DVA-C02 Development with AWS Services Practice Test 18 — 15 Questions

Question 1

A developer is deploying a Node.js application on AWS Lambda. The function uses the 'axios' library to call an external API. After deployment, the function times out after 3 seconds. The external API response time is normally under 500 ms. What should the developer do to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the Lambda function from the VPC.. When a Lambda function is configured to run inside a VPC, it loses its default internet access. If the function needs to call an external API, the connection will hang and eventually time out. Increasing the timeout (Option A) will not resolve this, as the network path is blocked. To resolve this, the developer should either configure a NAT Gateway in the VPC or, if VPC resources are not required, remove the Lambda function from the VPC (Option C) to restore default internet access.

Answer

Increase the Lambda function timeout to 10 seconds.

Answer

Increase the Lambda function reserved concurrency.

Answer

Increase the Lambda function memory to 1024 MB.

Question 2

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 3

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

Accepted Answer

The Error document field in the static website hosting configuration is not set to error.html.. When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Answer

The bucket policy denies access to the error.html object.

Answer

The index.html is missing from the bucket.

Answer

The error.html object has incorrect permissions.

Question 4

A developer needs to deploy a containerized application on AWS. The application requires persistent storage for stateful data. Which AWS compute service should the developer choose?

Accepted Answer

Amazon ECS with Fargate. Amazon ECS with Fargate is the best choice for deploying a containerized application with persistent storage. Fargate supports persistent storage by integrating with Amazon EFS. While Amazon EKS with Fargate also supports persistent storage, ECS with Fargate offers simpler management and is often preferred for stateful containers. AWS Elastic Beanstalk can run containers but is more opinionated and less flexible for stateful configurations. AWS Lambda is stateless and ephemeral, not suitable for persistent storage.

Answer

AWS Elastic Beanstalk

Answer

Amazon EKS with Fargate

Answer

AWS Lambda

Question 5

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications are the correct trigger because they natively support event-driven architectures where S3 object creation events (e.g., s3:ObjectCreated:Put) can directly invoke a Lambda function. This enables asynchronous processing of uploaded images without any intermediate polling or custom integration, ensuring fault tolerance through Lambda's built-in retry mechanism and dead-letter queue (DLQ) support.

Answer

Amazon SQS

Answer

Amazon API Gateway

Answer

AWS Step Functions

Question 6

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Accepted Answer

Scan and sort results client-side, then take first 10. Scanning all items and sorting them client-side by score descending gives the global top 10, regardless of partition keys. Option E is correct if the table is designed with a single partition key (e.g., a constant value like 'Leaderboard'), because a Query with ScanIndexForward=false and Limit=10 then retrieves the top 10 items from that partition efficiently. Options A, C, and D are incorrect because they cannot return the top 10 items sorted globally.

Answer

TransactGetItems

Answer

BatchGetItem

Answer

GetItem

Question 7

A developer is deploying a web application using AWS Elastic Beanstalk. The application needs to store session state. Which THREE services can be used for session state storage? (Choose THREE.)

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis (A) is correct because it is an in-memory data store that supports fast key-value session data with sub-millisecond latency and optional persistence, making it a standard choice for shared session state in Elastic Beanstalk applications. Amazon DynamoDB (B) is correct because it is a fully managed, highly available key-value NoSQL database that can store session tokens and attributes with consistent low-latency reads/writes at scale. Amazon RDS (E) is correct because a relational database such as MySQL, PostgreSQL, or SQL Server can persist session state in a table, and Elastic Beanstalk applications commonly use RDS for shared session storage. Amazon S3 (C) is not appropriate because it is object storage with eventual consistency characteristics and higher latency, not designed for frequent small session reads/writes. Amazon CloudFront (D) is a content delivery network that caches HTTP content at edge locations and does not provide writable session state storage.

Answer

Amazon S3

Answer

Amazon CloudFront

Question 8

A developer is using Amazon S3 to store sensitive data. The compliance team requires that all objects be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). Which THREE steps must the developer take to enforce this requirement? (Choose THREE.)

Accepted Answer

Create an AWS KMS customer-managed key.. SSE-KMS requires a customer-managed AWS KMS key to encrypt objects at rest. By creating a customer-managed key, the developer gains control over key rotation, access policies, and audit trails, which satisfies the compliance team's requirement for server-side encryption with a customer-managed key.

Answer

Configure the bucket ACL to require encryption.

Answer

Enable S3 default encryption with SSE-S3.

Question 9

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. The correct answer. The best practice for granting an AWS Lambda function access to an S3 bucket in the same account is to create an IAM execution role with a policy that allows the necessary S3 actions, and then attach that role to the Lambda function. This provides temporary credentials via STS, follows the principle of least privilege, and avoids hardcoding credentials.

Option B is incorrect because storing AWS credentials in environment variables is insecure and can lead to accidental exposure. AWS recommends using IAM roles for temporary credentials.

Option C is incorrect because Lambda functions do not support attaching IAM policies directly. Policies must be attached to an IAM role, and that role is assigned to the function.

Option D is incorrect because while a bucket policy could grant access based on the function's ARN, it is not the best approach for same-account access. Using an execution role is more scalable, easier to manage, and follows the principle of least privilege.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 10

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

Accepted Answer

S3 is not a suitable store for session state due to its higher latency compared to in-memory stores like ElastiCache or DynamoDB.. Amazon S3 now provides strong read-after-write consistency, so eventual consistency is not the cause. However, S3's higher latency compared to in-memory stores like ElastiCache or DynamoDB makes it unsuitable for session management, which requires fast, frequent reads and writes. The higher latency can cause delays in session retrieval, leading to timeouts and the login page being displayed again.

Answer

The EC2 instances do not have internet access to reach S3.

Answer

The ALB does not have sticky sessions enabled.

Answer

The application is not scaling properly, causing session loss.

Question 11

A company is using Amazon API Gateway to expose a set of RESTful APIs. Each API call is processed by an AWS Lambda function. The company wants to enforce throttling limits to prevent abuse. Specifically, the company wants to allow 100 requests per second per API key. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a usage plan in API Gateway with a rate limit of 100 requests per second per API key.. API Gateway usage plans are specifically designed to enforce throttling limits per API key. By creating a usage plan with a rate limit of 100 requests per second and associating it with the desired API keys, you can directly control request rates at the API Gateway layer without additional services or custom logic. This is the simplest and most native approach for per-API-key throttling.

Answer

Use AWS WAF to block requests after 100 per second.

Answer

Set a reserved concurrency on the Lambda function to 100.

Answer

Configure a CloudWatch alarm to disable the API key after exceeding the limit.

Question 12

A company is developing a microservices architecture using Amazon ECS with Fargate launch type. Each microservice needs to store sensitive configuration data such as database passwords. The company wants to avoid storing secrets in the application code or environment variables. What is the MOST secure and recommended approach?

Accepted Answer

Use AWS Systems Manager Parameter Store or AWS Secrets Manager to store and retrieve secrets.. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are purpose-built services for storing and retrieving secrets securely, with encryption at rest via KMS, fine-grained IAM access control, and native integration with ECS/Fargate task definitions. Secrets Manager additionally supports automatic rotation. This is the AWS-recommended approach for injecting secrets into containerized workloads without hardcoding them.

Answer

Pass secrets as environment variables in the task definition.

Answer

Store secrets in an encrypted S3 bucket and have the application download them at startup.

Answer

Use an AWS Lambda function to generate secrets and store them in DynamoDB.

Question 13

A company is using AWS CloudFormation to deploy infrastructure. The developer wants to update a stack and needs to know what changes will be made before executing the update. Which AWS CLI command should the developer use?

Accepted Answer

aws cloudformation create-change-set. The `aws cloudformation create-change-set` command creates a change set, which is a summary of proposed changes to a CloudFormation stack. This allows the developer to review what resources will be added, modified, or deleted before executing the update, without making any actual changes. The change set can then be executed with `aws cloudformation execute-change-set` to apply the changes.

Answer

aws cloudformation deploy

Answer

aws cloudformation validate-template

Answer

aws cloudformation update-stack

Question 14

A developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to communicate with a DynamoDB table. The developer creates a VPC with private subnets and configures the ECS service to use those subnets. However, the tasks cannot reach DynamoDB. What is the MOST likely cause?

Accepted Answer

The VPC does not have a VPC endpoint for DynamoDB, and there is no NAT gateway.. ECS tasks using the Fargate launch type in private subnets cannot reach public AWS services like DynamoDB unless the VPC has either a NAT gateway (to route traffic through an internet gateway) or a VPC endpoint for DynamoDB. Without one of these, the private subnets have no route to the DynamoDB API endpoints, causing connectivity failures. The IAM role and security group are configured correctly, but the network path is missing.

Answer

The task IAM role does not have permissions to access DynamoDB.

Answer

The security group of the tasks does not allow outbound traffic to DynamoDB.

Answer

The task definition does not have a network mode that supports DynamoDB.

Question 15

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available for deployment, or some instances in your deployment group are experiencing problems.' The developer wants to identify the specific error on a failed instance. Which AWS CLI command should the developer use?

Accepted Answer

aws deploy get-deployment-instance. The `aws deploy get-deployment-instance` command retrieves detailed information about a single instance in a deployment group, including the specific error messages and lifecycle event logs that caused the instance to fail. This allows the developer to diagnose the root cause of the failure on a particular instance, which is exactly what is needed when the overall deployment fails with a generic error message.

Answer

aws deploy get-deployment

Answer

aws deploy list-deployments

Answer

aws deploy list-deployment-instances