DVA-C02 Development with AWS Services Practice Test 16 — 15 Questions

Question 1

A developer is implementing a REST API using Amazon API Gateway and AWS Lambda. The API should return a static response from an Amazon S3 bucket for a specific GET endpoint without invoking a Lambda function. Which API Gateway integration type should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS. To integrate API Gateway directly with an AWS service like Amazon S3, you use the 'AWS' integration type. This allows API Gateway to securely call the S3 GetObject API using an IAM execution role, enabling access to private S3 buckets without invoking a Lambda function. While 'HTTP_PROXY' can technically forward requests to a public S3 static website endpoint, it is not the standard AWS service integration and does not support secure access to private buckets via IAM.

Answer

MOCK

Answer

HTTP_PROXY

Answer

AWS_PROXY

Question 2

A developer is designing a workflow using AWS Step Functions that includes a task to invoke an AWS Lambda function. The Lambda function sometimes times out due to long-running operations. The developer needs the workflow to wait for the Lambda function to complete asynchronously and retry on failure. Which Step Functions pattern should the developer use?

Accepted Answer

Use a Task state with .waitForTaskToken and have the Lambda function return the token upon completion.. In AWS Step Functions, you can handle transient failures and timeouts in a Task state by using a `Retry` block. By catching `States.Timeout` (which occurs when the task runs longer than the specified `TimeoutSeconds`) or specific Lambda service errors (like `Lambda.SdkClientException`), Step Functions can automatically retry the task according to the defined backoff rate and maximum attempts.

Answer

Use a Task state that directly invokes the Lambda function synchronously.

Answer

Use a Parallel state to run multiple Lambda functions concurrently.

Answer

Use a Choice state to branch based on the Lambda function's output.

Question 3

A developer is creating an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message only once. Which SQS queue type should the developer use?

Accepted Answer

FIFO queue. Amazon SQS FIFO (First-In-First-Out) queues guarantee exactly-once processing within a message group. They use a deduplication ID (either content-based or explicitly provided) to prevent duplicate message delivery, ensuring that each message is processed only once by the consumer.

Answer

Amazon SQS does not support exactly-once processing.

Answer

Dead-letter queue

Answer

Standard queue

Question 4

A developer is using AWS Lambda with an Amazon DynamoDB trigger. The Lambda function processes items from a DynamoDB Stream. The developer needs to ensure that the function processes each change exactly once and in order. Which TWO configurations should the developer use?

Accepted Answer

Set a reserved concurrency for the Lambda function to limit concurrent executions.. Setting a reserved concurrency for the Lambda function limits the number of concurrent executions, which prevents multiple shards from being processed simultaneously. This ensures that DynamoDB Stream records are processed in order within each shard, as the stream preserves order per shard but not across shards. Option D is correct because setting the batch size to 1 forces the Lambda function to process only one record per invocation, guaranteeing that each change is processed exactly once and in sequence without batching multiple records that could introduce ordering issues.

Answer

Use a FIFO queue as an event source instead of DynamoDB Streams.

Answer

Increase the Lambda function's concurrency limit.

Answer

Enable the batch window in the event source mapping.

Question 5

Refer to the exhibit. An IAM policy is attached to a Lambda function's execution role. The Lambda function is triggered by an S3 event and needs to invoke another Lambda function and decrypt an S3 object encrypted with a customer-managed KMS key. However, the invocation fails with an access denied error. What is the MOST likely cause?

Accepted Answer

The policy is missing kms:GenerateDataKey and kms:Decrypt might not be sufficient for all decryption scenarios.. First, there is no exhibit provided in the prompt. Second, the explanation states that `kms:GenerateDataKey` is required to decrypt an S3 object; this is technically incorrect. To decrypt an S3 object encrypted with SSE-KMS, the IAM identity only requires `kms:Decrypt` (along with `s3:GetObject`). `kms:GenerateDataKey` is only required when uploading (encrypting) an object. Third, if the 'invocation fails with an access denied error' when trying to invoke another Lambda function, the root cause would be a missing `lambda:InvokeFunction` permission, not a KMS permission.

Answer

The policy does not allow s3:GetObject on the S3 bucket.

Answer

The policy resource for Lambda is incorrect.

Answer

The policy does not allow kms:Decrypt for the key.

Question 6

Refer to the exhibit. A developer creates a CloudFormation stack with this template. The developer wants to ensure that all objects uploaded to the bucket are encrypted at rest using SSE-KMS. However, the current policy allows anyone to put objects without encryption. What additional change is needed to enforce SSE-KMS?

Accepted Answer

Add a bucket policy that denies PutObject if encryption is not set.. First, the exhibit (CloudFormation template/policy) is completely missing from the prompt, making the question impossible to evaluate. Second, setting the bucket's default encryption to SSE-KMS (Option A) does not strictly 'enforce' SSE-KMS because clients can still explicitly send headers for SSE-S3 (AES256), which overrides the bucket's default setting. To truly enforce SSE-KMS and prevent unencrypted or SSE-S3 uploads, an explicit bucket policy denying `s3:PutObject` when `s3:x-amz-server-side-encryption` is not `aws:kms` (Option B) is required.

Answer

Set the bucket's default encryption configuration to SSE-KMS.

Answer

Modify the condition to use s3:x-amz-server-side-encryption-aws-kms-key-id.

Answer

Remove the condition to allow all PutObject requests.

Question 7

A company runs a production web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic across multiple EC2 instances in an Auto Scaling group. The application uses an Amazon Aurora MySQL database. The operations team reports that the application is experiencing intermittent latency spikes, especially during peak hours. Investigation reveals that the database CPU utilization is consistently above 80% and there are many slow queries. The developer is asked to improve database performance without changing the application code. Which solution should the developer implement?

Accepted Answer

Upgrade the Aurora instance to a larger instance type.. Upgrading the Aurora instance to a larger instance type (vertical scaling) increases the CPU and memory resources available to the database. This directly addresses high CPU utilization and improves the performance of slow queries (e.g., by providing more processing power and larger buffer pools for caching data in memory) without requiring any changes to the application code or connection endpoints. Option A (RDS Proxy) is incorrect because it is used to manage connection pooling (typically for highly transient connections like AWS Lambda) and does not resolve CPU bottlenecks caused by slow queries. Option B is incorrect because implementing Amazon ElastiCache requires modifying the application code to introduce caching logic. Option C is incorrect because scaling out the EC2 instances will increase the load and connection count on the database, worsening the CPU bottleneck.

Answer

Implement an Amazon RDS Proxy in front of the Aurora cluster to manage database connections efficiently.

Answer

Use Amazon ElastiCache to cache frequently accessed data.

Answer

Increase the desired capacity of the Auto Scaling group to add more EC2 instances.

Question 8

A company uses AWS Lambda to process user-uploaded images stored in an S3 bucket. Recently, the Lambda function started timing out, and CloudWatch Logs show 'Error: Unable to locate credentials' in the function logs. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have the necessary IAM policy to access the S3 bucket.. The most likely cause is that the Lambda execution role lacks the necessary IAM policy to access the S3 bucket. Lambda functions assume an execution role that provides temporary credentials via AWS STS. If the role does not have permissions for the S3 bucket, the AWS SDK will fail to obtain credentials for the operation, resulting in the 'Unable to locate credentials' error. Option A is incorrect because Lambda does not use environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY; it uses temporary credentials. Option B is incorrect because the runtime supports the AWS SDK; the error is about credentials, not runtime compatibility. Option D is incorrect because manually setting credentials in code would not cause this error; in fact, it might override the temporary credentials but not lead to a credential location error.

Answer

The function's environment variables AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are missing.

Answer

The Lambda function is configured with a different runtime that does not support the AWS SDK.

Answer

The function's code is explicitly setting AWS credentials using the AWS SDK.

Question 9

A developer is building a REST API using API Gateway and AWS Lambda. The API must support long-running operations that can take up to 30 minutes. The current implementation uses synchronous Lambda invocation, causing API Gateway to timeout after 29 seconds. What solution should the developer implement?

Accepted Answer

Use an SQS queue to decouple the request and have the client poll for results.. API Gateway has a hard 29-second timeout for integration requests, which cannot be increased. Since the operations can take up to 10 minutes, a synchronous call will always fail due to the API Gateway timeout. By using an SQS queue to decouple the request, API Gateway can quickly accept the request, write it to SQS, and return a 202 Accepted response to the client. A Lambda function can then process the message from the SQS queue asynchronously (which is well within Lambda's 15-minute execution limit), while the client polls a status endpoint for the results.

Answer

Increase the Lambda function timeout to 30 minutes.

Answer

Use Lambda function URL directly and bypass API Gateway.

Answer

Change the API Gateway integration to HTTP_PROXY type.

Question 10

Which TWO actions should a developer take to securely store secrets (e.g., database passwords) used by a Lambda function?

Accepted Answer

Use AWS Secrets Manager to store and retrieve the secret at runtime.. To securely store and retrieve secrets such as database passwords in AWS, developers should use either AWS Secrets Manager or AWS Systems Manager Parameter Store with a SecureString parameter.

- **AWS Secrets Manager (Option A)** is specifically designed for secrets management, offering features like automatic rotation, fine-grained access control, and seamless integration with other AWS services.
- **AWS Systems Manager Parameter Store with SecureString (Option C)** provides secure, hierarchical storage for configuration data and secrets management. A SecureString parameter is any sensitive data that needs to be stored and referenced in a secure manner, encrypted using an AWS KMS key.

Both services encrypt the secrets at rest using AWS KMS and allow secure retrieval at runtime via the AWS SDK, ensuring that sensitive credentials are not exposed in code or environment variables.

Answer

Upload the secret to an S3 bucket and read it from the Lambda function.

Answer

Store the secret as an environment variable in the Lambda function.

Answer

Hardcode the secret in the Lambda function code.

Question 11

Which THREE steps are required to enable cross-account access to a DynamoDB table from a Lambda function in another AWS account?

Accepted Answer

Create a resource-based policy on the DynamoDB table that allows access from the Lambda execution role.. To enable cross-account access to a DynamoDB table using resource-based policies (introduced in late 2023), two steps are required: 
1. Attach a resource-based policy to the DynamoDB table in the destination account that grants access to the Lambda execution role in the source account.
2. Attach an identity-based policy to the Lambda execution role in the source account that allows access to the cross-account DynamoDB table.

Assuming a role is an alternative legacy method and is not used in conjunction with DynamoDB resource-based policies.

Answer

Configure the Lambda function to assume an IAM role in the DynamoDB account.

Answer

Add a trust policy to the Lambda execution role allowing the DynamoDB account to access it.

Answer

Add a bucket policy to the DynamoDB table to allow cross-account access.

Question 12

Which TWO AWS services can be used to trigger an AWS Lambda function asynchronously?

Accepted Answer

Amazon EventBridge. Options A and D are correct. Amazon EventBridge can asynchronously invoke Lambda in response to events from various AWS services. Amazon S3 can asynchronously invoke Lambda via bucket notifications for object create events. API Gateway (B) invokes Lambda synchronously by default. CloudWatch Events (C) is a legacy service replaced by EventBridge and is not considered a separate correct answer. Step Functions (E) invokes Lambda synchronously.

Answer

Amazon API Gateway (REST API)

Answer

Amazon CloudWatch Events (scheduled events)

Answer

AWS Step Functions (synchronous)

Question 13

Which THREE statements are true about AWS Lambda concurrency and scaling?

Accepted Answer

Provisioned concurrency can be used to reduce cold start latency.. Options A, B, and C are correct. Provisioned concurrency reduces cold starts by keeping a specified number of execution environments initialized and ready to respond. Lambda automatically scales concurrency in response to the rate of incoming requests, within account and function limits. The burst concurrency limit (500-3000 per region) is the initial pool of concurrency that can be used immediately across all functions. Option D is incorrect: reserved concurrency sets a maximum limit on concurrency for a function, not a guaranteed minimum. Option E is incorrect: Lambda concurrency limits per function can be increased by requesting a service quota increase from AWS Support.

Answer

Reserved concurrency guarantees a minimum number of concurrent executions.

Answer

Lambda's concurrency limit is per function and cannot be increased.

Question 14

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway REST API and several Lambda functions. The developer wants to enable X-Ray tracing to debug performance issues. What is the MINIMUM set of actions required to enable X-Ray tracing for the entire application?

Accepted Answer

Add Tracing: Active to the Globals section of the SAM template and attach the AWSXRayDaemonWriteAccess managed policy to the Lambda execution role.. In AWS SAM, you can enable X-Ray tracing globally for all Lambda functions by adding 'Tracing: Active' under the Globals section of the SAM template. When this property is set, AWS SAM automatically attaches the 'AWSXrayWriteOnlyAccess' managed policy to the auto-generated Lambda execution roles. Therefore, manually attaching an X-Ray policy is redundant and not part of the minimum set of actions. Option A is incorrect because enabling tracing individually is not the minimum configuration. Option B is incorrect because enabling tracing on API Gateway alone does not enable active tracing on Lambda. Option C is incorrect because Lambda runs its own X-Ray daemon; you do not package it as a sidecar container.

Answer

Enable X-Ray tracing on each Lambda function individually and deploy the X-Ray daemon as a Lambda layer.

Answer

Enable X-Ray tracing only on the API Gateway stage and configure the Lambda functions to forward traces.

Answer

Deploy the X-Ray daemon as a sidecar container on each Lambda function.

Question 15

A developer is working on an application that uses Amazon SQS as a message queue. The application polls the queue using long polling with a wait time of 20 seconds. Recently, the team noticed that messages are being processed multiple times. The application is idempotent, but duplicate processing is causing unnecessary costs. What should the developer do to reduce duplicate message processing?

Accepted Answer

Use a DynamoDB table to track processed message IDs and ignore duplicates.. Using a DynamoDB table to track processed message IDs allows the application to check if a message has already been processed before processing it. Since SQS standard queues provide at-least-once delivery, duplicates can occur. By storing message IDs in DynamoDB with a TTL, the application can skip processing duplicates, thereby reducing costs. Option B is incorrect because while FIFO queues guarantee exactly-once processing, they have lower throughput and are not necessary if the application can handle duplicates via idempotency and deduplication logic. Option C is incorrect because increasing the visibility timeout reduces the chance of duplicates but does not eliminate them; if processing fails after the timeout, the message becomes visible again and can be processed again, leading to duplicates.

Answer

Switch to a FIFO queue to enable exactly-once processing.

Answer

Increase the visibility timeout to a value greater than the maximum processing time.