DVA-C02 Development with AWS Services Practice Test 22 — 15 Questions

Question 1

A company is using AWS CodePipeline to automate its CI/CD pipeline. The pipeline has a source stage that pulls code from an Amazon S3 bucket. Which THREE steps should the developer take to ensure that only approved changes are deployed to production?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation change sets to review changes. AWS CloudFormation change sets allow you to preview how proposed changes to a stack will impact existing resources before you execute them. By reviewing the change set, you can verify that only approved modifications (e.g., infrastructure updates) are applied, providing a safety check before deployment to production. This step ensures that unapproved or unintended changes are caught early in the pipeline.

Answer

Configure cross-account access for the pipeline

Answer

Encrypt the S3 bucket with AWS KMS

Question 2

A developer needs to monitor the performance of an Amazon RDS for MySQL database. Which TWO metrics should the developer monitor to detect a potential CPU bottleneck?

Accepted Answer

DatabaseConnections. High CPUUtilization (Option C) directly indicates the CPU is under heavy load, which is the primary symptom of a CPU bottleneck. DatabaseConnections (Option B) is correct because an excessive number of concurrent connections can overwhelm the CPU as each connection requires context switching and query processing, leading to CPU saturation. Monitoring both metrics together helps distinguish between a CPU bottleneck caused by high query load versus one caused by connection overhead.

Answer

FreeStorageSpace

Answer

NetworkThroughput

Answer

ReadLatency

Question 3

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to s3://my-bucket/confidential/report.pdf. What is the outcome?

Accepted Answer

The upload fails because the Deny statement explicitly denies access to the confidential prefix.. The IAM policy includes an explicit Deny statement for s3:PutObject on the `confidential` prefix, which overrides any Allow statements. AWS IAM evaluates policies with explicit Denies taking precedence over Allows, so the upload to `s3://my-bucket/confidential/report.pdf` is blocked regardless of the Allow statement on the bucket.

Answer

The upload succeeds because the Allow statement grants s3:PutObject on the bucket.

Answer

The upload fails because there is no Allow statement for the confidential prefix.

Answer

The upload fails because the policy is malformed.

Question 4

Refer to the exhibit. A developer created this CloudFormation template for an S3 bucket. What is the expected behavior?

Accepted Answer

Noncurrent versions of objects are deleted 30 days after they become noncurrent.. The CloudFormation template defines an S3 Lifecycle rule with `NoncurrentVersionExpiration` set to 30 `NoncurrentDays`. This rule specifically targets noncurrent versions of objects, meaning that after an object version becomes noncurrent (e.g., due to a PUT or DELETE of the current version), that noncurrent version will be permanently deleted 30 days later. The `Status: Enabled` ensures the rule is active, and versioning is enabled via the `VersioningConfiguration` property.

Answer

The bucket will have versioning disabled because the rule conflicts.

Answer

Current versions are transitioned to another storage class after 30 days.

Answer

Objects are automatically deleted after 30 days.

Question 5

A company has a Lambda function that processes records from an SQS queue. The function is failing intermittently with timeout errors. The processing time per record varies, but the SQS queue has a visibility timeout of 30 seconds. The Lambda function has a timeout of 1 minute. What is the MOST likely cause of the timeout errors?

Accepted Answer

The SQS visibility timeout is shorter than the Lambda function timeout.. When the SQS visibility timeout (30 seconds) is shorter than the Lambda function timeout (1 minute), the message becomes visible again in the queue before the function finishes processing it. This causes the same message to be picked up by another consumer (or the same Lambda invocation) while the original invocation is still running, leading to duplicate processing and eventual timeout errors as the function repeatedly attempts to process the same record.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The SQS queue has too many messages causing Lambda to throttle.

Answer

The SQS queue's default visibility timeout of 30 seconds is too long.

Question 6

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function needs to read and write items to a DynamoDB table. What is the BEST way to securely provide the Lambda function with the necessary AWS credentials?

Accepted Answer

Create an IAM role with DynamoDB permissions and attach it to the Lambda function.. The best practice for granting AWS Lambda functions access to DynamoDB is to create an IAM role with the necessary DynamoDB permissions (e.g., dynamodb:GetItem, dynamodb:PutItem) and attach that role to the Lambda function. This follows the principle of least privilege and leverages AWS Identity and Access Management (IAM) roles, which provide temporary, automatically rotated credentials via the AWS Security Token Service (STS). This approach eliminates the need to manage long-term access keys and ensures secure, auditable access.

Answer

Store the AWS access key and secret key in the Lambda environment variables.

Answer

Create an IAM user with programmatic access and store the credentials in the Lambda code.

Answer

Use the Lambda function's default full admin access provided by AWS.

Question 7

A company is using AWS CodeDeploy to deploy an application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed to deploy.' The CodeDeploy agent logs show that the BeforeInstall lifecycle event script returned a non-zero exit code. What is the MOST likely cause of this issue?

Accepted Answer

The BeforeInstall script has a bug that causes it to exit with a non-zero status.. The error message explicitly states that the CodeDeploy agent logs show the BeforeInstall lifecycle event script returned a non-zero exit code. This directly indicates that the script itself failed during execution, which is the most likely cause of the deployment failure. The BeforeInstall script is a custom script run by the CodeDeploy agent on each instance, and a non-zero exit code signals an error condition that halts the deployment for that instance.

Answer

The application revision is missing from the S3 bucket.

Answer

The IAM instance profile does not have permissions to call CodeDeploy APIs.

Answer

The CodeDeploy agent is not running on the instances.

Question 8

A developer is writing a Lambda function that processes events from an Amazon S3 bucket. The function needs to access a DynamoDB table to store metadata about the S3 objects. Which of the following is the MOST efficient way to initialize the DynamoDB client in the Lambda function?

Accepted Answer

Create the DynamoDB client outside the Lambda handler function, in the global scope.. Initializing the DynamoDB client outside the Lambda handler (in global scope) allows the client to be reused across multiple invocations within the same execution environment. This avoids the overhead of creating a new client on every invocation, which reduces latency and conserves resources. AWS Lambda reuses the global scope for subsequent invocations after the first, making this the most efficient approach.

Answer

Store the DynamoDB table name as a global variable and create the client inside the handler.

Answer

Use a static variable inside the handler to cache the DynamoDB client.

Answer

Create the DynamoDB client inside the Lambda handler function every invocation.

Question 9

A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

Accepted Answer

AWS Systems Manager Parameter Store.. AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with server-side encryption.

Answer

Amazon DynamoDB with encryption at rest.

Question 10

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application uses WebSockets for real-time communication. The company wants to use AWS CodeDeploy to deploy updates with minimal downtime. Which deployment configuration should the developer use?

Accepted Answer

Blue/green deployment.. Blue/green deployment is correct because it allows the company to deploy a new version of the application on a separate set of EC2 instances (green environment) while the current version continues to serve traffic on the original set (blue environment). Once the green environment is fully tested and healthy, the Application Load Balancer can instantly switch traffic to it, minimizing downtime. This approach is ideal for stateful WebSocket applications because it avoids terminating active connections during the deployment, as the blue environment remains operational until the switch is complete.

Answer

Canary deployment.

Answer

In-place deployment.

Answer

Immutable deployment.

Question 11

A developer is using Amazon API Gateway to expose a Lambda function as a REST API. The Lambda function queries an Amazon RDS database. Under heavy load, the database connection pool is exhausted, causing errors. What is the BEST way to manage database connections in this serverless architecture?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between Lambda and RDS, managing a pool of database connections that can be reused across multiple concurrent Lambda invocations. This prevents connection exhaustion under heavy load without requiring code changes, as the proxy handles connection multiplexing and keeps idle connections warm.

Answer

Migrate the database to Amazon DynamoDB.

Answer

Increase the concurrency limit of the Lambda function.

Answer

Use Amazon ElastiCache to cache database connections.

Question 12

A developer is building a CI/CD pipeline using AWS CodePipeline. The source stage is an Amazon S3 bucket. The developer wants to automatically start the pipeline when a new file is uploaded to the S3 bucket. What should the developer do?

Accepted Answer

Create an Amazon CloudWatch Events rule that triggers on S3 object creation events and targets the pipeline.. Amazon CloudWatch Events (now Amazon EventBridge) can directly target an AWS CodePipeline pipeline as a rule target. By creating a rule that matches S3 object creation events (e.g., `s3:ObjectCreated:*`), the pipeline is automatically triggered without any intermediate polling, custom code, or additional services. This is the native, serverless integration recommended by AWS.

Answer

Configure the S3 bucket to send events to an SQS queue, and poll the queue from CodePipeline.

Answer

Set up a periodic Lambda function that checks the S3 bucket for new files and starts the pipeline.

Answer

Configure the S3 bucket to send events to an SNS topic, and subscribe CodePipeline to the topic.

Question 13

A developer is designing a serverless application that processes user-uploaded images. The images are uploaded to an S3 bucket, which triggers a Lambda function to create a thumbnail and store metadata in DynamoDB. The thumbnail creation is CPU-intensive and can take up to 10 seconds. The developer wants to minimize costs and ensure that the thumbnail is created as soon as possible. Which approach should the developer choose?

Accepted Answer

Use S3 event notifications to directly invoke the Lambda function.. S3 event notifications directly invoke the Lambda function asynchronously, which is the simplest, fastest, and most cost-effective approach for this use case. The Lambda function's 15-minute timeout easily accommodates the 10-second thumbnail creation, and direct invocation eliminates the cost and latency of additional intermediate services like SQS or Step Functions, ensuring the thumbnail is processed as soon as the image is uploaded.

Answer

Use AWS Step Functions to orchestrate the Lambda function and DynamoDB update.

Answer

Use an ECS Fargate task to process the images, triggered by S3 events.

Answer

Use an SQS queue between S3 and Lambda to buffer requests.

Question 14

A developer is configuring an Amazon S3 bucket for static website hosting. The website includes JavaScript that makes AJAX calls to an API Gateway endpoint. Which TWO actions should the developer take to allow cross-origin requests?

Accepted Answer

Enable CORS on the API Gateway API.. The API Gateway API must have CORS enabled to accept cross-origin requests from the S3-hosted static website. For an API Gateway endpoint backed by a Lambda proxy integration, enabling CORS in API Gateway alone is not enough — the Lambda function must also include the appropriate CORS headers (such as Access-Control-Allow-Origin) in its response. Therefore, the developer should both enable CORS on the API and modify the Lambda function to return CORS headers.

Answer

Use Amazon CloudFront to serve the website and set CORS headers.

Answer

Add a CORS configuration to the S3 bucket.

Answer

Configure the S3 bucket policy to allow cross-origin access.

Question 15

A developer is building a serverless application using AWS Lambda. The Lambda function needs to access a VPC to connect to an RDS database. Which TWO resources must the developer configure to allow the Lambda function to access the VPC?

Accepted Answer

A security group that allows inbound/outbound traffic to the RDS database.. A security group acts as a virtual firewall for the Lambda function, controlling inbound and outbound traffic. To connect to an RDS database in a VPC, the Lambda function's security group must allow outbound traffic to the RDS database's security group on the database port (e.g., 3306 for MySQL), and the RDS security group must allow inbound traffic from the Lambda security group. This two-way rule ensures the Lambda function can establish a TCP connection to the database.

Answer

A NAT gateway in the VPC.

Answer

An IAM role with permissions to access RDS.

Answer

An internet gateway attached to the VPC.