DVA-C02 Development with AWS Services Practice Test 15 — 15 Questions

Question 1

A company uses Amazon API Gateway to expose a REST API. The API uses a Lambda authorizer to validate JWT tokens. Recently, the API has been returning 401 Unauthorized errors for valid tokens. The developer notices that the tokens are signed with a new key but the authorizer still uses the old key. What is the MOST efficient way to update the authorizer with the new key?

Accepted Answer

Modify the Lambda authorizer to fetch the public key from a well-known URL at runtime.. Option A is correct because the Lambda authorizer can retrieve the public key from an external URL (e.g., JWKS endpoint) at runtime, avoiding hardcoded keys. Option B is wrong because recreating the authorizer would cause downtime. Option C is wrong because deploying a new stage does not update the authorizer logic. Option D is wrong because manually updating environment variables requires a function update and is less flexible than fetching keys dynamically.

Answer

Update the API Gateway stage deployment to redeploy the API.

Answer

Delete and recreate the API Gateway authorizer with the new key.

Answer

Update the Lambda authorizer's environment variable with the new key and publish a new version.

Question 2

A developer needs to send large files (up to 5 GB) from a web application to Amazon S3. The application runs on EC2 instances. Which approach is MOST efficient and reliable?

Accepted Answer

Use S3 multipart upload to upload the file in parts.. Option C is correct because multipart upload is recommended for files over 100 MB and allows parallel uploads with retry capability. Option A is wrong because uploading as a single operation is unreliable for large files. Option B is wrong because EC2 instance store is temporary and not durable. Option D is wrong because S3 Transfer Acceleration speeds up transfers but does not improve reliability for large files; multipart upload is still better.

Answer

Save the file to EC2 instance store and then copy to S3.

Answer

Upload the file as a single S3 PutObject operation.

Answer

Use S3 Transfer Acceleration to upload the file.

Question 3

A developer is building a serverless application that processes images uploaded to an S3 bucket. The bucket triggers a Lambda function that creates a thumbnail and stores it in another S3 bucket. The developer notices that the Lambda function is invoked multiple times for the same object, causing duplicate thumbnails. What is the MOST likely cause?

Accepted Answer

The S3 bucket has multiple event notifications that trigger the same Lambda function.. Option D is correct because if S3 event notifications are misconfigured (e.g., both PutObject and PutObjectAcl events trigger the same function), the function runs multiple times. Option A is wrong because Lambda provides at-least-once execution, but duplicates are not typical unless triggered multiple times. Option B is wrong because S3 does not send duplicate events; the issue is multiple triggers. Option C is wrong because concurrent Lambda executions would not cause duplicates; each invocation processes a unique event.

Answer

S3 event notifications are eventually consistent and may deliver duplicates.

Answer

The Lambda function is configured with a DLQ that causes retries.

Answer

The Lambda function is idempotent and should handle duplicates.

Question 4

Which TWO AWS services can be used to decouple components of a microservices architecture?

Accepted Answer

Amazon EventBridge. Options A and E are correct. SQS provides message queuing for asynchronous communication. EventBridge enables event-driven decoupling. Option B is wrong because ELB is for load balancing, not decoupling. Option C is wrong because CloudWatch is for monitoring. Option D is wrong because Route 53 is DNS.

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Answer

Amazon CloudWatch

Question 5

Which THREE actions can a developer take to improve the cold start latency of an AWS Lambda function?

Accepted Answer

Use a language runtime with faster startup time, such as Python or Node.js.. Options A, B, and C are correct. Provisioned concurrency keeps environments warm. Using a smaller runtime (e.g., Python vs Java) reduces startup time. Allocating more memory also increases CPU, speeding up initialization. Option D is wrong because VPC adds latency due to ENI setup. Option E is wrong because increasing timeout does not affect cold start.

Answer

Place the Lambda function inside a VPC.

Answer

Increase the function's timeout setting.

Question 6

Which TWO IAM policy conditions can be used to enforce multi-factor authentication (MFA) for API calls?

Accepted Answer

Condition: { "Null": { "aws:MultiFactorAuthPresent": "false" } }. Options B and D are correct. 'Bool' condition with 'aws:MultiFactorAuthPresent' checks if MFA was used. 'Null' condition can check if the MFA key is absent. Option A is wrong because it checks the user's path. Option C is wrong because it checks the MFA device type. Option E is wrong because it checks the caller identity.

Answer

Condition: { "StringLike": { "iam:MFADeviceType": "Virtual" } }

Answer

Condition: { "ForAllValues:StringEquals": { "aws:SourceIdentity": "admin" } }

Answer

Condition: { "StringEquals": { "iam:ResourcePath": "/" } }

Question 7

A company is building a serverless application using AWS Lambda and Amazon API Gateway. The application needs to process user uploads to an S3 bucket. The Lambda function should be invoked only when new objects are created in the bucket. Which service should be used to trigger the Lambda function?

Accepted Answer

Amazon S3 event notifications. Option B is correct because S3 can send events directly to Lambda when objects are created. Option A is wrong because SQS requires polling. Option C is wrong because CloudWatch Events can't directly trigger from S3 object creation. Option D is wrong because Kinesis requires a stream consumer.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Events

Answer

Amazon Simple Queue Service (SQS)

Question 8

A developer needs to store configuration parameters securely for a Lambda function. The parameters include database credentials and API keys. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct because Secrets Manager is designed to securely store secrets. Option A is wrong because SSM Parameter Store can be used but Secrets Manager is better for automated rotation. Option B is wrong because S3 is not secure for secrets. Option D is wrong because DynamoDB is not secure by default.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB with encryption

Answer

Amazon S3 with server-side encryption

Question 9

A developer notices that an AWS Lambda function is timing out after 15 seconds. The function makes HTTP requests to an external API. How can the developer resolve this issue without changing the function code?

Accepted Answer

Increase the timeout setting of the Lambda function. Option D is correct because increasing the Lambda timeout allows the function to wait longer. Option A is wrong because reducing memory may increase execution time. Option B is wrong because VPC does not affect timeout. Option C is wrong because reserved concurrency does not affect timeout.

Answer

Increase the reserved concurrency

Answer

Place the Lambda function in a VPC

Answer

Decrease the memory allocation of the Lambda function

Question 10

A company is using Amazon API Gateway to expose a REST API. The API must authenticate requests using an external OAuth 2.0 provider. Which API Gateway feature should be used?

Accepted Answer

Lambda authorizer. Option C is correct because API Gateway supports custom authorizers that can validate OAuth tokens. Option A is wrong because IAM auth is for AWS credentials. Option B is wrong because Cognito User Pools can be used but the question specifies external provider. Option D is wrong because Lambda authorizer is the custom authorizer type.

Answer

IAM authorization

Answer

Resource policy

Answer

Amazon Cognito User Pools

Question 11

A developer is building an application that needs to send email notifications to users. Which AWS service is designed for sending transactional emails?

Accepted Answer

Amazon Simple Email Service (SES). Option B is correct because Amazon SES is for sending emails. Option A is wrong because SNS is for push notifications. Option C is wrong because SQS is for message queuing. Option D is wrong because Lambda is compute.

Answer

AWS Lambda

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Simple Queue Service (SQS)

Question 12

A developer is using AWS CodeBuild to build a Java application. The build fails with 'OutOfMemoryError: Java heap space'. How can the developer fix this without changing the source code?

Accepted Answer

Increase the compute type of the build project. Option A is correct because increasing the compute type provides more memory. Option B is wrong because CodeBuild does not support custom JVM options in buildspec. Option C is wrong because changing the image may not help. Option D is wrong because CodeBuild doesn't have a memory setting separate from compute type.

Answer

Add -Xmx1024m to the buildspec commands

Answer

Change the build image to a smaller one

Answer

Set the memory parameter in the build project

Question 13

A company is deploying a microservices architecture on Amazon ECS. Each service needs to store secrets such as database passwords. Which service should be used to securely inject these secrets into containers?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager integrates with ECS to inject secrets. Option A is wrong because EFS is a file system. Option B is wrong because SSM Parameter Store can be used but Secrets Manager is preferred for secrets. Option D is wrong because S3 is not secure for secrets.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Question 14

A developer wants to debug an AWS Lambda function by viewing real-time logs. Which AWS service should the developer use?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because CloudWatch Logs captures Lambda logs. Option B is wrong because X-Ray is for tracing. Option C is wrong because CloudTrail is for API calls. Option D is wrong because S3 can store logs but not in real-time.

Answer

AWS X-Ray

Answer

Amazon S3

Answer

AWS CloudTrail

Question 15

A developer is using Amazon DynamoDB as the data store for a web application. The application experiences frequent throttling errors. Which action can reduce throttling without changing the application code?

Accepted Answer

Enable DynamoDB Auto Scaling. Option D is correct because enabling auto scaling adjusts capacity based on traffic. Option A is wrong because indexes don't affect throttling. Option B is wrong because decreasing capacity would worsen throttling. Option C is wrong because increasing read capacity only partially helps.

Answer

Add a secondary index

Answer

Decrease the provisioned write capacity

Answer

Increase the provisioned read capacity only