DVA-C02 Development with AWS Services Practice Test 24 — 15 Questions

Question 1

A company runs a critical web application on Amazon EC2 instances behind an Application Load Balancer. The application needs to authenticate users via an external OpenID Connect (OIDC) identity provider. The company wants to offload authentication to the load balancer and use IAM roles to access AWS resources. Which solution should the developer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the ALB to use the OIDC identity provider for user authentication. Use the identity token to assume an IAM role via web identity federation.. The Application Load Balancer (ALB) can directly authenticate users against an external OpenID Connect (OIDC) identity provider using its native OIDC authentication action. After successful authentication, the ALB passes the ID token to the backend application, which can then use the AWS Security Token Service (STS) AssumeRoleWithWebIdentity API to exchange the token for temporary AWS credentials, allowing the application to access AWS resources via an IAM role without managing long-term keys.

Answer

Configure the ALB target group to authenticate using the OIDC identity provider.

Answer

Use AWS Lambda@Edge to authenticate users at the edge.

Answer

Use Amazon Cognito user pools as the OIDC provider and integrate with ALB.

Question 2

A developer is writing an AWS Lambda function in Python that needs to download a file from Amazon S3, process it, and upload the result to a different S3 bucket. The function currently runs within the default 3-second timeout, but the developer expects the file size to increase. What is the MOST cost-effective way to handle the increase in processing time?

Accepted Answer

Increase the Lambda function's timeout to a value higher than the expected processing time.. Increasing the Lambda function's timeout is the most cost-effective solution because it directly addresses the expected increase in processing time without incurring additional costs. Lambda pricing is based on the number of invocations and duration (in GB-seconds), so extending the timeout only charges for the actual time the function runs, not for idle time or additional services. This approach avoids the complexity and cost of Step Functions or provisioned concurrency, which would add unnecessary overhead for a simple sequential task.

Answer

Increase the Lambda function's timeout to 15 minutes.

Answer

Use Lambda provisioned concurrency to keep the function warm.

Answer

Refactor the code to use AWS Step Functions to orchestrate the processing.

Question 3

A developer is creating a CloudFormation template to deploy an Amazon S3 bucket. The developer wants the bucket to be deleted automatically when the CloudFormation stack is deleted. What should the developer specify in the template?

Accepted Answer

Set the DeletionPolicy attribute to Delete.. The `DeletionPolicy` attribute in AWS CloudFormation controls what happens to a resource when its stack is deleted. By setting `DeletionPolicy: Delete` on the S3 bucket resource, the developer ensures that the bucket is automatically deleted when the stack is deleted. This is the default behavior for most resources, but explicitly setting it confirms the intent and overrides any other policy like `Retain`.

Answer

Specify a unique bucket name to avoid conflicts.

Answer

Use the DependsOn attribute to specify the bucket depends on the stack.

Answer

Set the DeletionPolicy attribute to Retain.

Question 4

A developer is using Amazon API Gateway to expose a REST API. The API needs to validate request parameters and payload before invoking the backend Lambda function. What is the MOST efficient way to perform this validation?

Accepted Answer

Use API Gateway request validation with a model schema.. API Gateway's built-in request validation allows you to define a JSON Schema model that automatically validates request parameters, headers, and payload before the request reaches the backend Lambda function. This offloads validation from the Lambda function, reducing compute time and cost, and provides immediate 400 error responses without invoking the backend. It is the most efficient approach because it minimizes latency and Lambda invocations for invalid requests.

Answer

Validate the request in the Lambda function and return errors if validation fails.

Answer

Use Amazon CloudFront to validate the request at the edge.

Answer

Use API Gateway request parameters to enforce required headers.

Question 5

A developer is writing code to upload an object to an Amazon S3 bucket. The object is 200 MB in size. Which AWS SDK method should the developer use to perform this upload?

Accepted Answer

Use the multipart upload API.. Objects larger than 100 MB should be uploaded using the multipart upload API to improve throughput and provide resilience against network failures. The multipart upload API allows the 200 MB object to be split into parts, uploaded in parallel, and then assembled, which is more efficient and reliable than a single PutObject operation for objects over 5 GB or for large objects in general.

Answer

Enable S3 Transfer Acceleration and use the PutObject API.

Answer

Use the PutObject API operation.

Answer

Use a pre-signed URL and upload using HTTP PUT.

Question 6

A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)

Accepted Answer

Use AWS Systems Manager Parameter Store to store encrypted credentials.. AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.

Answer

Store the credentials as Lambda environment variables.

Answer

Hardcode the credentials in the Lambda function code.

Answer

Store the credentials in a file in the Lambda deployment package.

Question 7

A company is using AWS CodePipeline to automate its deployment pipeline. The pipeline has a source stage that pulls code from Amazon S3, a build stage using AWS CodeBuild, and a deploy stage using AWS CodeDeploy. The developer wants to add a manual approval step before deployment to production. Which of the following are correct steps to implement this? (Choose THREE.)

Accepted Answer

Configure the approval action to use an SNS topic for notifications.. AWS CodePipeline approval actions can be configured to send notifications via Amazon SNS when the action requires manual approval. This allows approvers to be alerted that an approval is pending, enabling timely review and progression of the pipeline.

Answer

Add a second pipeline for the approval step.

Answer

Use AWS CodeBuild to run a script that waits for manual approval.

Question 8

A developer is troubleshooting an AWS Lambda function that is timing out. The function is configured with a 3-second timeout. Which of the following could cause the function to timeout? (Choose THREE.)

Accepted Answer

The function is configured to access a VPC without a NAT gateway.. Lambda timeouts occur when the function execution exceeds the configured timeout. Option A is incorrect because setting reserved concurrency to 0 causes immediate throttling (TooManyRequestsException), not a timeout. Option B is incorrect because a dead-letter queue is for asynchronous invocation failures, not timeouts. Option C is correct: if the function is in a VPC without a NAT gateway, it cannot access external networks, leading to network timeouts. Option D is correct: cold starts can delay execution due to initialization, potentially exceeding the timeout. Option E is correct: a deployment package larger than 50 MB can increase cold start time significantly, causing the function to timeout.

Answer

The function's reserved concurrency is set to 0.

Answer

The function has a dead-letter queue configured.

Question 9

A company runs a microservices architecture on Amazon ECS with Fargate. The application experiences intermittent high latency. The operations team wants to trace requests across services and identify bottlenecks. Which AWS service should be used?

Accepted Answer

AWS X-Ray. AWS X-Ray is the correct service because it provides end-to-end tracing of requests as they travel through microservices, capturing latency at each hop. It generates a service map that visualizes the flow and pinpoints bottlenecks, which is exactly what the operations team needs for a distributed application on ECS Fargate.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

Amazon CloudWatch Metrics

Question 10

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store with SecureString. AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer

EC2 user data

Answer

Amazon S3 with server-side encryption

Answer

AWS CloudFormation template parameters

Question 11

A developer is optimizing an S3 bucket for static website hosting. The site has a main page (index.html) and an error page (error.html). Users report seeing a generic 403 error instead of the error page when accessing a missing object. What is the likely cause?

Accepted Answer

The Error document field in the static website hosting configuration is not set to error.html.. When static website hosting is enabled on an S3 bucket, the Error Document field specifies the object served when a 403 or 404 error occurs. If this field is not set to error.html, S3 returns its generic 403 error response instead of the custom error page. The correct answer is B because the Error document configuration is missing or incorrect.

Answer

The bucket policy denies access to the error.html object.

Answer

The index.html is missing from the bucket.

Answer

The error.html object has incorrect permissions.

Question 12

A developer is designing a serverless application that processes images uploaded to an S3 bucket. Each image must be resized and then stored in a different S3 bucket. The process must be asynchronous and fault-tolerant. Which AWS service should trigger the Lambda function?

Accepted Answer

Amazon S3 Event Notifications. Amazon S3 Event Notifications are the correct trigger because they natively support event-driven architectures where S3 object creation events (e.g., s3:ObjectCreated:Put) can directly invoke a Lambda function. This enables asynchronous processing of uploaded images without any intermediate polling or custom integration, ensuring fault tolerance through Lambda's built-in retry mechanism and dead-letter queue (DLQ) support.

Answer

Amazon SQS

Answer

Amazon API Gateway

Answer

AWS Step Functions

Question 13

A developer is using Amazon DynamoDB for a gaming leaderboard. The table has a sort key of 'score' (Number). The developer wants to retrieve the top 10 players. Which TWO operations can achieve this? (Choose TWO.)

Accepted Answer

Scan and sort results client-side, then take first 10. Scanning all items and sorting them client-side by score descending gives the global top 10, regardless of partition keys. Option E is correct if the table is designed with a single partition key (e.g., a constant value like 'Leaderboard'), because a Query with ScanIndexForward=false and Limit=10 then retrieves the top 10 items from that partition efficiently. Options A, C, and D are incorrect because they cannot return the top 10 items sorted globally.

Answer

TransactGetItems

Answer

BatchGetItem

Answer

GetItem

Question 14

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. The correct answer. The best practice for granting an AWS Lambda function access to an S3 bucket in the same account is to create an IAM execution role with a policy that allows the necessary S3 actions, and then attach that role to the Lambda function. This provides temporary credentials via STS, follows the principle of least privilege, and avoids hardcoding credentials.

Option B is incorrect because storing AWS credentials in environment variables is insecure and can lead to accidental exposure. AWS recommends using IAM roles for temporary credentials.

Option C is incorrect because Lambda functions do not support attaching IAM policies directly. Policies must be attached to an IAM role, and that role is assigned to the function.

Option D is incorrect because while a bucket policy could grant access based on the function's ARN, it is not the best approach for same-account access. Using an execution role is more scalable, easier to manage, and follows the principle of least privilege.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 15

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an S3 bucket. Users report that after logging in, they are sometimes redirected to the login page again on subsequent requests. What is the MOST likely cause?

Accepted Answer

S3 is not a suitable store for session state due to its higher latency compared to in-memory stores like ElastiCache or DynamoDB.. Amazon S3 now provides strong read-after-write consistency, so eventual consistency is not the cause. However, S3's higher latency compared to in-memory stores like ElastiCache or DynamoDB makes it unsuitable for session management, which requires fast, frequent reads and writes. The higher latency can cause delays in session retrieval, leading to timeouts and the login page being displayed again.

Answer

The EC2 instances do not have internet access to reach S3.

Answer

The ALB does not have sticky sessions enabled.

Answer

The application is not scaling properly, causing session loss.