DVA-C02 Development with AWS Services Practice Test 20 — 15 Questions

Question 1

A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)

Accepted Answer

Verify that the Lambda function has network access to the database.. Options A, B, and D are correct. CloudWatch Logs shows error details; IAM permissions are often the cause; network connectivity is required for Lambda to reach the database. Option C is wrong because KMS key rotation is not related. Option E is wrong because VPC flow logs show network traffic but not Lambda errors.

Answer

Check VPC Flow Logs for the Lambda function's ENI.

Answer

Ensure the KMS key used to encrypt the secret is rotated.

Question 2

A company has a production application running on AWS Lambda that processes real-time streaming data from Amazon Kinesis Data Streams. The Lambda function is configured with a batch size of 100 and a maximum concurrency of 5. Recently, the application has been experiencing failures with a high number of invocation errors. The errors indicate that the function is timing out. The developer checks the CloudWatch metrics and notices that the IteratorAge metric for the Kinesis stream is increasing rapidly, and there are many Throttles events for the Lambda function. The average execution duration of the function is 30 seconds, and the function timeout is set to 1 minute. The Kinesis stream has 10 shards. The company expects the data volume to double in the next month. Which combination of actions should the developer take to resolve the issue and prepare for future growth?

Accepted Answer

Increase Lambda concurrency to at least 20 and reduce the batch size to 10.. Option C is correct. Increasing Lambda concurrency to at least 20 (2 per shard) will reduce throttling. Reducing batch size to 10 will lower processing time per batch, preventing timeouts. Option A is wrong because increasing timeout to 5 minutes doesn't address throttling. Option B is wrong because increasing shards to 20 without increasing concurrency will not help. Option D is wrong because disabling concurrency limit could cause uncontrolled scaling.

Answer

Increase the number of shards in the Kinesis stream to 20 and increase Lambda concurrency to 10.

Answer

Disable the reserved concurrency limit on the Lambda function and decrease the batch size to 5.

Answer

Increase the Lambda function timeout to 5 minutes and increase the batch size to 500.

Question 3

A developer is deploying a web application using AWS Elastic Beanstalk. The application uses an Amazon RDS MySQL database. The developer wants to ensure that database credentials are not stored in the application code or environment variables. The solution must automatically rotate credentials every 90 days. The developer has created a secret in AWS Secrets Manager containing the database credentials. The Elastic Beanstalk environment is configured with an IAM instance profile that has permission to read the secret. However, when the application is deployed, it fails to connect to the database. The developer checks the application logs and sees a 'Host not found' error. The RDS instance is in a private subnet, and the Elastic Beanstalk environment is in the same VPC. What is the MOST likely cause of the connection failure?

Accepted Answer

The application code is not retrieving the secret from Secrets Manager at startup.. Option D is correct. The application likely needs to retrieve the secret at runtime, but the code may be incorrect. However, the 'Host not found' error suggests the database hostname is not being resolved. Option A is wrong because the instance profile has permission. Option B is wrong because Secrets Manager does not automatically inject into environment; the app must fetch it. Option C is wrong because the secret can be stored as plaintext or JSON; format is not the issue.

Answer

The secret is not correctly referenced in the Elastic Beanstalk environment properties.

Answer

The IAM instance profile does not have the necessary permissions to access the secret.

Answer

The secret is stored in a different region than the Elastic Beanstalk environment.

Question 4

A company is using AWS Lambda to process messages from an Amazon SQS queue. The Lambda function sometimes fails to process a message due to a transient error. The company wants to automatically retry failed messages up to 3 times, with a 5-minute delay between retries. What should the company configure?

Accepted Answer

Configure a dead-letter queue on the Lambda function with a redrive policy that allows up to 3 retries and a 5-minute delay.. Option A is correct because the Lambda dead-letter queue (DLQ) with a redrive policy allows specifying the maximum number of retries and the delay. Option B is wrong because Lambda's maximum retry count is limited to 2 for synchronous invocations. Option C is wrong because SQS delay queues are for delaying new messages, not retries. Option D is wrong because Step Functions is overkill for this simple retry logic.

Answer

Use AWS Step Functions to poll the SQS queue and implement a retry loop with exponential backoff.

Answer

Set the Lambda function's reserved concurrency to 1 and enable the 'Retry attempts' option to 3 in the function configuration.

Answer

Configure the SQS queue with a delivery delay of 5 minutes and a redrive policy to move messages to a dead-letter queue after 3 receives.

Question 5

A developer is building a serverless application using AWS Lambda and Amazon API Gateway REST API. The API Gateway is configured to use a Lambda proxy integration. The developer wants to return a custom error message with a specific HTTP status code (e.g., 404) when a resource is not found. How should the developer implement this?

Accepted Answer

Return a JSON object with keys 'statusCode', 'headers', and 'body' where 'statusCode' is 404 and 'body' contains the error message.. Option B is correct because with proxy integration, Lambda must return a response in the specific format: statusCode, headers, and body. Option A is wrong because throwing an exception results in a 502 Bad Gateway. Option C is wrong because the format does not include 'errorMessage' as a top-level key. Option D is wrong because the correct format uses 'statusCode', not 'status_code'.

Answer

Return a JSON object with 'status_code' and 'message' keys.

Answer

Throw an exception with a message that includes the HTTP status code.

Answer

Return a JSON object with 'errorMessage' and 'errorType' keys.

Question 6

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application writes to the database using the primary endpoint. The company wants to improve read performance and offload read traffic from the primary instance. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Create an Amazon RDS read replica in the same region.. Option A is correct because a read replica can serve read traffic. Option C is correct because the application should use the read replica endpoint for read queries. Option B is wrong because Multi-AZ does not provide a separate read endpoint; the secondary is standby. Option D is wrong because RDS Proxy is for connection pooling, not read scaling. Option E is wrong because creating additional primary instances is not supported; RDS has one primary per DB instance.

Answer

Add another primary instance and configure replication.

Answer

Use the Multi-AZ secondary instance endpoint for read queries.

Answer

Enable Amazon RDS Proxy to distribute read queries across instances.

Question 7

A developer is deploying an application on Amazon ECS using Fargate. The application needs to securely access an Amazon RDS database. The developer wants to avoid hardcoding database credentials in the application code. Which THREE actions should the developer take to meet these requirements? (Choose THREE.)

Accepted Answer

Store the database credentials in AWS Systems Manager Parameter Store or AWS Secrets Manager.. Options A, C, and D are correct. Option A: AWS Systems Manager Parameter Store or AWS Secrets Manager can store credentials. Option C: Task execution role allows ECS to retrieve secrets. Option D: Secrets can be injected as environment variables. Option B is wrong because database credentials are not stored in ECR. Option E is wrong because Secrets Manager cannot be directly accessed by the application without proper IAM permissions.

Answer

Hardcode the credentials in the application code and encrypt the code using AWS KMS.

Answer

Store the credentials in Amazon Elastic Container Registry (ECR) as a tag.

Question 8

A company is running a containerized application on Amazon ECS with Fargate. The application needs to process messages from an Amazon SQS queue. The developer must ensure that the application can scale out based on the queue depth. Which THREE steps should the developer take to implement this? (Choose THREE.)

Accepted Answer

Configure an ECS Service Auto Scaling target tracking policy using the SQS queue's ApproximateNumberOfMessagesVisible metric.. Options B, D, and E are correct. Option B: The task role needs permission to poll SQS. Option D: ECS Service Auto Scaling with a target tracking policy using SQS queue depth as a metric. Option E: The application should delete messages after processing to avoid reprocessing. Option A is wrong because read capacity is for DynamoDB, not SQS. Option C is wrong because Fargate tasks are not registered with an ALB target group; they are launched by ECS service.

Answer

Configure DynamoDB auto scaling for the application's table to handle increased load.

Answer

Register the ECS tasks with an Application Load Balancer target group to distribute messages.

Question 9

A company is building a serverless application using AWS Lambda. The application processes messages from an Amazon SQS queue. The Lambda function is idempotent and handles duplicate messages correctly. The company needs to ensure that messages are processed in the order they were sent. Which solution should the company use?

Accepted Answer

Configure the Lambda function to poll an SQS FIFO queue with a batch size of 1.. Option A is correct because using an SQS FIFO queue ensures exactly-once processing and preserves message order. Lambda can poll FIFO queues with a batch size of 1 to maintain order. Option B is wrong because standard queues do not guarantee order. Option C is wrong because Kinesis Data Streams does not integrate natively with Lambda's event source mapping for ordered processing of individual messages. Option D is wrong because SNS does not provide ordering guarantees.

Answer

Use Amazon SNS to fan out messages to Lambda.

Answer

Use Amazon Kinesis Data Streams as the event source for Lambda.

Answer

Configure the Lambda function to poll an SQS standard queue with a batch size of 10.

Question 10

A developer needs to implement a serverless API using Amazon API Gateway and AWS Lambda. The API should support CORS (Cross-Origin Resource Sharing) to allow requests from a web application hosted on a different domain. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Enable CORS on the API Gateway resource and methods.. Options A and B are correct. Option A: API Gateway must return CORS headers. Option B: The Lambda function must handle the OPTIONS method. Option C is wrong because CORS is not disabled by default; it must be explicitly enabled. Option D is wrong because the Lambda function does not need to return CORS headers; API Gateway adds them. Option E is wrong because custom domain is not related to CORS.

Answer

Create a custom domain name for the API Gateway and configure the web application to use it.

Answer

Disable CORS on the API Gateway and set the Access-Control-Allow-Origin header in the Lambda function.

Answer

Modify the Lambda function to include the Access-Control-Allow-Origin header in all responses.

Question 11

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest. The developer must implement a solution that uses server-side encryption with AWS KMS managed keys (SSE-KMS). Which TWO steps are required to meet this requirement? (Choose TWO.)

Accepted Answer

Grant the IAM role used by the application the kms:GenerateDataKey permission for the KMS key.. Options B and D are correct. Option B: The bucket policy must deny uploads without the x-amz-server-side-encryption header. Option D: The IAM role must have kms:GenerateDataKey permission. Option A is wrong because the header is 'x-amz-server-side-encryption' not 'x-amz-sse'. Option C is wrong because SSE-S3 uses Amazon S3 managed keys, not KMS. Option E is wrong because the default encryption setting can be overridden by individual PUT requests.

Answer

Set the default encryption on the S3 bucket to SSE-KMS and disable the option to override it.

Answer

Set the x-amz-sse header to 'aws:kms' when uploading objects.

Answer

Enable default encryption on the S3 bucket with SSE-S3.

Question 12

A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?

Accepted Answer

Retrieve the secret outside the handler function and cache it in a global variable.. Option C is correct because caching the secret outside the handler reduces latency and cost. Option A is wrong because it does not cache. Option B is wrong because environment variables are not secure for secrets. Option D is wrong because SSM Parameter Store is not the best practice for secrets; Secrets Manager is preferred.

Answer

Use AWS Systems Manager Parameter Store to store the secret.

Answer

Retrieve the secret inside the handler function every time it is invoked.

Answer

Store the secret in an environment variable.

Question 13

A developer is building a real-time chat application using Amazon API Gateway WebSocket APIs and AWS Lambda. The application needs to send messages to all connected clients. Which THREE actions are required to implement this functionality? (Choose THREE.)

Accepted Answer

Use the API Gateway callback URL to post messages to a specific connection.. Options A, B, and D are correct. Option A: The Lambda function needs the execute-api:ManageConnections permission to post to connections. Option B: The callback URL is used to send messages to clients. Option D: The connection ID is obtained from the event object. Option C is wrong because the WebSocket URL is not needed for posting; the callback URL is derived from the API endpoint. Option E is wrong because DynamoDB is not required for sending messages; it's optional for persistence.

Answer

Store the WebSocket URL in the Lambda function environment variables.

Answer

Store the connection IDs in an Amazon DynamoDB table for later retrieval.

Question 14

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. The Lambda authorizer returns an IAM policy that grants access to the API. Recently, the company noticed that some API calls are being throttled due to high latency from the authorizer. What is the MOST effective way to reduce latency?

Accepted Answer

Enable caching for the Lambda authorizer responses.. Option B is correct because enabling caching for the authorizer allows API Gateway to reuse the policy for subsequent requests within the TTL. Option A is wrong because increasing Lambda memory may reduce latency but not as effectively as caching. Option C is wrong because using a custom authorizer with a simple response does not address latency. Option D is wrong because reducing the TTL would increase calls to the authorizer, increasing latency.

Answer

Use a custom authorizer instead of a Lambda authorizer.

Answer

Reduce the TTL of the authorizer cache.

Answer

Increase the memory allocated to the Lambda authorizer function.

Question 15

An IAM policy is attached to an IAM user. The user attempts to upload an object to s3://my-bucket/confidential/report.pdf from an IP address 192.168.1.100. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks the request.. Option A is correct because the Deny statement explicitly denies s3:* actions on the confidential prefix when the source IP is not in 10.0.0.0/8. Since the user's IP (192.168.1.100) is not in that range, the Deny applies. Even though the Allow statement grants s3:PutObject, the explicit Deny overrides. Option B is wrong because the Deny applies. Option C is wrong because the Deny is explicit. Option D is wrong because the IP condition is checked.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on all objects in the bucket.

Answer

The upload succeeds because the IP address 192.168.1.100 matches the condition.

Answer

The upload fails because the Deny statement does not have a condition.