DVA-C02 Development with AWS Services Practice Test 24 — 15 Questions

Question 1

A company is using Amazon S3 to store sensitive documents. The security team requires that all data be encrypted at rest using AWS KMS with a Customer Managed Key (CMK). The developer enabled default encryption on the S3 bucket with the CMK. However, some PUT requests are failing with 'Access Denied'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key policy does not grant the IAM user/role permissions to use the key.. When default encryption is enabled on an S3 bucket with a KMS CMK, the S3 service uses the CMK to encrypt objects at rest. However, the IAM user or role making the PUT request must have explicit permissions to use that CMK, typically via the kms:GenerateDataKey and kms:Decrypt actions in the KMS key policy. If the key policy does not grant these permissions to the principal, the request fails with an 'Access Denied' error, even though the bucket policy and IAM permissions are otherwise correct.

Answer

The S3 bucket's object ownership is set to BucketOwnerPreferred.

Answer

The KMS key is in a different AWS Region than the S3 bucket.

Answer

The S3 bucket policy denies PutObject without encryption.

Question 2

A developer is using AWS X-Ray to trace requests through a microservices application. The application consists of several AWS Lambda functions that call each other and Amazon DynamoDB. The developer notices that some traces are incomplete and missing segments for downstream calls. What is the MOST likely cause?

Accepted Answer

The Lambda functions do not have the X-Ray SDK imported.. The Lambda functions need to import the X-Ray SDK to create subsegments for downstream calls and propagate the trace header. Without the SDK, traces will be missing segments for DynamoDB calls. DynamoDB does not have a per-table X-Ray tracing setting; tracing is achieved by instrumenting the client in the calling code.

Answer

The downstream DynamoDB table does not have X-Ray tracing enabled.

Answer

The X-Ray daemon is not running on the Lambda execution environment.

Answer

The X-Ray sampling rate is set too low.

Question 3

A developer is designing a highly available application using Amazon SQS and AWS Lambda. Which TWO strategies should the developer implement to ensure that messages are processed at least once? (Choose TWO.)

Accepted Answer

Set the SQS queue's visibility timeout to be greater than the Lambda function's timeout.. Setting the SQS queue's visibility timeout to be greater than the Lambda function's timeout ensures that if the Lambda function fails or times out, the message becomes visible again in the queue after the visibility timeout expires, allowing another consumer to retry processing. This prevents messages from being lost due to processing failures, supporting at-least-once processing. Option E is correct because calling the SQS DeleteMessage API only after successful processing ensures that the message is not removed from the queue until it has been fully and correctly handled, so if processing fails, the message remains available for retry.

Answer

Configure a Dead Letter Queue (DLQ) to capture failed messages.

Answer

Enable long polling on the SQS queue.

Answer

Use a FIFO queue to ensure exactly-once processing.

Question 4

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses Amazon ElastiCache for session state. Recently, users are experiencing intermittent session timeouts and slow page loads. The developer suspects the issue is related to the ElastiCache cluster. Which THREE actions should the developer take to troubleshoot and resolve the issue? (Choose THREE.)

Accepted Answer

Monitor the ElastiCache cluster's CPU utilization and cache hit ratio in CloudWatch.. Option A is correct because CloudWatch metrics such as CPUUtilization and CacheHits/CacheMisses (cache hit ratio) directly reveal whether the ElastiCache cluster is saturated or failing to serve cached session data, which would cause the intermittent timeouts and slow loads. Option C is correct because if monitoring shows sustained high CPU or memory pressure, vertically scaling to a larger node type or horizontally adding nodes/shards increases capacity and restores consistent session-state performance. Option D is correct because uneven key distribution or poor cache key design can create hot shards/keys, leading to throttling and latency spikes even when overall cluster capacity looks adequate, so reviewing key design and shard balance addresses the root cause. Option B does not belong because enabling encryption in transit is a security hardening measure and does not resolve performance or session-timeout issues. Option E does not belong because Multi-AZ replication improves availability/failover, not the intermittent latency and timeout symptoms described.

Answer

Enable Encryption in transit for the ElastiCache cluster.

Answer

Enable Multi-AZ replication for the ElastiCache cluster.

Question 5

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function is triggered by S3 events. The developer notices that the function sometimes processes the same file multiple times. Which TWO steps should the developer take to make the processing idempotent? (Choose TWO.)

Accepted Answer

Check if the file has already been processed by storing a marker in DynamoDB.. Storing a marker in DynamoDB (e.g., a record with the S3 object key as the partition key) allows the Lambda function to check if a file has already been processed before performing the work. This ensures that even if the same S3 event is delivered multiple times (due to retries or duplicate notifications), the function will skip reprocessing, making the operation idempotent.

Answer

Reduce the S3 event batch size in the Lambda trigger.

Answer

Increase the Lambda function's timeout.

Answer

Enable S3 versioning on the bucket.

Question 6

A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The application includes an API Gateway REST API and a Lambda function. The developer wants to enable access logging for the API Gateway. Which THREE resources or configurations are required? (Choose THREE.)

Accepted Answer

A stage with access logging enabled in the API Gateway.. API Gateway access logging is configured at the stage level. The developer must enable access logging on a specific stage (e.g., prod, dev) and specify a destination CloudWatch Logs log group and a logging format (e.g., JSON or CLF). Without enabling it on the stage, no access logs are generated regardless of other configurations.

Answer

A Lambda function that processes the access logs.

Answer

An IAM role for the Lambda function with logs:PutLogEvents permission.

Question 7

A developer is building a mobile backend using Amazon API Gateway and AWS Lambda. The API has a single endpoint that accepts POST requests with a JSON payload and stores the data in an Amazon DynamoDB table. The developer wants to implement caching to reduce latency and costs. The data is user-specific and should not be shared between users. The developer configures API Gateway caching with a TTL of 300 seconds. After testing, the developer notices that users are seeing other users' data. What should the developer do to fix this issue?

Accepted Answer

Enable cache key parameters in API Gateway, such as the Authorization header.. API Gateway caching by default uses only the request path and method as the cache key, so all POST requests to the same endpoint share a single cache entry. Since the data is user-specific, the cache must include a unique user identifier in the cache key. Enabling cache key parameters (e.g., the Authorization header or a custom user ID header) ensures that each user's request generates a distinct cache key, preventing cross-user data leakage. This is the correct and minimal fix because it directly addresses the root cause—the cache key not being user-specific—while retaining the performance benefits of API Gateway caching.

Answer

Store cached responses in DynamoDB and retrieve them based on user ID.

Answer

Use Lambda@Edge to cache responses at the CloudFront level.

Answer

Disable API Gateway caching and use DynamoDB Accelerator (DAX) instead.

Question 8

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. Users report intermittent 503 errors. The Lambda function code appears correct. Which action is MOST likely to resolve the issue?

Accepted Answer

Request a service quota increase for Lambda concurrent executions.. Intermittent 503 errors from API Gateway often indicate that Lambda concurrent execution limits have been reached. When the number of simultaneous invocations exceeds the account-level or function-level reserved concurrency, API Gateway returns a 503 'Service Unavailable' response. Increasing the Lambda concurrent executions quota allows more invocations to be processed without throttling.

Answer

Increase the Lambda function memory allocation.

Answer

Increase the Lambda function timeout.

Answer

Increase the API Gateway throttling limits.

Question 9

A developer is building a serverless application using AWS Lambda and Amazon DynamoDB. The Lambda function reads from a DynamoDB table. The function fails with a timeout error when processing large items. What is the MOST efficient solution?

Accepted Answer

Increase the Lambda function memory.. In AWS Lambda, CPU power is allocated proportionally to the configured memory. When a Lambda function times out while processing large items or files, it is typically due to CPU bottlenecks (such as serialization, deserialization, or processing overhead). Increasing the memory (Option A) automatically increases the CPU power, which speeds up execution and resolves the timeout. Simply increasing the timeout (Option B) allows the function to run longer but does not address the performance bottleneck and can lead to higher latency and costs.

Answer

Increase the Lambda function timeout.

Answer

Enable Lambda provisioned concurrency.

Answer

Increase the DynamoDB read capacity units.

Question 10

A developer is deploying a web application on AWS Elastic Beanstalk. The application requires a fixed IP address for outbound traffic to a third-party API. What is the MOST cost-effective solution?

Accepted Answer

Launch the environment in a VPC with a NAT Gateway in a public subnet.. A NAT Gateway in a public subnet provides a fixed public IP address for outbound traffic from private subnets, enabling the web application to communicate with the third-party API while remaining secure. Elastic Beanstalk environments are typically launched in private subnets, and the NAT Gateway is the most cost-effective managed service for this purpose compared to a NAT instance or assigning Elastic IPs to each EC2 instance.

Answer

Attach an Internet Gateway to the VPC.

Answer

Use a VPC endpoint for the third-party API.

Answer

Assign an Elastic IP to each EC2 instance.

Question 11

A developer needs to store application configuration data that can be read by multiple EC2 instances. The data is less than 1 KB and changes frequently. Which AWS service is BEST suited for this?

Accepted Answer

AWS AppConfig. AWS AppConfig is the best choice because it is designed for dynamic, frequent configuration changes that need to be deployed to multiple EC2 instances without redeploying code or restarting applications. It supports hosted configuration data (up to 1 MB) and provides controlled rollouts, validation, and monitoring, making it ideal for sub-1 KB data that changes frequently.

Answer

Amazon S3

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Question 12

A developer is using Amazon SQS to decouple microservices. The consumer service processes messages from the queue. To reduce processing time, the developer wants to receive multiple messages in a single API call. What is the maximum number of messages that can be received at once?

Accepted Answer

10. Amazon SQS allows a consumer to retrieve up to 10 messages in a single ReceiveMessage API call. This is the hard limit enforced by the SQS service, regardless of the queue type (standard or FIFO). Using this maximum batch size can reduce the number of API calls and improve throughput, but each message must still be processed individually and deleted after processing.

Answer

5

Answer

100

Answer

20

Question 13

A company has a Lambda function that writes to an S3 bucket. The IAM role used by the function has an inline policy allowing s3:PutObject on the bucket. However, writes fail with an access denied error. What is the MOST likely cause?

Accepted Answer

The S3 bucket has a bucket policy that denies the request.. Even if the Lambda function's IAM role grants s3:PutObject, an explicit deny in the S3 bucket policy takes precedence over any allow. The access denied error indicates that the request is being evaluated and denied by the bucket policy, which overrides the IAM permission due to AWS's policy evaluation logic (explicit deny > allow).

Answer

The S3 bucket is in a different region.

Answer

The S3 bucket uses SSE-KMS encryption and the function lacks kms:Decrypt permissions.

Answer

The Lambda function does not have the correct execution role.

Question 14

A developer is designing a system that ingests high-volume data from IoT devices. The data must be processed in near real-time and then stored in Amazon S3 for analytics. Which TWO AWS services should the developer use together to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is designed for real-time ingestion of large data streams, such as IoT telemetry, and can capture and store data in shards for up to 365 days. AWS Lambda can be configured as a consumer of the Kinesis stream to process records in near real-time and then write the results to Amazon S3 for analytics. Together, they provide a serverless, scalable pipeline for high-volume IoT data.

Answer

Amazon SQS

Answer

Amazon SNS

Answer

Amazon EC2

Question 15

A company is running a web application on EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. A developer needs to improve performance. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure Auto Scaling to add more instances during peak hours.. Option A is correct because configuring Auto Scaling to add more instances during peak hours horizontally scales the compute capacity behind the Application Load Balancer, distributing the increased request load across more targets and directly reducing the per-instance latency caused by peak traffic. Option C is correct because implementing Amazon ElastiCache (Redis or Memcached) offloads repeated reads of frequently accessed data from the backend instances and any database, cutting response times and reducing the load that contributes to high latency during peaks. Option B is not appropriate because increasing the ALB idle timeout only affects how long idle connections are kept open and does not improve application response latency. Option D is not the best fit because vertically scaling with larger instance types is a single-instance change that does not address load distribution and is less elastic than Auto Scaling. Option E is incorrect because EBS optimization improves storage throughput/IOPS consistency for EBS-backed volumes, not the application's peak-hour latency driven by request load.

Answer

Increase the ALB idle timeout.

Answer

Use larger EC2 instance types.

Answer

Enable EBS optimization on the instances.