DVA-C02 Development with AWS Services Practice Test 18 — 15 Questions

Question 1

A developer is troubleshooting an issue where an IAM user is unable to upload a file to an S3 bucket that uses server-side encryption with AWS KMS (SSE-KMS). The IAM policy shown in the exhibit is attached to the user. What is the likely cause of the failure?

Accepted Answer

The user does not have kms:Encrypt permission on the KMS key.. The correct answer is B. The policy allows s3:PutObject but does not include kms:Encrypt, which is required for uploading objects with SSE-KMS. Option A is wrong because the policy allows s3:PutObject. Option C is wrong because the KMS key is specified. Option D is wrong because the user may not have KMS permissions, but the missing action is kms:Encrypt.

Answer

The KMS key ARN in the resource statement is incorrect.

Answer

The user does not have s3:PutObject permission on the bucket.

Answer

The user does not have access to the KMS key at all.

Question 2

A developer is investigating why an AWS Lambda function is not writing logs to CloudWatch Logs. The function has been invoked multiple times, but the log group shows 0 stored bytes. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks permissions to write to CloudWatch Logs.. The correct answer is A. The Lambda function's execution role does not have permissions to create log streams and put log events. Option B is wrong because the log group exists. Option C is wrong because the function has been invoked, so it is not failing before logging. Option D is wrong because the log group name is correct.

Answer

The CloudWatch Logs log group does not exist.

Answer

The Lambda function is failing before any logging code is executed.

Answer

The Lambda function is configured to use a different log group name.

Question 3

A developer is setting up an S3 bucket to trigger an AWS Lambda function when a new object is created. After configuring the event notification, the Lambda function is not invoked. The developer checks the Lambda resource-based policy, which is shown in the exhibit. What is the issue?

Accepted Answer

The policy is missing a condition that specifies the S3 bucket ARN.. The correct answer is C. The policy is missing a 'Version' and 'Id' field, but more importantly, S3 requires the source account ID in the policy. However, the policy is valid syntax but lacks the 'Condition' block that includes the bucket name or account ID. Actually, the typical issue is that the policy is missing the 'Service' principal specification. The correct answer is that the Principal should be 's3.amazonaws.com' but the policy is missing the 'SourceAccount' condition. However, the most common mistake is that the policy is missing the 'SourceArn' condition. Given the options, C is correct because the policy must include a condition to restrict which bucket can invoke the function.

Answer

The Action is incorrect; it should be 'lambda:Invoke' instead of 'lambda:InvokeFunction'.

Answer

The principal is incorrect; it should be the S3 bucket ARN.

Answer

The policy is missing the 'Version' field.

Question 4

A company is using AWS Lambda functions to process events from Amazon S3. The functions are writing logs to CloudWatch Logs. Recently, they noticed that some logs are missing and the functions are experiencing throttling errors. What is the MOST likely cause?

Accepted Answer

The Lambda function's reserved concurrency is set to a low value.. Option D is correct because Lambda concurrency limits cause throttling when exceeded. Option A is wrong because CloudWatch Logs doesn't cause throttling. Option B is wrong because S3 event notifications are asynchronous and not source of throttling. Option C is wrong because IAM roles affect permissions, not concurrency.

Answer

The CloudWatch Logs log group retention policy is set too low.

Answer

The Lambda function's IAM role lacks permissions to write to CloudWatch Logs.

Answer

The S3 bucket is sending too many event notifications.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The API has a REST endpoint that triggers a Lambda function to write data to an Amazon DynamoDB table. Under high traffic, some requests are failing with 5xx errors. The developer notices that the Lambda function's duration is spiking. Which combination of actions should the developer take to improve performance and reduce errors?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for the table and set a Lambda reserved concurrency.. Option B is correct because enabling DynamoDB acceleration and Lambda concurrency limits address both performance and throttling. Option A is wrong because increasing memory reduces duration but not concurrency issues. Option C is wrong because DAX is not for API Gateway. Option D is wrong because SQS adds latency for real-time APIs.

Answer

Use an Amazon SQS queue as a buffer between API Gateway and Lambda.

Answer

Increase the Lambda function's memory and enable DynamoDB auto-scaling.

Answer

Switch the API endpoint to HTTP API and enable API Gateway caching.

Question 6

A developer wants to deploy a containerized application on AWS. The application requires persistent storage that can be accessed by multiple containers running on different EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon Elastic File System (EFS). Option B is correct because Amazon EFS provides shared file storage for multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance. Option C is wrong because S3 is object storage. Option D is wrong because DynamoDB is a NoSQL database.

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon DynamoDB

Question 7

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is triggered by the SQS queue. Recently, the function started failing due to timeout errors when processing large messages. The function's timeout is set to the maximum of 15 minutes. What should a developer do to resolve this issue?

Accepted Answer

Split the large messages into smaller messages before sending to SQS.. Option D is correct because splitting large messages into smaller ones reduces processing time. Option A is wrong because increasing visibility timeout doesn't help if function times out. Option B is wrong because batch size reduction may not help per-message timeout. Option C is wrong because SQS message size limit is 256 KB, cannot increase.

Answer

Increase the SQS queue's visibility timeout.

Answer

Increase the maximum message size in the SQS queue.

Answer

Decrease the SQS batch size in the Lambda trigger.

Question 8

A developer is building a real-time chat application using WebSocket APIs in Amazon API Gateway. The backend is an AWS Lambda function that stores connection IDs in an Amazon DynamoDB table. After a few days, the application stops working for new users. The developer checks CloudWatch Logs and sees that the Lambda function is returning 'AccessDeniedException' when calling DynamoDB. What is the MOST likely cause?

Accepted Answer

The DynamoDB table was recreated and the Lambda function's IAM role still references the old table ARN.. Option A is correct because Lambda execution role must be updated when DynamoDB table is recreated. Option B is wrong because Lambda function code updates don't change IAM roles. Option C is wrong because API Gateway permissions affect invocation, not DynamoDB access. Option D is wrong because SDK version mismatch would cause different errors.

Answer

The Lambda function code was updated but the IAM role was not reattached.

Answer

The Lambda function uses an outdated AWS SDK version.

Answer

The API Gateway route was updated without redeploying the API.

Question 9

A developer is creating a CI/CD pipeline for a serverless application using AWS CodePipeline. The application consists of an AWS Lambda function, an Amazon API Gateway REST API, and an Amazon DynamoDB table. Which action should the developer take to automate the deployment of the API Gateway updates?

Accepted Answer

Use AWS CloudFormation to define and deploy the API Gateway.. Option B is correct because AWS CloudFormation can deploy and update API Gateway as part of infrastructure as code. Option A is wrong because Lambda only updates function code. Option C is wrong because CodeBuild builds artifacts, doesn't deploy API Gateway directly. Option D is wrong because S3 doesn't deploy API Gateway.

Answer

Use AWS Lambda to update the API Gateway configuration.

Answer

Store the API Gateway Swagger file in Amazon S3 and trigger a deployment.

Answer

Use AWS CodeBuild to compile and deploy the API Gateway configuration.

Question 10

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

Accepted Answer

The KMS key policy does not grant the IAM user/role permissions to use the key.. Option B is correct because KMS key policies can restrict access to the key. Option A is wrong because S3 bucket policy affects S3 actions, not KMS. Option C is wrong because KMS keys are regional and cross-region access fails. Option D is wrong because object ownership doesn't affect KMS permissions.

Answer

The S3 bucket's object ownership is set to BucketOwnerPreferred.

Answer

The KMS key is in a different AWS Region than the S3 bucket.

Answer

The S3 bucket policy denies PutObject without encryption.

Question 11

A developer is using AWS X-Ray to trace requests through a microservices application. The application consists of several AWS Lambda functions that call each other and Amazon DynamoDB. The developer notices that some traces are incomplete and missing segments for downstream calls. What is the MOST likely cause?

Accepted Answer

The downstream DynamoDB table does not have X-Ray tracing enabled.. Option D is correct because X-Ray tracing must be enabled on downstream resources to record segments. Option A is wrong because sampling rate affects number of traces, not completeness. Option B is wrong because X-Ray SDK is needed on Lambda. Option C is wrong because X-Ray daemon is needed for EC2, but Lambda uses the X-Ray SDK.

Answer

The Lambda functions do not have the X-Ray SDK imported.

Answer

The X-Ray daemon is not running on the Lambda execution environment.

Answer

The X-Ray sampling rate is set too low.

Question 12

A developer is writing a script to programmatically create an Amazon EC2 instance. The script will run on an EC2 instance that already has an IAM role attached. Which AWS SDK method should the developer use to securely obtain temporary credentials for the script?

Accepted Answer

Retrieve the temporary credentials from the instance metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/).. Option C is correct because instance metadata provides temporary credentials from the attached IAM role. Options A and B are wrong because hardcoding keys is insecure. Option D is wrong because AWS Secrets Manager is for secrets, not automatic credential retrieval for EC2.

Answer

Store the access key ID and secret access key in the script.

Answer

Use AWS Secrets Manager to store and retrieve the credentials.

Answer

Use the AWS SDK's default credential provider chain.

Question 13

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Accepted Answer

Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.. Options A and D are correct. Option A ensures at-least-once processing because after the visibility timeout, the message becomes visible again if not deleted. Option D ensures the function deletes the message only after successful processing. Option B is wrong because long polling reduces empty responses but doesn't guarantee processing. Option C is wrong because DLQ is for failed messages. Option E is wrong because FIFO ensures exactly-once, not at-least-once.

Answer

Configure a Dead Letter Queue (DLQ) to capture failed messages.

Answer

Enable long polling on the SQS queue.

Answer

Use a FIFO queue to ensure exactly-once processing.

Question 14

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon ElastiCache for session state. Recently, users are experiencing intermittent session timeouts and slow page loads. The developer suspects the issue is related to the ElastiCache cluster. Which THREE actions should the developer take to troubleshoot and resolve the issue? (Choose THREE.)

Accepted Answer

Monitor the ElastiCache cluster's CPU utilization and cache hit ratio in CloudWatch.. Options B, C, and D are correct. Option B helps identify slow queries and cache hits. Option C helps scale for increased load. Option D helps distribute traffic evenly. Option A is wrong because multi-AZ is for high availability, not performance. Option E is wrong because Encryption in transit addresses security, not performance.

Answer

Enable Encryption in transit for the ElastiCache cluster.

Answer

Enable Multi-AZ replication for the ElastiCache cluster.

Question 15

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function is triggered by S3 events. The developer notices that the function sometimes processes the same file multiple times. Which TWO steps should the developer take to make the processing idempotent? (Choose TWO.)

Accepted Answer

Check if the file has already been processed by storing a marker in DynamoDB.. Options B and D are correct. Option B ensures that if a file is processed again, it checks for a marker. Option D ensures updates are idempotent. Option A is wrong because increasing timeout does not prevent duplicate processing. Option C is wrong because batch size is for SQS, not S3 triggers. Option E is wrong because it does not prevent reprocessing.

Answer

Reduce the S3 event batch size in the Lambda trigger.

Answer

Increase the Lambda function's timeout.

Answer

Enable S3 versioning on the bucket.

DVA-C02 Development with AWS Services Practice Test 18 — 15 Questions

Exhibit

DVA-C02 Development with AWS Services Practice Test 18 — 15 Questions

Exhibit