DVA-C02 Development with AWS Services Practice Test 20 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive documents. They must encrypt all objects at rest. Which TWO methods can be used to enforce server-side encryption? (Choose TWO.)

Accepted Answer

Set a bucket policy that denies PutObject if x-amz-server-side-encryption header is not present.. Option A is correct because a bucket policy can include a Deny statement on s3:PutObject with a condition such as StringNotEquals on s3:x-amz-server-side-encryption (or its absence via Null), which blocks any upload that does not request server-side encryption with the required algorithm (for example, AES256 or aws:kms). Option B is correct because enabling default bucket encryption (SSE-S3, SSE-KMS, or DSSE-KMS) causes Amazon S3 to automatically encrypt every object at rest on upload, even when the request does not include the x-amz-server-side-encryption header, thereby enforcing encryption at rest. Option C is not appropriate because an IAM policy denying all S3 actions unless encryption is specified is overly broad and does not itself enforce encryption on PutObject in the precise, header-based way a bucket policy condition does. Option D is wrong because an SQS queue policy governs access to an SQS queue, not to S3 objects, and has no effect on S3 server-side encryption. Option E is wrong because client-side encryption encrypts data before it reaches S3 and is not a server-side encryption enforcement method.

Answer

Attach an IAM policy that denies all S3 actions unless encryption is specified.

Answer

Configure an SQS queue policy to require encryption.

Answer

Use client-side encryption before uploading objects.

Question 2

A developer is using AWS Lambda to process events from an Amazon Kinesis stream. The function has been failing with 'ProvisionedThroughputExceededException' errors when writing to a DynamoDB table. What should the developer do to resolve this issue?

Accepted Answer

Implement retry logic with exponential backoff in the Lambda function.. The 'ProvisionedThroughputExceededException' error indicates that the Lambda function is exceeding the write capacity units (WCUs) provisioned for the DynamoDB table. Implementing retry logic with exponential backoff in the Lambda function allows it to handle throttling gracefully by pausing and retrying failed writes, which is the standard AWS-recommended pattern for managing DynamoDB throttling.

Answer

Decrease the batch size of the Kinesis event source mapping.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the memory allocated to the Lambda function.

Question 3

A developer is building a serverless application using AWS Lambda. The application needs to process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. Which AWS service should the developer use to trigger the Lambda function when new messages arrive in the SQS queue?

Accepted Answer

Configure an SQS event source mapping on the Lambda function.. AWS Lambda supports native SQS event source mappings, which allow Lambda to poll an SQS queue and invoke the function automatically when new messages arrive. This integration handles the polling, batch retrieval, and deletion of messages from the queue, making it the simplest and most efficient way to process SQS messages with Lambda.

Answer

Set up an Amazon EventBridge rule to capture SQS events and invoke Lambda.

Answer

Use Amazon SNS to subscribe to the SQS queue and trigger Lambda.

Answer

Use AWS Step Functions to poll the SQS queue and invoke Lambda.

Question 4

A developer is deploying a new version of an AWS Lambda function. The function uses an environment variable for a database password. The developer wants to securely store the password and automatically rotate it. Which combination of AWS services should the developer use?

Accepted Answer

Store the password in AWS Secrets Manager and retrieve it in the Lambda function using the AWS SDK.. AWS Secrets Manager is specifically designed to securely store secrets like database passwords, supports automatic rotation of secrets, and integrates with Lambda via the AWS SDK to retrieve the secret at runtime. This ensures the password is never hardcoded or exposed in environment variables, and rotation can be scheduled without code changes.

Answer

Use AWS KMS to generate a data key and store it in the Lambda environment variable.

Answer

Store the password in AWS Systems Manager Parameter Store and reference it in the Lambda function.

Answer

Encrypt the password using AWS KMS and store it in Amazon DynamoDB.

Question 5

A developer is designing a microservices architecture using Amazon ECS with Fargate. The application needs to store and retrieve user session data. Which TWO AWS services can be used to store session state?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB (A) is correct because it is a fully managed, low-latency key-value NoSQL database that is commonly used to store session state for microservices, allowing fast reads/writes keyed by session ID with automatic scaling and TTL-based expiration. Amazon ElastiCache for Redis (B) is also correct because Redis is an in-memory data store with sub-millisecond latency and native support for data structures and key expiration, making it a standard choice for session caching and storage in containerized ECS/Fargate architectures. Amazon S3 (C) is not suitable because it is object storage with higher latency and eventual consistency characteristics, not designed for frequent small session reads/writes. Amazon EFS (D) is a shared file system for POSIX workloads and is not intended as a low-latency session state store. Amazon RDS for MySQL (E) is a relational database that can technically store sessions, but it is not the typical high-throughput, low-latency session store for microservices and is not marked correct here.

Answer

Amazon S3

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Question 6

A developer is building an API using Amazon API Gateway and AWS Lambda. The API must authenticate users using a third-party OAuth 2.0 provider. Which TWO components are required to implement this authentication?

Accepted Answer

The OAuth 2.0 access token in the Authorization header. Option D is correct because a Lambda authorizer (formerly a custom authorizer) is the API Gateway mechanism that lets you plug in custom authentication logic; the function receives the caller's token, validates it against the third-party OAuth 2.0 provider (e.g., by verifying the JWT signature or calling the provider's introspection endpoint), and returns an IAM policy that allows or denies the request. Option A is correct because the client must present the OAuth 2.0 access token to API Gateway, and the standard convention is to send it in the Authorization header (typically as 'Bearer <token>'), which is exactly what the Lambda authorizer reads to perform validation. Option B is not required because a CloudFront distribution is only an optional caching/edge layer and plays no role in OAuth 2.0 authentication. Option C is incorrect because resource policies control access to the API based on source IP, VPC endpoint, or AWS account/IAM principal, not by invoking a Lambda authorizer; the authorizer is attached via the API method's authorization settings. Option E is incorrect because the scenario specifies a third-party OAuth 2.0 provider, so an Amazon Cognito user pool is not needed and would instead make Cognito the identity provider.

Answer

Amazon CloudFront distribution for API caching

Answer

An API Gateway resource policy that invokes the Lambda authorizer

Answer

An Amazon Cognito user pool as the OAuth provider

Question 7

Refer to the exhibit. A developer runs the AWS CLI command to invoke a Lambda function. The command succeeds, but the function returns an error. The developer wants to see the error message and logs from the function execution. What should the developer add to the command?

Accepted Answer

--log-type Tail. The `--log-type Tail` parameter instructs the AWS CLI to retrieve the last 4 KB of log data from the function's execution and base64-encode it in the response. This allows the developer to see the error message and logs directly without needing to query CloudWatch Logs separately. The command must also use `--invocation-type RequestResponse` (the default) to get a synchronous response containing the logs.

Answer

--client-context string

Answer

--qualifier alias

Answer

--invocation-type Event

Question 8

A developer wants to deploy a containerized application to Amazon ECS using Fargate. The application requires persistent storage that can be shared across multiple containers in the same task. Which storage option should the developer use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable file system that can be mounted by multiple containers within the same ECS task using Fargate. EFS supports the Network File System (NFS) protocol, allowing concurrent read/write access from all containers in the task, which meets the requirement for shared persistent storage. Unlike ephemeral or block storage options, EFS is designed for multi-attach scenarios and persists independently of the container lifecycle.

Answer

Amazon EC2 instance store

Answer

Amazon S3 bucket

Answer

Amazon EBS volume

Question 9

A company runs a critical application on AWS Lambda that processes real-time data from Kinesis Data Streams. The function is idempotent, but occasionally duplicate records are processed due to retries. The company wants to ensure exactly-once processing. Which approach should the developer implement?

Accepted Answer

Use a DynamoDB table to store processed record IDs and perform deduplication in the Lambda function.. DynamoDB provides a scalable, low-latency store for tracking processed record IDs, enabling the Lambda function to check for duplicates before processing. Since the function is idempotent but retries cause duplicates, a DynamoDB-based deduplication layer ensures exactly-once semantics without altering the event source or introducing ordering constraints.

Answer

Use an SQS FIFO queue between Kinesis and Lambda.

Answer

Enable Lambda reserved concurrency to limit retries.

Answer

Reduce the batch size in the event source mapping.

Question 10

A developer is using Amazon API Gateway to create a REST API. The API must support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. What must the developer do to enable CORS?

Accepted Answer

Enable CORS in the API Gateway settings and configure the required headers.. Enabling CORS in API Gateway requires explicit configuration: you must enable CORS on the API Gateway resource, which automatically generates an OPTIONS method and adds the necessary CORS headers (Access-Control-Allow-Origin, Access-Control-Allow-Methods, Access-Control-Allow-Headers) to responses. This is done through the API Gateway console or API configuration, not by the backend Lambda function or CloudFront.

Answer

Use Amazon CloudFront to proxy the API and add CORS headers.

Answer

Nothing; API Gateway automatically handles CORS.

Answer

Add CORS headers in the Lambda function code.

Question 11

A developer invokes an AWS Lambda function and receives a timeout error. The function is configured with a 3-second timeout. The developer needs to process data that sometimes takes up to 10 seconds. What should the developer do?

Accepted Answer

Increase the Lambda function timeout to 10 seconds.. The error indicates the Lambda function is timing out because its configured timeout of 3 seconds is insufficient for processing that sometimes takes up to 10 seconds. Option B directly addresses this by increasing the timeout to 10 seconds, which is within the maximum Lambda timeout of 15 minutes (900 seconds). This ensures the function can complete its execution without being prematurely terminated.

Answer

Change the invocation type to Event (async).

Answer

Increase the memory allocation for the Lambda function.

Answer

Set reserved concurrency to 1.

Question 12

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function processes user uploads from Amazon S3 and stores metadata in DynamoDB. The function is experiencing high latency during peak hours. Which action would MOST improve the performance without increasing the function timeout?

Accepted Answer

Increase the DynamoDB table's provisioned read and write capacity.. Increasing the DynamoDB table's provisioned read and write capacity directly addresses the root cause of high latency during peak hours: throttling due to insufficient throughput. When the Lambda function's write requests exceed the table's capacity, DynamoDB throttles them, causing retries and increased latency. Raising the capacity allows DynamoDB to handle the burst of metadata writes without throttling, reducing response times without requiring a longer function timeout.

Answer

Increase the Lambda reserved concurrency.

Answer

Move the Lambda function into a VPC with a DynamoDB VPC endpoint.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Question 13

A developer needs to store temporary session data for a web application running on Amazon EC2 behind an Application Load Balancer. The data must be accessible across multiple EC2 instances. Which AWS service should the developer use?

Accepted Answer

Amazon ElastiCache. Amazon ElastiCache is the correct choice because it provides a managed, in-memory caching service (e.g., Redis or Memcached) that can store temporary session data with sub-millisecond latency. Since the data must be accessible across multiple EC2 instances behind an Application Load Balancer, ElastiCache offers a centralized, highly available data store that all instances can read from and write to, ensuring session persistence regardless of which instance handles a request.

Answer

Amazon EBS

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 14

A company runs a containerized web application on Amazon ECS using Fargate. The application needs to store files in Amazon S3. The developer wants to follow the principle of least privilege for the ECS task IAM role. Which IAM policy should be attached to the task role?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}]}. It grants only the s3:PutObject action on the specific S3 bucket, which is the minimum permission required for the application to store files. This adheres to the principle of least privilege by not including unnecessary read or list actions. The task role should be scoped to the exact resource and action needed.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::example-bucket/*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:PutObject"],"Resource":"arn:aws:s3:::example-bucket/*"}]}

Question 15

A developer is writing an AWS Lambda function that processes messages from an Amazon SQS queue. The function should process each message at least once, but duplicates are acceptable. The function is triggered by a Lambda event source mapping. If the function returns an error, what happens to the message?

Accepted Answer

The message remains in the queue and becomes visible after the visibility timeout expires.. When a Lambda function invoked by an SQS event source mapping returns an error, the message is not deleted from the queue. Instead, it remains in the queue and becomes visible again after the visibility timeout expires. This allows the function to retry processing the message, ensuring at-least-once processing. The default behavior is to retry based on the queue's redrive policy, not to immediately send the message to a DLQ or delete it.

Answer

The message is sent to a dead-letter queue (DLQ).

Answer

The message is deleted from the queue to prevent duplicate processing.

Answer

Lambda automatically retries the function with a 1-minute delay.