DVA-C02 Development with AWS Services Practice Test 19 — 15 Questions

Question 1

A developer is designing a serverless application using AWS Lambda. The function needs to process messages from an Amazon SQS queue. The developer wants to configure the Lambda function to be triggered by the SQS queue. Which TWO actions are required? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach an IAM execution role to Lambda with permission to receive messages from SQS.. Option A is correct because the Lambda function's IAM execution role must grant permissions such as sqs:ReceiveMessage, sqs:DeleteMessage, and sqs:GetQueueAttributes so the service can poll and consume messages from the SQS queue on the function's behalf. Option C is correct because SQS is a pull-based source, so you must create an event source mapping that tells the Lambda service to poll the queue, batch records, and invoke the function with those messages. Option B is not required because SQS integration uses the execution role for polling rather than a resource-based policy invoking Lambda directly, as would be the case for push-based sources like S3 or SNS. Option D is not required, though a dead-letter queue or Lambda destinations can optionally handle failed messages. Option E is not required because Lambda can reach SQS over the AWS network without being placed in a VPC.

Answer

Configure a resource-based policy on the SQS queue to allow Lambda invocation.

Answer

Set up a dead-letter queue for failed messages.

Answer

Place the Lambda function in a VPC to access the SQS queue.

Question 2

A company is using Amazon API Gateway to expose a REST API. The API is integrated with an AWS Lambda function. The developer wants to implement caching to improve performance. Which THREE steps are necessary to enable caching for a specific stage? (Choose THREE.)

Accepted Answer

Enable API caching in the stage settings.. API Gateway provides built-in caching at the stage level, which can be enabled directly in the stage settings without modifying the Lambda function or adding external services. This caching reduces the number of calls made to the backend Lambda function by serving cached responses for identical requests, improving performance and reducing latency.

Answer

Attach an IAM policy to the API Gateway role for cache access.

Answer

Modify the Lambda function to store responses in ElastiCache.

Question 3

A developer is building a CI/CD pipeline using AWS CodePipeline. The pipeline has a source stage from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to ensure that a manual approval step is required before deploying to production. Which THREE components must be configured? (Choose THREE.)

Accepted Answer

Set up an Amazon SNS topic to notify approvers of pending approval.. Amazon SNS is used to send notifications to approvers when a manual approval action is pending in the pipeline. The approval action in CodePipeline can be configured with an SNS topic ARN, and when the pipeline reaches that stage, it publishes a notification to the topic, alerting approvers to review and approve or reject the deployment.

Answer

Create an AWS Lambda function to process approval logic.

Answer

Configure Amazon CloudWatch Events to trigger the approval step.

Question 4

The above CLI output shows the versioning status of an S3 bucket. A developer wants to enable MFA Delete on the bucket. What should the developer do?

Accepted Answer

Use the aws s3api put-bucket-versioning command with the --mfa parameter.. The `aws s3api put-bucket-versioning` command with the `--mfa` parameter is the correct way to enable MFA Delete on an S3 bucket. The `--mfa` parameter supplies the MFA token (serial number + code) required for this high-security operation, as MFA Delete can only be toggled by the bucket owner using multi-factor authentication.

Answer

Use the aws s3api put-bucket-acl command with MFA token.

Answer

Enable Object Lock on the bucket, which automatically enables MFA Delete.

Answer

Use the aws s3api put-bucket-policy command to require MFA.

Question 5

The above IAM policy is attached to an IAM role used by a Lambda function. The function tries to scan the table 'MyTable' but receives an AccessDenied error. What is the MOST likely cause?

Accepted Answer

The policy does not include the 'dynamodb:Scan' action.. The IAM policy shown in the question does not include the 'dynamodb:Scan' action. Without this action explicitly allowed, the Lambda function's role lacks permission to perform a Scan operation on the DynamoDB table, resulting in an AccessDenied error. The policy must grant the specific action required by the API call.

Answer

The DynamoDB table does not exist.

Answer

The IAM role is not attached to the Lambda function.

Answer

The resource ARN is incorrect.

Question 6

A developer is using AWS Lambda to process messages from an Amazon SQS queue. The function needs to access an Amazon DynamoDB table. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Assign an IAM role to the Lambda function with a policy that grants the required DynamoDB permissions.. AWS Lambda uses an IAM execution role to securely obtain temporary credentials via the AWS Security Token Service (STS). By attaching a policy that grants only the required DynamoDB actions (e.g., GetItem, PutItem) on specific tables, you follow the principle of least privilege. This avoids hardcoding long-term credentials and eliminates the risk of credential exposure.

Answer

Use the Lambda function's execution role to grant full administrative access to DynamoDB.

Answer

Store the AWS access key and secret access key as environment variables in the Lambda function.

Answer

Create an IAM user with DynamoDB access and use its credentials in the Lambda function.

Question 7

A development team is using AWS CodeBuild to compile and test their code. They want to store build artifacts in an Amazon S3 bucket. The buildspec.yml file includes an artifacts section. Which configuration correctly specifies the output artifacts?

Accepted Answer

artifacts:
  files:
    - '**/*'
  discard-paths: no. It uses the correct `files` key with a glob pattern `'**/*'` to include all files, and `discard-paths: no` preserves the directory structure in the S3 bucket. In CodeBuild, the `artifacts` section requires `files` (not `file` or `path`) to specify which files to output, and `discard-paths` controls whether the relative path is kept.

Answer

artifacts:
  base-directory: 'build'
  files: '**/*'

Answer

artifacts:
  file: '**/*'
  discard-paths: no

Answer

artifacts:
  path: '**/*'
  discard-paths: false

Question 8

A company has a microservices architecture running on Amazon ECS with Fargate. Each service exposes an API through an Application Load Balancer (ALB). The development team needs to implement canary deployments for one of the services. What is the MOST efficient way to achieve this?

Accepted Answer

Use AWS CodeDeploy with an ECS blue/green deployment configuration that supports canary traffic shifting.. AWS CodeDeploy natively supports blue/green and canary deployments (e.g., ECSCanary10Percent5Minutes) for Amazon ECS. While ALB weighted target groups and ECS Task Sets are the underlying mechanisms used during these deployments, managing them manually (Option C) requires using the EXTERNAL deployment controller and writing custom orchestration code, which is highly inefficient. CodeDeploy automates this entire process seamlessly.

Answer

Create two ECS services behind the same ALB, each with a different task definition, and use sticky sessions.

Answer

Use Amazon Route 53 weighted routing policies to distribute traffic between two ALBs.

Answer

Configure the ALB to use weighted target groups, each pointing to a different task set of the same ECS service.

Question 9

A developer is troubleshooting a Lambda function that times out when processing large files from Amazon S3. The function is configured with a 3-minute timeout and 128 MB memory. Which TWO actions would MOST likely resolve the issue? (Choose TWO.)

Accepted Answer

Increase the memory allocation for the Lambda function.. Increasing the memory allocation for a Lambda function also increases CPU and network bandwidth, which can significantly speed up the processing of large files, helping the function complete within the timeout. Option E is correct because increasing the Lambda function timeout directly addresses the timeout issue, giving the function more time to complete processing large files. Option A is incorrect because S3 multipart upload is used for uploading large objects to S3, not for downloading/reading from S3; it does not improve data ingestion into a Lambda function. Option C is incorrect because sending events to SQS does not affect the processing speed of a single large file; it only decouples the event source. Option D is too generic; while a more efficient algorithm could help, it is not a guaranteed or most likely fix compared to increasing memory or timeout.

Answer

Use S3 multipart upload for large files to improve throughput.

Answer

Change the S3 event notification to send messages to an Amazon SQS queue instead.

Answer

Update the Lambda function code to use a more efficient algorithm.

Question 10

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The API should only be accessible from a specific VPC. Which TWO steps are required to achieve this? (Choose TWO.)

Accepted Answer

Create a VPC endpoint for API Gateway.. Creating a VPC endpoint for API Gateway (of type `execute-api`) allows API Gateway to be accessed privately from within a specific VPC without traversing the public internet. This endpoint uses AWS PrivateLink to provide a private IP address within the VPC, ensuring traffic stays within the AWS network.

Answer

Use an API key that is only known within the VPC.

Answer

Configure the Lambda function to be VPC-enabled.

Answer

Create a VPC endpoint for Lambda.

Question 11

An S3 bucket has versioning enabled with MFA Delete. A developer tries to permanently delete a specific version of an object using the AWS CLI without providing MFA. What is the result?

Accepted Answer

The request is denied with an AccessDenied error.. When MFA Delete is enabled on an S3 bucket, any request to permanently delete an object version must include multi-factor authentication. Without MFA, the AWS CLI request is denied with an AccessDenied error, as S3 enforces this security requirement at the API level. The developer cannot bypass this by omitting the MFA token.

Answer

A delete marker is created for the object version.

Answer

The object version is permanently deleted.

Answer

The object version is marked with a delete marker.

Question 12

A developer creates the CloudFormation stack with the template above. After the stack is created, messages that are not processed after 5 receives are moved to the DLQ. However, the developer notices that the RedrivePolicy references a queue ARN that is hardcoded. What is the best practice to avoid this hardcoded ARN?

Accepted Answer

Use Fn::GetAtt with "Arn" attribute on the DLQ resource.. `Fn::GetAtt` with the `Arn` attribute retrieves the actual Amazon Resource Name (ARN) of the Dead Letter Queue (DLQ) resource dynamically at stack creation time. This avoids hardcoding the ARN, making the template portable across accounts and regions. The RedrivePolicy property requires the full ARN of the DLQ, and `Fn::GetAtt` is the intrinsic function designed to return resource attributes like ARN.

Answer

Use Ref to reference the DLQ's QueueName and construct the ARN.

Answer

Use Fn::Sub to substitute the queue name into a hardcoded ARN template.

Answer

Use Fn::ImportValue to import the DLQ ARN from another stack.

Question 13

A developer is using AWS Elastic Beanstalk to deploy a web application. The application writes logs to the local file system. The developer wants to ensure that logs are automatically rotated and retained for 30 days. What should the developer do?

Accepted Answer

Configure the Elastic Beanstalk environment to enable log rotation and set retention period to 30 days.. Elastic Beanstalk provides a built-in configuration for log rotation and retention directly in the environment settings. By enabling log rotation and setting the retention period to 30 days, the developer can automatically manage logs without modifying application code or adding external agents. This leverages the Elastic Beanstalk health agent, which handles log rotation on the EC2 instances and stores rotated logs in Amazon S3 with lifecycle policies to enforce the retention period.

Answer

Modify the application code to write logs directly to an S3 bucket with lifecycle policies.

Answer

Add a cron job to the EC2 instances that compresses and deletes old logs.

Answer

Install the CloudWatch Logs agent on the EC2 instances and configure it to stream logs to CloudWatch Logs with a 30-day retention.

Question 14

A company is using AWS CodePipeline to automate their CI/CD pipeline. The pipeline includes a stage that runs a set of integration tests using AWS CodeBuild. The tests require access to a database running on a private subnet in a VPC. The CodeBuild project is configured to use a managed compute image. How can the CodeBuild project access the database?

Accepted Answer

Configure the CodeBuild project to use a custom VPC with the appropriate subnet and security group.. CodeBuild projects using managed compute images run in an AWS-managed VPC by default, which cannot access resources in a customer VPC. By configuring the CodeBuild project to use a custom VPC with the appropriate subnet and security group, the build environment is launched directly into that VPC, enabling it to reach the database on the private subnet without needing a NAT gateway or internet access.

Answer

Place the CodeBuild project in a public subnet and use a NAT gateway to route traffic to the private subnet.

Answer

Set up a VPC peering connection between the CodeBuild VPC and the database VPC.

Answer

Create a VPC endpoint for the database service and attach it to the CodeBuild project.

Question 15

A developer is using Amazon DynamoDB as a data store for a serverless application. The application requires strongly consistent reads and must be able to recover from failures. Which THREE measures should the developer implement? (Choose THREE.)

Accepted Answer

Use the ConsistentRead parameter set to true in GetItem and Query operations.. Option A is correct because setting ConsistentRead to true on GetItem, Query, and Scan forces a strongly consistent read that returns the most up-to-date data instead of a possibly stale eventually consistent result. Option C is correct because DynamoDB global tables provide multi-region, active-active replication, allowing the application to continue serving reads and writes from another Region if one Region fails, which directly supports failure recovery. Option D is incorrect because DynamoDB Streams is a change-data-capture feature that records item-level changes for event-driven processing, replication, or auditing; it does not itself provide failure recovery or strongly consistent reads. Option B is incorrect because DynamoDB does not offer native read replicas as a standalone feature; read scaling is achieved through partitions, global tables, or DAX. Option E is incorrect because DAX is an in-memory write-through cache that serves eventually consistent reads by default and does not provide strongly consistent reads or cross-Region failure recovery.

Answer

Use DynamoDB read replicas to offload read traffic.

Answer

Enable DynamoDB Streams to capture changes.

Answer

Implement DAX (DynamoDB Accelerator) for caching.