazon CloudWatch. How can the developer ensure the EC2 instances can send metrics without traversing the internet?

Accepted Answer

Create a VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring).. A VPC Endpoint for CloudWatch (com.amazonaws.region.monitoring) allows EC2 instances in a private subnet to send metrics to CloudWatch over the AWS network without traversing the internet. This is achieved by creating an Interface Endpoint (powered by AWS PrivateLink) that provides private connectivity to CloudWatch using private IP addresses from your subnet, avoiding the need for an internet gateway, NAT gateway, or virtual private gateway.

Answer

Attach a NAT Gateway to the private subnet and update the route table.

Answer

Install the CloudWatch agent on each instance and configure it to use a proxy.

Answer

Attach an Internet Gateway to the VPC and assign public IPs to instances.

Question 5

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The function is currently active and handling traffic. The developer wants to gradually shift traffic to the new version and rollback if errors increase. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the alias to route a percentage of traffic to the new version and the rest to the current version.. Lambda aliases support weighted routing, allowing you to specify a percentage of traffic to send to a new version while the remainder goes to the current version. This enables canary deployments where you can monitor error rates and rollback by adjusting the weights without redeploying.

Answer

Invoke the Lambda function with the new version using the AWS SDK.

Answer

Update the alias to route 100% of traffic to the new version.

Answer

Use AWS CodeDeploy to create a deployment group for the Lambda function.

Question 6

A company is using AWS CloudFormation to manage infrastructure. A developer needs to create a stack that will launch an EC2 instance and associate an Elastic IP address. The Elastic IP must be released when the stack is deleted. Which TWO resources should the developer include in the CloudFormation template? (Choose TWO.)

Accepted Answer

AWS::EC2::EIP. (AWS::EC2::EIP) is correct because it provisions an Elastic IP address that can be associated with an EC2 instance. Option E (AWS::EC2::EIPAssociation) is correct because it explicitly associates the Elastic IP with the instance, and when the stack is deleted, CloudFormation automatically releases the EIP due to the association being removed. Without the association, the EIP remains allocated and incurs charges even after stack deletion.

Answer

AWS::EC2::Instance

Answer

AWS::EC2::NetworkInterface

Answer

AWS::EC2::Address

Question 7

A developer is building a REST API using API Gateway and Lambda. The API must be secured using a Lambda authorizer. Which THREE steps are necessary to implement the Lambda authorizer? (Choose THREE.)

Accepted Answer

Configure the API Gateway method to use the Lambda authorizer.. The API Gateway method must be explicitly configured to use the Lambda authorizer as the authorization mechanism. This is done by setting the method's Authorization type to the Lambda authorizer's logical name in the API Gateway console or via the REST API's `authorizationType` property set to `CUSTOM` and referencing the authorizer's ID. Without this configuration, API Gateway will not invoke the authorizer function for incoming requests.

Answer

Return a JSON Web Token (JWT) from the authorizer function.

Answer

Generate an API key and distribute it to clients.

Question 8

Refer to the exhibit. A developer attached the IAM policy to a Lambda function's execution role. The function reads items from a DynamoDB table that uses AWS KMS customer managed key (CMK) for encryption at rest. When the function tries to read an item, it receives an access denied error. What is the cause?

Accepted Answer

The policy allows kms:Decrypt on all resources but the CMK key policy may not grant access.. The IAM policy grants kms:Decrypt on all resources, but DynamoDB uses AWS KMS customer managed keys (CMKs) for encryption at rest. Even if the IAM policy allows the action, the CMK's key policy must also grant the Lambda execution role access to use the key. If the key policy does not include a statement allowing the Lambda role to perform kms:Decrypt, the request fails with an access denied error, regardless of the IAM policy.

Answer

The DynamoDB table is not encrypted with a KMS key.

Answer

The policy does not allow dynamodb:GetItem on the table.

Answer

The DynamoDB table does not exist.

Question 9

A developer creates an S3 bucket. After creation, the developer tries to access https://my-app-data-123.s3.amazonaws.com/index.html but gets a 403 Forbidden error. The S3 bucket has public access blocked at the account level. What should the developer do to allow public read access?

Accepted Answer

Disable the block public access settings at the account level.. The stem has been cleaned up to remove references to an exhibit and CloudFormation template that are not provided, making the question self-contained and clear.

Answer

Enable static website hosting on the bucket.

Answer

Modify the bucket policy to include the AWS account ID as Principal.

Answer

Add a bucket policy that grants s3:ListBucket.

Question 10

A developer invokes a Lambda function using the AWS CLI. The response shows StatusCode 200 and FunctionError: Unhandled. What does this indicate?

Accepted Answer

The Lambda function threw an exception that was not caught by the code.. A is correct because a StatusCode 200 from an AWS Lambda invocation via the AWS CLI indicates that the invocation request itself was accepted and processed by the Lambda service, but the presence of FunctionError: Unhandled means the function code threw an exception that was not caught by any try-catch block or error handler. This results in the Lambda service returning a 200 HTTP status for the invocation request while signaling the error via the FunctionError field in the response payload.

Answer

The Lambda function timed out before completing.

Answer

The Lambda function executed successfully without errors.

Answer

The AWS CLI failed to invoke the function due to permissions.

Question 11

A developer is building a serverless application using API Gateway and Lambda. The API Gateway REST API endpoint needs to be accessible only from a specific VPC. Which configuration should be used?

Accepted Answer

Configure a resource policy with a condition using aws:SourceVpc.. For an API Gateway private REST API, access must be explicitly allowed using an API Gateway resource policy. To restrict access to a specific VPC, you configure a resource policy with a condition block that allows access only when `aws:SourceVpc` matches the target VPC ID. Private APIs are accessed via interface VPC endpoints (execute-api), and the resource policy ensures that only traffic originating from the specified VPC is permitted.

Answer

Attach a security group to the API Gateway.

Answer

Create a VPC endpoint for API Gateway and associate it with the API.

Answer

Enable private DNS on the API Gateway API.

Question 12

An application running on Amazon ECS Fargate uses a DynamoDB table with on-demand capacity. The table has a partition key of 'userId' and a sort key of 'timestamp'. During peak hours, some requests experience throttling errors. The application performs updates to existing items using 'UpdateItem' with ConditionExpression to ensure the 'status' attribute is 'active'. Which design change will BEST reduce throttling?

Accepted Answer

Implement DynamoDB Accelerator (DAX) to cache frequent items.. DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for Amazon DynamoDB. It is designed to handle read-heavy or hot-key workloads by caching read results (such as GetItem or Query). This prevents repeated read requests for the same items from reaching the DynamoDB table, thereby eliminating read throttling and reducing latency.

Answer

Use 'TransactWriteItems' instead of 'UpdateItem' for atomic updates.

Answer

Change the table to provisioned capacity and increase read capacity units.

Answer

Create a global secondary index with the same partition key and a different sort key.

Question 13

A company is using Amazon SQS to decouple microservices. The producer sends messages, and the consumer processes them. The consumer occasionally fails to process a message due to transient errors. What is the BEST way to ensure such messages are retried automatically?

Accepted Answer

Use a FIFO queue with content-based deduplication.. When a consumer retrieves a message from an SQS queue, the message remains in the queue but is hidden for the duration of the visibility timeout. If processing fails due to a transient error, the consumer should not delete the message. Once the visibility timeout expires, the message automatically becomes visible again in the queue for reprocessing. If the message was deleted, it would be lost; if it is not deleted, SQS handles the retry automatically.

Answer

Use a delay queue to postpone message processing.

Answer

Configure a dead-letter queue with a redrive policy on the source queue.

Answer

Increase the visibility timeout to give the consumer more time.

Question 14

An organization uses AWS CodeBuild to run tests for a Node.js application. The build environment is Linux. The buildspec.yml includes a pre_build phase that runs 'npm install'. Occasionally, the build fails with an error 'npm ERR! code EINTEGRITY'. The developer wants to resolve this issue without compromising security. Which action should be taken?

Accepted Answer

Add 'npm cache verify' to the pre_build phase before 'npm install'.. The EINTEGRITY error occurs when npm's integrity check fails due to a corrupted cache. Adding 'npm cache verify' before 'npm install' verifies and cleans the cache, resolving the issue without compromising security. Option A is incorrect because creating a separate CodeBuild project does not address the cache integrity issue. Option C is incorrect because switching to HTTP registry disables HTTPS integrity checks, compromising security. Option D is incorrect because 'npm install --prefer-offline' avoids fetching from the registry but still uses the potentially corrupted local cache.

Answer

Create a separate CodeBuild project to run npm install.

Answer

Add 'npm config set registry http://registry.npmjs.org/' to use HTTP.

Answer

Use 'npm install --prefer-offline' to avoid fetching from registry.

Question 15

A developer is designing a system where an S3 bucket receives uploads, and each upload triggers a Lambda function to process the file. The processed output is stored in another S3 bucket. The developer notices that sometimes the same file is processed multiple times. How can this be prevented?

Accepted Answer

Make the Lambda function idempotent by checking if the object has already been processed using a DynamoDB table.. Making the Lambda function idempotent using a DynamoDB table ensures that even if the same S3 event is delivered multiple times (due to at-least-once delivery semantics) or if the same file is uploaded again, the function checks a unique identifier (such as the object key or hash) in DynamoDB before processing. If it has already been processed, the function can safely skip it. This is the standard architectural pattern for ensuring idempotency in serverless pipelines.

Answer

Use an SQS FIFO queue as the event destination and enable content-based deduplication.

Answer

Enable S3 bucket replication to another bucket and trigger Lambda from the replica.

Answer

Enable S3 bucket versioning and use 's3:ObjectCreated:Put' events.