DVA-C02 Development with AWS Services Practice Test 22 — 15 Questions

Question 1

A developer is using AWS CodeCommit as the source repository for a CI/CD pipeline. The developer wants to trigger a build automatically when changes are pushed to a specific branch. Which services can be used to achieve this? (Choose TWO.)

Accepted Answer

AWS CodeBuild. Option A is correct because CodePipeline can be configured with a CodeCommit source action that triggers on changes. Option C is correct because CodeBuild can be triggered directly by CodeCommit via webhooks. Option B is wrong because CloudWatch Events can trigger on CodeCommit events as well, but it is not a build service; however, it can trigger CodeBuild. But the question asks for services that can achieve the trigger, and both CodePipeline and CodeBuild are valid. However, Option D is wrong because CodeDeploy is for deployment, not build. Option E is wrong because CodeStar is a management console, not a trigger service.

Answer

Amazon CloudWatch Events

Answer

AWS CodeStar

Answer

AWS CodeDeploy

Question 2

A company uses Amazon API Gateway to expose a REST API backed by AWS Lambda. The API has a resource /items with GET and POST methods. The GET method returns items from a DynamoDB table. The POST method adds an item to the table. Currently, all methods are open to the public. Security requirements mandate that only authenticated users can access the POST method, while the GET method remains public. Which THREE steps should the developer take to meet these requirements?

Accepted Answer

Configure the Lambda authorizer only on the POST method in the API Gateway.. Option A is correct because a Lambda authorizer can validate tokens. Option C is correct because the authorizer can be configured only on the POST method. Option E is correct because the Lambda authorizer returns an IAM policy that allows or denies access. Option B is incorrect because Cognito User Pools authorizer would apply to the entire API. Option D is incorrect because resource policies are global, not method-specific.

Answer

Use an Amazon Cognito User Pools authorizer for the entire API.

Answer

Add a resource policy that denies public access to the POST method.

Question 3

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload a file to s3://my-bucket/confidential/report.pdf. What will happen?

Accepted Answer

The upload fails because the Deny statement overrides the Allow.. Option B is correct because the Deny statement explicitly denies all s3 actions on the confidential prefix, overriding the Allow. Option A is wrong because the Deny takes precedence. Option C is wrong because the Deny applies to the specific path. Option D is wrong because the Deny applies to the user.

Answer

The upload succeeds because the Deny statement applies only to the bucket, not the user.

Answer

The upload fails because the policy does not allow PutObject on that path.

Answer

The upload succeeds because the Allow statement grants PutObject.

Question 4

A developer is designing a microservices architecture where each service runs in its own Amazon ECS container. Services need to communicate with each other. The developer wants to simplify service discovery and load balancing. Which AWS service should the developer use?

Accepted Answer

AWS Cloud Map. Option C is correct because AWS Cloud Map provides service discovery for microservices. Option A is incorrect because Route 53 is for DNS, but not optimized for dynamic service discovery. Option B is incorrect because ELB is for load balancing, not service discovery. Option D is incorrect because Amazon ECS does not have built-in service discovery.

Answer

Elastic Load Balancing

Answer

Amazon ECS service discovery

Answer

Amazon Route 53

Question 5

Refer to the exhibit. A developer invoked a Lambda function and received the response shown. What does the response indicate?

Accepted Answer

The function was invoked but returned an error.. Option B is correct because the FunctionError field is 'Unhandled' and the response contains an error object, indicating a function error. Option A is wrong because the StatusCode is 200, not 4xx or 5xx. Option C is wrong because the invocation succeeded but the function failed. Option D is wrong because LogResult is empty, but that's not the reason.

Answer

The function was not invoked due to a permissions error.

Answer

The function executed successfully but did not return any logs.

Answer

The invocation timed out.

Question 6

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application receives high traffic and needs to process incoming HTTP requests, store the request payload in an S3 bucket for auditing, and return a response. The development team uses AWS Lambda to process the payload. The team wants to ensure that the solution is scalable, fault-tolerant, and decoupled. The current approach is to have the EC2 instances send requests directly to the Lambda function via the AWS SDK. However, the team notices that during traffic spikes, some requests are lost and the Lambda function throttles. What should the team do to improve the architecture?

Accepted Answer

Have the EC2 instances send messages to an Amazon SQS queue, and configure the SQS queue as an event source for the Lambda function.. Option C is correct because using SQS decouples the EC2 instances from Lambda, provides buffering, and reduces throttling. Option A is incorrect because increasing Lambda concurrency may not solve the loss of requests; requests can still be dropped if Lambda is overwhelmed. Option B is incorrect because API Gateway still requires synchronous invocation and may still cause throttling. Option D is incorrect because Kinesis is for real-time streaming, not ideal for simple request queuing.

Answer

Increase the Lambda function's reserved concurrency to the maximum allowed.

Answer

Place API Gateway in front of Lambda and have EC2 send requests to API Gateway.

Answer

Use Amazon Kinesis Data Streams instead of Lambda to process the payload.

Question 7

Refer to the exhibit. A developer created the CloudFormation template snippet. After deployment, the developer uploads a file to the bucket, but the Lambda function is not invoked. What is the MOST likely cause?

Accepted Answer

The bucket has a bucket policy that denies s3:PutObject for the IAM user.. Option A is correct because S3 bucket policies that deny s3:PutObject would prevent the upload from triggering the event. Option B is wrong because versioning does not affect notifications. Option C is wrong because lifecycle rules do not affect immediate events. Option D is wrong because Lambda function errors do not prevent invocation.

Answer

The bucket has versioning enabled, which blocks event notifications.

Answer

The lifecycle rule moves objects to Glacier before the notification is sent.

Answer

The Lambda function returned an error, so the invocation failed silently.

Question 8

A developer is building a serverless application that uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The workflow involves three steps: validate input, process data, and store results. The developer notices that the workflow occasionally fails due to transient errors in the process data step. The developer wants to implement error handling so that the workflow retries the process data step up to three times with an exponential backoff. Additionally, if all retries fail, the workflow should send a notification to an Amazon SNS topic and transition to a failure state. The developer has defined the state machine in Amazon States Language (ASL). How should the developer configure the state machine?

Accepted Answer

In the process data state definition, add a Retry field with MaxAttempts: 3 and BackoffRate: 2, and add a Catch field that transitions to a failure state and sends an SNS notification.. Option B is correct because you can define Retry and Catch within a state. Retry specifies the retry behavior, and Catch specifies what to do after retries are exhausted. Option A is incorrect because you cannot define Retry and Catch at the workflow level; they must be per state. Option C is incorrect because you should modify the state definition, not the execution role. Option D is incorrect because you can handle this within the state machine without Lambda code changes.

Answer

Write custom retry logic inside the Lambda function code and catch exceptions there.

Answer

Modify the IAM execution role to allow the state machine to call SNS and then use a ResultPath to handle errors.

Answer

Add a Retry field at the workflow level and a Catch field at the workflow level.

Question 9

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. Option B is correct because attaching an IAM role to the Lambda function with the least privilege permissions is the AWS best practice for granting permissions to AWS services. Option A is wrong because storing access keys in environment variables is insecure. Option C is wrong because resource-based policies are for granting cross-account access, not for Lambda's own permissions. Option D is wrong because hardcoding credentials is a security risk.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.

Question 10

A company is using Amazon DynamoDB as the database for a web application. The application reads and writes items based on a primary key. The traffic pattern shows that reads are 10 times more frequent than writes. The development team wants to reduce read latency and costs. They are considering adding a cache layer. The data is not sensitive, but stale data is acceptable for up to 5 minutes. The application runs on EC2 instances. What should the team do to implement caching?

Accepted Answer

Set up an Amazon ElastiCache Memcached cluster and update the application to check the cache before reading from DynamoDB.. Option D is correct because Amazon ElastiCache with Memcached provides a distributed cache that is suitable for read-heavy workloads and handles frequent reads. Option A is incorrect because DAX is a DynamoDB accelerator that is tightly coupled with DynamoDB and may be overkill. Option B is incorrect because CloudFront is for content delivery, not for caching database queries. Option C is incorrect because S3 is not suitable for low-latency caching of database items.

Answer

Use Amazon DynamoDB Accelerator (DAX) as a caching layer.

Answer

Store frequently accessed items in an S3 bucket and read from S3.

Answer

Use Amazon CloudFront to cache responses from the application.

Question 11

A developer is using AWS CodeCommit as a source repository and AWS CodePipeline for CI/CD. The developer wants to automatically trigger a pipeline execution when changes are pushed to the main branch. Which action should the developer take?

Accepted Answer

Create an Amazon CloudWatch Events rule that detects changes to the CodeCommit repository and triggers the pipeline.. Option C is correct because configuring a CloudWatch Events rule to detect CodeCommit repository changes and trigger the pipeline is the standard method. Option A is wrong because CodePipeline does not poll repositories directly. Option B is wrong because webhooks are not supported by CodeCommit. Option D is wrong because SNS notifications do not trigger pipelines directly.

Answer

Configure CodePipeline to poll the CodeCommit repository every minute.

Answer

Set up a webhook in CodeCommit to notify CodePipeline on push events.

Answer

Use an SNS topic to send a notification to CodePipeline when a push occurs.

Question 12

A developer attached the above IAM policy to an IAM user. The user tries to upload an object to the S3 bucket my-bucket without specifying server-side encryption. What will happen?

Accepted Answer

The upload will be denied because the Deny statement explicitly denies PutObject without AES256 encryption.. Option A is correct because the Deny statement will match (since s3:x-amz-server-side-encryption is not AES256), and explicit Deny overrides Allow. Option B is incorrect because the Allow statement requires encryption, but the Deny explicitly denies if not AES256. Option C is incorrect because the Deny is not redundant; it enforces encryption. Option D is incorrect because the upload will be denied, not proceed without encryption.

Answer

The upload will succeed because the Deny statement is redundant.

Answer

The upload will succeed because the Allow statement grants PutObject permission.

Answer

The upload will succeed but the object will be stored without encryption.

Question 13

A Lambda function processes messages from an SQS queue. The function occasionally fails due to network timeouts when calling an external API. The developer wants to retry failed messages automatically. What should the developer do?

Accepted Answer

Configure a dead-letter queue for the SQS queue and set the Lambda function's maximum retries to 2.. Option D is correct because configuring a dead-letter queue (DLQ) for the SQS queue allows messages that exceed the maximum retries to be stored for later analysis, while the Lambda function's retry behavior handles transient failures. Option A is wrong because increasing the Lambda timeout may help but does not provide automatic retries. Option B is wrong because SQS does not have a built-in retry mechanism; Lambda retries are separate. Option C is wrong because DLQ on Lambda captures only events that Lambda cannot process, but the best practice is to use SQS DLQ.

Answer

Enable SQS redrive policy to automatically retry after a failure.

Answer

Configure a dead-letter queue on the Lambda function to capture failed events.

Answer

Increase the Lambda function's timeout to 15 minutes.

Question 14

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The developer wants to ensure that the new version is stable before routing all traffic to it. The developer has already published version 1 and version 2 of the function. The developer wants to send 10% of the traffic to version 2 and 90% to version 1. The developer then plans to gradually increase the traffic to version 2. Which approach should the developer use?

Accepted Answer

Create a Lambda alias named 'prod' and update the alias's routing configuration to send 10% traffic to version 2 and 90% to version 1.. Option B is correct because Lambda aliases support traffic shifting via weighted routing. Option A is incorrect because Lambda function versions do not support traffic weights directly. Option C is incorrect because there is no built-in feature to configure traffic distribution on the function itself. Option D is incorrect because API Gateway endpoint configuration doesn't handle Lambda traffic shifting.

Answer

Use the Lambda function's versioning feature to set the traffic weight directly on the function.

Answer

Configure the API Gateway endpoint to route 10% of requests to version 2 and 90% to version 1.

Answer

Create a new alias and assign the traffic weights to the versions in the alias configuration.

Question 15

A developer is deploying a serverless application using AWS SAM. The application includes an API Gateway endpoint that invokes a Lambda function. The developer wants to pass a stage name as a parameter to the Lambda function. How should the developer define the Lambda function's environment variable in the SAM template?

Accepted Answer

Use the parameter reference 'Ref: StageName' in the environment variable mapping.. Option B is correct because the SAM template can use the Ref function to reference a parameter and assign it to an environment variable. Option A is wrong because it uses hardcoded value. Option C is wrong because AWS::StackName would give the stack name, not the stage parameter. Option D is wrong because GetAtt is not used for parameters.

Answer

Define the environment variable as 'Stage: dev' in the Lambda function configuration.

Answer

Use 'Fn::GetAtt: [AWS::StackName, Outputs.StageName]' to get the stage name.

Answer

Use 'Fn::ImportValue: StageName' to import from another stack.