DVA-C02 Development with AWS Services Practice Test 17 — 15 Questions

Question 1

The exhibit shows an IAM policy attached to a user. The user reports being unable to upload files to S3 bucket 'my-bucket'. What is the MOST likely cause?

Accepted Answer

The bucket policy denies the upload. The user has an IAM policy that grants s3:PutObject on 'my-bucket', but the bucket policy explicitly denies s3:PutObject for that user. Since an explicit deny in a resource-based policy overrides any allow in an identity-based policy, the upload fails. AWS IAM evaluates all policies, and a single explicit deny results in a final decision of deny.

Answer

The user needs s3:PutObjectAcl permission

Answer

The policy does not allow s3:ListBucket

Answer

The user does not have s3:GetObject permission

Question 2

A developer is running a Lambda function that uses the 'requests' library. The error shown in the exhibit occurs when invoking the function. Which step should the developer take to fix this?

Accepted Answer

Package the 'requests' library with the Lambda deployment package. The 'requests' library is not included in the AWS Lambda Python runtime by default. To use it, the developer must package the library as a dependency layer or include it in the deployment package. Option B correctly identifies this approach, ensuring the library is available at runtime.

Answer

Change the Lambda runtime to Python 3.9 which includes requests

Answer

Use the 'urllib' library instead of 'requests'

Answer

Install the 'requests' library using pip in the Lambda console

Question 3

A developer runs the following AWS CLI query against a DynamoDB table named 'Orders' and receives a ValidationException:

```
aws dynamodb query \
    --table-name Orders \
    --key-condition-expression "OrderID = :orderID" \
    --expression-attribute-values '{":orderID":{"S":"12345"}}'
```

What is the MOST likely cause?

Accepted Answer

The table's partition key is not named 'OrderID'. DynamoDB's Query operation requires that the KeyConditionExpression reference the table's actual partition key name exactly. If the Orders table's partition key is not named 'OrderID', the query fails with a ValidationException. The expression attribute values are formatted correctly, and a sort key is not required to query by partition key alone.

Answer

The expression attribute values are incorrectly formatted

Answer

The table does not exist

Answer

The query needs to use a sort key

Question 4

A developer is building a serverless application using AWS Lambda functions that process events from Amazon SQS. The developer notices that some messages are being processed multiple times. What is the MOST likely cause of this issue?

Accepted Answer

The SQS visibility timeout is too short for the Lambda function's execution time.. When an SQS message is processed by a Lambda function, the message becomes invisible to other consumers for the duration of the visibility timeout. If the Lambda function takes longer to process the message than the visibility timeout, SQS makes the message visible again and can deliver it to another consumer (or the same Lambda function in a new invocation), causing duplicate processing. This is the most likely cause of messages being processed multiple times.

Answer

The Lambda function's reserved concurrency is set too high.

Answer

The SQS queue has a dead-letter queue configured.

Answer

The Lambda function's batch size is set to more than 1.

Question 5

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?

Accepted Answer

Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.. The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.

Answer

Configure the ALB target group to authenticate using the OIDC identity provider.

Answer

Use AWS Lambda@Edge to authenticate users at the edge.

Answer

Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.

Question 6

A developer is writing an AWS Lambda function in Python that needs to download a file from Amazon S3, process it, and upload the result to a different S3 bucket. The function currently runs within the default 3-second timeout, but the developer expects the file size to increase. What is the MOST cost-effective way to handle the increase in processing time?

Accepted Answer

Increase the Lambda function's timeout to a value higher than the expected processing time.. Increasing the Lambda function's timeout is the most cost-effective solution because it directly addresses the expected increase in processing time without incurring additional costs. Lambda pricing is based on the number of invocations and duration (in GB-seconds), so extending the timeout only charges for the actual time the function runs, not for idle time or additional services. This approach avoids the complexity and cost of Step Functions or provisioned concurrency, which would add unnecessary overhead for a simple sequential task.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use Lambda provisioned concurrency to keep the function warm.

Answer

Refactor the code to use AWS Step Functions to orchestrate the processing.

Question 7

A developer is deploying an application using AWS Elastic Beanstalk. The application reads and writes data to an Amazon RDS database. The developer wants to ensure that database credentials are not stored in the application code or configuration files. What should the developer do?

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them in the application code.. AWS Secrets Manager is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) needed to access applications, services, and IT resources. It enables you to easily rotate, manage, and retrieve database credentials throughout their lifecycle. Storing credentials in Elastic Beanstalk environment properties (Option A) is a security risk because they are stored in plaintext within the environment configuration, can be exposed via the AWS Console/API to users with Beanstalk permissions, and do not support automatic rotation.

Answer

Store the credentials as environment properties in the Elastic Beanstalk environment configuration.

Answer

Encrypt the credentials and store them in an Amazon S3 bucket. Have the application download them at startup.

Answer

Store the credentials in a separate configuration file and include it in the application source bundle.

Question 8

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to connected clients. The developer notices that the 'connectionId' changes every time a client reconnects. How should the developer store the mapping between user identity and connectionId?

Accepted Answer

Use Amazon DynamoDB to store the mapping, with user identity as the partition key and connectionId as an attribute.. Amazon DynamoDB is the recommended, fully managed, serverless key-value store for persisting WebSocket connection IDs in AWS. It offers single-digit millisecond latency, scales automatically, and integrates seamlessly with AWS Lambda without requiring VPC configuration (unlike Amazon ElastiCache, which typically requires a VPC, adding setup complexity and potential latency for Lambda functions).

Answer

Use Amazon ElastiCache to store the mapping in memory.

Answer

Use Amazon RDS to store the mapping in a relational database.

Answer

Use Amazon S3 to store the mapping as a JSON file.

Question 9

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 10

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. API Gateway's built-in request validation allows you to define a JSON Schema model that automatically validates request parameters, headers, and payload before the request reaches the backend Lambda function. This offloads validation from the Lambda function, reducing compute time and cost, and provides immediate 400 error responses without invoking the backend. It is the most efficient approach because it minimizes latency and Lambda invocations for invalid requests.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.

Question 11

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

Accepted Answer

Use the multipart upload API.. Objects larger than 100 MB should be uploaded using the multipart upload API to improve throughput and provide resilience against network failures. The multipart upload API allows the 200 MB object to be split into parts, uploaded in parallel, and then assembled, which is more efficient and reliable than a single PutObject operation for objects over 5 GB or for large objects in general.

Answer

Enable S3 Transfer Acceleration and use the PutObject API.

Answer

Use the PutObject API operation.

Answer

Use a pre-signed URL and upload using HTTP PUT.

Question 12

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.

Question 13

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function is configured to access a VPC without a NAT gateway.. Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts. Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Answer

The function's reserved concurrency is set to 0.

Answer

The function has a dead-letter queue configured.

Question 14

A developer is building a serverless application using AWS Lambda. The function needs to access a DynamoDB table and write logs to Amazon CloudWatch. What is the minimum set of IAM permissions the Lambda execution role must have?

Accepted Answer

dynamodb:PutItem, logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents. The Lambda execution role must include `dynamodb:PutItem` to write to the DynamoDB table, and the three `logs:` permissions (`CreateLogGroup`, `CreateLogStream`, `PutLogEvents`) are required for Lambda to create log groups/streams and send log events to CloudWatch Logs. This is the minimum set that satisfies both requirements without granting unnecessary privileges.

Answer

logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents

Answer

dynamodb:*, logs:PutLogEvents

Answer

dynamodb:GetItem, dynamodb:PutItem, logs:PutLogEvents

Question 15

A company runs a microservices architecture on Amazon ECS with Fargate. The application experiences intermittent high latency. The operations team wants to trace requests across services and identify bottlenecks. Which AWS service should be used?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, capturing latency at each hop. It generates a service map that visualizes the flow and pinpoints bottlenecks, which is exactly what the operations team needs for a distributed application on ECS Fargate.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Metrics