DVA-C02 Development with AWS Services Practice Test 15 — 15 Questions

Question 1

An organization has a Lambda function that processes messages from an Amazon SQS queue. The function is configured with a reserved concurrency of 5. The SQS queue has a visibility timeout of 30 seconds. The Lambda function takes an average of 45 seconds to process each message. What is the likely behavior of this setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Messages will be processed multiple times because they become visible again before the function completes.. The Lambda function takes 45 seconds to process a message, but the SQS queue's visibility timeout is only 30 seconds. Because the processing time exceeds the visibility timeout, the message will become visible again in the queue after 30 seconds and can be received by another Lambda invocation before the first one finishes. This leads to duplicate processing. To prevent this, the SQS visibility timeout should be configured to be at least 6 times the Lambda function's timeout.

Answer

The Lambda function will be throttled due to reserved concurrency.

Answer

The Lambda function will process messages successfully with no issues.

Answer

The Lambda function will automatically increase its processing speed.

Question 2

A developer wants to trigger an AWS Lambda function every time a new object is created in an Amazon S3 bucket. Which S3 event notification configuration should be used?

Accepted Answer

s3:ObjectCreated:*. The `s3:ObjectCreated:*` event type captures all object creation events in an S3 bucket, including PUT, POST, COPY, and multipart upload completions. This is the appropriate event notification to trigger an AWS Lambda function when a new object is created.

Answer

s3:ObjectRestore:*

Answer

s3:ReducedRedundancyLostObject:*

Answer

s3:ObjectRemoved:*

Question 3

A developer is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The developer wants to ensure that the DB instance is not accidentally deleted when the stack is updated. Which property should be set on the DB instance resource?

Accepted Answer

DeletionPolicy: Retain. Setting `DeletionPolicy: Retain` on an Amazon RDS DB instance in a CloudFormation template ensures that when the stack is deleted, the DB instance is preserved and not removed. This property overrides the default behavior where CloudFormation would delete the resource when the stack is deleted, preventing accidental data loss.

Answer

UpdateReplacePolicy: Retain

Answer

DeletionPolicy: Delete

Answer

DependsOn: SomeOtherResource

Question 4

A company is designing a microservices architecture using AWS Lambda. Each microservice has its own DynamoDB table. The Lambda functions need to perform CRUD operations on their respective tables. Which TWO IAM best practices should be applied? (Choose TWO.)

Accepted Answer

Scope the IAM policy resource to the specific DynamoDB table ARN.. Scoping the IAM policy resource to the specific DynamoDB table ARN follows the principle of least privilege, ensuring each Lambda function can only access its own table. Option E is correct because creating a separate IAM role for each Lambda function isolates permissions, preventing a compromised function from affecting others. Together, these practices enforce granular access control in a microservices architecture.

Answer

Grant access to all DynamoDB tables using a wildcard in the resource ARN.

Answer

Use a single IAM role shared by all Lambda functions.

Answer

Attach the IAM policy to the AWS account instead of the role.

Question 5

A developer is using Amazon Kinesis Data Streams to ingest real-time events. The application uses the Kinesis Client Library (KCL) to process records. The developer notices that one shard is falling behind while others are processing fine. Which THREE actions can help improve processing of the lagging shard? (Choose THREE.)

Accepted Answer

Use Enhanced Fan-Out to reduce contention.. Enhanced Fan-Out (EFO) provides dedicated throughput of up to 2 MB/s per shard per consumer, eliminating contention between consumers on the same shard. This reduces latency and helps a lagging shard catch up by ensuring the KCL worker gets consistent read capacity without interference from other consumers.

Answer

Decrease the record size by compressing the data.

Answer

Reduce the number of shards in the stream.

Question 6

A developer is building a serverless application that uses Amazon S3 for static website hosting and AWS Lambda for dynamic API calls. The developer wants to enable logging of all API requests. Which TWO services can be used to log API requests? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it can capture and store logs from AWS Lambda function executions. When a Lambda function is invoked via an API request (e.g., through Amazon API Gateway), the function's execution details, including request IDs, timestamps, and error messages, are automatically sent to CloudWatch Logs. This enables developers to monitor and troubleshoot API-driven serverless applications.

Answer

VPC Flow Logs

Answer

Amazon S3 server access logs

Answer

Amazon Route 53 logs

Question 7

A developer is building a serverless application that processes images uploaded to an S3 bucket. The processing includes generating thumbnails and storing metadata in DynamoDB. The developer wants to ensure that the processing function is triggered only when new objects are created, not when existing objects are updated. Which S3 event notification configuration should be used?

Accepted Answer

Use s3:ObjectCreated:*. The `s3:ObjectCreated:*` event type is a wildcard that covers all object creation APIs, including `s3:ObjectCreated:Put`, `s3:ObjectCreated:Post`, `s3:ObjectCreated:Copy`, and `s3:ObjectCreated:CompleteMultipartUpload`. Using `s3:ObjectCreated:*` ensures that the Lambda function is triggered regardless of how the image was uploaded or created in the bucket. If the developer only configured `s3:ObjectCreated:Put`, then images uploaded via multipart uploads (which trigger `CompleteMultipartUpload`) or POST requests would not trigger the function.

Answer

Use s3:ObjectCreated:Post

Answer

Use s3:ObjectCreated:Put

Answer

Use s3:ObjectCreated:Copy

Question 8

A developer needs to store application configuration that can be accessed by multiple microservices running on Amazon ECS. The configuration must be encrypted at rest and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) and features built-in, automatic rotation of secrets using AWS Lambda. While AWS Systems Manager Parameter Store can store encrypted configuration data (using SecureString), it does not offer native automatic rotation capabilities; implementing rotation in Parameter Store requires custom integration and code.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation

Answer

Amazon S3

Question 9

A developer needs to access a DynamoDB table from a Lambda function. The Lambda function is in the same AWS account as the DynamoDB table. What is the most secure way to grant the Lambda function access to the DynamoDB table?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and assign it as the Lambda execution role.. The most secure and standard way to grant a Lambda function access to DynamoDB is to create an IAM role with a policy that grants the necessary DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem) and assign that role as the Lambda execution role. This follows the principle of least privilege and avoids hardcoding credentials, as Lambda automatically assumes this role and manages temporary security credentials. While DynamoDB supports resource-based policies, the Lambda execution role (identity-based policy) remains the standard and recommended approach for granting a Lambda function access to resources within the same account.

Answer

Use the AWS account root user credentials.

Answer

Store the AWS access key and secret access key in the Lambda environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function.

Question 10

A developer is building a REST API using Amazon API Gateway and AWS Lambda. The API must support CORS to allow requests from a web application hosted on a different domain. The developer has enabled CORS on the API Gateway resource and configured the Lambda function to return the appropriate headers. However, the web application is still receiving CORS errors. What is the most likely cause?

Accepted Answer

The API Gateway stage is not redeployed after enabling CORS.. When you enable CORS in the API Gateway console, it creates or updates the OPTIONS method for the resource. However, these configuration changes do not take effect until the API is redeployed to a stage. If the developer does not redeploy the API, the preflight OPTIONS request will fail (typically returning a 403 or 404), which the browser interprets as a CORS error. Since the developer already configured the Lambda function to return the headers, the missing step is redeploying the API stage.

Answer

The API Gateway CORS configuration is incorrect; the allowed origin should be set to '*'.

Answer

The web application is not sending the preflight OPTIONS request.

Answer

The Lambda function is not returning the CORS headers in the response.

Question 11

A developer is designing a serverless application using AWS Lambda and Amazon S3. The application must process files immediately after they are uploaded to an S3 bucket. Which TWO services can be used to trigger the Lambda function?

Accepted Answer

Amazon SQS. Amazon S3 event notifications can publish events directly to three destinations: Amazon Simple Notification Service (SNS) topics, Amazon Simple Queue Service (SQS) queues, and AWS Lambda functions. By sending the event to SNS or SQS first, the developer can decouple the S3 upload from the Lambda execution, allowing for fan-out patterns (via SNS) or message queuing and throttling (via SQS) before triggering the Lambda function. Amazon Kinesis, DynamoDB, and Cognito are not supported as direct destinations for S3 event notifications.

Answer

Amazon Kinesis Data Streams

Answer

Amazon CloudWatch Events

Answer

AWS Lambda S3 event notifications

Question 12

A developer is configuring an Amazon API Gateway REST API with a Lambda function as the backend. The Lambda function returns a JSON response. The developer wants to enable caching to reduce the number of calls to the Lambda function. Which TWO steps are required to enable caching for a specific stage?

Accepted Answer

Configure cache key parameters in the method request.. To enable caching for a specific stage in Amazon API Gateway, you must enable API caching in the stage settings (Option B) and choose a cache capacity (Option A). Choosing a cache capacity is required because API Gateway provisions a dedicated cache cluster of the specified size, which is a billable resource. Configuring cache key parameters (such as query strings or headers) is optional and only necessary if you need to vary the cached responses based on those parameters.

Answer

Attach a custom domain name to the API.

Answer

Create an API key and usage plan.

Answer

Deploy the API to an edge-optimized endpoint.

Question 13

A developer is building a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO AWS services can be used for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows you to define custom names for your application resources and maintain the updated location of these dynamically changing resources. For Amazon ECS with Fargate, you can register each service instance with Cloud Map, and other services can then discover them via DNS queries or API calls, enabling seamless inter-service communication in a microservices architecture.

Answer

Amazon ECR

Answer

Elastic Load Balancing

Answer

AWS Systems Manager Parameter Store

Question 14

A developer is troubleshooting a Lambda function that is failing with a 'Task timed out' error. The function is configured with a 3-second timeout. The function makes an HTTP request to an external API that sometimes takes more than 3 seconds to respond. Which THREE actions should the developer take to resolve this issue?

Accepted Answer

Use an asynchronous invocation pattern with a queue to decouple the HTTP request.. To resolve the 'Task timed out' error caused by a slow external API, the developer should take the following actions:

1. **Increase the Lambda function timeout (Option C)**: Since the external API sometimes takes more than 3 seconds, increasing the timeout to 10 seconds ensures the Lambda function has enough time to receive the response without being prematurely terminated.
2. **Use an asynchronous invocation pattern with a queue (Option A)**: Decoupling the invocation using a queue (like Amazon SQS) prevents the calling application from blocking while waiting for the slow API response. The Lambda function can process messages asynchronously.
3. **Implement retry logic with exponential backoff (Option E)**: When dealing with external APIs, transient network issues or rate limiting can occur. Implementing retries with exponential backoff in the code ensures that the function can gracefully recover from temporary API failures.

Option B is incorrect because placing a Lambda function in a VPC does not improve network latency to external APIs; in fact, it requires a NAT Gateway to access the public internet, which can add complexity and potential latency.
Option D is incorrect because reducing the batch size is relevant for event source mappings (like Kinesis or DynamoDB Streams) to prevent timeouts when processing large batches, but it does not address the latency of a single external HTTP request.
Option F is incorrect because increasing the memory allocated to the Lambda function increases CPU and network bandwidth for the Lambda itself, but it cannot speed up the response time of an external, third-party API.

Answer

Place the Lambda function in a VPC to improve network latency.

Answer

Reduce the batch size in the event source mapping.

Question 15

A company runs a critical application on AWS Lambda that processes real-time financial transactions. The Lambda function is triggered by an SQS queue that receives messages from an API Gateway. Recently, the team has observed an increase in processing errors and occasional data loss. Upon investigation, they find that the Lambda function's concurrency limit is set to 5, and the SQS queue has a visibility timeout of 30 seconds. The function typically takes 2 seconds to process a message, but during peak hours, the queue depth grows to thousands of messages. The errors occur when the Lambda function throws an exception, causing the message to return to the queue after the visibility timeout expires. However, some messages are never processed again and are eventually lost. The team suspects that the messages are being sent to the dead-letter queue (DLQ) after multiple retries, but the DLQ is not configured. The team needs to ensure that no messages are lost and that processing errors are handled appropriately. What should the team do to resolve this issue?

Accepted Answer

Configure a dead-letter queue on the SQS source queue and set the maximum receives to 3. Implement error handling in the Lambda function to catch exceptions and log them.. Configuring a dead-letter queue on the SQS source queue ensures that messages that cannot be processed after the maximum receives are moved to the DLQ for later analysis and reprocessing, preventing data loss. The maximum receives should be set to a small number (e.g., 3) to avoid excessive retries. Additionally, implementing error handling in the Lambda function to catch exceptions and log them helps identify and fix processing issues. Option A is incorrect because increasing concurrency and visibility timeout does not prevent message loss after retries are exhausted without a DLQ. Option B is incorrect because CloudWatch alarms and on-failure destinations are for asynchronous Lambda invocations, not for SQS-triggered Lambda which uses event source mapping. Option C is incorrect because changing to synchronous invocation does not address the retry and loss problem and may cause API Gateway timeouts.

Answer

Increase the Lambda concurrency limit to 100 and set the SQS visibility timeout to 60 seconds.

Answer

Configure an Amazon CloudWatch alarm on the queue depth and set a Lambda function as the on-failure destination for asynchronous invocations.

Answer

Change the Lambda invocation mode to synchronous and use API Gateway as a proxy to invoke the function directly.